Play interactive tour

Edit tour

Analysis Report dbeaver.exe

Overview

General Information

Sample Name:	dbeaver.exe
Analysis ID:	347768
MD5:	b56bf7c40d3e84ca5557e6f9f9786cb3
SHA1:	eadaa2cdd7c8dd0f2978a8ea0b2fe45ae9d4dd26
SHA256:	82d314c6d7c17dbbd8ba26241b82402f246da22aaaafc3418d04b6fc30872a10
Most interesting Screenshot:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential time zone aware malware

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Analysis Advice

Sample may be VM or Sandbox-aware, try analysis on a native machine

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Startup

System is w10x64

dbeaver.exe (PID: 1064 cmdline: 'C:\Users\user\Desktop\dbeaver.exe' MD5: B56BF7C40D3E84CA5557E6F9F9786CB3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Compliance:

PE / OLE file has a valid certificate

Show sources

Source: dbeaver.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: dbeaver.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading:

Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F35E94 __doserrno,_errno,_errno,__doserrno,FindFirstFileW,_errno,_errno,_errno,_errno,_errno,GetDriveTypeW,free,free,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,		0_2_00007FF6C6F35E94
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F32A20 free,malloc,FindFirstFileW,FindNextFileW,free,FindClose,malloc,free,free,		0_2_00007FF6C6F32A20

Networking:

Source: dbeaver.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: dbeaver.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: dbeaver.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: dbeaver.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: dbeaver.exe	String found in binary or memory: http://sv.symcd.com0&
Source: dbeaver.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: dbeaver.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: dbeaver.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: dbeaver.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: dbeaver.exe	String found in binary or memory: https://d.symcb.com/rpa0

System Summary:

Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F41BD0	0_2_00007FF6C6F41BD0
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F36680	0_2_00007FF6C6F36680
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F34E90	0_2_00007FF6C6F34E90
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F3D6A8	0_2_00007FF6C6F3D6A8
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F44158	0_2_00007FF6C6F44158
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F44958	0_2_00007FF6C6F44958
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F43870	0_2_00007FF6C6F43870
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F42070	0_2_00007FF6C6F42070
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F3DC94	0_2_00007FF6C6F3DC94
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F41518	0_2_00007FF6C6F41518
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F4364C	0_2_00007FF6C6F4364C
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F38EE4	0_2_00007FF6C6F38EE4
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F46300	0_2_00007FF6C6F46300
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F36F30	0_2_00007FF6C6F36F30
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F3654C	0_2_00007FF6C6F3654C
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F4094C	0_2_00007FF6C6F4094C
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F44D8C	0_2_00007FF6C6F44D8C

Source: dbeaver.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dbeaver.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: dbeaver.exe, 00000000.00000002.219120303.0000000000740000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenameuser32j% vs dbeaver.exe

Source: classification engine

Classification label: sus24.evad.winEXE@1/0@0/0

Source: dbeaver.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\dbeaver.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dbeaver.exe	String found in binary or memory: --launcher.library
Source: dbeaver.exe	String found in binary or memory: --launcher.suppressErrors
Source: dbeaver.exe	String found in binary or memory: --launcher.ini
Source: dbeaver.exe	String found in binary or memory: .exe.exe-vmargs-name.--launcher.library--launcher.suppressErrors-protectroot--launcher.inieclipseorg.eclipse.equinox.launcherorg.eclipse.equinox.launcherpluginseclipse.inirt%[^

Source: dbeaver.exe

Static PE information: certificate valid

Source: dbeaver.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: dbeaver.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Source: C:\Users\user\Desktop\dbeaver.exe

Code function: 0_2_00007FF6C6F3FC90 LoadLibraryA,GetProcAddress,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00007FF6C6F3FC90

Malware Analysis System Evasion:

Potential time zone aware malware

Show sources

Source: C:\Users\user\Desktop\dbeaver.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: C:\Users\user\Desktop\dbeaver.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-9228

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F35E94 __doserrno,_errno,_errno,__doserrno,FindFirstFileW,_errno,_errno,_errno,_errno,_errno,GetDriveTypeW,free,free,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,		0_2_00007FF6C6F35E94
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F32A20 free,malloc,FindFirstFileW,FindNextFileW,free,FindClose,malloc,free,free,		0_2_00007FF6C6F32A20

Source: C:\Users\user\Desktop\dbeaver.exe

API call chain: ExitProcess graph end node

graph_0-9230

Anti Debugging:

Source: C:\Users\user\Desktop\dbeaver.exe

Code function: 0_2_00007FF6C6F383BC RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00007FF6C6F383BC

Source: C:\Users\user\Desktop\dbeaver.exe

0_2_00007FF6C6F3FC90

Source: C:\Users\user\Desktop\dbeaver.exe

Code function: 0_2_00007FF6C6F46474 GetProcessHeap,HeapAlloc,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,

0_2_00007FF6C6F46474

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F383BC RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6C6F383BC
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F36F18 SetUnhandledExceptionFilter,	0_2_00007FF6C6F36F18
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F3FF30 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6C6F3FF30
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: 0_2_00007FF6C6F36A00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6C6F36A00

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\dbeaver.exe	Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLangID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,	0_2_00007FF6C6F3C7EC
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_00007FF6C6F3C0A8
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: GetLocaleInfoW,	0_2_00007FF6C6F400D8
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,GetLocaleInfoA,	0_2_00007FF6C6F40134
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,	0_2_00007FF6C6F3C348
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: EnumSystemLocalesA,	0_2_00007FF6C6F3C780
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: GetLocaleInfoA,	0_2_00007FF6C6F3C294
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: GetLocaleInfoA,	0_2_00007FF6C6F42AA0
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: EnumSystemLocalesA,	0_2_00007FF6C6F3C6EC
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: _getptd,GetLocaleInfoA,	0_2_00007FF6C6F3C1AC
Source: C:\Users\user\Desktop\dbeaver.exe	Code function: _getptd,GetLocaleInfoA,	0_2_00007FF6C6F3C5DC

Source: C:\Users\user\Desktop\dbeaver.exe

Code function: 0_2_00007FF6C6F38070 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00007FF6C6F38070

Source: C:\Users\user\Desktop\dbeaver.exe

Code function: 0_2_00007FF6C6F41BD0 _lock,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00007FF6C6F41BD0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Path Interception	Virtualization/Sandbox Evasion1	OS Credential Dumping	System Time Discovery12	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
dbeaver.exe	0%	Virustotal	Browse
dbeaver.exe	0%	Metadefender	Browse
dbeaver.exe	0%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.thawte.com/ThawteTimestampingCA.crl0	dbeaver.exe	false		high
http://ocsp.thawte.com0	dbeaver.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	347768
Start date:	03.02.2021
Start time:	08:07:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	dbeaver.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus24.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 86.3%) Quality average: 61.9% Quality standard deviation: 33%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.047360328974477
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dbeaver.exe
File size:	421968
MD5:	b56bf7c40d3e84ca5557e6f9f9786cb3
SHA1:	eadaa2cdd7c8dd0f2978a8ea0b2fe45ae9d4dd26
SHA256:	82d314c6d7c17dbbd8ba26241b82402f246da22aaaafc3418d04b6fc30872a10
SHA512:	c2486fdacab42218bfcf66b62f07481f1889efa04c97316dd6b101922fe7905ca5c95ad8a447c109f07e4f30374d3cc1b251f2ffe2e4ef5bf42622ced6fde996
SSDEEP:	3072:rWquWTMBa39BAr9vfzb6ZhPd7z08qdK6D9qQWqXmF:TuWTaanSZzOZhVzWVDSF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j....\|...\|...\|..0.r..\|..0.c.'\|......)\|...\|..E\|..0.u..\|..0.b./\|..0.g./\|..Rich.\|..........PE..d....J,].........."......l.........

File Icon


Icon Hash:	e8a6b531258c8cf4

Static PE Info

General
Entrypoint:	0x140003a14
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5D2C4A8F [Mon Jul 15 09:42:39 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	4cb0bcb130e5a05bcf628fec922fe4cf

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	10/18/2019 5:00:00 PM 10/19/2021 4:59:59 PM
Subject Chain	CN=DBeaver Corp, O=DBeaver Corp, L=New York, S=New York, C=US
Version:	3
Thumbprint MD5:	334A98F5FE4639AFB11AD5EA77FF367E
Thumbprint SHA-1:	B994BB5D145459C197D1F7D34AAB24789FFE2458
Thumbprint SHA-256:	92593F323CBC6DE10A454F2F46248A6BC35C400BB83EDB02427AE73379A1CD4B
Serial:	50D9C98DE6FA143E7D1411BB6E379FC3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0618ADCE78h
dec eax
add esp, 28h
jmp 00007F0618AD867Bh
int3
int3
dec eax
test ecx, ecx
je 00007F0618AD8859h
push ebx
dec eax
sub esp, 20h
dec esp
mov eax, ecx
dec eax
mov ecx, dword ptr [0001A624h]
xor edx, edx
call dword ptr [00014654h]
test eax, eax
jne 00007F0618AD8839h
call 00007F0618ADBBECh
dec eax
mov ebx, eax
call dword ptr [0001463Ah]
mov ecx, eax
call 00007F0618ADBB94h
mov dword ptr [ebx], eax
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
cmp ecx, FFFFFFE0h
jnbe 00007F0618AD889Eh
mov edi, 00000001h
dec eax
test ecx, ecx
dec eax
cmovne edi, ecx
dec eax
mov ecx, dword ptr [0001A5CDh]
dec eax
test ecx, ecx
jne 00007F0618AD8842h
call 00007F0618ADBEE0h
mov ecx, 0000001Eh
call 00007F0618ADBCAEh
mov ecx, 000000FFh
call 00007F0618AD8900h
dec eax
mov ecx, dword ptr [0001A5A8h]
dec esp
mov eax, edi
xor edx, edx
call dword ptr [000145DDh]
dec eax
mov esi, eax
dec eax
test eax, eax
jne 00007F0618AD884Eh
cmp dword ptr [0001A59Fh], eax
je 00007F0618AD8830h
dec eax
mov ecx, ebx
call 00007F0618ADCE76h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b2f8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21000	0x47d90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x20000	0xef4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x65e00	0x1250	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x69000	0x200	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x328	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16a07	0x16c00	False	0.553828983516	zlib compressed data	6.32672377634	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x3d8a	0x3e00	False	0.39314516129	data	5.32901592653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c000	0x3c58	0x1c00	False	0.186802455357	data	2.20987381275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x20000	0xef4	0x1000	False	0.479248046875	data	4.82830588581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x21000	0x47d90	0x47e00	False	0.0541202445652	data	2.3032042568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x69000	0x5de	0x600	False	0.261067708333	data	2.45367038558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x21210	0xea8	data	English	United States
RT_ICON	0x220b8	0x8a8	data	English	United States
RT_ICON	0x22960	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x22ec8	0x25a8	data	English	United States
RT_ICON	0x25470	0x10a8	data	English	United States
RT_ICON	0x26518	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x26980	0x42028	dBase IV DBT, blocks size 0, block length 8192, next free block index 40, next free block 16777215, next used block 16777215	English	United States
RT_GROUP_ICON	0x689a8	0x68	data	English	United States
RT_MANIFEST	0x68a10	0x37c	XML 1.0 document, ASCII text	English	United States

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, FindClose, FindNextFileW, FindFirstFileW, LoadLibraryExW, GetModuleHandleW, LoadLibraryW, GetModuleFileNameW, GetProcAddress, CreateFileA, GetProcessHeap, SetEndOfFile, ReadFile, WriteConsoleW, FreeLibrary, MultiByteToWideChar, GetLastError, HeapFree, HeapAlloc, Sleep, ExitProcess, EnterCriticalSection, LeaveCriticalSection, GetFullPathNameW, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDriveTypeW, HeapReAlloc, SetUnhandledExceptionFilter, WriteFile, GetStdHandle, GetModuleFileNameA, RtlUnwindEx, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, EncodePointer, DecodePointer, FlsGetValue, FlsSetValue, FlsFree, SetLastError, GetCurrentThreadId, FlsAlloc, HeapSetInformation, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, GetStringTypeW, GetCurrentDirectoryA, GetDriveTypeA, LCMapStringW, CloseHandle, HeapSize, GetLocaleInfoW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, LCMapStringA, GetTimeZoneInformation, SetStdHandle, CreateFileW, CompareStringW, SetEnvironmentVariableA, SetEnvironmentVariableW, WriteConsoleA, GetConsoleOutputCP, CompareStringA
USER32.dll	CreateWindowExW, SetClassLongPtrW, MessageBoxW, LoadIconW
COMCTL32.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: dbeaver.exe PID: 1064 Parent PID: 5552

General

Start time:	08:08:15
Start date:	03/02/2021
Path:	C:\Users\user\Desktop\dbeaver.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\dbeaver.exe'
Imagebase:	0x7ff6c6f30000
File size:	421968 bytes
MD5 hash:	B56BF7C40D3E84CA5557E6F9F9786CB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: dbeaver.exe PID: 1064 Parent PID: 5552 dbeaver.exeCOMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	541
Total number of Limit Nodes:	50

Executed Functions

Function 00007FF6C6F35E94, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 247
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 00007FF6C6F35ECB
_errno.LIBCMT ref: 00007FF6C6F35ED3

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

_errno.LIBCMT ref: 00007FF6C6F35F0D
__doserrno.LIBCMT ref: 00007FF6C6F35F19

Strings

./\, xrefs: 00007FF6C6F35F74

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno$DecodePointer
String ID: ./\
API String ID: 3911551546-3176372042
Opcode ID: 39f36bb0085d1c377e5a917e7848e06c4ec50267ee93517a53bc2af592be334a
Instruction ID: d0996a8f5e12cb03c950af2817435859fc1a01bb42ccf57638a2655acf0d36c8
Opcode Fuzzy Hash: 39f36bb0085d1c377e5a917e7848e06c4ec50267ee93517a53bc2af592be334a
Instruction Fuzzy Hash: DFB1C97290C24A86EB629F24E50017E77A2FB81B62F104131E6ED93AD5DF7ED450CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F44158, Relevance: 36.5, APIs: 24, Instructions: 546fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F4420F
_errno.LIBCMT ref: 00007FF6C6F44219
__doserrno.LIBCMT ref: 00007FF6C6F4437A
_errno.LIBCMT ref: 00007FF6C6F44384
_errno.LIBCMT ref: 00007FF6C6F4438F
CreateFileW.KERNELBASE ref: 00007FF6C6F443CC
CreateFileW.KERNEL32 ref: 00007FF6C6F44421
GetLastError.KERNEL32 ref: 00007FF6C6F44454
_errno.LIBCMT ref: 00007FF6C6F44461
GetFileType.KERNEL32 ref: 00007FF6C6F44470
GetLastError.KERNEL32 ref: 00007FF6C6F4449C
CloseHandle.KERNEL32 ref: 00007FF6C6F444B0
_errno.LIBCMT ref: 00007FF6C6F444BA
_lseek_nolock.LIBCMT ref: 00007FF6C6F44551
__doserrno.LIBCMT ref: 00007FF6C6F4455F
_close_nolock.LIBCMT ref: 00007FF6C6F4456E
_lseek_nolock.LIBCMT ref: 00007FF6C6F445B3
_close_nolock.LIBCMT ref: 00007FF6C6F4473F

Part of subcall function 00007FF6C6F3D964: CloseHandle.KERNEL32(?,?,00000000,00007FF6C6F3DADE,?,?,?,?,00000000,00007FF6C6F362EC,?,?,?,?,?,00007FF6C6F3637B), ref: 00007FF6C6F3D9C3
Part of subcall function 00007FF6C6F3D964: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F3DADE,?,?,?,?,00000000,00007FF6C6F362EC,?,?,?,?,?,00007FF6C6F3637B), ref: 00007FF6C6F3D9CD

