Windows Analysis Report
Cobian.Reflector.RemoteClient.exe

Overview

General Information

Sample name:	Cobian.Reflector.RemoteClient.exe
Analysis ID:	1417453
MD5:	c4273522e62e91d6c809299f134b7899
SHA1:	a4f4b7e92dbd9b60f1f27d0e615356804d596b24
SHA256:	cacb9e288755986ad4846c480c46a7b6d2d428816b236e5f18185fb074e7ed14
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Detected potential crypto function

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Classification

Signatures

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: certificate valid

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb, # source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb4 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb9u source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationFramework.pdb H source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdbdlllZ source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbF source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdbz! source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA5000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA7000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdbH source: WER737B.tmp.dmp.3.dr
Source:	Binary string: Cobian.Reflector.RemoteClient.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msrlib.pdb3693405117-2476756634 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER737B.tmp.dmp.3.dr
Source:	Binary string: ll\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationCore.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: orlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr

Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713082477.000001C6A27E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Cobian.Reflector.RemoteClient;component/app.xaml
Source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713082477.000001C6A27E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713082477.000001C6A27E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: https://www.certum.pl/CPS0

Detected potential crypto function

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Code function: 0_2_00007FFD9B8806FA		0_2_00007FFD9B8806FA
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Code function: 0_2_00007FFD9B880E83		0_2_00007FFD9B880E83

One or more processes crash

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 772 -s 1004

Tries to load missing DLLs

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: profapi.dll	Jump to behavior

Source: Cobian.Reflector.RemoteClient.exe, TaskEditor.cs

Task registration methods: '_CreateDelegate'

Source: classification engine

Classification label: clean4.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess772

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9c3b185e-f5cb-4d3c-9e65-e00b01086e1a

Jump to behavior

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Cobian.Reflector.RemoteClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

File read: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe "C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe"
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 772 -s 1004

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: certificate valid

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: e.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb, # source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb4 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb9u source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationFramework.pdb H source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdbdlllZ source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbF source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdbz! source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA5000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA7000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdbH source: WER737B.tmp.dmp.3.dr
Source:	Binary string: Cobian.Reflector.RemoteClient.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msrlib.pdb3693405117-2476756634 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER737B.tmp.dmp.3.dr
Source:	Binary string: ll\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationCore.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: orlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr

Binary contains a suspicious time stamp

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: 0xD2F28F76 [Mon Feb 23 22:36:38 2082 UTC]

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Memory allocated: 1C6A2620000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Memory allocated: 1C6BA7C0000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Queries volume information: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Cobian.Reflector_864eeece3af2e1c7577532f3abfe40b0d7aafd64_21c124f6_7e44faf3-9f28-439f-9dbd-445dce6a0f1d\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	5B3C9B4FECFBF0033CF3693F3D2894F2	0F0E1E877417A9E2362D0F3D2D8A8F9A12439C42	7B3760900EC343830F9CF66E055FDE694F8896231B44CDF3E11679B65DF1980F
C:\ProgramData\Microsoft\Windows\WER\Temp\WER737B.tmp.dmp	Mini DuMP crash report, 16 streams, Fri Mar 29 09:29:22 2024, 0x1205a4 type	2931E116F033D6C8F29BBB464F6D5473	C98ACFDD2C0058B31BA46EA71FCB0B9B8BF6483A	CDA57B0F8A922F1F9EBAACDAF521BDCC4582D5501BCBA6745C132CADC0960AF7
C:\ProgramData\Microsoft\Windows\WER\Temp\WER75AF.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	F1345F0AC6FD6BD24BD40C6D7CC14B41	1C13A48648D5265CE236358F3C363576EEA34B6B	5A3FFE0DBD92490CB3F6E89C5A635F9867274DF16B0EB89ACAD8BBD5E30B8BA7
C:\ProgramData\Microsoft\Windows\WER\Temp\WER763C.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	A7F8532DB1C69535C2DDAE9F2D92DFAA	AF7447E011D21CDB7408B69084BAB27FB8D28C2A	5F657A2CA563164CD2753E9E8B085ECF1E4A9803536161E35B26AD2452B2E6B9
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	18C2FD6EFB246487A17DDAFA21394D72	E63F4465460BE3A12015D54F025E7BBDF01A00F6	EDB0FDB5DA65D1B37CF976DFF6E015AA56FF0303743461C23DE9F988F3896488

