CREATE TABLE SQLiteGlobals(ID INTEGER PRIMARY KEY NOT NULL, Version INTEGER NOT NULL, Current BOOLEAN NOT NULL, LastUpdated TEXT NULL);
CREATE TABLE AttributePersistContext(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FilePath NVARCHAR NULL, Context NVARCHAR NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL);
CREATE TABLE BackupProcessInfo(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FilePath NVARCHAR NULL, FirstStartTime INTEGER NULL, NextUSN INTEGER NULL, AutomaticRemovalPolicy INTEGER NULL, ImpactedCBPNameSpaces NVARCHAR NULL, InstanceTimeStamp INTEGER NULL);
CREATE TABLE BmFileActions(ID INTEGER PRIMARY KEY NOT NULL, FileInfoId INTEGER NOT NULL, ThreatRecordId INTEGER, Action INTEGER);
CREATE TABLE BmFileInfo(ID INTEGER PRIMARY KEY NOT NULL, NormalizedPathHash INTEGER, DosPathHash INTEGER, StructVersion INTEGER NOT NULL, NormalizedPath NVARCHAR NOT NULL, DosPath NVARCHAR NOT NULL, Wow64Context BLOB, MetaContext BLOB, IsFromWeb TINYINT DEFAULT 0, IsExecutable TINYINT DEFAULT 0);
CREATE TABLE BmFileStartupActions(ID INTEGER PRIMARY KEY NOT NULL, FilePathHash INTEGER NULL, FilePath NVARCHAR NULL, ActionFlags INTEGER NULL, ProcessStartCount INTEGER NULL, FdrFlags INTEGER NULL, FdrThreatRecordId INTEGER NULL, EvaluatorThreatRecordId INTEGER NULL, TrustedInstallerThreatRecordId INTEGER NULL, LFRThreatRecordId INTEGER NULL);
CREATE TABLE BmHipsRuleInfo(ID INTEGER PRIMARY KEY NOT NULL, ProcessInfoId INTEGER NOT NULL, RuleAction INTEGER NOT NULL, RuleId BLOB, IsAudit INTEGER NOT NULL DEFAULT 0, IsInherited INTEGER NOT NULL DEFAULT 0, State INTEGER NULL);
CREATE TABLE BmProcessInfo(ID INTEGER PRIMARY KEY NOT NULL, PPIDHash INTEGER NOT NULL, ProcessStartTime INTEGER NOT NULL, PID INTEGER NOT NULL, StructVersion INTEGER, ImageFileName NVARCHAR, MonitoringFlags_Flags INTEGER NOT NULL, MonitoringFlags_VmHardenType INTEGER NOT NULL, MonitoringFlags_ExemptVmHardenedTypes INTEGER NOT NULL, CommandLineArgs NVARCHAR, HipsInjectionId BLOB, FolderGuardId BLOB, Flags INTEGER, LsassReadMemId BLOB, MonitoringFlags_Flags2Low INTEGER, MonitoringFlags_Flags2High INTEGER);
CREATE TABLE DynSigRevisions(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, SdnRevision INTEGER NULL, EsuRevision INTEGER NULL, BFRevision INTEGER NULL, EntCertRevision INTEGER NULL, TamperRevision INTEGER NULL, AGBlobRevision INTEGER NULL, BFFileAllowRevision INTEGER NULL, BFFileBlockRevision INTEGER NULL, BFCertAllowRevision INTEGER NULL, BFCertBlockRevision INTEGER NULL);
CREATE TABLE Engine(ID INTEGER PRIMARY KEY NOT NULL, EngineVersion VARCHAR(20) NULL, SigVersion VARCHAR(20) NULL);
CREATE TABLE FileLowFiAsync(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FileName NVARCHAR NULL, SigSeq INTEGER NULL, SigSha BLOB NULL, SigIsSync BOOLEAN NULL, InstanceTimeStamp INTEGER NULL);
CREATE TABLE FolderGuardPaths(ID INTEGER PRIMARY KEY NOT NULL, UserIdHash INTEGER NOT NULL, UserId NVARCHAR, GUID BLOB, Path NVARCHAR);
CREATE TABLE ProcessBlockHistory(ID INTEGER PRIMARY KEY NOT NULL, ProcessPath TEXT NOT NULL, TimeStamp INTEGER NOT NULL, TargetPath TEXT, RuleId BLOB, IsAudit BOOLEAN NOT NULL DEFAULT 0, Action INTEGER NOT NULL, ProcessTaintReason INTEGER NOT NULL DEFAULT 0, ProcessIntegrity INTEGER NOT NULL);