_errno.LIBCMT ref: 00007FF6C6F44744
_lseek_nolock.LIBCMT ref: 00007FF6C6F44766
CloseHandle.KERNEL32 ref: 00007FF6C6F448A9
CreateFileW.KERNEL32 ref: 00007FF6C6F448DE
GetLastError.KERNEL32 ref: 00007FF6C6F448EA

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$ErrorFileLast$CloseCreateHandle__doserrno_lseek_nolock$_close_nolock$Type
String ID:
API String ID: 3224512341-0
Opcode ID: cce571e701cf62988453a4a2073631fe82f1a1a7546ec7af1203d218e6340c6f
Instruction ID: 6404c4c8917b3f082ad041d9bbeb6117ae2b193509ddf7aabfe2d44c60e3d405
Opcode Fuzzy Hash: cce571e701cf62988453a4a2073631fe82f1a1a7546ec7af1203d218e6340c6f
Instruction Fuzzy Hash: A9321522A0C64A41FB668F28D64037D6652EF81766F104235DAFDD7FD5CEBEE8408B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F32A20, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C6F342D4: calloc.LIBCMT ref: 00007FF6C6F342FC

free.LIBCMT ref: 00007FF6C6F32AFE
malloc.LIBCMT ref: 00007FF6C6F32B54

Part of subcall function 00007FF6C6F33A68: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33A98
Part of subcall function 00007FF6C6F33A68: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393), ref: 00007FF6C6F33ABD
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AE1
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AEC

Part of subcall function 00007FF6C6F341F4: _errno.LIBCMT ref: 00007FF6C6F3420D

FindFirstFileW.KERNEL32 ref: 00007FF6C6F32B9F
FindNextFileW.KERNEL32 ref: 00007FF6C6F32C06
free.LIBCMT ref: 00007FF6C6F32C92
FindClose.KERNEL32 ref: 00007FF6C6F32CB9
malloc.LIBCMT ref: 00007FF6C6F32CED
free.LIBCMT ref: 00007FF6C6F32D59
free.LIBCMT ref: 00007FF6C6F32D66

Part of subcall function 00007FF6C6F33220: malloc.LIBCMT ref: 00007FF6C6F3325F
Part of subcall function 00007FF6C6F33220: free.LIBCMT ref: 00007FF6C6F332AF

Strings

%s%c%s_*, xrefs: 00007FF6C6F32B7E

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$Find_errnomalloc$File$AllocateCloseFirstHeapNextcalloc
String ID: %s%c%s_*
API String ID: 3240083902-2802115005
Opcode ID: 7fedb0e86948e4cf237fd708d4eee5b649b4452f9b31897c3324b5c43c20307d
Instruction ID: a94205bec05f788f9e5c71f44000ce77c47018f5f208e382788463fac3075adb
Opcode Fuzzy Hash: 7fedb0e86948e4cf237fd708d4eee5b649b4452f9b31897c3324b5c43c20307d
Instruction Fuzzy Hash: A8812B2260DAC981EA71DF15E4943BEA366FBC4781F404132DADDC3BAADF2DD5418B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F41BD0, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 301
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 00007FF6C6F41BFB

Part of subcall function 00007FF6C6F41B70: _errno.LIBCMT ref: 00007FF6C6F41B79

free.LIBCMT ref: 00007FF6C6F41CF2

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

Part of subcall function 00007FF6C6F3BED8: _errno.LIBCMT ref: 00007FF6C6F3BEF0

___lc_codepage_func.LIBCMT ref: 00007FF6C6F41C7B

Part of subcall function 00007FF6C6F383BC: RtlCaptureContext.KERNEL32 ref: 00007FF6C6F383FB
Part of subcall function 00007FF6C6F383BC: IsDebuggerPresent.KERNEL32 ref: 00007FF6C6F38499
Part of subcall function 00007FF6C6F383BC: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384A3
Part of subcall function 00007FF6C6F383BC: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384AE
Part of subcall function 00007FF6C6F383BC: GetCurrentProcess.KERNEL32 ref: 00007FF6C6F384C4
Part of subcall function 00007FF6C6F383BC: TerminateProcess.KERNEL32 ref: 00007FF6C6F384D2

Strings

Pacific Daylight Time, xrefs: 00007FF6C6F41E82
Pacific Standard Time, xrefs: 00007FF6C6F41E2E

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerErrorFreeHeapLastPresentTerminate___lc_codepage_func_lockfree
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 178205154-1154798116
Opcode ID: 7233c75f312d55a8691537bf7af01122a5c629dbcc2d298c544cd6c031014258
Instruction ID: 3f461a043dd4a37ccd02e4fc953f5cccf5c9cf74510fc0b581f956158a1b0a3a
Opcode Fuzzy Hash: 7233c75f312d55a8691537bf7af01122a5c629dbcc2d298c544cd6c031014258
Instruction Fuzzy Hash: 44D1E432A0C28A85E732DF25965067A3697BB80742F404135DAEDD3F96CFBEE4429708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C7EC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 161
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getptd.LIBCMT ref: 00007FF6C6F3C80E
GetUserDefaultLangID.KERNELBASE(?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C90E
IsValidCodePage.KERNEL32(?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C95F
IsValidLocale.KERNEL32(?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C975
GetLocaleInfoA.KERNEL32(?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C9F0
GetLocaleInfoA.KERNEL32(?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3CA0D
_itow_s.LIBCMT ref: 00007FF6C6F3CA2B

Strings

Norwegian-Nynorsk, xrefs: 00007FF6C6F3C9B0

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultLangPageUser_getptd_itow_s
String ID: Norwegian-Nynorsk
API String ID: 926657232-461349085
Opcode ID: 7ff0974399a832ac8e76f8d152517f6fd010818402cdbb7f46a5b145d7612eaa
Instruction ID: 1d2d87c741cfe08cbbcbe8aa6ccbacbefb61f546d5be8580acbdcba4ee468c01
Opcode Fuzzy Hash: 7ff0974399a832ac8e76f8d152517f6fd010818402cdbb7f46a5b145d7612eaa
Instruction Fuzzy Hash: DE619462A4874A86FB269F21D5303B92792EF44B46F048035CAEDC76D4CF7EE940C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F36680, Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F366B2

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

_errno.LIBCMT ref: 00007FF6C6F366E6

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$DecodePointer
String ID:
API String ID: 2310398763-0
Opcode ID: 9001ec01307512f6005c3245dfabb65157091bd5d3477073366688a9cb22da91
Instruction ID: 568ba36c08304164a929b41579703fb2d26c5024abc3549b07567ec73337c0f6
Opcode Fuzzy Hash: 9001ec01307512f6005c3245dfabb65157091bd5d3477073366688a9cb22da91
Instruction Fuzzy Hash: 5D310B36A1824A42FB22AF35E90192F2153BF80795F504430E9DDC7B85DE3EE464971A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3D6A8, Relevance: 4.7, APIs: 3, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

__tzset.LIBCMT ref: 00007FF6C6F3D86A
_isindst.LIBCMT ref: 00007FF6C6F3D924
_errno.LIBCMT ref: 00007FF6C6F3D93A

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __tzset_errno_isindst
String ID:
API String ID: 2776731402-0
Opcode ID: a144e9c8cb28964006e84db05e43291a8d387b4da8cccedbe6304c0d126b774e
Instruction ID: f1e1c58ebdde6239c20fde374f492ca6dfdbbe5993c2ecf3090653a89c2dea4e
Opcode Fuzzy Hash: a144e9c8cb28964006e84db05e43291a8d387b4da8cccedbe6304c0d126b774e
Instruction Fuzzy Hash: 93714673F1924A42E729CE14D965778A293E7D4346F448135DAAEC7AD8DF3EE401CA01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F44958, Relevance: 4.6, APIs: 3, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F44981

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

_errno.LIBCMT ref: 00007FF6C6F449B8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$DecodePointer
String ID:
API String ID: 2310398763-0
Opcode ID: 1c425128edd9717f6f4c1b8876a5fecec9d432f856f0ec43f3c24770cca3715a
Instruction ID: 08b758f03bba25a18ce4c680aab1d3a033a1a552295aef1adaf20f75a904d4ab
Opcode Fuzzy Hash: 1c425128edd9717f6f4c1b8876a5fecec9d432f856f0ec43f3c24770cca3715a
Instruction Fuzzy Hash: 2731B232B1868A43E7668F25E50177A6652FF80751F148234EAEDD7ED5CF6ED8018B08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F34E90, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6C6F34ECA

Part of subcall function 00007FF6C6F3BED8: _errno.LIBCMT ref: 00007FF6C6F3BEF0

Part of subcall function 00007FF6C6F383BC: RtlCaptureContext.KERNEL32 ref: 00007FF6C6F383FB
Part of subcall function 00007FF6C6F383BC: IsDebuggerPresent.KERNEL32 ref: 00007FF6C6F38499
Part of subcall function 00007FF6C6F383BC: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384A3
Part of subcall function 00007FF6C6F383BC: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384AE
Part of subcall function 00007FF6C6F383BC: GetCurrentProcess.KERNEL32 ref: 00007FF6C6F384C4
Part of subcall function 00007FF6C6F383BC: TerminateProcess.KERNEL32 ref: 00007FF6C6F384D2

Strings

C, xrefs: 00007FF6C6F34F18

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate_errno_getptd
String ID: C
API String ID: 1583075380-1037565863
Opcode ID: 90169d63b95ef29e5a4ee078383e0d4fd096b9c193f4b96df77c56a0196f47e8
Instruction ID: 4cbc2357a80fa113d8483bc3ce4484050a4d7c19883d65aa4ed8de260bdfa274
Opcode Fuzzy Hash: 90169d63b95ef29e5a4ee078383e0d4fd096b9c193f4b96df77c56a0196f47e8
Instruction Fuzzy Hash: 6C51C752B1868B41FB629E62A5113BA6352FFC4B85F045031EEED87B85DE3FD041C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F46A38, Relevance: 24.3, APIs: 16, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C6F46F7A), ref: 00007FF6C6F46AA5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C6F46F7A), ref: 00007FF6C6F46AB9
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C6F46F7A), ref: 00007FF6C6F46BBC

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: CompareErrorInfoLastString
String ID:
API String ID: 3723911898-0
Opcode ID: 4fef309759a332e5e78228dc9ae9cdacf75abd625977a99af39bf93bf1aada7f
Instruction ID: 6c5b7018263f0128d365c199dd2f4244dddb03f5b6b11e8156d24d2a4882ec15
Opcode Fuzzy Hash: 4fef309759a332e5e78228dc9ae9cdacf75abd625977a99af39bf93bf1aada7f
Instruction Fuzzy Hash: F9E1D422A082CA86EB329F1596401BD2793FB44796F544535E7AD87FC4DFBEE944C308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F31190, Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 236
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C6F355FC: _errno.LIBCMT ref: 00007FF6C6F35623

malloc.LIBCMT ref: 00007FF6C6F311F9

Part of subcall function 00007FF6C6F33A68: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33A98
Part of subcall function 00007FF6C6F33A68: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393), ref: 00007FF6C6F33ABD
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AE1
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AEC

malloc.LIBCMT ref: 00007FF6C6F313C1
free.LIBCMT ref: 00007FF6C6F31428
free.LIBCMT ref: 00007FF6C6F314EB

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

Part of subcall function 00007FF6C6F33810: GetProcAddress.KERNEL32 ref: 00007FF6C6F33840
Part of subcall function 00007FF6C6F33810: free.LIBCMT ref: 00007FF6C6F33850

malloc.LIBCMT ref: 00007FF6C6F31484

Part of subcall function 00007FF6C6F33F08: _errno.LIBCMT ref: 00007FF6C6F33F31

Part of subcall function 00007FF6C6F33620: MessageBoxW.USER32 ref: 00007FF6C6F33657

free.LIBCMT ref: 00007FF6C6F3161D
free.LIBCMT ref: 00007FF6C6F31629
free.LIBCMT ref: 00007FF6C6F31633
free.LIBCMT ref: 00007FF6C6F3163F

Strings

setInitialArgsW, xrefs: 00007FF6C6F314FA
%s:%s, xrefs: 00007FF6C6F315F6
%s:%s, xrefs: 00007FF6C6F31417
%s:%s, xrefs: 00007FF6C6F314DA
%s:%s, xrefs: 00007FF6C6F3156A
runW, xrefs: 00007FF6C6F31580

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$_errno$malloc$Heap$AddressAllocateErrorFreeLastMessageProc
String ID: %s:%s$%s:%s$%s:%s$%s:%s$runW$setInitialArgsW
API String ID: 601363308-1770921581
Opcode ID: 833ae90926bc19009da1be6bc201c345330405e6e993f3d5c75365387514064d
Instruction ID: 027429571c3e36c4cd3b16e5a0cf6893f80fa108747f11644ce33343b3096837
Opcode Fuzzy Hash: 833ae90926bc19009da1be6bc201c345330405e6e993f3d5c75365387514064d
Instruction Fuzzy Hash: C4D1536290CA4A85E612DF15E5513B973A2FF81786F001035E6EDC7BA6CFBEE440C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F32060, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 00007FF6C6F320BD
malloc.LIBCMT ref: 00007FF6C6F320CF
malloc.LIBCMT ref: 00007FF6C6F320E7
realloc.LIBCMT ref: 00007FF6C6F3216E
realloc.LIBCMT ref: 00007FF6C6F32185
swscanf.LIBCMT ref: 00007FF6C6F321DE

Strings

%[^], xrefs: 00007FF6C6F321D2

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: malloc$realloc$swscanf
String ID: %[^]
API String ID: 300293884-1511528883
Opcode ID: 71f4be30116a87db26c233eb0f6d87bcaea55527c1114bd669d981afa9d5aca4
Instruction ID: 5b4789fd19eb03491fdc06abb944c61d86e8b269a20b8758eeef490e9910d125
Opcode Fuzzy Hash: 71f4be30116a87db26c233eb0f6d87bcaea55527c1114bd669d981afa9d5aca4
Instruction Fuzzy Hash: F381297260CA8582DA61DF59E49032EB3A1FBC4B95F104132EADDC3B69DF7ED4418B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F32490, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 00007FF6C6F324FD
__except_validate_jump_buffer.LIBVCRUNTIMED ref: 00007FF6C6F32526
malloc.LIBCMT ref: 00007FF6C6F32554
malloc.LIBCMT ref: 00007FF6C6F32617
free.LIBCMT ref: 00007FF6C6F329BB
free.LIBCMT ref: 00007FF6C6F329FA

Strings

PATH, xrefs: 00007FF6C6F325E0
.exe, xrefs: 00007FF6C6F32984
.exe, xrefs: 00007FF6C6F32974

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: malloc$free$__except_validate_jump_buffer
String ID: .exe$.exe$PATH
API String ID: 1394753668-4238971936
Opcode ID: 005eb9812bb9f9bf2c7a28a61ffd215e65a4c4fdba6fa1ba0bfb3bd9a6ff8f25
Instruction ID: d0fba67aaa4e7385a3902e6ab8a6b043e3a99f749e0ce89fe34b324a0e694490
Opcode Fuzzy Hash: 005eb9812bb9f9bf2c7a28a61ffd215e65a4c4fdba6fa1ba0bfb3bd9a6ff8f25
Instruction Fuzzy Hash: 45F10C2260CB8981DA619F16E48037EB3A1FBC8B95F404132EADDC7B69DF6DD441CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F31C30, Relevance: 16.6, APIs: 6, Strings: 5, Instructions: 132
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 00007FF6C6F31CEA
malloc.LIBCMT ref: 00007FF6C6F31D48
malloc.LIBCMT ref: 00007FF6C6F31DE8
free.LIBCMT ref: 00007FF6C6F31E97

