"HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup"	""	""	""	"16/12/2018 19:29"	""
"HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup"	""	""	""	""	""
"HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon"	""	""	""	""	""
"HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon"	""	""	""	""	""
"HKCU\Environment\UserInitMprLogonScript"	""	""	""	"11/09/2018 18:15"	""
"HKLM\Environment\UserInitMprLogonScript"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet"	""	""	""	"16/12/2018 19:29"	""
"HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown"	""	""	""	""	""
"HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff"	""	""	""	""	""
"HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logoff"	""	""	""	""	""
"HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup"	""	""	""	""	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup"	""	""	""	""	""
"HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon"	""	""	""	""	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon"	""	""	""	""	""
"HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff"	""	""	""	""	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff"	""	""	""	""	""
"HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown"	""	""	""	""	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown"	""	""	""	""	""
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell"	""	""	""	"12/05/2018 16:57"	""
"HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"	""	""	""	"16/12/2018 19:27"	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell"	""	""	""	"12/05/2018 11:29"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell"	""	""	""	"12/05/2018 16:53"	""
+ "cmd.exe"	"Windows Command Processor"	"(Verified) Microsoft Windows"	"c:\windows\system32\cmd.exe"	"08/01/1971 08:44"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman"	""	""	""	"16/12/2018 19:29"	""
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells\AvailableShells"	""	""	""	"11/04/2018 23:38"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run"	""	""	""	""	""
"HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	""	""	""	"16/12/2018 19:29"	""
+ "RTHDVCPL"	"Realtek HD Audio Manager"	"(Verified) Realtek Semiconductor Corp"	"c:\program files\realtek\audio\hda\rtkngui64.exe"	"07/07/2015 09:26"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"	""	""	""	"02/11/2018 20:18"	""
+ "IJNetworkScannerSelectorEX2"	"Canon IJ Network Scanner Selector EX2"	"(Verified) Canon Inc."	"c:\program files (x86)\canon\ij network scanner selector ex2\cnmnsst2.exe"	"17/06/2015 07:00"	""
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	""	""	""	"11/12/2018 18:36"	""
"HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx"	""	""	""	"11/12/2018 20:03"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx"	""	""	""	"16/12/2018 19:29"	""
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx"	""	""	""	"27/09/2018 17:53"	""
"HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"	""	""	""	"16/12/2018 17:52"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce"	""	""	""	"16/12/2018 17:38"	""
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"	""	""	""	"05/12/2018 08:44"	""
"HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce"	""	""	""	""	""
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"	""	""	""	"11/04/2018 23:38"	""
"C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"	""	""	""	"11/12/2018 20:03"	""
+ "Jacquie Lawson Desktop Widget.lnk"	""	""	"c:\program files (x86)\jacquie lawson desktop widget\jacquie lawson desktop widget.exe"	"27/08/2018 22:42"	""
"HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load"	""	""	""	"10/07/2018 18:54"	""
"HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run"	""	""	""	"10/07/2018 18:54"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"	""	""	""	"11/04/2018 23:40"	""
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components"	""	""	""	"19/11/2018 20:13"	""
+ "Google Chrome"	"Google Chrome Installer"	"(Verified) Google Inc"	"c:\program files (x86)\google\chrome\application\70.0.3538.110\installer\chrmstp.exe"	"15/11/2018 05:00"	""
+ "n/a"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components"	""	""	""	"12/05/2018 16:53"	""
+ "n/a"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\syswow64\rundll32.exe"	"30/01/1986 11:42"	""
