"UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger') " "CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB) CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER) CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER) INSERT INTO '%q'.'%q_node' VALUES(1, z" "CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB) " "CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx)) " "CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB) " "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ' ' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' "
"SELECT 'DELETE FROM vacuum_db.' || quote(name) || ' ' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ' 'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" "CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB) " "UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s " "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s " Sample was identified as clean by Antivirus engines Source Hybrid Analysis Technology relevance 10/10 from Calculator - SpeedCrunchPortable_0.12.paf.exe (PID: 2520) ( Show Stream)įound API call (Target: "Calculator - SpeedCrunchPortable_0.12.paf.exe" Stream UID: "00014463-00002520-4033B6") Which is directly followed by "cmp ax, 00000006h" and "je 004033FCh". "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\w7tbp.dll" for deletionįound API call (Target: "Calculator - SpeedCrunchPortable_0.12.paf.exe" Stream UID: "00014463-0000-004033B6") "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\System.dll" for deletion
"C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\nsDialogs.dll" for deletion "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\modern-wizard.bmp" for deletion "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\modern-header.bmp" for deletion "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\LangDLL.dll" for deletion "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp\FindProcDLL.dll" for deletion "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsw3C8C.tmp" for deletion "C:\Calculator - SpeedCrunchPortable_0.12.paf.exe" marked "%TEMP%\nsg3C12.tmp" for deletion