Part of subcall function 00007FF6C6F35E94: __doserrno.LIBCMT ref: 00007FF6C6F35ECB
Part of subcall function 00007FF6C6F35E94: _errno.LIBCMT ref: 00007FF6C6F35ED3

free.LIBCMT ref: 00007FF6C6F31ED9
free.LIBCMT ref: 00007FF6C6F31EE6

Part of subcall function 00007FF6C6F32A20: free.LIBCMT ref: 00007FF6C6F32AFE

Strings

org.eclipse.equinox.launcher, xrefs: 00007FF6C6F31D52
eclipse, xrefs: 00007FF6C6F31EBE
org.eclipse.equinox.launcher, xrefs: 00007FF6C6F31CF9
eclipse, xrefs: 00007FF6C6F31CA3
plugins, xrefs: 00007FF6C6F31E64

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$malloc$__doserrno_errno
String ID: eclipse$eclipse$org.eclipse.equinox.launcher$org.eclipse.equinox.launcher$plugins
API String ID: 3299306392-1329844695
Opcode ID: 0d2d8010bbe24606e888a6769674a0d5955357583ec9c762be9c85dadd9ccb5d
Instruction ID: 43f7ef80e67b1394ea83cd8fe07752d50b893899f38a37a71e26c76a95960514
Opcode Fuzzy Hash: 0d2d8010bbe24606e888a6769674a0d5955357583ec9c762be9c85dadd9ccb5d
Instruction Fuzzy Hash: 5671FF2260CA8980EA62DF15E4913BA7362FBC4BC1F405132EAEDC7B69DF2DD585C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F33670, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62
windowlibraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C6F33688
LoadIconW.USER32 ref: 00007FF6C6F336B6
LoadLibraryExW.KERNEL32 ref: 00007FF6C6F336D9
LoadIconW.USER32 ref: 00007FF6C6F336F6
#17.COMCTL32 ref: 00007FF6C6F33701
CreateWindowExW.USER32 ref: 00007FF6C6F3377F
SetClassLongPtrW.USER32 ref: 00007FF6C6F337A5

Strings

STATIC, xrefs: 00007FF6C6F33774

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Load$Icon$ClassCreateHandleLibraryLongModuleWindow
String ID: STATIC
API String ID: 707653617-1882779555
Opcode ID: 436f30f6e0417e8058d5f85b2d871ca7db2401e1b0e9070417d23a5df567399b
Instruction ID: 8e41346ff8bf651040fcd51d3d892a194d6c169bd3ee29d57c56e80fc5b081c9
Opcode Fuzzy Hash: 436f30f6e0417e8058d5f85b2d871ca7db2401e1b0e9070417d23a5df567399b
Instruction Fuzzy Hash: E031D97691CB4986E351DF14F45832A76A1FB84785F200138E6ED87BA8CFBEE085CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F470B8, Relevance: 13.8, APIs: 9, Instructions: 256
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF6C6F470E0

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

__wtomb_environ.LIBCMT ref: 00007FF6C6F471D9
_errno.LIBCMT ref: 00007FF6C6F471E3
free.LIBCMT ref: 00007FF6C6F472D5
SetEnvironmentVariableA.KERNEL32 ref: 00007FF6C6F47420
_errno.LIBCMT ref: 00007FF6C6F4742E
free.LIBCMT ref: 00007FF6C6F4743C
free.LIBCMT ref: 00007FF6C6F47449
free.LIBCMT ref: 00007FF6C6F4745B

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$_errno$DecodeEnvironmentPointerVariable__wtomb_environ
String ID:
API String ID: 3451773520-0
Opcode ID: 635371aa4bd84910a3ec74b0f0e5250c62adae22b29609ff47a1a7630e4d6539
Instruction ID: c68bf64e4961241f138de28970cf317a016849df2d521c05a3f0474f67a843c4
Opcode Fuzzy Hash: 635371aa4bd84910a3ec74b0f0e5250c62adae22b29609ff47a1a7630e4d6539
Instruction Fuzzy Hash: 79A1FC25F0D64A41FA12AF119A1023A2287FF80796F144535DEFEC7FC5DEBEA4858709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F33CDC, Relevance: 13.6, APIs: 9, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 00007FF6C6F33D05
DecodePointer.KERNEL32 ref: 00007FF6C6F33D38
DecodePointer.KERNEL32 ref: 00007FF6C6F33D55
DecodePointer.KERNEL32 ref: 00007FF6C6F33D94
DecodePointer.KERNEL32 ref: 00007FF6C6F33DAD
DecodePointer.KERNEL32 ref: 00007FF6C6F33DBC
_initterm.LIBCMT ref: 00007FF6C6F33DFB
_initterm.LIBCMT ref: 00007FF6C6F33E0E
ExitProcess.KERNEL32 ref: 00007FF6C6F33E47

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: DecodePointer$_initterm$ExitProcess_lock
String ID:
API String ID: 2551688548-0
Opcode ID: 6aae837fb427203b975f66c309e5329f83957dee51cdb19c44dfbfa9fbc02cee
Instruction ID: f094e1edcf0f2c42a4ed9181b8ed1c665e445e0f369454adad5c0c21a2136392
Opcode Fuzzy Hash: 6aae837fb427203b975f66c309e5329f83957dee51cdb19c44dfbfa9fbc02cee
Instruction Fuzzy Hash: A5419022A0EA8E45E612DF01E9401396297BF847C6F040034EAEDC7B95DFBEE441830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3F1F4, Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF6C6F3F25A
_wsopen_s.LIBCMT ref: 00007FF6C6F3F4A0

Part of subcall function 00007FF6C6F44BF0: _errno.LIBCMT ref: 00007FF6C6F44C11

Strings

UNICODE, xrefs: 00007FF6C6F3F44E
ccs, xrefs: 00007FF6C6F3F3C4
UTF-16LE, xrefs: 00007FF6C6F3F42A
=, xrefs: 00007FF6C6F3F3F2
UTF-8, xrefs: 00007FF6C6F3F406

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$_wsopen_s
String ID: =$UNICODE$UTF-16LE$UTF-8$ccs
API String ID: 586276568-31882262
Opcode ID: 5fc937fa530fa101b8cab47349414950ccbb0e48019be69f6e65dbeaac96068d
Instruction ID: 4b219e89ebb06d5468276d0952e49a8351e867addc3ed9d3c78242ecd857d232
Opcode Fuzzy Hash: 5fc937fa530fa101b8cab47349414950ccbb0e48019be69f6e65dbeaac96068d
Instruction Fuzzy Hash: 6871E426E0E20AC1FB764E15E50273A1293AF55742F554131CEEEE3AD4CE3FE881420B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F31670, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 00007FF6C6F31697

Part of subcall function 00007FF6C6F33A68: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33A98
Part of subcall function 00007FF6C6F33A68: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393), ref: 00007FF6C6F33ABD
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AE1
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AEC

_free_nolock.LIBCMTD ref: 00007FF6C6F316F3
free.LIBCMT ref: 00007FF6C6F3170E
malloc.LIBCMT ref: 00007FF6C6F31720
GetModuleFileNameW.KERNEL32 ref: 00007FF6C6F31737

Part of subcall function 00007FF6C6F35A58: _errno.LIBCMT ref: 00007FF6C6F35A70

Strings

.exe, xrefs: 00007FF6C6F316CD
.exe, xrefs: 00007FF6C6F316DD

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$malloc$AllocateFileHeapModuleName_free_nolockfree
String ID: .exe$.exe
API String ID: 2786203957-1392631246
Opcode ID: 89bf050788bbb70a64b0589cb2c74ed4180642fa759755f5dbfc551fbb9531c8
Instruction ID: 048aa9de88070536c071003eecebd62311a27f9f58a6016bf888d0e480527013
Opcode Fuzzy Hash: 89bf050788bbb70a64b0589cb2c74ed4180642fa759755f5dbfc551fbb9531c8
Instruction Fuzzy Hash: 3A318D76A1CA4982DA61DF15E49013EB3A2FBC8B95F001132EADDC3B59CF7DD1408B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3387C, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33909
_FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33934
_RTC_Initialize.LIBCMT ref: 00007FF6C6F3394D
GetCommandLineW.KERNEL32 ref: 00007FF6C6F33966
_cinit.LIBCMT ref: 00007FF6C6F339A6
__create_locale.LIBCMTD ref: 00007FF6C6F339D1

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: CommandInitializeLine__create_locale_cinit
String ID:
API String ID: 899786927-0
Opcode ID: 099ae3a07c332bb2c585d7edec65833441fb8b131d0507388e79762aedd69517
Instruction ID: 4b6b9bfc7f42d83774c972279e9e2fdaed00e01b7088471bc9634328a58287d7
Opcode Fuzzy Hash: 099ae3a07c332bb2c585d7edec65833441fb8b131d0507388e79762aedd69517
Instruction Fuzzy Hash: 85414C62E0C68F86FA52AF64A5512792293AF40347F140039D7EDC76D7DEAFA840871F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F355FC, Relevance: 6.1, APIs: 4, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F35623

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

_getptd.LIBCMT ref: 00007FF6C6F35649
_lock.LIBCMT ref: 00007FF6C6F35682
_lock.LIBCMT ref: 00007FF6C6F35715

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _lock$DecodePointer_errno_getptd
String ID:
API String ID: 4201827665-0
Opcode ID: b214a0416cc190f90d6c8e026eb95d306f7565141d6b00d5f51af00543002440
Instruction ID: 48e3f16a375046fa1cfa697c75e5df1eb37e2d0e02f73196d75a1b56454d504a
Opcode Fuzzy Hash: b214a0416cc190f90d6c8e026eb95d306f7565141d6b00d5f51af00543002440
Instruction Fuzzy Hash: C551AC31A0964A82F746DF25E9407BA3292FF85782F104135EDED83792DE7EE800871A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F32686, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F35E94: __doserrno.LIBCMT ref: 00007FF6C6F35ECB
Part of subcall function 00007FF6C6F35E94: _errno.LIBCMT ref: 00007FF6C6F35ED3

free.LIBCMT ref: 00007FF6C6F329BB
free.LIBCMT ref: 00007FF6C6F329FA

Strings

.exe, xrefs: 00007FF6C6F32984
.exe, xrefs: 00007FF6C6F32974

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$__doserrno_errno
String ID: .exe$.exe
API String ID: 13327527-1392631246
Opcode ID: 51931eef1e682aefba3e16cd104743b560ae62145aa1d14770ded707e4c36f38
Instruction ID: 6750e2e95d8f39c9a33547cfaa6ec5df88527b7cf2833aab6ec2f326cb766b85
Opcode Fuzzy Hash: 51931eef1e682aefba3e16cd104743b560ae62145aa1d14770ded707e4c36f38
Instruction Fuzzy Hash: 0C11462250CA4A80EA22DF11E54037AA352FBC43A6F400031E9DDC75A9DF6ED585D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F37FA0, Relevance: 4.5, APIs: 3, Instructions: 35memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F33EA0: _initp_misc_winsig.LIBCMT ref: 00007FF6C6F33ED9
Part of subcall function 00007FF6C6F33EA0: EncodePointer.KERNEL32(?,?,00000000,00007FF6C6F37FAB,?,?,00000000,00007FF6C6F33927), ref: 00007FF6C6F33EF5

FlsAlloc.KERNEL32(?,?,00000000,00007FF6C6F33927), ref: 00007FF6C6F37FBB

Part of subcall function 00007FF6C6F39A60: Sleep.KERNEL32(?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F39AA5

FlsSetValue.KERNEL32(?,?,00000000,00007FF6C6F33927), ref: 00007FF6C6F37FEC

Part of subcall function 00007FF6C6F37D0C: _lock.LIBCMT ref: 00007FF6C6F37D5C
Part of subcall function 00007FF6C6F37D0C: _lock.LIBCMT ref: 00007FF6C6F37D7C

GetCurrentThreadId.KERNEL32 ref: 00007FF6C6F38000

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _lock$AllocCurrentEncodePointerSleepThreadValue_initp_misc_winsig
String ID:
API String ID: 54287522-0
Opcode ID: b7123ba67d215fb6092044bae2c2c9933779e6912c19712fbe0f064f10f19147
Instruction ID: 1ba451fcd00171c6ff402a1dc2d16a1cc3cef63f30b224dcaf21ef4144fbe930
Opcode Fuzzy Hash: b7123ba67d215fb6092044bae2c2c9933779e6912c19712fbe0f064f10f19147
Instruction Fuzzy Hash: C5014B60E0960F41FB57AF75994517922939F44B32F181230D5FDC72E1EE6EE881D22A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F46FA0, Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F35898: _getptd.LIBCMT ref: 00007FF6C6F358AE

_errno.LIBCMT ref: 00007FF6C6F46FE8
_errno.LIBCMT ref: 00007FF6C6F4707F

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$_getptd
String ID:
API String ID: 3432092939-0
Opcode ID: ff4fe4a15314d55cd44c9a9eb9755e010b3356c16205939f3b0cbbae4eff763b
Instruction ID: 33901329ef068eaa724347e04695c76fea976fa61dd4e726a0ffd23ecd0c6116
Opcode Fuzzy Hash: ff4fe4a15314d55cd44c9a9eb9755e010b3356c16205939f3b0cbbae4eff763b
Instruction Fuzzy Hash: D731B622A0D28582F7628F28D54037EA751FB847A5F144235EAFC87FD9DF6ED4418B08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F40800, Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F40823

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

RtlAllocateHeap.NTDLL(?,?,?,?,00000000,00007FF6C6F39A93,?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F), ref: 00007FF6C6F4086C

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: AllocateDecodeHeapPointer_errno
String ID:
API String ID: 15861996-0
Opcode ID: 3a150d5caabfca685e044c64d3bc12d330369aec01c7c7f71b58062f87caa723
Instruction ID: 76cdd6d0dcf34ffb9b66f914b6f4f1bb606e151fbb327f3dd282c7a113a7120a
Opcode Fuzzy Hash: 3a150d5caabfca685e044c64d3bc12d330369aec01c7c7f71b58062f87caa723
Instruction Fuzzy Hash: 1811C421B0D24A85FF565F24E70077962936F80796F088630CABD83EC5DEBE94418648

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F408B0, Relevance: 3.0, APIs: 2, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F408DA

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

realloc.LIBCMT ref: 00007FF6C6F40914

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: DecodePointer_errnorealloc
String ID:
API String ID: 1659991715-0
Opcode ID: 40d1447f9cb56b735b7fa2efafe4b8b5e1e93be9a069a78c3cc09aafea3fd532
Instruction ID: 6e711c955204f7d7d10eed279617e6e3c9a728dc449785b79304af9deacacfd8
Opcode Fuzzy Hash: 40d1447f9cb56b735b7fa2efafe4b8b5e1e93be9a069a78c3cc09aafea3fd532
Instruction Fuzzy Hash: 66014921F1D75A80FE169F26E60027DA2936F887C1B088431DFADC3F89DE7ED0118608

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F378D4, Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,00007FF6C6F36849,?,?,?,00007FF6C6F36955,?,?,?,?,?,00007FF6C6F325EC), ref: 00007FF6C6F378E8
FreeEnvironmentStringsW.KERNEL32(?,?,?,00007FF6C6F36849,?,?,?,00007FF6C6F36955,?,?,?,?,?,00007FF6C6F325EC), ref: 00007FF6C6F3793F

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 28ce36d650e87c43a9e5cdd6ceeb2295ad0d0ee5a0dfc16f80b58ba6c24dd179
Instruction ID: 643ea17cb4ed0eada9fc8a56c3475215e4cf9f96a83dbab694bcf33b20e130a4
Opcode Fuzzy Hash: 28ce36d650e87c43a9e5cdd6ceeb2295ad0d0ee5a0dfc16f80b58ba6c24dd179
Instruction Fuzzy Hash: 5501D811F0D38985DE61AF52A54503963A2EF48BC1F484531DBEE83B49DE2DE5808309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F33EA0, Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 00007FF6C6F33ED9

Part of subcall function 00007FF6C6F387F8: EncodePointer.KERNEL32(?,?,?,?,00007FF6C6F33EEE,?,?,00000000,00007FF6C6F37FAB,?,?,00000000,00007FF6C6F33927), ref: 00007FF6C6F38803

EncodePointer.KERNEL32(?,?,00000000,00007FF6C6F37FAB,?,?,00000000,00007FF6C6F33927), ref: 00007FF6C6F33EF5