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\IconServiceLib"	""	""	""	"12/05/2018 16:53"	""
"HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce"	""	""	""	""	""
"HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx"	""	""	""	""	""
"HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnConnect"	""	""	""	""	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services\AutoStartOnConnect"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnDisconnect"	""	""	""	""	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services\AutoStartOnDisconnect"	""	""	""	""	""
"HKCU\SOFTWARE\Classes\Protocols\Filter"	""	""	""	""	""
"HKLM\SOFTWARE\Classes\Protocols\Filter"	""	""	""	"12/05/2018 16:53"	""
"HKCU\SOFTWARE\Classes\Protocols\Handler"	""	""	""	""	""
"HKLM\SOFTWARE\Classes\Protocols\Handler"	""	""	""	"12/05/2018 16:53"	""
"HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components"	""	""	""	"12/05/2018 17:03"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler"	""	""	""	"16/12/2018 16:39"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects"	""	""	""	"12/05/2018 16:53"	""
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects"	""	""	""	"16/12/2018 19:36"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"	""	""	""	"12/05/2018 16:53"	""
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"	""	""	""	"27/09/2018 17:53"	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\*\ShellEx\ContextMenuHandlers"	""	""	""	"04/12/2018 18:11"	""
"HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:51"	""
"HKLM\Software\Wow6432Node\Classes\*\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:51"	""
"HKCU\Software\Classes\Drive\ShellEx\ContextMenuHandlers"	""	""	""	""	""
"HKLM\Software\Classes\Drive\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:50"	""
"HKLM\Software\Wow6432Node\Classes\Drive\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:50"	""
"HKCU\Software\Classes\*\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:58"	""
"HKLM\Software\Classes\*\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:55"	""
"HKLM\Software\Wow6432Node\Classes\*\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:55"	""
"HKCU\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers"	""	""	""	""	""
"HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:51"	""
"HKLM\Software\Wow6432Node\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:51"	""
"HKCU\Software\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers"	""	""	""	""	""
"HKLM\Software\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\AllFileSystemObjects\ShellEx\PropertySheetHandlers"	""	""	""	""	""
"HKLM\Software\Classes\AllFileSystemObjects\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\AllFileSystemObjects\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Directory\ShellEx\ContextMenuHandlers"	""	""	""	"04/12/2018 18:11"	""
"HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:50"	""
"HKLM\Software\Wow6432Node\Classes\Directory\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:50"	""
"HKCU\Software\Classes\Directory\Shellex\DragDropHandlers"	""	""	""	"12/05/2018 16:58"	""
"HKLM\Software\Classes\Directory\Shellex\DragDropHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\Directory\Shellex\DragDropHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Directory\Shellex\PropertySheetHandlers"	""	""	""	"12/05/2018 16:58"	""
"HKLM\Software\Classes\Directory\Shellex\PropertySheetHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\Directory\Shellex\PropertySheetHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers"	""	""	""	"12/05/2018 16:58"	""
"HKLM\Software\Classes\Directory\Shellex\CopyHookHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\Directory\Shellex\CopyHookHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers"	""	""	""	"04/12/2018 18:11"	""
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers"	""	""	""	"12/05/2018 16:55"	""
"HKLM\Software\Wow6432Node\Classes\Directory\Background\ShellEx\ContextMenuHandlers"	""	""	""	"12/05/2018 16:55"	""
"HKCU\Software\Classes\Folder\Shellex\ColumnHandlers"	""	""	""	""	""
"HKLM\Software\Classes\Folder\Shellex\ColumnHandlers"	""	""	""	"12/05/2018 16:53"	""
+ "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}"	""	"(Verified) The Document Foundation"	"c:\program files\libreoffice\program\shlxthdl\shlxthdl.dll"	"22/02/2018 23:01"	""
