SQLite format 3@  .  z = k zd!- indexCF_INDEXCF CREATE INDEX CF_INDEX on CF (K)!itableCFCFCREATE TABLE CF(K CHAR PRIMARY KEY, V CHAR, VR INTEGER)?!aindexsqlite_autoindex_CF_1CF!-MindexFI_INDEXFICREATE INDEX FI_INDEX on FI (ID, FO, M5, S1, S6)Z! tableFIFICREATE TABLE FI(ID INTEGER, FO CHAR, FQ CHAR, M5 CHAR, S1 CHAR, S6 CHAR, SZ INTEGER, VR INTEGER)f!- indexFQ_INDEXFQCREATE INDEX FQ_INDEX on FQ (ID)!II%tablesqlite_sequencesqlite_sequenceCREATE TABLE sqlite_sequence(name,seq)^!tableFQFQCREATE TABLE FQ(ID INTEGER PRIMARY KEY autoincrement, FC BLOB, VE INTEGER, CS INTEGER, VR INTEGER) Av @100@210 @211 @200filemon@212@201 360TS@202@203D>Win64/Miner.Coinminer.H8oAJsYA@511@204trojan@205 restore file@206,&133537411045620000@207 @208D>C:\ProgramData\mssts\javag.exe@209D>C:\ProgramData\mssts\javag.exe@1010Ot/-]@500D>C:\ProgramData\mssts\javag.exe@511@5015389312@502vpC:\$360Section\360.3F2AA84E60402051EF251B3285DF3762.q3q@503 @504,&133537518947808828@505,&133537518947808828@506,&133537519038902578@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-2732810954-1700855356-1339776706-1000)(A;ID;0x1200a9;;;BU)j[}n @100&@210 @211 @200filemon@212@201 360TS@202@203B<Win64/Trojan.Generic.H8oAAy4C@511@204trojan@205 restore file@206,&133027586795180000@207 @208`ZC:\Users\Admin\AppData\Roaming\1pjszuldc.exe@209`ZC:\Users\Admin\AppData\Roaming\1pjszuldc.exe@1010Ot/-]@500`ZC:\Users\Admin\AppData\Roaming\1pjszuldc.exe@511@5012986496@502vpC:\$360Section\360.4B441A901DBB3AC4DE4F44820A5D8EDC.q3q@503 @504,&133027730741933593@505,&133027730741933593@506,&133027730781455078@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-2732810954-1700855356-1339776706-1000)zˈvb @100@210 @211 @200"newspy_killer@212@201360safe@202@203tnTrojan:Win32/Backdoor.Zegost.HwcBXdcA <Trojan.Generic>@204Trojan@205,&Archivo Restaurado@206,&132936084283550000@207 @208@209:4C:\ProgramData\SB360..exe@101rj0Ot/-]@500:4C:\ProgramData\SB360..exe@501221277@502vpC:\$360Section\360.CE9BEAC17FBD5C38EB3B8FFAF2400550.q3q@503 @504,&132936227799433438@505,&132936227799433438@506,&132936227819902188@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x13   FQ    Mr  : Y x] Ii  C:\apache-tomcat-7.0.69\webapps\funcspecs\5.jspC:\$360Section\360.70685ED0441C916DC97253DA777A9E16.q3qu0u^ Ii  C:\apache-tomcat-7.0.69\webapps\funcspecs\4.jspC:\$360Section\360.9D711C60E6AF2450C214567538EDF5F7.q3qyK^ Ii C:\apache-tomcat-7.0.69\webapps\funcspecs\3.jspC:\$360Section\360.41184BAC156681C347E974AB78958AF4.q3q<ݽ^ Ii C:\apache-tomcat-7.0.69\webapps\funcspecs\1.jspC:\$360Section\360.E5E5D63FCBEBFF5543BC3D3B27C9FB8D.q3qCWin64/Miner.Coinminer.H8oAJsYA@511@204trojan@205 restore file@206,&133537411045620000@207 @208D>C:\ProgramData\mssts\javag.exe@209D>C:\ProgramData\mssts\javag.exe@1010Ot/-]@500D>C:\ProgramData\mssts\javag.exe@511@5015389312@502vpC:\$360Section\360.3F2AA84E60402051EF251B3285DF3762.q3q@503 @504,&133537518947808828@505,&133537518947808828@506,&133537519038902578@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-2732810954-1700855356-1339776706-1000)(A;ID;0x1200a9;;;BU)j[}n @100&@210 @211 @200filemon@212@201 360TS@202@203B<Win64/Trojan.Generic.H8oAAy4C@511@204trojan@205 restore file@206,&133027586795180000@207 @208`ZC:\Users\Admin\AppData\Roaming\1pjszuldc.exe@209`ZC:\Users\Admin\AppData\Roaming\1pjszuldc.exe@1010Ot/-]@500`ZC:\Users\Admin\AppData\Roaming\1pjszuldc.exe@511@5012986496@502vpC:\$360Section\360.4B441A901DBB3AC4DE4F44820A5D8EDC.q3q@503 @504,&133027730741933593@505,&133027730741933593@506,&133027730781455078@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-2732810954-1700855356-1339776706-1000)zˈvb @100@210 @211 @200"newspy_killer@212@201360safe@202@203tnTrojan:Win32/Backdoor.Zegost.HwcBXdcA <Trojan.Generic>@204Trojan@205,&Archivo Restaurado@206,&132936084283550000@207 @208@209:4C:\ProgramData\SB360..exe@101rj0Ot/-]@500:4C:\ProgramData\SB360..exe@501221277@502vpC:\$360Section\360.CE9BEAC17FBD5C38EB3B8FFAF2400550.q3q@503 @504,&132936227799433438@505,&132936227799433438@506,&132936227819902188@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)]p  nvfB @100$@210 @211 @200filemon@212@201 360TS@202@203D>Win32/Exploit.Generic.HwoCCBsB@511@204trojan@205 restore file@206,&133862525135710000@207 @208^XC:\apache-tomcat-7.0.69\webapps\scvhost.exe@209^XC:\apache-tomcat-7.0.69\webapps\scvhost.exe@1010Ot/-]@500^XC:\apache-tomcat-7.0.69\webapps\scvhost.exe@511@501183296@502vpC:\$360Section\360.24DB9174996ADE06A5D74DDCFE66B941.q3q@503 @504,&133862633092636250@505,&133862633092636250@506,&133862633092636250@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)1u^ @100,@210 @211 @200filemon@212@201 360TS@202@203<6ex_webshell.jsp.hacktool.a@511@204trojan@205 restore file@206,&133862525121790000@207 @208f`C:\apache-tomcat-7.0.69\webapps\funcspecs\2.jsp@209f`C:\apache-tomcat-7.0.69\webapps\funcspecs\2.jsp@1010Ot/-]@500f`C:\apache-tomcat-7.0.69\webapps\funcspecs\2.jsp@511@501 74235@502vpC:\$360Section\360.61608B826C0CB65A6F4AEFB7F8346E86.q3q@503 @504,&133862633092480000@505,&133862633092480000@506,&133862633092480000@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)WC @100@210 @211 @200"newspy_killer@212@201360safe@202@203RLTrojan:Win64/Miner.Coinminer.H8oAJsYA@204Trojan@205,&Archivo Restaurado@206,&133537411365770000@207 @208@209D>C:\ProgramData\mssts\javag.exe@1010Ot/-]@500D>C:\ProgramData\mssts\javag.exe@5015389312@502vpC:\$360Section\360.458D6AB62D56B2446972737D1863CC12.q3q@503@504,&133537518947808828@505,&133537518947808828@506,&133537519038902578@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-2732810954-1700855356-1339776706-1000)(A;ID;0x1200a9;;;BU)  w b @100.@210 @211 @200filemon@212@201 360TS@202@203>8ex_webshell.jsp.backdoor.ab@511@204trojan@205 restore file@206,&133862525141340000@207 @208f`C:\apache-tomcat-7.0.69\webapps\funcspecs\4.jsp@209f`C:\apache-tomcat-7.0.69\webapps\funcspecs\4.jsp@1010Ot/-]@500f`C:\apache-tomcat-7.0.69\webapps\funcspecs\4.jsp@511@501 36217@502vpC:\$360Section\360.9D711C60E6AF2450C214567538EDF5F7.q3q@503 @504,&133862633092636250@505,&133862633092636250@506,&133862633092636250@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU) ,u^ @100,@210 @211 @200filemon@212@201 360TS@202@203<6ex_webshell.jsp.backdoor.b@511@204trojan@205 restore file@206,&133862525141190000@207 @208f`C:\apache-tomcat-7.0.69\webapps\funcspecs\3.jsp@209f`C:\apache-tomcat-7.0.69\webapps\funcspecs\3.jsp@1010Ot/-]@500f`C:\apache-tomcat-7.0.69\webapps\funcspecs\3.jsp@511@501 56781@502vpC:\$360Section\360.41184BAC156681C347E974AB78958AF4.q3q@503 @504,&133862633092636250@505,&133862633092636250@506,&133862633092636250@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)]/wb @100.@210 @211 @200filemon@212@201 360TS@202@203>8ex_webshell.jsp.backdoor.pc@511@204trojan@205 restore file@206,&133862525141030000@207 @208f`C:\apache-tomcat-7.0.69\webapps\funcspecs\1.jsp@209f`C:\apache-tomcat-7.0.69\webapps\funcspecs\1.jsp@1010Ot/-]@500f`C:\apache-tomcat-7.0.69\webapps\funcspecs\1.jsp@511@501 38211@502vpC:\$360Section\360.E5E5D63FCBEBFF5543BC3D3B27C9FB8D.q3q@503 @504,&133862633092480000@505,&133862633092480000@506,&133862633092636250@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)L   u ^ @100,@210 @211 @200filemon@212@201 360TS@202@203<6ex_webshell.jsp.backdoor.b@511@204trojan@205 restore file@206,&133862525141500000@207 @208f`C:\apache-tomcat-7.0.69\webapps\funcspecs\5.jsp@209f`C:\apache-tomcat-7.0.69\webapps\funcspecs\5.jsp@1010Ot/-]@500f`C:\apache-tomcat-7.0.69\webapps\funcspecs\5.jsp@511@501 30204@502vpC:\$360Section\360.70685ED0441C916DC97253DA777A9E16.q3q@503 @504,&133862633092636250@505,&133862633092636250@506,&133862633092636250@508 @509@507O:S-1-5-21-2732810954-1700855356-1339776706-1000G:S-1-5-21-2732810954-1700855356-1339776706-513D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)[%