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: EncodePointer$_initp_misc_winsig
String ID:
API String ID: 190222155-0
Opcode ID: 4a98d4ad99af827c8750d7040cb2a7ed9ef8ab7550306bf797b381641462de66
Instruction ID: f403ec23f72ec04fba4540106b0a725a86df3b292e1cf396e9e96c2ff5df8e80
Opcode Fuzzy Hash: 4a98d4ad99af827c8750d7040cb2a7ed9ef8ab7550306bf797b381641462de66
Instruction Fuzzy Hash: E7F02811E8964F40ED4AFF6268620BD12525F96782F482030E8BF8B393DD6EE551835E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F38024, Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(?,?,?,?,00007FF6C6F338FC), ref: 00007FF6C6F38036
HeapSetInformation.KERNEL32 ref: 00007FF6C6F38060

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: 3733050a6e88fbb8d062053ef85dd06d1548b4a5d7c7fbd25413876dbc148eff
Instruction ID: 980c5ab6b391932dc6ebb58b8fef2d36cdd58d09cf25c47d34bc96efdea1b83a
Opcode Fuzzy Hash: 3733050a6e88fbb8d062053ef85dd06d1548b4a5d7c7fbd25413876dbc148eff
Instruction Fuzzy Hash: 41E0D8B0A1578542E7499F2194057352151FB88345F805039EAAD43B84DF7DC041CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F37514, Relevance: 2.6, APIs: 2, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F375FC
free.LIBCMT ref: 00007FF6C6F37639

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: e415b5c2b800d60a65acdd22561913b5507e8bdf46b5bf7b0ff8b0147edf17a3
Instruction ID: 1463ec4631ecddf7010e67a4d7e97bc05073ba40ecc9fccbfb57d3bf21267737
Opcode Fuzzy Hash: e415b5c2b800d60a65acdd22561913b5507e8bdf46b5bf7b0ff8b0147edf17a3
Instruction Fuzzy Hash: E2318122A0864A80EB569F29E50027933A6FF45B82F484535DAEDC3B95DF7EE451C30D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F399F4, Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF6C6F39A13

Part of subcall function 00007FF6C6F33A68: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33A98
Part of subcall function 00007FF6C6F33A68: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393), ref: 00007FF6C6F33ABD
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AE1
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AEC

Sleep.KERNEL32(?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393,?,?,?,?,?,?,00000000,00007FF6C6F37E18), ref: 00007FF6C6F39A2A

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$AllocateHeapSleepmalloc
String ID:
API String ID: 4275769124-0
Opcode ID: e56ad9ca86bcd53af0efd5e5a049cb7641f0c7afaa9fa1702f8ac1b5bb5fd424
Instruction ID: 6984e64895e265632406547c93e241c01d5a7165f6877bedd2922f84cb9b053c
Opcode Fuzzy Hash: e56ad9ca86bcd53af0efd5e5a049cb7641f0c7afaa9fa1702f8ac1b5bb5fd424
Instruction Fuzzy Hash: 99F0F632E0878E86EE129F16B44003DB262EB84F91F544234EAFD43B55DF3DE8928749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F4682C, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F35898: _getptd.LIBCMT ref: 00007FF6C6F358AE

_errno.LIBCMT ref: 00007FF6C6F4687B

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno_getptd
String ID:
API String ID: 2021257665-0
Opcode ID: a71bbee57709a43b7d3bf57b8071eab6305aa7767ce688d8d0574177b21a0e0c
Instruction ID: 4f8c2fddae50692ad4f3ba745ce1001c9251df3c0f9afd0dfd3680dacc438c2f
Opcode Fuzzy Hash: a71bbee57709a43b7d3bf57b8071eab6305aa7767ce688d8d0574177b21a0e0c
Instruction Fuzzy Hash: 1B31B422A0878582E7628F15D54037DB761EB85BA5F284235EAEC87BD9CEBED8418704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F456B8, Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__wtomb_environ.LIBCMT ref: 00007FF6C6F456E8

Part of subcall function 00007FF6C6F46944: WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F46990
Part of subcall function 00007FF6C6F46944: WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F469D7
Part of subcall function 00007FF6C6F46944: free.LIBCMT ref: 00007FF6C6F469FB

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ByteCharMultiWide$__wtomb_environfree
String ID:
API String ID: 3717827047-0
Opcode ID: ef54c96346dcf029c30282142703527ad988e4bb431dda914704447c2bfc79f3
Instruction ID: b36042b98d0e36e2d548dfeb5685a5a3277e503d5b1fa51c072acb9522d87ea5
Opcode Fuzzy Hash: ef54c96346dcf029c30282142703527ad988e4bb431dda914704447c2bfc79f3
Instruction Fuzzy Hash: 4C114611E0D68E81FE53AF11974027952D69F45BC6F088031D9BDC7E85DE9EE4418609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F33620, Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6C6F33657

Part of subcall function 00007FF6C6F33670: GetModuleHandleW.KERNEL32 ref: 00007FF6C6F33688

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: HandleMessageModule
String ID:
API String ID: 2216695990-0
Opcode ID: 1a1730f39a4ca4e69405780b676626f8e3800921ed29e7f51602549e7ba76a56
Instruction ID: 391a1a883c9f9e614221f48fcddea008bdcffed6510c0064bc8b0e3fe257c2ac
Opcode Fuzzy Hash: 1a1730f39a4ca4e69405780b676626f8e3800921ed29e7f51602549e7ba76a56
Instruction Fuzzy Hash: F4E0D831E1868585E744EF21E9516363252FB80781F405035EAAE43F14CEBDD0508A04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F386D0, Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(?,?,00000001,00007FF6C6F33C5F,?,?,00000001,00007FF6C6F339AB), ref: 00007FF6C6F386E9

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 248a848f1f9c1dc392dfb65fb5eff8a535342491f906c638ff665f9bcdc7a251
Instruction ID: ac972b1a29f5e01677d0ba89322af10e0dcfb645daf0cd881c6db62a8e72517d
Opcode Fuzzy Hash: 248a848f1f9c1dc392dfb65fb5eff8a535342491f906c638ff665f9bcdc7a251
Instruction Fuzzy Hash: 93D02B33F1854982DB018F20F68027C23A1EB85784F588031D6AC03704DE3DD851C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F39B6C, Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F408B0: _errno.LIBCMT ref: 00007FF6C6F408DA

Sleep.KERNEL32(00000000,00000000,023E85E0,00007FF6C6F4738D), ref: 00007FF6C6F39BB8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: 28f774ad660b3f239ec59eb5075e021c9e0ef7c848656666a5e23842ee2fe05e
Instruction ID: 49baac21a87ef82c592e8766736d10ffae87dfd1600b4b48ef905c2e37356ddd
Opcode Fuzzy Hash: 28f774ad660b3f239ec59eb5075e021c9e0ef7c848656666a5e23842ee2fe05e
Instruction Fuzzy Hash: F801F722E0874985E6169F12B50007AB662BB44FD2F144134EEBC47B54DE3DE9808788

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F39A60, Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F40800: _errno.LIBCMT ref: 00007FF6C6F40823

Sleep.KERNEL32(?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F39AA5

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: 070eb01aa248df2bd45c3b3f83eba9cd2018183e53fbc119892e1053ba694b6b
Instruction ID: 204e043a1662b692197dc84fcca45951690082fb8e775f91846532ae79b17e40
Opcode Fuzzy Hash: 070eb01aa248df2bd45c3b3f83eba9cd2018183e53fbc119892e1053ba694b6b
Instruction Fuzzy Hash: 73012B32A24B4985EB468F169400039B762F788FD1F085131EEAD43B90CF3DE851CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F31F10, Relevance: 1.3, APIs: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F31F79

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b4cd5405422bfb7b6c149535512612428fbe3e327d7ae1ad8fee52cc9ebc1492
Instruction ID: eecdb79da658285f72bc933aa7e26debb8daeee91f9551fa15de758250aafa32
Opcode Fuzzy Hash: b4cd5405422bfb7b6c149535512612428fbe3e327d7ae1ad8fee52cc9ebc1492
Instruction Fuzzy Hash: 6B01E47290CA8582D621DF28E44036AB7A2FBC9399F100235F6DC83AA9CF7DD5548B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6C6F4094C, Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 468COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F4099D
_errno.LIBCMT ref: 00007FF6C6F409A4

Strings

U, xrefs: 00007FF6C6F40F5B

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID: U
API String ID: 921712934-4171548499
Opcode ID: 4ff929d15d2477ac321ab4e51f47354186fe63010a99dcf498c3047be3f2d256
Instruction ID: 5f53003e21c75ccce760d7cb5e8d5f107984cbf9090a47fcfe693145f2a8efad
Opcode Fuzzy Hash: 4ff929d15d2477ac321ab4e51f47354186fe63010a99dcf498c3047be3f2d256
Instruction Fuzzy Hash: E9121522A1C64B86EB228F24E14437A7762FB84745F044135DAED83F95DFBEE449CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3FC90, Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 130libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FCCD
GetProcAddress.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FCE9
GetProcAddress.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD11
EncodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD1A
GetProcAddress.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD30
EncodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD39
GetProcAddress.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD4F
EncodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD58
GetProcAddress.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD76
EncodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FD7F
DecodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FDB1
DecodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FDC0
DecodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FE18
DecodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FE38
DecodePointer.KERNEL32(?,?,00000000,?,00000000,000000FC,00000000,00007FF6C6F370F8,?,?,?,?,00000000,00007FF6C6F3718C), ref: 00007FF6C6F3FE51

Strings

USER32.DLL, xrefs: 00007FF6C6F3FCC6
GetLastActivePopup, xrefs: 00007FF6C6F3FD1F
GetProcessWindowStation, xrefs: 00007FF6C6F3FD6C
GetActiveWindow, xrefs: 00007FF6C6F3FD00
MessageBoxA, xrefs: 00007FF6C6F3FCDF
GetUserObjectInformationA, xrefs: 00007FF6C6F3FD3E

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Pointer$AddressDecodeProc$Encode$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3085332118-232180764
Opcode ID: 1d93ecc68f554e04bdaf65efe74ad38e5abb5af4490d683007b3ad6cb3c9afab
Instruction ID: e884acdb416d7fe7c66c16580ad4bff25a0fbc188bc2993347dcfe949403f617
Opcode Fuzzy Hash: 1d93ecc68f554e04bdaf65efe74ad38e5abb5af4490d683007b3ad6cb3c9afab
Instruction Fuzzy Hash: 6C511C20A0EB5F80FE56EF56A91417822D26F44B82F444835DDBDC3B96EE7EE4428219

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F44D8C, Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F44DB9

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

__mbtow_environ.LIBCMT ref: 00007FF6C6F44ED1
_errno.LIBCMT ref: 00007FF6C6F44EDB
free.LIBCMT ref: 00007FF6C6F44FD6

Part of subcall function 00007FF6C6F39FF8: _errno.LIBCMT ref: 00007FF6C6F3A016

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C6F450E8
GetLastError.KERNEL32 ref: 00007FF6C6F450F4
WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F4519F
WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F451EB
WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F45227
WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F45274
SetEnvironmentVariableA.KERNEL32 ref: 00007FF6C6F4529B
free.LIBCMT ref: 00007FF6C6F452AA
free.LIBCMT ref: 00007FF6C6F452B2
_errno.LIBCMT ref: 00007FF6C6F452C3
free.LIBCMT ref: 00007FF6C6F452D1
free.LIBCMT ref: 00007FF6C6F452E4
free.LIBCMT ref: 00007FF6C6F452F7

Part of subcall function 00007FF6C6F39A60: Sleep.KERNEL32(?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F39AA5

Strings

PATH, xrefs: 00007FF6C6F44D9B

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ByteCharMultiWide_errno$EnvironmentVariable$DecodeErrorLastPointerSleep__mbtow_environ
String ID: PATH
API String ID: 3366669060-1036084923
Opcode ID: bff926f39773a72747324f376fb3ed372db21cf63646ec9755756b9c95eaa03e
Instruction ID: 59c6bd24cf0ef57b046f43f23f11b666ed9f71daa4c62727b6b500e980644c14
Opcode Fuzzy Hash: bff926f39773a72747324f376fb3ed372db21cf63646ec9755756b9c95eaa03e
Instruction Fuzzy Hash: 09E1D431A0D64A41EB66EF25A64013A72D3FF84796F504534DAFED7F85EEBEA4408308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F41518, Relevance: 28.9, APIs: 19, Instructions: 377COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F4158A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F415A0
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F4164A
malloc.LIBCMT ref: 00007FF6C6F416BB
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F416F2
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F41717
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F41767
malloc.LIBCMT ref: 00007FF6C6F417BA
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F417F4
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F41837
free.LIBCMT ref: 00007FF6C6F41848
free.LIBCMT ref: 00007FF6C6F41856
LCMapStringA.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F418E5
malloc.LIBCMT ref: 00007FF6C6F41953
LCMapStringA.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F4199C
free.LIBCMT ref: 00007FF6C6F419E4
LCMapStringA.KERNEL32(?,?,?,?,?,?,?,?,00000140,?,?,00007FF6C6F41AC9), ref: 00007FF6C6F41A04
free.LIBCMT ref: 00007FF6C6F41A16
free.LIBCMT ref: 00007FF6C6F41A28

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: String$free$ByteCharMultiWidemalloc$ErrorLast
String ID:
API String ID: 1837315383-0
Opcode ID: 0a85e11711928d378cbb609f8a470e95faf3aa06bf991e71fe22a8672c89bfa7
Instruction ID: abc3b4f0971bbd26082ac78ea493606553747e0085edc07e6bf6464b1552db46
Opcode Fuzzy Hash: 0a85e11711928d378cbb609f8a470e95faf3aa06bf991e71fe22a8672c89bfa7
Instruction Fuzzy Hash: FDF11732A086898AE722CF25D5001BD7792FB4479AF144234DABD93FD4DFBEE9409708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3DC94, Relevance: 24.0, APIs: 6, Strings: 7, Instructions: 1237COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F3DD16

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

Strings

F, xrefs: 00007FF6C6F3DEA6
I, xrefs: 00007FF6C6F3DEAF
*, xrefs: 00007FF6C6F3DE9D
w, xrefs: 00007FF6C6F3DED0
h, xrefs: 00007FF6C6F3DEC2
N, xrefs: 00007FF6C6F3DEB9
L, xrefs: 00007FF6C6F3DEB4

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: DecodePointer_errno
String ID: *$F$I$L$N$h$w
API String ID: 3485708101-1147943917
Opcode ID: 04c87f6898ee3bda7fba989e0a89fdac9052d36863b4be1b16411cfc8572b701
Instruction ID: d0b8028fc8d42bb6d2471836ad16f25aeef3bd5dba88b131596e386efc272bd4
Opcode Fuzzy Hash: 04c87f6898ee3bda7fba989e0a89fdac9052d36863b4be1b16411cfc8572b701
Instruction Fuzzy Hash: 52B20B6690C68A86EB729F14904027E77A2FF80785F540136E7DD87B95DF3ED841CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F46474, Relevance: 18.1, APIs: 12, Instructions: 115memoryfileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F412F4: _errno.LIBCMT ref: 00007FF6C6F41316

_errno.LIBCMT ref: 00007FF6C6F464FC

Part of subcall function 00007FF6C6F412F4: SetFilePointer.KERNEL32 ref: 00007FF6C6F41336
Part of subcall function 00007FF6C6F412F4: GetLastError.KERNEL32 ref: 00007FF6C6F41345

GetProcessHeap.KERNEL32 ref: 00007FF6C6F464CE
HeapAlloc.KERNEL32 ref: 00007FF6C6F464E3
_errno.LIBCMT ref: 00007FF6C6F464F1
__doserrno.LIBCMT ref: 00007FF6C6F46556
_errno.LIBCMT ref: 00007FF6C6F46560
GetProcessHeap.KERNEL32 ref: 00007FF6C6F46579
HeapFree.KERNEL32 ref: 00007FF6C6F46587
SetEndOfFile.KERNEL32 ref: 00007FF6C6F465B2
_errno.LIBCMT ref: 00007FF6C6F465C9
__doserrno.LIBCMT ref: 00007FF6C6F465D4
GetLastError.KERNEL32 ref: 00007FF6C6F465DC