"HKLM\Software\Wow6432Node\Classes\Folder\Shellex\ColumnHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Folder\ShellEx\ContextMenuHandlers"	""	""	""	""	""
"HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:51"	""
"HKLM\Software\Wow6432Node\Classes\Folder\ShellEx\ContextMenuHandlers"	""	""	""	"19/11/2018 17:51"	""
"HKCU\Software\Classes\Folder\ShellEx\DragDropHandlers"	""	""	""	""	""
"HKLM\Software\Classes\Folder\ShellEx\DragDropHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\Folder\ShellEx\DragDropHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Folder\ShellEx\ExtShellFolderViews"	""	""	""	""	""
"HKLM\Software\Classes\Folder\ShellEx\ExtShellFolderViews"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\Folder\ShellEx\ExtShellFolderViews"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Folder\ShellEx\PropertySheetHandlers"	""	""	""	""	""
"HKLM\Software\Classes\Folder\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\Folder\ShellEx\PropertySheetHandlers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers"	""	""	""	"16/12/2018 19:36"	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers"	""	""	""	"22/09/2018 17:32"	""
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\Clsid\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Inprocserver32"	""	""	""	"16/12/2018 19:29"	""
"HKCU\Software\Microsoft\Ctf\LangBarAddin"	""	""	""	"01/12/2018 10:13"	""
"HKLM\Software\Microsoft\Ctf\LangBarAddin"	""	""	""	"12/05/2018 17:02"	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"	""	""	""	"16/12/2018 16:39"	""
+ "HP Network Check Helper"	""	""	"File not found: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll"	""	""
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"	""	""	""	"16/12/2018 16:39"	""
+ "HP Network Check Helper"	""	""	"File not found: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll"	""	""
"HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks"	""	""	""	"12/05/2018 16:57"	""
"HKLM\Software\Microsoft\Internet Explorer\Toolbar"	""	""	""	"16/12/2018 16:39"	""
"HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar"	""	""	""	"16/12/2018 16:39"	""
"HKCU\Software\Microsoft\Internet Explorer\Explorer Bars"	""	""	""	"16/12/2018 10:01"	""
"HKLM\Software\Microsoft\Internet Explorer\Explorer Bars"	""	""	""	"16/12/2018 16:39"	""
"HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars"	""	""	""	"16/12/2018 16:39"	""
"HKCU\Software\Microsoft\Internet Explorer\Extensions"	""	""	""	"16/12/2018 10:01"	""
"HKLM\Software\Microsoft\Internet Explorer\Extensions"	""	""	""	"16/12/2018 16:39"	""
+ "@C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102"	""	""	"File not found: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe"	""	""
"HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions"	""	""	""	"16/12/2018 16:39"	""
+ "@C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102"	""	""	"File not found: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe"	""	""
"Task Scheduler"	""	""	""	""	""
+ "\Microsoft\Windows\Application Experience\StartupAppTask"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
+ "\Microsoft\Windows\ApplicationData\CleanupTemporaryState"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
X "\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
+ "\Microsoft\Windows\Autochk\Proxy"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
X "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
X "\Microsoft\Windows\SharedPC\Account Cleanup"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
+ "\Microsoft\Windows\Sysmain\WsSwapAssessmentTask"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
+ "\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange"	"Windows host process (Rundll32)"	"(Verified) Microsoft Windows"	"c:\windows\system32\rundll32.exe"	"14/04/1957 11:35"	""
"HKLM\System\CurrentControlSet\Services"	""	""	""	"16/12/2018 19:29"	""
+ "cphs"	"Intel(R) Content Protection HECI Service: Intel(R) Content Protection HECI Service - enables communication with the Content Protection FW"	"(Verified) Intel(R) pGFX"	"c:\windows\syswow64\intelcphecisvc.exe"	"18/09/2017 11:36"	""
+ "gupdate"	"Google Update Service (gupdate): Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it."	"(Verified) Google Inc"	"c:\program files (x86)\google\update\googleupdate.exe"	"08/05/2018 22:44"	""