CREATE TABLE RansomwareDetections(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, DetectionGuid NVARCHAR NULL, LkgTS INTEGER NULL, NextUSN INTEGER NULL, DetectionTS INTEGER NULL, ProvisionalRemedComplTS INTEGER NULL, RemedComplTS INTEGER NULL, ImpactedCBPNameSpaces NVARCHAR NULL, InstanceTimeStamp INTEGER NULL);
CREATE TABLE SdnEx(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, CurrentCount INTEGER NULL);
CREATE TABLE SystemFileCache(ID INTEGER PRIMARY KEY NOT NULL, InfectedFileSHAHash INTEGER NULL, InfectedFileSHA NVARCHAR NULL, ProcFileIDSystemFileHash INTEGER NULL, ProcFileId BLOB NULL, SystemFilePath NVARCHAR NULL, CleanFileSha NVARCHAR NULL, CleanFileShaHash INTEGER NULL, InstanceTimeStamp INTEGER NULL);
CREATE TABLE SystemRegistryCache(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FileIDHash INTEGER NULL, RegPath NVARCHAR NULL, RegOperation INTEGER NULL, NewRegType INTEGER NULL, OldRegType INTEGER NULL, OldRegData BLOB NULL, NewRegData BLOB NULL, InstanceTimeStamp INTEGER NULL);
CREATE TABLE ValueMapArray(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, RecordType INTEGER NULL, ValueMapArrayBlob BLOB NULL, InstanceTimeStamp INTEGER NULL);
CREATE TABLE FileHashes(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, VSN INTEGER NULL, FileID INTEGER NULL, USN INTEGER NULL, InstanceTimeStamp INTEGER NULL, SHA1 BLOB NULL, MD5 BLOB NULL, SHA256 BLOB NULL, LSHASH BLOB NULL, LSHASHS BLOB NULL, CTPH BLOB NULL, PartialCRC1 UNSIGNED INT NULL, PartialCRC2 UNSIGNED INT NULL, PartialCRC3 UNSIGNED INT NULL, KCRC1 UNSIGNED INT NULL, KCRC2 UNSIGNED INT NULL, KCRC3 UNSIGNED INT NULL, KCRC3n UNSIGNED INT NULL);
CREATE TABLE AmsiFileCache(ID INTEGER PRIMARY KEY NOT NULL, PersistId VARCHAR NOT NULL,PersistIdBlob BLOB NOT NULL,ExpirationDate TEXT NOT NULL);
CREATE TABLE AttributeCounts(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Count INTEGER NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL);
CREATE TABLE NetworkIpFirewallRules(ID INTEGER PRIMARY KEY NOT NULL, Key VARCHAR NOT NULL, FirewallRuleName VARCHAR NOT NULL, ExpiryTime INTEGER NOT NULL);
CREATE TABLE AtomicCounters(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Count INTEGER NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL, UpdateTime INTEGER NULL, ScalarFactor INTEGER NULL, LinearFactor INTEGER NULL, DecayInterval INTEGER NULL, HighCount INTEGER NULL, LastDecayTime INTEGER NULL, Namespace NVARCHAR DEFAULT '');
CREATE TABLE RollingQueuesValues(ID INTEGER PRIMARY KEY NOT NULL, EntryTable NVARCHAR NULL, EntryKey NVARCHAR NULL, EntryValue NVARCHAR NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL);
CREATE TABLE RollingQueuesTables(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Capacity INTEGER NULL, TimeToLive INTEGER NULL, Mode INTEGER NULL, Namespace NVARCHAR DEFAULT '');
CREATE TABLE NetworkIpFirewallRulesOutgoing(ID INTEGER PRIMARY KEY NOT NULL, Key VARCHAR NOT NULL, FirewallRuleName VARCHAR NOT NULL, ExpiryTime INTEGER NOT NULL);
CREATE TABLE DnRevisions(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Revision INTEGER NULL);