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$Heap$ErrorFileLastProcess__doserrno$AllocFreePointer
String ID:
API String ID: 3112900366-0
Opcode ID: 072ca6f3b166f9df5e542a363f15d2722490eaf1119615306fd4483e680ebf09
Instruction ID: 1c34791e07e800b208b78be5c6587e7733e6ac806861d84a71c297d390b3b2c2
Opcode Fuzzy Hash: 072ca6f3b166f9df5e542a363f15d2722490eaf1119615306fd4483e680ebf09
Instruction Fuzzy Hash: 40411621B18A5A45EA16AF39DB0417D2283AF45BF2F040330D9BD87BD6DEBEE445C209

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F38EE4, Relevance: 15.7, APIs: 10, Instructions: 726COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F35898: _getptd.LIBCMT ref: 00007FF6C6F358AE

_errno.LIBCMT ref: 00007FF6C6F38F4F

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

DecodePointer.KERNEL32 ref: 00007FF6C6F3953E
DecodePointer.KERNEL32 ref: 00007FF6C6F39582
DecodePointer.KERNEL32 ref: 00007FF6C6F395A9
write_multi_char.LIBCMT ref: 00007FF6C6F3963F
write_multi_char.LIBCMT ref: 00007FF6C6F39679
write_char.LIBCMT ref: 00007FF6C6F396CA
write_multi_char.LIBCMT ref: 00007FF6C6F39724
free.LIBCMT ref: 00007FF6C6F3974F

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: DecodePointer$write_multi_char$_errno_getptdfreewrite_char
String ID:
API String ID: 2334620807-0
Opcode ID: d69f8d7bd9c6f19685121c1cd0dcd30b8878e6ab109697d1284962c48b5d94ef
Instruction ID: e43899cbdcae323fbbddf2c53a6f99092ec61992ac02f2c8d9a0093eadce34f3
Opcode Fuzzy Hash: d69f8d7bd9c6f19685121c1cd0dcd30b8878e6ab109697d1284962c48b5d94ef
Instruction Fuzzy Hash: EB52D732A0C68A86EB628F15D44427E67A2FB41782F145036D7EDC76D4EE7FE840CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F46300, Relevance: 15.1, APIs: 10, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F46329
_errno.LIBCMT ref: 00007FF6C6F46332
__doserrno.LIBCMT ref: 00007FF6C6F46383
_errno.LIBCMT ref: 00007FF6C6F4638A

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 1e4598dee6a357aea2a2a5b534fe70123c4abc1340a452faba74e4e6b75eee02
Instruction ID: e09982d6c851f35339bfcbb7302e030ed43f982881678e5196eb45c8077a1ec2
Opcode Fuzzy Hash: 1e4598dee6a357aea2a2a5b534fe70123c4abc1340a452faba74e4e6b75eee02
Instruction Fuzzy Hash: 9E412632A1829A81E712AF35D95213D3552BF80361F518234EABC87BD3CE7EE4418718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F36F30, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 137fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,?,00000000,00007FF6C6F3718C,?,?,?,?,00007FF6C6F33A9D,?,?,00000000,00007FF6C6F39A18), ref: 00007FF6C6F36FF3
GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6C6F3718C,?,?,?,?,00007FF6C6F33A9D,?,?,00000000,00007FF6C6F39A18), ref: 00007FF6C6F370FF
WriteFile.KERNEL32 ref: 00007FF6C6F37139

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00007FF6C6F370E3
..., xrefs: 00007FF6C6F37056
<program name unknown>, xrefs: 00007FF6C6F36FFD
Runtime Error!Program: , xrefs: 00007FF6C6F36FB2

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 4859dd3b15ca44b4914ec39d5dd938afb070b33adea7dafd62e9f0a1873d9d6b
Instruction ID: 2a1189b6948b91cc6fce9b1a2e92864f08f70a44ca1d2517a51df54d2f534882
Opcode Fuzzy Hash: 4859dd3b15ca44b4914ec39d5dd938afb070b33adea7dafd62e9f0a1873d9d6b
Instruction Fuzzy Hash: FF51D162B1864B41FB22DF25AA6177A2253AF85386F404135DEFDC3AD1CF7EE005820E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F43870, Relevance: 12.2, APIs: 8, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F438BB

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: a4dc2269901a5651ad8dcfc2262e9c7bfb0408b2b445ea56c7cf33b6f06dfa48
Instruction ID: 2666ed596c5a02534b821db78721fc75992373d691e610060ae54083258a4a6f
Opcode Fuzzy Hash: a4dc2269901a5651ad8dcfc2262e9c7bfb0408b2b445ea56c7cf33b6f06dfa48
Instruction Fuzzy Hash: 6A91C923A0CA8A85EA718F12A64023DA7A6FB41761F144635D7FD93ED4CFFED4418B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F40134, Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C6F4035E), ref: 00007FF6C6F4018E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C6F4035E), ref: 00007FF6C6F401A0
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C6F4035E), ref: 00007FF6C6F401EB
malloc.LIBCMT ref: 00007FF6C6F40250

Part of subcall function 00007FF6C6F33A68: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33A98
Part of subcall function 00007FF6C6F33A68: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393), ref: 00007FF6C6F33ABD
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AE1
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AEC

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C6F4035E), ref: 00007FF6C6F4027D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C6F4035E), ref: 00007FF6C6F402B7
free.LIBCMT ref: 00007FF6C6F402CB
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C6F4035E), ref: 00007FF6C6F402E1

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale$_errno$AllocateByteCharErrorHeapLastMultiWidefreemalloc
String ID:
API String ID: 4202622830-0
Opcode ID: 333305acf3de38dad2a5cea814540686be6389dd6796037158923790addd2d0b
Instruction ID: bd5d83c002a2e545c41212674133bda87b802dbaf3dde650332ba770a6158168
Opcode Fuzzy Hash: 333305acf3de38dad2a5cea814540686be6389dd6796037158923790addd2d0b
Instruction Fuzzy Hash: 3D510C32A0864A86EB529F559A4057D3393FF447A9F540535DABE93FC4CFBEE9408308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F36A00, Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C6F3F9BF
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C6F3F9DE
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C6F3FA2A
IsDebuggerPresent.KERNEL32 ref: 00007FF6C6F3FA9C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F3FAB4
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F3FAC1
GetCurrentProcess.KERNEL32 ref: 00007FF6C6F3FADA
TerminateProcess.KERNEL32 ref: 00007FF6C6F3FAE8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 294248248e6ea2dcecfaaa187076693cccc5f5fd0778115a3d887ecf26f98c3d
Instruction ID: 25b33b1365123dce388c22d6b852497f14c4706b46982f3f87fa96c3400aca7e
Opcode Fuzzy Hash: 294248248e6ea2dcecfaaa187076693cccc5f5fd0778115a3d887ecf26f98c3d
Instruction Fuzzy Hash: 7631F435909B4A85EB129F14F94437973A2FB84356F508036EAED83B65DFBEE0458B08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F4364C, Relevance: 10.6, APIs: 7, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F43692
_errno.LIBCMT ref: 00007FF6C6F43700
_errno.LIBCMT ref: 00007FF6C6F4370B
_errno.LIBCMT ref: 00007FF6C6F4373F
WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F437DA
GetLastError.KERNEL32 ref: 00007FF6C6F437FA
_errno.LIBCMT ref: 00007FF6C6F43820

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$ByteCharErrorLastMultiWide
String ID:
API String ID: 3895584640-0
Opcode ID: b8ea9136630ce5355403cf0952ac0ae887c7ef490093564d9e0ed85c7c7c59ac
Instruction ID: 339c0140cbb5065f8b22f276f51b361fe911c55426ae3505d077cf3c96d4a6f2
Opcode Fuzzy Hash: b8ea9136630ce5355403cf0952ac0ae887c7ef490093564d9e0ed85c7c7c59ac
Instruction Fuzzy Hash: EA51D663A0C2CA85E7729F26E10067DB692AB81762F148135D7ECC3FC5CEEDD8418B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F383BC, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C6F383FB
IsDebuggerPresent.KERNEL32 ref: 00007FF6C6F38499
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384A3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384AE
GetCurrentProcess.KERNEL32 ref: 00007FF6C6F384C4
TerminateProcess.KERNEL32 ref: 00007FF6C6F384D2

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 8d1a731cf550170dd24023532b3d158d1858887a524fe41fb85e4e670e14f1fa
Instruction ID: e1931684d6e89aae0bd24bddcf632f5a07693bc183080d17e040e56cfa17f74c
Opcode Fuzzy Hash: 8d1a731cf550170dd24023532b3d158d1858887a524fe41fb85e4e670e14f1fa
Instruction Fuzzy Hash: 5B312D32608B8A82EB259F54F4403AEB3A5FB88745F500136DBED83A55EF7DD144CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C0A8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,?,00000000,00007FF6C6F3C93C,?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C103
GetLocaleInfoA.KERNEL32(?,?,?,?,00000000,00007FF6C6F3C93C,?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C145
GetACP.KERNEL32(?,?,?,?,00000000,00007FF6C6F3C93C,?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C168

Strings

OCP, xrefs: 00007FF6C6F3C0E1
ACP, xrefs: 00007FF6C6F3C0D1

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c3cd847921d65e5be7eea410fe7bcdc4f9f5d37c501c10a2afb6f592cef33a52
Instruction ID: 423dc255110c9dd06869f327eafe9344e42b1058ccc0ed39cf1eddb2e73c2f96
Opcode Fuzzy Hash: c3cd847921d65e5be7eea410fe7bcdc4f9f5d37c501c10a2afb6f592cef33a52
Instruction Fuzzy Hash: 4221A431B4854F91FA22AF20E96017967A2BF44786F444030CAEDC7AA5EF6EF504C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F38070, Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6C6F380A7
GetCurrentProcessId.KERNEL32 ref: 00007FF6C6F380B2
GetCurrentThreadId.KERNEL32 ref: 00007FF6C6F380BE
GetTickCount.KERNEL32 ref: 00007FF6C6F380CA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6C6F380DB

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 0e0b0daf2d3464fe0f2eb59402f8c4a834a875576d0d347859fd9322bf69f5c9
Instruction ID: 2826b855946a98c396481a55499aff70abc88989ee6ae98defc7cfa0ba8fe9b8
Opcode Fuzzy Hash: 0e0b0daf2d3464fe0f2eb59402f8c4a834a875576d0d347859fd9322bf69f5c9
Instruction Fuzzy Hash: 6701C822619A0D91F7418F21E9502752361FB44B92F447531DEFE87B54CF7ED9848304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C348, Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6C6F3C36F
GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F3C3A4
GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F3C3FC
GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F3C4F0

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale$_getptd
String ID:
API String ID: 1743167714-0
Opcode ID: 3e4fd66511ad2bd683acb56c593ffb1c6717a694d8daae11eb80987bd1e6ffc0
Instruction ID: 327d6ab031bad583d637f555fbb72f14883b1c995db1d4425221f8ddddedab14
Opcode Fuzzy Hash: 3e4fd66511ad2bd683acb56c593ffb1c6717a694d8daae11eb80987bd1e6ffc0
Instruction Fuzzy Hash: DE618172B48A8A97EA6A9E25C9543FD7392FB88346F400136C7ADC7684CF3DE4648705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3654C, Relevance: 4.6, APIs: 3, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F36577

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

_errno.LIBCMT ref: 00007FF6C6F365AB
_errno.LIBCMT ref: 00007FF6C6F365DF

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$DecodePointer
String ID:
API String ID: 2310398763-0
Opcode ID: 7d0b1b20ad0c120295f1c780292606717f18c58f6ae3647ab39b5b96c40ae609
Instruction ID: 97be879036022c6714848a9fb09ce74da81f20c5b6599929ccccf4ef6a913da8
Opcode Fuzzy Hash: 7d0b1b20ad0c120295f1c780292606717f18c58f6ae3647ab39b5b96c40ae609
Instruction Fuzzy Hash: E3312935B1C64A82F6729F25A51143F6143BF4139AF104134EAEDCBB85CE3EE4558B0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3FF30, Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C6F3FF6F
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F3FFB5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F3FFC0

Part of subcall function 00007FF6C6F36F30: GetModuleFileNameA.KERNEL32(?,?,?,?,00000000,00007FF6C6F3718C,?,?,?,?,00007FF6C6F33A9D,?,?,00000000,00007FF6C6F39A18), ref: 00007FF6C6F36FF3

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextFileModuleName
String ID:
API String ID: 2731829486-0
Opcode ID: e88a5ea4125f983a330b36214773acc992e49d69ae17c0b8fea59f736f1f8ed2
Instruction ID: 9bba4d2e2a1816a579b36456a650b36427e2d327a6910ac9c68fb84aa6ab8805
Opcode Fuzzy Hash: e88a5ea4125f983a330b36214773acc992e49d69ae17c0b8fea59f736f1f8ed2
Instruction Fuzzy Hash: 7201842161DA8E41F6669F60F4143BA7392FF85306F000235EAEE87AD5DF6EE504C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C5DC, Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6C6F3C5FE
GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F3C633

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale_getptd
String ID:
API String ID: 3731964398-0
Opcode ID: 132a7dd22cf8e5d1321647df7149a58a330ccb138cef8f5b31d0df4a95e2c780
Instruction ID: 53e50ae66f2671a10acf2708211d5a099955bc320a084450feef7c70bd10e02b
Opcode Fuzzy Hash: 132a7dd22cf8e5d1321647df7149a58a330ccb138cef8f5b31d0df4a95e2c780
Instruction Fuzzy Hash: B121C132B086CA96EB2A9F22D9103F97392FB89346F005035CBADC7281DF3DE4648605

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C1AC, Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6C6F3C1D3
GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F3C208

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale_getptd
String ID:
API String ID: 3731964398-0
Opcode ID: 27bf1438532f6ff03f7f41338c943cd1d1bdb66fcb0791caa3c924ca9cd62dab
Instruction ID: 4a4e1b9b244ea7e810f3f57f2084d014a4856060c30a952e370845eae7157a5e
Opcode Fuzzy Hash: 27bf1438532f6ff03f7f41338c943cd1d1bdb66fcb0791caa3c924ca9cd62dab
Instruction Fuzzy Hash: 3B21C232B0868996EB29CF60D5553EA73A2F788B81F405131DAAD87744CF3EE454C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C294, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F3C2D5

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 57102eb5d20e823e1519ba91753b0142f498755b6d63a9952598f5a4c74cc382
Instruction ID: 025e68705d5396d409cce190b0db2b15fac7a7f37207eb1a8fc395881af5ae77
Opcode Fuzzy Hash: 57102eb5d20e823e1519ba91753b0142f498755b6d63a9952598f5a4c74cc382
Instruction Fuzzy Hash: 7311EB33A4868F49EB326F75D4613BD1352EB44785F440031DBEEC7686CE2EE546820A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C6EC, Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(?,?,00000140,00007FF6C6F3C8BE,?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C73C

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 92816945e2fec6512b4728e887fd2165526d1921799207029cb566ac91c026f9
Instruction ID: bc0bdbb0e857971f3b456679bfec19a6f80fd26b5818219b05682813f48be494
Opcode Fuzzy Hash: 92816945e2fec6512b4728e887fd2165526d1921799207029cb566ac91c026f9
Instruction Fuzzy Hash: EB118272A4860D8AFB1A9F31C0253793292FB54B4AF044435CAAD83285CF7DD5A4868A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3C780, Relevance: 1.5, APIs: 1, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(?,?,00000140,00007FF6C6F3C886,?,?,?,?,00000000,00007FF6C6F34FD8), ref: 00007FF6C6F3C7B5