+ "gupdatem"	"Google Update Service (gupdatem): Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it."	"(Verified) Google Inc"	"c:\program files (x86)\google\update\googleupdate.exe"	"08/05/2018 22:44"	""
+ "IAStorDataMgrSvc"	"Intel(R) Rapid Storage Technology: Provides storage event notification and manages communication between the storage driver and user space applications."	"(Verified) Intel Corporation - Rapid Storage Technology"	"c:\program files\intel\intel(r) rapid storage technology\iastordatamgrsvc.exe"	"03/06/2015 09:43"	""
+ "igfxCUIService2.0.0.0"	"Intel(R) HD Graphics Control Panel Service: Service for Intel(R) HD Graphics Control Panel"	"(Verified) Intel(R) pGFX"	"c:\windows\system32\igfxcuiservice.exe"	"16/10/2017 17:43"	""
+ "MozillaMaintenance"	"Mozilla Maintenance Service: The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled."	"(Verified) Mozilla Corporation"	"c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe"	"14/11/2018 23:03"	""
+ "RtkAudioService"	"Realtek Audio Service: For cooperation with Realtek audio driver."	"(Verified) Realtek Semiconductor Corp"	"c:\program files\realtek\audio\hda\rtkaudioservice64.exe"	"22/05/2015 06:16"	""
+ "SynTPEnhService"	"SynTPEnh Caller Service: 64-bit Synaptics Pointing Enhance Service"	"(Verified) Synaptics Incorporated"	"c:\program files\synaptics\syntp\syntpenhservice.exe"	"16/08/2017 23:43"	""
"HKLM\System\CurrentControlSet\Services"	""	""	""	"16/12/2018 19:29"	""
+ "Accelerometer"	"HP Mobile Data Protection Sensor: HP Accelerometer"	"(Verified) HP Inc."	"c:\windows\system32\drivers\accelerometer.sys"	"29/08/2018 06:24"	""
+ "dg_ssudbus"	"SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.): SAMSUNG USB Composite Device Driver"	"(Verified) Samsung Electronics Co., Ltd."	"c:\windows\system32\drivers\ssudbus.sys"	"15/05/2017 07:53"	""
+ "hpdskflt"	"HP Disk Filter: HP Disk Filter - SATA/RAID"	"(Verified) HP Inc."	"c:\windows\system32\drivers\hpdskflt.sys"	"29/08/2018 06:24"	""
+ "iaLPSSi_GPIO"	"Intel(R) Serial IO GPIO Controller Driver: Intel(R) Serial IO GPIO Controller Driver"	"(Verified) Intel Corporation - Client Components Group"	"c:\windows\system32\drivers\ialpssi_gpio.sys"	"02/02/2015 09:00"	""
+ "iaStorA"	"iaStorA: Intel(R) Rapid Storage Technology driver - x64"	"(Verified) Intel Corporation - Rapid Storage Technology"	"c:\windows\system32\drivers\iastora.sys"	"03/06/2015 09:38"	""
+ "igfx"	"igfx: Intel Graphics Kernel Mode Driver"	"(Verified) Intel(R) pGFX"	"c:\windows\system32\drivers\igdkmd64.sys"	"16/10/2017 18:17"	""
+ "IntcAzAudAddService"	"Service for Realtek HD Audio (WDM): Realtek(r) High Definition Audio Function Driver"	"(Verified) Realtek Semiconductor Corp"	"c:\windows\system32\drivers\rtkvhd64.sys"	"07/07/2015 11:13"	""
+ "IntcDAud"	"Intel(R) Display Audio: Intel(R) Display Audio Driver"	"(Verified) Intel(R) OWR"	"c:\windows\system32\drivers\intcdaud.sys"	"10/05/2016 08:08"	""
+ "ISCT"	"Intel(R) Smart Connect Technology Device Driver: Intel(R) Smart Connect Technology Device Driver"	"(Verified) Intel(R) Smart Connect software"	"c:\windows\system32\drivers\isctd64.sys"	"27/11/2012 19:52"	""
+ "iwdbus"	"IWD Bus Enumerator: Intel® WiDi Solution"	"(Verified) Intel Wireless Display"	"c:\windows\system32\drivers\iwdbus.sys"	"13/03/2014 21:59"	""
+ "MEIx64"	"Intel(R) Management Engine Interface : Intel(R) Management Engine Interface"	"(Verified) Intel Corporation - Embedded Subsystems and IP Blocks Group"	"c:\windows\system32\drivers\teedriverw8x64.sys"	"12/06/2015 01:52"	""
+ "RSUSBSTOR"	"RtsUStor.Sys Realtek USB Card Reader: Realtek USB Mass Storage Driver for 2K/XP/Vista/Win7/Win8"	"(Verified) Realtek Semiconductor Corp"	"c:\windows\system32\drivers\rtsustor.sys"	"27/03/2014 02:59"	""
+ "RSUSBVSTOR"	"RtsUVStor.Sys Realtek USB Card Reader: Realtek USB Mass Storage Driver for 2K/XP/Vista/Win7/Win8"	"(Verified) Realtek Semiconductor Corp"	"c:\windows\system32\drivers\rtsuvstor.sys"	"27/03/2014 03:04"	""
+ "rt640x64"	"Realtek RT640 NT Driver: Realtek 8101E/8168/8169 NDIS 6.40 64-bit Driver                "	"(Verified) Realtek Semiconductor Corp"	"c:\windows\system32\drivers\rt640x64.sys"	"05/05/2015 16:21"	""
+ "RtkBtFilter"	"Realtek Bluetooth Filter Driver: Realtek Bluetooth Filter Driver"	"(Verified) Realtek Semiconductor Corp."	"c:\windows\system32\drivers\rtkbtfilter.sys"	"03/04/2018 02:29"	""
