SQLite format 3  

 @                    *              
                                               ???                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
   	   
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
   
 
??11                                                                                                                                                                                                                                                                                      ?%%
?tableTable_ActionTable_ActionCREATE TABLE Table_Action(ID INTEGER PRIMARY KEY,TimeStart INTEGER,TimeEnd INTEGER,Finder INTEGER,Found INTEGER,Clean INTEGER,Scan INTEGER)�H--
‚CtableTable_FileAccConTable_FileAccConCREATE TABLE Table_FileAccCon(ID INTEGER PRIMARY KEY,RuleID INTEGER,RuleClass INTEGER,FileApiMark INTEGER,ActionTime INTEGER,Procname TEXT,TargetName TEXT)?11
�EtableTable_HideProcInfoTable_HideProcInfoCREATE TABLE Table_HideProcInfo(ID INTEGER PRIMARY KEY,ActionTime INTEGER,HideProcList TEXT)�L--
‚KtableTable_ProcAccConTable_ProcAccConCREATE TABLE Table_ProcAccCon(ID INTEGER PRIMARY KEY,RuleID INTEGER,RuleClass INTEGER,ProcApiMark INTEGER,ActionTime INTEGER,ProcName TEXT,TargetProcName TEXT)

    ??                                                                                                                                                                ?++
?tableTable_RegAccConTable_RegAccCon	CREATE TABLE Table_RegAccCon (ID INTEGER PRIMARY KEY, RuleID INTEGER, RuleClass INTEGER, RegApiMark INTEGER, ActionTime INTEGER, ProcName TEXT, TargetKeyName TEXT, IsValue INTEGER, OldValueType INTEGER, OldValue TEXT, NewValueType INTEGER, NewValue TEXT)   ?77
?tableTable_VirusActionInfoTable_VirusActionInfoCREATE TABLE Table_VirusActionInfo(ID INTEGER PRIMARY KEY,VirusID INTEGER,VirusName TEXT,ActiveProcList TEXT,CreateFileList TEXT,ActionTime INTEGER)‚U	++
„atableTable_VirusInfoTable_VirusInfoCREATE TABLE Table_VirusInfo(ID INTEGER PRIMARY KEY,Finder INTEGER,VirusID INTEGER,Type INTEGER,KillResult INTEGER,FindTime INTEGER,Path TEXT,FileName TEXT,ClientID TEXT,ClientName TEXT,ClientIP INTEGER,CenterID TEXT,Centername TEXT,VirusSource TEXT,strReserve TEXT,nReserve INTEGER,VirusFrom TEXT)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
    h  h
E
??g                                                                                      �Z++
‚ktableTable_SysFunConTable_SysFunCon
CREATE TABLE Table_SysFunCon(ID INTEGER PRIMARY KEY,RuleID INTEGER,RuleClass INTEGER,NtApiMark INTEGER, NtApiMarkHigh INTEGER,ActionTime INTEGER,ProcName TEXT,TargetData TEXT)v
?tableRfwSysEvtRfwSysEvtCREATE TABLE RfwSysEvt (ID INTEGER PRIMARY KEY, Action INTEGER,Time INTEGER, User TEXT)�X
%%
‚stableRfwAttackEvtRfwAttackEvtCREATE TABLE RfwAttackEvt (ID INTEGER PRIMARY KEY, Action INTEGER, Content TEXT, Direction INTEGER, LocalAddr TEXT, Protocol INTEGER, RemoteAddr TEXT, Rulename TEXT, Time INTEGER)�L
‚ktableRfwIPEvtRfwIPEvtCREATE TABLE RfwIPEvt (ID INTEGER PRIMARY KEY, Action INTEGER, Content TEXT, Direction INTEGER, LocalAddr TEXT, Protocol INTEGER, RemoteAddr TEXT, Rulename TEXT, Time INTEGER)?%%
�otableRfwEdRuleEvtRfwEdRuleEvtCREATE TABLE RfwEdRuleEvt (ID INTEGER PRIMARY KEY, Action INTEGER, Rulename TEXT, Ruletype INTEGER, Time INTEGER)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
   
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              g

 
1
/o ??92.168.1.104:1515121.12.173.218:80æµ�览器攻击：大规模暴å�‘性网马群 VIII€�y
   t ?t                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        D
 ''	#' ÈCode=0 Type=8
?92.168.1.104192.168.1.1ç¦�æ­¢Pingå…¥Iz¦`D

 ''	#' ÈCode=0 Type=8
?92.168.1.104192.168.1.1�止Ping入IxV?   
B 
B
?                                                                                                                                                                                                                                                                                                                    ?
?tableRfwTDIEvtRfwTDIEvtCREATE TABLE RfwTDIEvt (ID INTEGER PRIMARY KEY, Action INTEGER, LocalAddr TEXT, Pathname TEXT, RemoteAddr TEXT, Tdievt INTEGER, Time INTEGER)?
?tableRfwArpEvtRfwArpEvtCREATE TABLE RfwArpEvt (ID INTEGER PRIMARY KEY, ConflictMAC TEXT, IPAddr TEXT, OriginalMAC TEXT, Rulename TEXT, Time INTEGER, Type INTEGER)‚_''
„}tableTable_FileMonTable_FileMonCREATE TABLE Table_FileMon (ID INTEGER PRIMARY KEY, Finder INTEGER, VirusID INTEGER, Type INTEGER, KillResult INTEGER, VirusSource TEXT, FindTime INTEGER, Path TEXT, FileName TEXT, ScriptBDType INTEGER, ClsID TEXT, ClsName TEXT, CreateFileName TEXT, VirusName TEXT, DownLoadUrl TEXT, PID INTEGER, VirusFrom TEXT)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
     x6
                                                                                                                                        @
YtableVersionVersionCREATE TABLE Version (Version INTEGER)�[77
‚UtableTable_VirusActionInfoTable_VirusActionInfoCREATE TABLE Table_VirusActionInfo(ID INTEGER PRIMARY KEY,VirusID INTEGER,VirusName TEXT,ActiveProcList TEXT,CreateFileList TEXT,ActionTime INTEGER,OwernID INTEGER)?11
?tableTable_ActionDetailTable_ActionDetailCREATE TABLE Table_ActionDetail (TaskNo INTEGER, TimeStart INTEGER, LastAction INTEGER, Finder INTEGER, LastFound INTEGER, LastScan INTEGER)?))
?tableRfwOutFloodEvtRfwOutFloodEvtCREATE TABLE RfwOutFloodEvt (ID INTEGER PRIMARY KEY, LocalAddr TEXT, Pathname TEXT, RemoteAddr TEXT, Time INTEGER, Protocol INTEGER, Type INTEGER)�G%%
‚QtableTable_ActionTable_ActionCREATE TABLE Table_Action (ID INTEGER PRIMARY KEY, TimeStart INTEGER, TimeEnd INTEGER, Finder INTEGER, Found INTEGER, Clean INTEGER, Scan INTEGER, TaskNo INTEGER)