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: c5fb755275880c70d477dd755342e0c44e9ff4b6ba81483ce6298fa39fd63029
Instruction ID: 8f8ab6c3b3a48b1f46078a7f023bd99bfa5b322141f56db32220260e9511d5a5
Opcode Fuzzy Hash: c5fb755275880c70d477dd755342e0c44e9ff4b6ba81483ce6298fa39fd63029
Instruction Fuzzy Hash: FDF0F462E4890E4AF7168E31D4353B92393AB80B06F188031CAAD832C6CF7ED591820A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F400D8, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F35898: _getptd.LIBCMT ref: 00007FF6C6F358AE

GetLocaleInfoW.KERNEL32 ref: 00007FF6C6F40108

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale_getptd
String ID:
API String ID: 3731964398-0
Opcode ID: eb61ac9f7c34bb9e87256369d4af9d7af7afb46eff3103d38e234148170a4c4d
Instruction ID: 1af602ee9e473ceb5e348c798bb0bfe139398ab8159dc9b27ba2da71cfb1d7e8
Opcode Fuzzy Hash: eb61ac9f7c34bb9e87256369d4af9d7af7afb46eff3103d38e234148170a4c4d
Instruction Fuzzy Hash: DDF0B422A1868483D7118B05F40406AA761F7C4BE0F584220EAAD57B99CE6CC8418B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F42AA0, Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 00007FF6C6F42AC8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bdbe706b0a2bb25a261b57c8222e226aa5ff7f36dce98d23560cfd8266eaf711
Instruction ID: afdc6ecc68c0253a72c24fb8bde2421e857268e0c9274c73e818682555348a37
Opcode Fuzzy Hash: bdbe706b0a2bb25a261b57c8222e226aa5ff7f36dce98d23560cfd8266eaf711
Instruction Fuzzy Hash: 51E06C61B1C58581F6319B10D51127A2752EF58759F800231D9ED87A95DE6DD1418704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F36F18, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F36F23

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57a8ea4ea7cf2b3958af0f0628e86b4596a0c983b14863412ee4e1df305efdd6
Instruction ID: 6c050adc1998ee5cc92abcd1f36a787d1541b8621c8abcdb1f17f5da22754cf0
Opcode Fuzzy Hash: 57a8ea4ea7cf2b3958af0f0628e86b4596a0c983b14863412ee4e1df305efdd6
Instruction Fuzzy Hash: 91B09210E2A50AC1D605AF21DD8606412A16B68312FC00430C26DC3520EEAD959A8718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F42070, Relevance: .2, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1663c57a7fe0ae7ccf6371ea137dc6896b28bfae64ece0ef38731e82d03764d
Instruction ID: 39fdff3195257bb06e3c900f175ed0b23261e0bc67528d8bcdc0d8718bc9b6af
Opcode Fuzzy Hash: f1663c57a7fe0ae7ccf6371ea137dc6896b28bfae64ece0ef38731e82d03764d
Instruction Fuzzy Hash: 6771E272F1C14A4BE31D8F18DA4167866D7E7E4306F489036DA9DCBF94EE7AEA008604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3A6F4, Relevance: 53.8, APIs: 43, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F3A709

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

free.LIBCMT ref: 00007FF6C6F3A712
free.LIBCMT ref: 00007FF6C6F3A71B
free.LIBCMT ref: 00007FF6C6F3A724
free.LIBCMT ref: 00007FF6C6F3A72D
free.LIBCMT ref: 00007FF6C6F3A736
free.LIBCMT ref: 00007FF6C6F3A73E
free.LIBCMT ref: 00007FF6C6F3A747
free.LIBCMT ref: 00007FF6C6F3A750
free.LIBCMT ref: 00007FF6C6F3A759
free.LIBCMT ref: 00007FF6C6F3A762
free.LIBCMT ref: 00007FF6C6F3A76B
free.LIBCMT ref: 00007FF6C6F3A774
free.LIBCMT ref: 00007FF6C6F3A77D
free.LIBCMT ref: 00007FF6C6F3A786
free.LIBCMT ref: 00007FF6C6F3A78F
free.LIBCMT ref: 00007FF6C6F3A79B
free.LIBCMT ref: 00007FF6C6F3A7A7
free.LIBCMT ref: 00007FF6C6F3A7B3
free.LIBCMT ref: 00007FF6C6F3A7BF
free.LIBCMT ref: 00007FF6C6F3A7CB
free.LIBCMT ref: 00007FF6C6F3A7D7
free.LIBCMT ref: 00007FF6C6F3A7E3
free.LIBCMT ref: 00007FF6C6F3A7EF
free.LIBCMT ref: 00007FF6C6F3A7FB
free.LIBCMT ref: 00007FF6C6F3A807
free.LIBCMT ref: 00007FF6C6F3A813
free.LIBCMT ref: 00007FF6C6F3A81F
free.LIBCMT ref: 00007FF6C6F3A82B
free.LIBCMT ref: 00007FF6C6F3A837
free.LIBCMT ref: 00007FF6C6F3A843
free.LIBCMT ref: 00007FF6C6F3A84F
free.LIBCMT ref: 00007FF6C6F3A85B
free.LIBCMT ref: 00007FF6C6F3A867
free.LIBCMT ref: 00007FF6C6F3A873
free.LIBCMT ref: 00007FF6C6F3A87F
free.LIBCMT ref: 00007FF6C6F3A88B
free.LIBCMT ref: 00007FF6C6F3A897
free.LIBCMT ref: 00007FF6C6F3A8A3
free.LIBCMT ref: 00007FF6C6F3A8AF
free.LIBCMT ref: 00007FF6C6F3A8BB
free.LIBCMT ref: 00007FF6C6F3A8C7
free.LIBCMT ref: 00007FF6C6F3A8D3

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: ceb0a351ede683f57604ec992d06b2fd3cc5d871eff94823fad2b1ca851a9998
Instruction ID: 7e8e4470c1c8ef0d39af8f3e2782f4eedfc7d1c774d638436aaf4237c57e1bb5
Opcode Fuzzy Hash: ceb0a351ede683f57604ec992d06b2fd3cc5d871eff94823fad2b1ca851a9998
Instruction Fuzzy Hash: 1741D627A2448990EE42FF31D4512BC1326AFC5F47F445431FBADEB1A7CE55D8419316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F45B80, Relevance: 30.5, APIs: 20, Instructions: 485COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F45BB3
_errno.LIBCMT ref: 00007FF6C6F45BBC
__doserrno.LIBCMT ref: 00007FF6C6F45C16
_errno.LIBCMT ref: 00007FF6C6F45C1D

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: a96054e113d08fdb33e306ec23310197f431bbd3992d752558d6e1544d851584
Instruction ID: a06e2dc96ef015afdf1a858038fe17ad0352b538aca48a1053ac829764149f92
Opcode Fuzzy Hash: a96054e113d08fdb33e306ec23310197f431bbd3992d752558d6e1544d851584
Instruction Fuzzy Hash: A7221822A0D6CA81EB63AF14D5842BC2A93BF41755F544531DAFE83FC5CEAEE445C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F37E68, Relevance: 18.1, APIs: 12, Instructions: 82COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F37E87

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

free.LIBCMT ref: 00007FF6C6F37E95
free.LIBCMT ref: 00007FF6C6F37EA3
free.LIBCMT ref: 00007FF6C6F37EB1
free.LIBCMT ref: 00007FF6C6F37EBF
free.LIBCMT ref: 00007FF6C6F37ECD
free.LIBCMT ref: 00007FF6C6F37EDE
free.LIBCMT ref: 00007FF6C6F37EF6
_lock.LIBCMT ref: 00007FF6C6F37F00
free.LIBCMT ref: 00007FF6C6F37F2E
_lock.LIBCMT ref: 00007FF6C6F37F43
free.LIBCMT ref: 00007FF6C6F37F8D

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$_lock$ErrorFreeHeapLast_errno
String ID:
API String ID: 1575098132-0
Opcode ID: f8afcf7035aa9411a6b822ef96bd34a7bdc5dd0887c6c2965ef470a85a2fd555
Instruction ID: c6619ffbffdcb2622e7c2ab391d45f3cf9243936b65571de91d501a4a14a86cc
Opcode Fuzzy Hash: f8afcf7035aa9411a6b822ef96bd34a7bdc5dd0887c6c2965ef470a85a2fd555
Instruction Fuzzy Hash: 40318F16B0A64A45FE56EF6190513BC2357AF81B43F441530EAAEC76C6CF1EE840935E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3B028, Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6C6F3B14F

Part of subcall function 00007FF6C6F38ABC: GetLastError.KERNEL32 ref: 00007FF6C6F38B25
Part of subcall function 00007FF6C6F38ABC: free.LIBCMT ref: 00007FF6C6F38BB1

free.LIBCMT ref: 00007FF6C6F3B318
free.LIBCMT ref: 00007FF6C6F3B328
free.LIBCMT ref: 00007FF6C6F3B338
free.LIBCMT ref: 00007FF6C6F3B344
free.LIBCMT ref: 00007FF6C6F3B399
free.LIBCMT ref: 00007FF6C6F3B3A1
free.LIBCMT ref: 00007FF6C6F3B3A9
free.LIBCMT ref: 00007FF6C6F3B3B1
free.LIBCMT ref: 00007FF6C6F3B3BB

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: 37fd411cafc51dd6ae77dc9437cce5f96e4dce761e921224bd1d49a429c84a87
Instruction ID: a04c2b0edb27876e5eb1b487f9f98011bf9ab5add3268d52191419f9815ede40
Opcode Fuzzy Hash: 37fd411cafc51dd6ae77dc9437cce5f96e4dce761e921224bd1d49a429c84a87
Instruction Fuzzy Hash: 78B1DE32A086D686EB22CF25E4502AD77A6FB88B45F844136EBECC7781DF3AD441C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F42AF4, Relevance: 15.2, APIs: 10, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42B4A
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42B69
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42C0E
malloc.LIBCMT ref: 00007FF6C6F42C25
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42C6D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42CA8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42CE4
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42D24
free.LIBCMT ref: 00007FF6C6F42D32
free.LIBCMT ref: 00007FF6C6F42D54

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ByteCharMultiWide$Infofree$malloc
String ID:
API String ID: 1309074677-0
Opcode ID: 722f9fd91d5f463c635a3d5f6fcd1896b878e897b4ff861ca9f62c2f82444a75
Instruction ID: 2f27e0851bed24aaa27929d24a880a6fc7b0a7efbe28c4b4dee0cdc2ef106e83
Opcode Fuzzy Hash: 722f9fd91d5f463c635a3d5f6fcd1896b878e897b4ff861ca9f62c2f82444a75
Instruction Fuzzy Hash: F0611632A0C68A86EB228F15994017962E7FF447A6F144631DABDC7FD4CFBED5818308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F35AEC, Relevance: 15.1, APIs: 10, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F35B20
_errno.LIBCMT ref: 00007FF6C6F35B2B
_errno.LIBCMT ref: 00007FF6C6F35B60
GetFullPathNameW.KERNEL32(?,?,?,?,00000000,?,?,00000001,?,00007FF6C6F35C8B,?,?,?,00007FF6C6F3D59A), ref: 00007FF6C6F35BC1
_errno.LIBCMT ref: 00007FF6C6F35BDA

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$FullNamePath__doserrno
String ID:
API String ID: 46980266-0
Opcode ID: 7d2cc5d7812354785611953985e6148ff6c9e9de23567e27ea527d31c8c91bd5
Instruction ID: b38d64b76e446bb0209d409e0310eb6b47655010f7797aa70d367f5b77a992aa
Opcode Fuzzy Hash: 7d2cc5d7812354785611953985e6148ff6c9e9de23567e27ea527d31c8c91bd5
Instruction Fuzzy Hash: 7B418012A1824E81FA635F60D44127D6293BFC4756F545031EAEECB795DE3EE840C71E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3D468, Relevance: 15.1, APIs: 10, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000001,00000000,00007FF6C6F35FB1), ref: 00007FF6C6F3D4A9
GetLastError.KERNEL32(?,?,?,00000001,00000000,00007FF6C6F35FB1), ref: 00007FF6C6F3D4B4
_errno.LIBCMT ref: 00007FF6C6F3D4E3
calloc.LIBCMT ref: 00007FF6C6F3D4F8
_errno.LIBCMT ref: 00007FF6C6F3D505
_errno.LIBCMT ref: 00007FF6C6F3D517
GetFullPathNameW.KERNEL32(?,?,?,00000001,00000000,00007FF6C6F35FB1), ref: 00007FF6C6F3D548
free.LIBCMT ref: 00007FF6C6F3D55D
_errno.LIBCMT ref: 00007FF6C6F3D562
free.LIBCMT ref: 00007FF6C6F3D583

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$FullNamePathfree$ErrorLastcalloc
String ID:
API String ID: 1092050825-0
Opcode ID: 60149821ea5855547ab7a057b4be9b314ba054b9493587547247c09cee0ad84a
Instruction ID: 23c9d210709a09b436e0a91ed586447c5b39ba8084a7ae5d805737550cc37856
Opcode Fuzzy Hash: 60149821ea5855547ab7a057b4be9b314ba054b9493587547247c09cee0ad84a
Instruction Fuzzy Hash: 8331B815E1925E81FA626F69E40017D62C3AF84B96F144031DAFEC37C5CD7EA441922F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F346B4, Relevance: 13.8, APIs: 11, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F34700

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3ABEE
Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3AC00
Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3AC12
Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3AC24
Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3AC36
Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3AC48
Part of subcall function 00007FF6C6F3ABD0: free.LIBCMT ref: 00007FF6C6F3AC5A

free.LIBCMT ref: 00007FF6C6F34722
free.LIBCMT ref: 00007FF6C6F3473A
free.LIBCMT ref: 00007FF6C6F34746
free.LIBCMT ref: 00007FF6C6F3476A
free.LIBCMT ref: 00007FF6C6F3477E
free.LIBCMT ref: 00007FF6C6F3478D
free.LIBCMT ref: 00007FF6C6F34799
free.LIBCMT ref: 00007FF6C6F347C6
free.LIBCMT ref: 00007FF6C6F347EE
free.LIBCMT ref: 00007FF6C6F34808

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 697ee04297b807d0f0c1a743fefd7eb6bbff9d3d426448245321a28f7307c1f7
Instruction ID: 21e87a0d347bcabd17c2654646928ff955ef733530b109ae7a88b4f771c759b1
Opcode Fuzzy Hash: 697ee04297b807d0f0c1a743fefd7eb6bbff9d3d426448245321a28f7307c1f7
Instruction Fuzzy Hash: F6414036A1A58A84EF56DF21C4503BC2396EF45B47F040431EAEDCB6D5CF6EA8818316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3CBF8, Relevance: 13.7, APIs: 9, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,00000000,0000000A,00000008,00007FF6C6F3CECA), ref: 00007FF6C6F3CC58
GetLastError.KERNEL32(?,?,?,?,00000000,0000000A,00000008,00007FF6C6F3CECA), ref: 00007FF6C6F3CC6A
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,0000000A,00000008,00007FF6C6F3CECA), ref: 00007FF6C6F3CCCA
malloc.LIBCMT ref: 00007FF6C6F3CD36
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,0000000A,00000008,00007FF6C6F3CECA), ref: 00007FF6C6F3CD80
GetStringTypeW.KERNEL32(?,?,?,?,00000000,0000000A,00000008,00007FF6C6F3CECA), ref: 00007FF6C6F3CD97
free.LIBCMT ref: 00007FF6C6F3CDA8
GetStringTypeA.KERNEL32(?,?,?,?,00000000,0000000A,00000008,00007FF6C6F3CECA), ref: 00007FF6C6F3CE25
free.LIBCMT ref: 00007FF6C6F3CE35