+ "RTWlanE"	"Realtek Wireless LAN 802.11n PCI-E Network Adapter: Realtek PCIE NDIS Driver 67063 33137"	"(Verified) Realtek Semiconductor Corp."	"c:\windows\system32\drivers\rtwlane.sys"	"24/07/2018 05:42"	""
+ "SmbDrv"	"SmbDrv: Synaptics SMBus Driver"	"(Verified) Synaptics Incorporated"	"c:\windows\system32\drivers\smb_driver_amdasf.sys"	"16/08/2017 21:24"	""
+ "SmbDrvI"	"SmbDrvI: Synaptics SMBus Driver"	"(Verified) Synaptics Incorporated"	"c:\windows\system32\drivers\smb_driver_intel.sys"	"16/08/2017 21:24"	""
+ "ssudmdm"	"SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.): SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)"	"(Verified) Samsung Electronics Co., Ltd."	"c:\windows\system32\drivers\ssudmdm.sys"	"15/05/2017 07:53"	""
+ "ssudqcfilter"	"SAMSUNG Mobile USB QCRMNET Filter Driver: Filter Driver for the Qualcomm USB Driver Stack"	"(Verified) Samsung Electronics Co., Ltd."	"c:\windows\system32\drivers\ssudqcfilter.sys"	"16/10/2014 16:47"	""
+ "SynTP"	"Synaptics TouchPad Driver: Synaptics Touchpad Win64 Driver"	"(Verified) Synaptics Incorporated"	"c:\windows\system32\drivers\syntp.sys"	"16/08/2017 21:24"	""
+ "WirelessButtonDriver64"	"HP Wireless Button Driver Service: HP Wireless Button Driver"	"(Verified) Hewlett-Packard Company"	"c:\windows\system32\drivers\wirelessbuttondriver64.sys"	"28/05/2015 20:38"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Microsoft\Windows NT\CurrentVersion\Drivers32"	""	""	""	"16/12/2018 10:43"	""
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32"	""	""	""	"16/12/2018 17:45"	""
"HKCU\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32"	""	""	""	"16/12/2018 17:45"	""
+ "VIDC.FMVC"	"FM Screen Capture Codec (VFW)"	"(Not Verified) Fox Magic Software"	"c:\windows\syswow64\fmcodec.dll"	"12/06/2005 14:29"	""
"HKCU\Software\Classes\Filter"	""	""	""	"16/12/2018 19:36"	""
"HKLM\Software\Classes\Filter"	""	""	""	"16/12/2018 19:14"	""
"HKCU\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance"	""	""	""	""	""
"HKCU\Software\Classes\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Classes\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance"	""	""	""	""	""
"HKCU\Software\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance"	""	""	""	""	""
"HKCU\Software\Classes\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Classes\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance"	""	""	""	""	""
"HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance"	""	""	""	"27/09/2018 17:54"	""
+ "Dump"	"Audio Encoder"	"(Not Verified) Viscom Software"	"c:\program files (x86)\dsnet corp\atube catcher 2.0\viscomaudioencoder.dll"	"11/11/2006 13:38"	""
+ "Image Effects"	"Audio Data"	"(Not Verified) Viscom Software"	"c:\program files (x86)\dsnet corp\atube catcher 2.0\viscomaudiodata.dll"	"02/12/2006 13:55"	""
+ "VISCOM Audio Processing"	"viscomaudioprocess.dll"	""	"c:\program files (x86)\dsnet corp\atube catcher 2.0\viscomaudioprocess.dll"	"09/06/2012 05:31"	""
+ "VISCOM Wave Form Display Filter"	"Wave Form"	"(Not Verified) Viscom Software www.viscomsoft.com"	"c:\program files (x86)\dsnet corp\atube catcher 2.0\viscomwaveform.dll"	"07/12/2008 16:19"	""
+ "WAV Dest"	""	"(Not Verified) Viscom Software"	"c:\program files (x86)\dsnet corp\atube catcher 2.0\viscomwave.dll"	"18/08/2003 05:31"	""
+ "What you hear filter"	""	""	"c:\program files (x86)\dsnet corp\atube catcher 2.0\viscomspeaker.dll"	"20/06/2012 11:12"	""
"HKLM\Software\Classes\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Classes\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance"	""	""	""	""	""
"HKLM\Software\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Classes\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Classes\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance"	""	""	""	""	""
"HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute"	""	""	""	"16/12/2018 19:29"	""
"HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute"	""	""	""	"16/12/2018 19:29"	""
"HKLM\System\CurrentControlSet\Control\Session Manager\Execute"	""	""	""	"16/12/2018 19:29"	""
"HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand"	""	""	""	"16/12/2018 19:29"	""
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Microsoft\Command Processor\Autorun"	""	""	""	"12/05/2018 17:03"	""
