Edit C:\ProgramData\CheckPoint\DBStore\EFRSAL_REG.20191101.113637.171.ds
SQLite format 3 @ ? -?r ? ?Z?l ?!?tableInjectRawInjectRawCREATE TABLE InjectRaw( PID INTEGER NOT NULL, CreationTime INTEGER NOT NULL, OpTime INTEGER NOT NULL, DestinationPID INTEGER NOT NULL, DestinationCreationTime INTEGER NOT NULL, OpClass INTEGER NOT NULL, OpType INTEGER NOT NULL, OpFlag INTEGER NOT NULL, HookID INTEGER NOT NULL, ObjName TEXT, Classification TEXT )?G?etableUserRAWUserRAWCREATE TABLE UserRAW( PID INTEGER NOT NULL, CreationTime INTEGER NOT NULL, OpTime INTEGER NOT NULL, OpSID TEXT, OpType INTEGER NOT NULL )??YtableFileRawFileRawCREATE TABLE FileRaw( PID INTEGER NOT NULL, CreationTime INTEGER NOT NULL, OpTime INTEGER NOT NULL, OpType INTEGER NOT NULL, FileName TEXT, CloseTime INTEGER NOT NULL, NewFileName TEXT, FileSize INTEGER NOT NULL, FileHash TEXT, FileType TEXT, UNIQUE ( PID, CreationTime, FileName, OpType, OpTime ) ON CONFLICT IGNORE )-A indexsqlite_autoindex_FileRaw_1FileRaw ??stableNetRawNetRawCREATE TABLE NetRaw( PID INTEGER NOT NULL, CreationTime INTEGER NOT NULL, OpTime INTEGER NOT NULL, OpType INTEGER NOT NULL, URL TEXT, ResponseStatusCode INTEGER NOT NULL, Location TEXT, Referer TEXT, UserAgent TEXT, SrcIPAddr TEXT, SrcPort INTEGER NOT NULL, DstIPAddr TEXT, DstPort INTEGER NOT NULL, IsListening INTEGER NOT NULL, IANAProcol INTEGER NOT NULL, ConnectionCreationTime INTEGER NOT NULL, ConnectionTerminationTime INTEGER NOT NULL, BytesReceived INTEGER NOT NULL, BytesSent INTEGER NOT NULL, FlowId INTEGER NOT NULL, dns_response TEXT )?'?-tablePsRawPsRawCREATE TABLE PsRaw( PID INTEGER NOT NULL, CreationTime INTEGER NOT NULL, OpTime INTEGER NOT NULL, OpSID TEXT, OpType INTEGER NOT NULL, ImagePath TEXT, Args TEXT, ImageMD5 TEXT, ImageSigner TEXT, PPID INTEGER NOT NULL, PCreationTime INTEGER NOT NULL, CertificateDescriptionID INTEGER NOT NULL )?/''?tableSchemaVersionSchemaVersionCREATE TABLE SchemaVersion( Major INTEGER NOT NULL, Minor INTEGER NOT NULL, CreationDate INTEGER NOT N ? ? Tn'W?F o j ???????????????????????ztnhb\VPJD>82,& ?????????????????????~xrlf`ZTNHB<60*$ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? | v p jledtpi0x510x52?+?AI 7n'9??n'bI? ?s-1-5-21-2732810954-1700855356-1339776706-1000_classes\local settings\muicache\3f\a7eab198@c:\windows\explorer.exe,-7022Seguridad de Windows ?/?AI ?n'9??n'bI? ?s-1-5-21-2732810954-1700855356-1339776706-1000_classes\local settings\muicache\3f\a7eab198@c:\windows\explorer.exe,-7021Ayuda y soporte técnico ?1?AK An'9??n'bI? ?s-1-5-21-2732810954-1700855356-1339776706-1000_classes\local settings\muicache\3f\a7eab198@c:\windows\system32\sud.dll,-1Programas predeterminados ?=?Ac An'9??n'bI? ?s-1-5-21-2732810954-1700855356-1339776706-1000_classes\local settings\muicache\3f\a7eab198@c:\windows\system32\devicecenter.dll,-1000Dispositivos e impresoras n?/ Xn'U??n'_H?software\microsoft\windows\currentversion\component based servicing\rebootpendingTi ?n$?n'_H? ?system\controlset001\services\trustedinstallerstart0x34!) Xn'U??n'_H?componentsexecutionstate9!) Xn'U??n'_H? ?componentsexecutionstate0x59!) Xn'U??n'_H? ?componentsexecutionstate0x2?} Ok ??Xn'U??n'_H? ?components\servicingstackversions6.1.7601.24516 (win7sp1_ldr_escrow.190815-1609)2019/11/1:14:19:18.241 6.1.7601.24516 (win7sp1_ldr_escrow.190815-1609) 2019/11/1:14:29:46.249 6.1.7601.24516 (win7sp1_ldr_escrow.190815-1609) n?/ Xn'U??n'_HJ software\microsoft\windows\currentversion\component based servicing\rebootpendingWi?n$?n'_HJ ?system\controlset001\services\trustedinstallerstart0x30x2r?# Pn$?6n'X? {e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222aeprogramido? Pn$?6n'X? {e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222aefileid?,? Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\indextable\fileidindex-{8bd0435c-b77a-11e8-8dc1-806e6f6e6963}\1300000001c7072220x222?@?) -Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222\indexes\fileidindex-{8bd0435c-b77a-11e8-8dc1-806e6f6e6963}1300000001c7070x1300000001C707?! ? Pn$?6n'X? {e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222\indexes\fileidindex-{8bd0435c-b77a-11e8-8dc1-806e6f6e6963}n?/ Pn$?6n'X? {e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222\indexes?#? Pn$?6n'X? {e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\indextable\fileidindex-{8bd0435c-b77a-11e8-8dc1-806e6f6e6963}\1300000001c707? ?) /Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222_usnjournalid_0x1D44B875334B6BEv ? !Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222_usn_0xA9E9FF30? -Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222_fileid_0x1300000001C707w?# Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectstore\objecttable\222_objectlru_0xE58~?1 Pn$?6n'X?{e81e4d25-fc32-11e9-92b2-363226b4d3a3}\defaultobjectsto ? ?p ?V ?: Í"