Part of subcall function 00007FF6C6F42AF4: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42B4A
Part of subcall function 00007FF6C6F42AF4: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42B69
Part of subcall function 00007FF6C6F42AF4: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42C6D
Part of subcall function 00007FF6C6F42AF4: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FF6C6F42CA8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Infofree$ErrorLastmalloc
String ID:
API String ID: 3804003340-0
Opcode ID: ca3837d9676ca9c6949ec9740481654c6b0cc80d705b1a1472469707800d0257
Instruction ID: a9cb31b2f3a8fe66fc22f093dc8b7dbe21ed3809e14f8e8c7d5ddd17de913150
Opcode Fuzzy Hash: ca3837d9676ca9c6949ec9740481654c6b0cc80d705b1a1472469707800d0257
Instruction Fuzzy Hash: 0E61E432B4868A86EB229F25D5504783B93FB44BE5B140235EEBD93BD4CE7EE8418345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F332F0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF6C6F33376
_errno.LIBCMT ref: 00007FF6C6F33396
realloc.LIBCMT ref: 00007FF6C6F333C0

Strings

%s%c%s, xrefs: 00007FF6C6F334D8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errnomallocrealloc
String ID: %s%c%s
API String ID: 1851400379-2756932909
Opcode ID: 68a06ff830aed0209863df8710137a73456ab97b94e79bc4a37cef9557a98986
Instruction ID: 6e4faad80308ef069862a25f9f6141414362880a07f676d0ea7364bd72323207
Opcode Fuzzy Hash: 68a06ff830aed0209863df8710137a73456ab97b94e79bc4a37cef9557a98986
Instruction Fuzzy Hash: 9861182260DAC985EA71CF19E4813AEB3A1FB84781F104132EBDD87BA9DF6DD444CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F410AC, Relevance: 12.1, APIs: 8, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F410D5
_errno.LIBCMT ref: 00007FF6C6F410DE
__doserrno.LIBCMT ref: 00007FF6C6F4112D
_errno.LIBCMT ref: 00007FF6C6F41134

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 93c1dc8c4c97c4ab3ac1c81edadba6cb88abea897e6b1b3bee3be5b6a9d37608
Instruction ID: b477ca832c981a6dd6f87286a9636d2c19b977ff07b240ebba3e921131614bc9
Opcode Fuzzy Hash: 93c1dc8c4c97c4ab3ac1c81edadba6cb88abea897e6b1b3bee3be5b6a9d37608
Instruction Fuzzy Hash: 1C312432A1868A81E7139F25ED4123D3656BFC0761F214630EABD87BD2CEBED442971C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F4138C, Relevance: 12.1, APIs: 8, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F413B5
_errno.LIBCMT ref: 00007FF6C6F413BE
__doserrno.LIBCMT ref: 00007FF6C6F4140E
_errno.LIBCMT ref: 00007FF6C6F41415

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: d2413592a799a71a90b66b24d24142031a5c85a30999cea13f508ec6782928b4
Instruction ID: affc2d1ad0620f507dea18f93fc83c17026185b4be4d0879a7eaff1776b9f6d5
Opcode Fuzzy Hash: d2413592a799a71a90b66b24d24142031a5c85a30999cea13f508ec6782928b4
Instruction Fuzzy Hash: 78312432A0868A81E713DF21E94123D2512BB817B5F214331EEBD87BD2CE7ED4429718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3DA20, Relevance: 12.1, APIs: 8, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F3DA3F
_errno.LIBCMT ref: 00007FF6C6F3DA48
__doserrno.LIBCMT ref: 00007FF6C6F3DA98
_errno.LIBCMT ref: 00007FF6C6F3DA9F

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 23574dfab6ab80e158a865db2a714f61726ff419ec4cb443f513d51c8c3cde67
Instruction ID: 3ee373daaf8179923e066a704198122af6f76d2fe02439dfe68426639c23148a
Opcode Fuzzy Hash: 23574dfab6ab80e158a865db2a714f61726ff419ec4cb443f513d51c8c3cde67
Instruction Fuzzy Hash: 1531A43290868A85E7139F35E94113D2592BF80721F548635EABD87BD2CE7ED4418729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F458CC, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F35898: _getptd.LIBCMT ref: 00007FF6C6F358AE

_errno.LIBCMT ref: 00007FF6C6F4590C
_errno.LIBCMT ref: 00007FF6C6F45AC6

Strings

0, xrefs: 00007FF6C6F45A05
0, xrefs: 00007FF6C6F459D7
-, xrefs: 00007FF6C6F4599E
+, xrefs: 00007FF6C6F459A9

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$_getptd
String ID: +$-$0$0
API String ID: 3432092939-699404926
Opcode ID: 10033543220eb3e4309f04d8df9f6409899ccd7a08e5ec7c320dfe56c4eb2f84
Instruction ID: 0286b523e0ca2029b53c555a7638c92c15e3d4c32af4360ae54ddf43fc22fe6d
Opcode Fuzzy Hash: 10033543220eb3e4309f04d8df9f6409899ccd7a08e5ec7c320dfe56c4eb2f84
Instruction Fuzzy Hash: B5712722D1C68E45FBB76E15C64537A2693AF40766F154132CAFE83AC4DEAFE840C319

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F411E0, Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F411F9
_errno.LIBCMT ref: 00007FF6C6F41246

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 23ef31ce8a75920ceaac06aef46eb4bafbb2e813bad55bacb939581e1d39336a
Instruction ID: abd2b7c92ef5a58e995ea6d57b1deae1ec997f803f682e6f8d0603b9319b2d3a
Opcode Fuzzy Hash: 23ef31ce8a75920ceaac06aef46eb4bafbb2e813bad55bacb939581e1d39336a
Instruction Fuzzy Hash: 8E31D822F1868A41F7239F65DA4537D26536F82362F144238E6BDC7AD2CEBEE500961C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F38288, Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF6C6F382AF

Part of subcall function 00007FF6C6F36F30: GetModuleFileNameA.KERNEL32(?,?,?,?,00000000,00007FF6C6F3718C,?,?,?,?,00007FF6C6F33A9D,?,?,00000000,00007FF6C6F39A18), ref: 00007FF6C6F36FF3

Part of subcall function 00007FF6C6F33B8C: ExitProcess.KERNEL32 ref: 00007FF6C6F33B9B

Part of subcall function 00007FF6C6F399F4: malloc.LIBCMT ref: 00007FF6C6F39A13
Part of subcall function 00007FF6C6F399F4: Sleep.KERNEL32(?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393,?,?,?,?,?,?,00000000,00007FF6C6F37E18), ref: 00007FF6C6F39A2A

_errno.LIBCMT ref: 00007FF6C6F382F1
_lock.LIBCMT ref: 00007FF6C6F38305
free.LIBCMT ref: 00007FF6C6F38327
_errno.LIBCMT ref: 00007FF6C6F3832C
LeaveCriticalSection.KERNEL32(?,?,?,00007FF6C6F38393,?,?,?,?,?,?,00000000,00007FF6C6F37E18,?,?,?,00007FF6C6F37E4F), ref: 00007FF6C6F38352

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$CriticalExitFileLeaveModuleNameProcessSectionSleep_lockfreemalloc
String ID:
API String ID: 1024173049-0
Opcode ID: 4d04a333a7ee11d257e8f783972cab6ea25ea148697972bacd9eac67d5f7f4e2
Instruction ID: c6754922bc2e1e69cb34c101c0bab345a84ea06aa490583587d7bbbc03cb79da
Opcode Fuzzy Hash: 4d04a333a7ee11d257e8f783972cab6ea25ea148697972bacd9eac67d5f7f4e2
Instruction Fuzzy Hash: 45217C21A1D68E82F656AF10E51137D6296AF84792F045434E6FEC77C2CF7EE841831A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3BAC0, Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6C6F3BADF

Part of subcall function 00007FF6C6F3B6FC: _getptd.LIBCMT ref: 00007FF6C6F3B706

Part of subcall function 00007FF6C6F3B7B8: GetOEMCP.KERNEL32 ref: 00007FF6C6F3B7E2

Part of subcall function 00007FF6C6F399F4: malloc.LIBCMT ref: 00007FF6C6F39A13
Part of subcall function 00007FF6C6F399F4: Sleep.KERNEL32(?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393,?,?,?,?,?,?,00000000,00007FF6C6F37E18), ref: 00007FF6C6F39A2A

free.LIBCMT ref: 00007FF6C6F3BB6B

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

_lock.LIBCMT ref: 00007FF6C6F3BBA3
free.LIBCMT ref: 00007FF6C6F3BC53
free.LIBCMT ref: 00007FF6C6F3BC83
_errno.LIBCMT ref: 00007FF6C6F3BC88

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 2878544890-0
Opcode ID: 6a3b26f126ec00173afdbdec6d464518cb690c4548c0b4f3b0f3307c7a3451bb
Instruction ID: 2799e63eb8f241c3c7c68240fe7aee8ee05423665f36fdf96c7a1e77074cef55
Opcode Fuzzy Hash: 6a3b26f126ec00173afdbdec6d464518cb690c4548c0b4f3b0f3307c7a3451bb
Instruction Fuzzy Hash: AC51F531A0868A86E7229F21A450278B793FF90796F144236D6FDC73A5CF7EE401C71A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F455A4, Relevance: 9.1, APIs: 6, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

__initconout.LIBCMT ref: 00007FF6C6F455D2

Part of subcall function 00007FF6C6F467B4: CreateFileA.KERNEL32 ref: 00007FF6C6F467DD

WriteConsoleW.KERNEL32 ref: 00007FF6C6F455FE
GetLastError.KERNEL32 ref: 00007FF6C6F45619
GetConsoleOutputCP.KERNEL32(?,?,?,?,00007FF6C6F40C74,?,00000000,?,?,00000000,00000000,?,00007FF6C6F41178), ref: 00007FF6C6F4562B
WideCharToMultiByte.KERNEL32 ref: 00007FF6C6F4565E
WriteConsoleA.KERNEL32 ref: 00007FF6C6F45684

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide__initconout
String ID:
API String ID: 2210154019-0
Opcode ID: f37ada550cce15c27b79f0c66dcbd3cf8b066d4035b34aa65d438b3702186596
Instruction ID: 88efc8ad8720ac99d3196c8680a79f5186c93f524ff919ce7708bca650894a3a
Opcode Fuzzy Hash: f37ada550cce15c27b79f0c66dcbd3cf8b066d4035b34aa65d438b3702186596
Instruction Fuzzy Hash: C0312C21A1894A82FB229F20E51437972A2FF86776F500335E6BD87DD4CFBED5448B08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F37DC0, Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F37DCA
FlsGetValue.KERNEL32(?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F37DD8
SetLastError.KERNEL32(?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F37E30

Part of subcall function 00007FF6C6F39A60: Sleep.KERNEL32(?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F39AA5

FlsSetValue.KERNEL32(?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F37E04
free.LIBCMT ref: 00007FF6C6F37E27

Part of subcall function 00007FF6C6F37D0C: _lock.LIBCMT ref: 00007FF6C6F37D5C
Part of subcall function 00007FF6C6F37D0C: _lock.LIBCMT ref: 00007FF6C6F37D7C

GetCurrentThreadId.KERNEL32 ref: 00007FF6C6F37E18

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: feb53d8bade9d96a4b643fdf61d47b42e145bae36863b5c285b26daf9c9d1e9f
Instruction ID: 9360c11d77cf23c4c2257ef5a9c2d1d2d810e261536f9d0810680382d45700b1
Opcode Fuzzy Hash: feb53d8bade9d96a4b643fdf61d47b42e145bae36863b5c285b26daf9c9d1e9f
Instruction Fuzzy Hash: 1D018825E0874E82FF07AF7595540792293AF88B62F184234C9FD837C1DE3DE844C219

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3ABD0, Relevance: 8.8, APIs: 7, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F3ABEE

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

free.LIBCMT ref: 00007FF6C6F3AC00
free.LIBCMT ref: 00007FF6C6F3AC12
free.LIBCMT ref: 00007FF6C6F3AC24
free.LIBCMT ref: 00007FF6C6F3AC36
free.LIBCMT ref: 00007FF6C6F3AC48
free.LIBCMT ref: 00007FF6C6F3AC5A

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 3970a2f4dd8e2bc9e63fd22e76b517ac89f75ecef42314953e98a84ac307ffa1
Instruction ID: 64bed277fad0267f52ebbe0bd5f3c7d0e768c536f33ee8f6b634d4c87e63d8c1
Opcode Fuzzy Hash: 3970a2f4dd8e2bc9e63fd22e76b517ac89f75ecef42314953e98a84ac307ffa1
Instruction Fuzzy Hash: 2D011E13A1844E92FE57DF62D5610382367AF80743F441431E5AEC7992CEAEF8C0932A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3AC68, Relevance: 7.7, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F3ACE8
free.LIBCMT ref: 00007FF6C6F3AD0F
free.LIBCMT ref: 00007FF6C6F3AFE0
free.LIBCMT ref: 00007FF6C6F3AFEC

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: bd5a41a343740c7bdf7b0b579bedc9914df45a067c63497103451b1e68b6a53e
Instruction ID: 9ef6a37b034a62cd0017bc04236481819a3860e5bc73b74f4eb02565d02e1d45
Opcode Fuzzy Hash: bd5a41a343740c7bdf7b0b579bedc9914df45a067c63497103451b1e68b6a53e
Instruction Fuzzy Hash: 13B1B532B18B8985EB22CF62E0406A977A2FB85745F404135EEEE83785DF7DD105C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F37968, Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 00007FF6C6F3798D

Part of subcall function 00007FF6C6F39A60: Sleep.KERNEL32(?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F39AA5

GetFileType.KERNEL32 ref: 00007FF6C6F37B0A

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: ce6658298909e3b97387a800a2ac03f89814e1ba9e231f68ba9387809d5c49b4
Instruction ID: ff64b9af3b9554258362861004e46ec16b4eaf40236b02e67cc20ffac4d25bba
Opcode Fuzzy Hash: ce6658298909e3b97387a800a2ac03f89814e1ba9e231f68ba9387809d5c49b4
Instruction Fuzzy Hash: D6919321A0868A81E7128F24D48863836A6FB05776F258735C6FD877D5DF7EE842C30E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F31030, Relevance: 7.6, APIs: 6, Instructions: 78COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF6C6F3104B

Part of subcall function 00007FF6C6F33A68: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F33A98
Part of subcall function 00007FF6C6F33A68: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393), ref: 00007FF6C6F33ABD
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AE1
Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33AEC

MultiByteToWideChar.KERNEL32 ref: 00007FF6C6F310AB
malloc.LIBCMT ref: 00007FF6C6F310C2

Part of subcall function 00007FF6C6F33A68: _errno.LIBCMT ref: 00007FF6C6F33B01

MultiByteToWideChar.KERNEL32 ref: 00007FF6C6F310FD
free.LIBCMT ref: 00007FF6C6F3116C
free.LIBCMT ref: 00007FF6C6F31178

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno$ByteCharMultiWidefreemalloc$AllocateHeap
String ID:
API String ID: 4228965069-0
Opcode ID: fea99d41eba0fec2b298fc5c1ee7f8ada5eed0359a22aad72f19de039a4819a5
Instruction ID: dab2cacc1f81106334d6cdc9948724c6eb1392588e4fc6906c316ad3ec66ba7c
Opcode Fuzzy Hash: fea99d41eba0fec2b298fc5c1ee7f8ada5eed0359a22aad72f19de039a4819a5
Instruction Fuzzy Hash: 8341E572629A8487DB50DF19E48162EB7A1FB88B95F101126FADE87B68DF7DD0408F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F385B0, Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF6C6F386C1,?,?,?,?,00007FF6C6F33C82,?,?,00000001,00007FF6C6F339AB), ref: 00007FF6C6F385D9
DecodePointer.KERNEL32(?,?,?,00007FF6C6F386C1,?,?,?,?,00007FF6C6F33C82,?,?,00000001,00007FF6C6F339AB), ref: 00007FF6C6F385E8

Part of subcall function 00007FF6C6F3FEDC: _errno.LIBCMT ref: 00007FF6C6F3FEE5

EncodePointer.KERNEL32(?,?,?,00007FF6C6F386C1,?,?,?,?,00007FF6C6F33C82,?,?,00000001,00007FF6C6F339AB), ref: 00007FF6C6F38665