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: certificate valid

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb, # source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb4 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb9u source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationFramework.pdb H source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdbdlllZ source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbF source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdbz! source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA5000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA7000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdbH source: WER737B.tmp.dmp.3.dr
Source:	Binary string: Cobian.Reflector.RemoteClient.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msrlib.pdb3693405117-2476756634 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER737B.tmp.dmp.3.dr
Source:	Binary string: ll\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationCore.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: orlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr

Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713082477.000001C6A27E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Cobian.Reflector.RemoteClient;component/app.xaml
Source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713082477.000001C6A27E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713082477.000001C6A27E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: Cobian.Reflector.RemoteClient.exe	String found in binary or memory: https://www.certum.pl/CPS0

Detected potential crypto function

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Code function: 0_2_00007FFD9B8806FA		0_2_00007FFD9B8806FA
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Code function: 0_2_00007FFD9B880E83		0_2_00007FFD9B880E83

One or more processes crash

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 772 -s 1004

Tries to load missing DLLs

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Section loaded: profapi.dll	Jump to behavior

Source: Cobian.Reflector.RemoteClient.exe, TaskEditor.cs

Task registration methods: '_CreateDelegate'

Source: classification engine

Classification label: clean4.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess772

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9c3b185e-f5cb-4d3c-9e65-e00b01086e1a

Jump to behavior

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Cobian.Reflector.RemoteClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

File read: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe "C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe"
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 772 -s 1004

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: certificate valid

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: e.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb, # source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb4 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb9u source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Configuration.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationFramework.pdb H source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdbdlllZ source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbF source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdbz! source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA5000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFA7000.00000004.00000020.00020000.00000000.sdmp, WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER737B.tmp.dmp.3.dr
Source:	Binary string: D:\Projects\Cobian Reflector 2\RemoteClient\obj\Release\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe
Source:	Binary string: PresentationCore.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.Xaml.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: WindowsBase.pdbH source: WER737B.tmp.dmp.3.dr
Source:	Binary string: Cobian.Reflector.RemoteClient.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Cobian.Reflector.RemoteClient.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msrlib.pdb3693405117-2476756634 source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER737B.tmp.dmp.3.dr
Source:	Binary string: ll\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1713371096.000001C6BAFB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: PresentationCore.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdb source: WER737B.tmp.dmp.3.dr
Source:	Binary string: orlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Cobian.Reflector.RemoteClient.exe, 00000000.00000002.1712717562.000001C6A0C75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER737B.tmp.dmp.3.dr

Binary contains a suspicious time stamp

Source: Cobian.Reflector.RemoteClient.exe

Static PE information: 0xD2F28F76 [Mon Feb 23 22:36:38 2082 UTC]

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Memory allocated: 1C6A2620000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Memory allocated: 1C6BA7C0000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Queries volume information: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Cobian.Reflector.RemoteClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

ID:	1417453
Product:	CloudBasic
Start time:	10:28:37
Start date:	29.03.2024
Sample:	Cobian.Reflector.RemoteClient.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c4273522e62e91d6c809299f134b7899
SHA1:	a4f4b7e92dbd9b60f1f27d0e615356804d596b24
SHA256:	cacb9e288755986ad4846c480c46a7b6d2d428816b236e5f18185fb074e7ed14
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Windows Analysis Report
Cobian.Reflector.RemoteClient.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Cobian.Reflector.RemoteClient.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Cobian.Reflector.RemoteClient.exe