CREATE TABLE AnomalyInfo(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, UnbiasedTime INTEGER NULL);
CREATE TABLE AnomalyTables(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, TableKey INTEGER NULL, TableName TEXT NULL, UnbiasedTableAge INTEGER NULL, KeyName TEXT NULL, FirstSeen INTEGER NULL, LastSeen INTEGER NULL, UnbiasedTime INTEGER NULL, Value REAL NULL, Order_ INTEGER NULL);
CREATE TABLE sqlite_stat1(tbl,idx,stat);
CREATE INDEX IDX_AttributePersistContext_Key ON AttributePersistContext(Key);
CREATE INDEX IDX_BackupProcessInfo ON BackupProcessInfo(Key);
CREATE INDEX IDX_BmFileActions_FileInfoId ON BmFileActions(FileInfoId);
CREATE INDEX IDX_BmFileInfo_NormalizedPath ON BmFileInfo(NormalizedPathHash);
CREATE INDEX IDX_BmFileInfo_DosPath ON BmFileInfo(DosPathHash);
CREATE INDEX IDX_BmFileStartupActions ON BmFileStartupActions(FilePathHash);
CREATE INDEX IDX_BmHipsRuleInfo_ProcessInfoId ON BmHipsRuleInfo(ProcessInfoId);
CREATE INDEX IDX_BmProcessInfo_PPID ON BmProcessInfo(PPIDHash);
CREATE INDEX IDX_DynSigRevisions ON DynSigRevisions(Key);
CREATE INDEX IDX_FileLowFiAsync ON FileLowFiAsync(Key);
CREATE INDEX IDX_FolderGuardPaths ON FolderGuardPaths(UserIdHash);
CREATE UNIQUE INDEX IDX_ProcessBlockHistoryPathTime ON ProcessBlockHistory(ProcessPath,TimeStamp);
CREATE INDEX IDX_ProcessBlockHistoryTime ON ProcessBlockHistory(TimeStamp);
CREATE INDEX IDX_RansomwareDetections ON RansomwareDetections(Key);
CREATE INDEX IDX_SdnEx ON SdnEx(Key);
CREATE INDEX IDX_SystemFileCache_InfectedFileSHAHash ON SystemFileCache(InfectedFileSHAHash);
CREATE INDEX IDX_SystemFileCache_ProcFileIDSystemFileHash ON SystemFileCache(ProcFileIDSystemFileHash);
CREATE INDEX IDX_SystemRegistryCache ON SystemRegistryCache(Key);
CREATE INDEX IDX_ValueMapArray ON ValueMapArray(Key);
CREATE INDEX IDX_FileHashes ON FileHashes(Key);
CREATE INDEX IDX_AmsiFileCachePersistId ON AmsiFileCache(PersistId);
CREATE INDEX IDX_AmsiFileCacheDate ON AmsiFileCache(ExpirationDate);
CREATE INDEX IDX_AttributeCounts_Key ON AttributeCounts(Key);
CREATE INDEX IDX_NetworkIpFirewallRules ON NetworkIpFirewallRules(Key);
CREATE INDEX IDX_AtomicCounters_Key ON AtomicCounters(Key);
CREATE INDEX IDX_RollingQueuesValues_EntryTable ON RollingQueuesValues(EntryTable);
CREATE INDEX IDX_RollingQueuesTables_Key ON RollingQueuesTables(Key);
CREATE INDEX IDX_RollingQueuesTables_Name ON RollingQueuesTables(Name);
CREATE INDEX IDX_NetworkIpFirewallRulesOutgoing ON NetworkIpFirewallRulesOutgoing(Key);
CREATE INDEX IDX_DnRevisions ON DnRevisions(Key);
CREATE INDEX IDX_AnomalyInfo_Key ON AnomalyInfo(Key);
CREATE INDEX IDX_AnomalyTables_Key ON AnomalyTables(Key);
CREATE TRIGGER TGR_BmFileInfo_DeleteActions AFTER DELETE ON BmFileInfo BEGIN  DELETE FROM BmFileActions WHERE FileInfoId = OLD.ID; END;
CREATE TRIGGER TGR_BmProcessInfo_DeleteHipsRules AFTER DELETE ON BmProcessInfo BEGIN  DELETE FROM BmHipsRuleInfo WHERE ProcessInfoId = OLD.ID; END;
CREATE TRIGGER TGR_RollingQueuesTables_DeleteActions AFTER DELETE ON RollingQueuesTables BEGIN  DELETE FROM RollingQueuesValues WHERE EntryTable = OLD.Name; END;