"HKLM\Software\Wow6432Node\Microsoft\Command Processor\Autorun"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Microsoft\Command Processor\Autorun"	""	""	""	"12/05/2018 17:03"	""
"HKCU\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)"	""	""	""	""	""
"HKLM\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)"	""	""	""	"12/05/2018 16:53"	""
"HKLM\Software\Classes\.exe"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\.exe"	""	""	""	"16/12/2018 19:36"	""
"HKLM\Software\Classes\.cmd"	""	""	""	"12/05/2018 16:53"	""
"HKCU\Software\Classes\.cmd"	""	""	""	"16/12/2018 19:36"	""
"HKCU\SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)"	""	""	""	""	""
"HKLM\SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)"	""	""	""	"12/05/2018 17:04"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls"	""	""	""	"12/05/2018 16:53"	""
"HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls"	""	""	""	"16/12/2018 19:29"	""
"HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls"	""	""	""	"11/04/2018 23:38"	""
+ "_wow64"	""	""	"c:\windows\syswow64\wow64.dll"	""	""
+ "_wow64cpu"	""	""	"c:\windows\syswow64\wow64cpu.dll"	""	""
+ "_wow64win"	""	""	"c:\windows\syswow64\wow64win.dll"	""	""
+ "_wowarmhw"	""	""	"c:\windows\system32\wowarmhw.dll"	""	""
+ "_wowarmhw"	""	""	"c:\windows\syswow64\wowarmhw.dll"	""	""
"HKLM\SYSTEM\Setup\CmdLine"	""	""	""	"16/12/2018 17:38"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman"	""	""	""	"16/12/2018 19:29"	""
"HKCU\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop\Scrnsave.exe"	""	""	""	""	""
"HKCU\Control Panel\Desktop\Scrnsave.exe"	""	""	""	"16/12/2018 19:29"	""
"HKLM\System\CurrentControlSet\Control\BootVerificationProgram\ImagePath"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GpExtensions"	""	""	""	"12/05/2018 16:53"	""
"HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries"	""	""	""	"12/05/2018 16:56"	""
"HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries"	""	""	""	"12/05/2018 16:56"	""
"HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64"	""	""	""	"12/05/2018 16:56"	""
"HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64"	""	""	""	"12/05/2018 16:56"	""
"HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors"	""	""	""	"13/05/2018 11:49"	""
"HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders"	""	""	""	"12/05/2018 16:53"	""
"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages"	""	""	""	"16/12/2018 19:29"	""
"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages"	""	""	""	"11/04/2018 23:38"	""
"HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order"	""	""	""	"12/05/2018 16:53"	""
"WMI Database Entries - run as Administrator for complete scan"	""	""	""	""	""
"HKLM\Software\Microsoft\Office\Outlook\Addins"	""	""	""	""	""
"HKCU\Software\Microsoft\Office\Outlook\Addins"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Office\Outlook\Addins"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Microsoft\Office\Outlook\Addins"	""	""	""	""	""
"HKLM\Software\Microsoft\Office\Excel\Addins"	""	""	""	""	""
"HKCU\Software\Microsoft\Office\Excel\Addins"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Office\Excel\Addins"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Microsoft\Office\Excel\Addins"	""	""	""	""	""
"HKLM\Software\Microsoft\Office\PowerPoint\Addins"	""	""	""	""	""
"HKCU\Software\Microsoft\Office\PowerPoint\Addins"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins"	""	""	""	""	""
"HKLM\Software\Microsoft\Office\Word\Addins"	""	""	""	""	""
"HKCU\Software\Microsoft\Office\Word\Addins"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Office\Word\Addins"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Microsoft\Office\Word\Addins"	""	""	""	""	""
"HKLM\Software\Microsoft\Office\Access\Addins"	""	""	""	""	""
"HKCU\Software\Microsoft\Office\Access\Addins"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Office\Access\Addins"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Microsoft\Office\Access\Addins"	""	""	""	""	""
"HKLM\Software\Microsoft\Office\Onenote\Addins"	""	""	""	""	""
"HKCU\Software\Microsoft\Office\Onenote\Addins"	""	""	""	""	""
"HKLM\Software\Wow6432Node\Microsoft\Office\Onenote\Addins"	""	""	""	""	""
"HKCU\Software\Wow6432Node\Microsoft\Office\Onenote\Addins"	""	""	""	""	""
"HKLM\SOFTWARE\Microsoft\Office test\Special\Perf\(Default)"	""	""	""	""	""
"HKCU\SOFTWARE\Microsoft\Office test\Special\Perf\(Default)"	""	""	""	""	""