Part of subcall function 00007FF6C6F39AE4: realloc.LIBCMT ref: 00007FF6C6F39B0F
Part of subcall function 00007FF6C6F39AE4: Sleep.KERNEL32(?,?,00000000,00007FF6C6F38655,?,?,?,00007FF6C6F386C1,?,?,?,?,00007FF6C6F33C82,?,?,00000001), ref: 00007FF6C6F39B2B

EncodePointer.KERNEL32(?,?,?,00007FF6C6F386C1,?,?,?,?,00007FF6C6F33C82,?,?,00000001,00007FF6C6F339AB), ref: 00007FF6C6F38674
EncodePointer.KERNEL32(?,?,?,00007FF6C6F386C1,?,?,?,?,00007FF6C6F33C82,?,?,00000001,00007FF6C6F339AB), ref: 00007FF6C6F38680

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errnorealloc
String ID:
API String ID: 1310268301-0
Opcode ID: 4d22ffa4449150b0b015ac8b093a21fede078953f29259b97c946d1038f5740b
Instruction ID: 2f2f001b83070558d36d34882a0319dbb53b04b85d7409062a74cc583447d4aa
Opcode Fuzzy Hash: 4d22ffa4449150b0b015ac8b093a21fede078953f29259b97c946d1038f5740b
Instruction Fuzzy Hash: FA217711F1A68E41EA12AF11E5440796393BF857C2B444835DAEDCB796DE7EF441830E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3D158, Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF6C6F3D192
free.LIBCMT ref: 00007FF6C6F3D207

Part of subcall function 00007FF6C6F39A60: Sleep.KERNEL32(?,?,00000000,00007FF6C6F37DF3,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F39AA5

_errno.LIBCMT ref: 00007FF6C6F3D1B7
GetCurrentDirectoryA.KERNEL32 ref: 00007FF6C6F3D1D4
_errno.LIBCMT ref: 00007FF6C6F3D1F5

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: CurrentDirectory_errno$Sleepfree
String ID:
API String ID: 3152075348-0
Opcode ID: 9f796aca54aaff8974af517f3cdb31ed6d199b2d69ea6536cfd613a4bcf2111e
Instruction ID: ea7bba58dd1067b5e09f185af57af9db8abd4e76ad31bd2813c07a5d0f8a04f4
Opcode Fuzzy Hash: 9f796aca54aaff8974af517f3cdb31ed6d199b2d69ea6536cfd613a4bcf2111e
Instruction Fuzzy Hash: 4821C136A0878E86F6229F10D5402BE33A2EB48B81F414534DEAC87745DF7EE9448769

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F43BEC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F43C5D
_errno.LIBCMT ref: 00007FF6C6F43C6B
_errno.LIBCMT ref: 00007FF6C6F43CAC

Strings

P, xrefs: 00007FF6C6F43CBB

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _errno
String ID: P
API String ID: 2918714741-3110715001
Opcode ID: bc9f5d428828e86c1e118f2ef8fc997163de7334b4ed4da3adfd847a41bc8a10
Instruction ID: 24e411e5397123dc9aa415ef28ebeab6183d7b255c5e4885ee078355dbf8c8f3
Opcode Fuzzy Hash: bc9f5d428828e86c1e118f2ef8fc997163de7334b4ed4da3adfd847a41bc8a10
Instruction Fuzzy Hash: 1D21E863A0C7AA41FA578E16960027962D2AF557E1F084A30DFFC87FC5DEFEA4508708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F33B50, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FF6C6F33B99,?,?,00000028,00007FF6C6F33AB1,?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9), ref: 00007FF6C6F33B5F
GetProcAddress.KERNEL32(?,?,000000FF,00007FF6C6F33B99,?,?,00000028,00007FF6C6F33AB1,?,?,00000000,00007FF6C6F39A18,?,?,00000000,00007FF6C6F382E9), ref: 00007FF6C6F33B74

Strings

CorExitProcess, xrefs: 00007FF6C6F33B6A
mscoree.dll, xrefs: 00007FF6C6F33B58

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 314d6f858e88a6480d3f4ef31ac68a81fb78dd61469ae465a1ffa7c973a3a161
Instruction ID: 4245468b718b48cf4c9169faba8c1129208241d4f15cbef873cfd3daf05cab70
Opcode Fuzzy Hash: 314d6f858e88a6480d3f4ef31ac68a81fb78dd61469ae465a1ffa7c973a3a161
Instruction Fuzzy Hash: 40E01251F1A64E81FE1BEF50A99523823926F48752B48143CC5BE8B790DEADE548C318

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F34CA8, Relevance: 6.4, APIs: 5, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F399F4: malloc.LIBCMT ref: 00007FF6C6F39A13
Part of subcall function 00007FF6C6F399F4: Sleep.KERNEL32(?,?,00000000,00007FF6C6F382E9,?,?,?,00007FF6C6F38393,?,?,?,?,?,?,00000000,00007FF6C6F37E18), ref: 00007FF6C6F39A2A

Part of subcall function 00007FF6C6F3BCE0: _errno.LIBCMT ref: 00007FF6C6F3BCFB

free.LIBCMT ref: 00007FF6C6F34DF1
free.LIBCMT ref: 00007FF6C6F34E0D

Part of subcall function 00007FF6C6F383BC: RtlCaptureContext.KERNEL32 ref: 00007FF6C6F383FB
Part of subcall function 00007FF6C6F383BC: IsDebuggerPresent.KERNEL32 ref: 00007FF6C6F38499
Part of subcall function 00007FF6C6F383BC: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384A3
Part of subcall function 00007FF6C6F383BC: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C6F384AE
Part of subcall function 00007FF6C6F383BC: GetCurrentProcess.KERNEL32 ref: 00007FF6C6F384C4
Part of subcall function 00007FF6C6F383BC: TerminateProcess.KERNEL32 ref: 00007FF6C6F384D2

free.LIBCMT ref: 00007FF6C6F34E22

Part of subcall function 00007FF6C6F33A28: HeapFree.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A3E
Part of subcall function 00007FF6C6F33A28: _errno.LIBCMT ref: 00007FF6C6F33A48
Part of subcall function 00007FF6C6F33A28: GetLastError.KERNEL32(?,?,00000000,00007FF6C6F37E2C,?,?,?,00007FF6C6F37E4F,?,?,?,00007FF6C6F3564E), ref: 00007FF6C6F33A50

free.LIBCMT ref: 00007FF6C6F34E41
free.LIBCMT ref: 00007FF6C6F34E5D

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free$ExceptionFilterProcessUnhandled_errno$CaptureContextCurrentDebuggerErrorFreeHeapLastPresentSleepTerminatemalloc
String ID:
API String ID: 2327265721-0
Opcode ID: 280b089678f42c366018b0d496c1d0d0c7e55a009609946cafb1c0c59ea9af18
Instruction ID: 5353253fcdf56d95b7ff24da4b4694cabfa7b62aebcdb8054242b847f8f12e57
Opcode Fuzzy Hash: 280b089678f42c366018b0d496c1d0d0c7e55a009609946cafb1c0c59ea9af18
Instruction Fuzzy Hash: 2851B136604A8982EB22DF25E84016D3357FB84BAAF584035DEEDC7795DE3DD881C349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F350D0, Relevance: 6.2, APIs: 4, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6C6F35102

Part of subcall function 00007FF6C6F34E90: _getptd.LIBCMT ref: 00007FF6C6F34ECA

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: _getptd
String ID:
API String ID: 3186804695-0
Opcode ID: 499d4c99a389790061ed60ce893507ab4218f50be3f7d41f4bf3cd1659de1a0e
Instruction ID: d377023d85444cbd0132c77bbd810e01b468c8e9f5f627d8da8d7a1c31bb95b3
Opcode Fuzzy Hash: 499d4c99a389790061ed60ce893507ab4218f50be3f7d41f4bf3cd1659de1a0e
Instruction Fuzzy Hash: 2681B072A1978A96DB22DF25E1803AA73A2FB84785F504135DBAD83B54DF7EE440CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F4322C, Relevance: 6.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C6F38288: _FF_MSGBANNER.LIBCMT ref: 00007FF6C6F382AF

_lock.LIBCMT ref: 00007FF6C6F4326A
_lock.LIBCMT ref: 00007FF6C6F432C3
EnterCriticalSection.KERNEL32 ref: 00007FF6C6F43302
LeaveCriticalSection.KERNEL32 ref: 00007FF6C6F43312

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: CriticalSection_lock$EnterLeave
String ID:
API String ID: 2641352136-0
Opcode ID: b97964ea8a3072e94c36babdd14444813bb812038066c4283b874c534c1602dc
Instruction ID: f6746e3df59973e3a989fd9af342a3f2e81eb89ce70d19947733400d18541410
Opcode Fuzzy Hash: b97964ea8a3072e94c36babdd14444813bb812038066c4283b874c534c1602dc
Instruction Fuzzy Hash: 2C51F623A0878A82EB128F16D5453797696FF9076AF044635DABE83BD0CFBEE440C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F33090, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Strings

.jar, xrefs: 00007FF6C6F33120
.zip, xrefs: 00007FF6C6F33135

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID:
String ID: .jar$.zip
API String ID: 0-1338640362
Opcode ID: b673739174c04974da84a1a31118cba48eb53f8125a5138903a687a7c53895e3
Instruction ID: ea7d37e55c1ac587bcc6e30fe0dfdb080cd1ea2fd64d9135d35d40b949e8e414
Opcode Fuzzy Hash: b673739174c04974da84a1a31118cba48eb53f8125a5138903a687a7c53895e3
Instruction Fuzzy Hash: D041133291CA8A81DA52EF55E44017EB3A2FBC4795F000531FADDC7B69DFAED5408B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F37CE4, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00007FF6C6F38019,?,?,00000000,00007FF6C6F33927), ref: 00007FF6C6F37CF3
DeleteCriticalSection.KERNEL32(?,?,?,00000001,?,?,?,?,?,?,?,?,?,00007FF6C6F38019), ref: 00007FF6C6F38222
free.LIBCMT ref: 00007FF6C6F3822B
DeleteCriticalSection.KERNEL32(?,?,?,00000001,?,?,?,?,?,?,?,?,?,00007FF6C6F38019), ref: 00007FF6C6F3824B

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 207915d49a2fce4c78ddee3ac80dee0017ea51e28601dd82261419c285bc90b7
Instruction ID: 480991941bee7ad510b2ccc215baa58d491e8a9001737837ff7cb869131064af
Opcode Fuzzy Hash: 207915d49a2fce4c78ddee3ac80dee0017ea51e28601dd82261419c285bc90b7
Instruction Fuzzy Hash: 73119132E09A4E82FA169F15E6501387362EF41B92F584131D6FD83B95CF7EE492C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F36290, Relevance: 6.0, APIs: 4, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6C6F362A5

Part of subcall function 00007FF6C6F384E4: DecodePointer.KERNEL32 ref: 00007FF6C6F3850B

_flush.LIBCMT ref: 00007FF6C6F362CE
_freebuf.LIBCMT ref: 00007FF6C6F362D8

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: DecodePointer_errno_flush_freebuf
String ID:
API String ID: 1889905870-0
Opcode ID: b408d893756a2f9fdde779e28b60f08a0badfaa3c05bc1974da565a8fbe3b4e9
Instruction ID: 0b9d23b96da7462775cdb71647169b5db75e5aefa90f5f7d809641b1291ed520
Opcode Fuzzy Hash: b408d893756a2f9fdde779e28b60f08a0badfaa3c05bc1974da565a8fbe3b4e9
Instruction Fuzzy Hash: 4A01F922E1864A41FF169F75941137C11939F85775F250330DABDC72D2CE3ED401520A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F430D8, Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6C6F430E1
_errno.LIBCMT ref: 00007FF6C6F430E9

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: ca73a6a791f24fecc173a2ec0f5fec00ebdd981fdf3bdbfac392b3851e4186f2
Instruction ID: 43016085e5c6edc46cca619109de4c28e8cea0d52addd412c349a295eee6487c
Opcode Fuzzy Hash: ca73a6a791f24fecc173a2ec0f5fec00ebdd981fdf3bdbfac392b3851e4186f2
Instruction Fuzzy Hash: 6301F563E1864E81FB165F15C94133C22525F90733F508731D7BE83BD1CFAE68018119

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3D238, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C6F35B1B), ref: 00007FF6C6F3D262

Strings

\, xrefs: 00007FF6C6F3D24F
:, xrefs: 00007FF6C6F3D24A

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: b9e4c16f2b95b07270ecc6f9f5b3d7bd76e356bb68da26bd8caa8756811a2de9
Instruction ID: a246f4153cd0a5d87cda4d3501e8c1d930f3714146900955957f981afe147791
Opcode Fuzzy Hash: b9e4c16f2b95b07270ecc6f9f5b3d7bd76e356bb68da26bd8caa8756811a2de9
Instruction Fuzzy Hash: 7DE06814E2C2C686FB974A10428073F16D0DBA2302F001034F6EEC3AC1CE4ED0498727

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C6F3A9C4, Relevance: 5.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6C6F3AA57
free.LIBCMT ref: 00007FF6C6F3AAEF
free.LIBCMT ref: 00007FF6C6F3AB8A
free.LIBCMT ref: 00007FF6C6F3AB96

Memory Dump Source

Source File: 00000000.00000002.219908185.00007FF6C6F31000.00000020.00020000.sdmp, Offset: 00007FF6C6F30000, based on PE: true

Associated: 00000000.00000002.219904310.00007FF6C6F30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219920875.00007FF6C6F48000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219926388.00007FF6C6F4C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219937426.00007FF6C6F50000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219945454.00007FF6C6F5D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219977661.00007FF6C6F98000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c6f30000_dbeaver.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 70334a6b60f72a026b29da2252e4a2bdba9f0307f2537794f22995d7955fb69d
Instruction ID: abd09a0a3b854fc5da203220622d667e1abd5c894d5d3630799963ee8d7078e4
Opcode Fuzzy Hash: 70334a6b60f72a026b29da2252e4a2bdba9f0307f2537794f22995d7955fb69d
Instruction Fuzzy Hash: EF51C532B0968E86EB629F12A4401B977A2FB44B86F444535DFFE87781CE7EE542C305

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report dbeaver.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: dbeaver.exe PID: 1064 Parent PID: 5552

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: dbeaver.exe PID: 1064 Parent PID: 5552 dbeaver.exeCOMMON

Execution Graph

Graph

Executed Functions

Function 00007FF6C6F35E94, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 247COMMONLIBRARYCODE

Function 00007FF6C6F35E94, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 247
COMMONLIBRARYCODE

Function 00007FF6C6F32A20, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151
fileCOMMONLIBRARYCODE

Function 00007FF6C6F41BD0, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 301
COMMONLIBRARYCODE

Function 00007FF6C6F3C7EC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 161
COMMONLIBRARYCODE

Function 00007FF6C6F46A38, Relevance: 24.3, APIs: 16, Instructions: 348
COMMON

Function 00007FF6C6F31190, Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 236
COMMONLIBRARYCODE

Function 00007FF6C6F32060, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 164
COMMONLIBRARYCODE

Function 00007FF6C6F32490, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Function 00007FF6C6F31C30, Relevance: 16.6, APIs: 6, Strings: 5, Instructions: 132
COMMONLIBRARYCODE

Function 00007FF6C6F33670, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62
windowlibraryCOMMONLIBRARYCODE

Function 00007FF6C6F470B8, Relevance: 13.8, APIs: 9, Instructions: 256
COMMONLIBRARYCODE

Function 00007FF6C6F33CDC, Relevance: 13.6, APIs: 9, Instructions: 98
COMMON

Function 00007FF6C6F3F1F4, Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 215
COMMON

Function 00007FF6C6F31670, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMONLIBRARYCODE

Function 00007FF6C6F3387C, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON