<?xml version="1.0" encoding="windows-1251" ?>
<AVZ Version="4.46" LogDate="17.12.2016 13:15:46" WinDir="C:\WINDOWS\" OS_MjVer="6" OS_MiVer="3" OS_Build="9600" OS_ProductName="Windows 8.1 Pro" BootMode="0" OS_CSDV="" ProfileDir="C:\Users\Graels" Session="" Domain="WORKGROUP" IsWow64="True" IsAdmin="True" Base64Mode="False" IsSRDisabled="False" MainDBDate="01.03.2016 12:37:05" CompHash="279130EAF675F7A13115ACBB6A2F1179" AVZMD5="DC6A72DB5A580DE52A06760341661C4E" OSInstallDate="04.10.2016 10:46:03"  >
 <PROCESS>
  <ITEM PID="3284" File="C:\Program Files\Classic Shell\ClassicStartMenu.exe" CheckResult="-1" Descr="Classic Start Menu" LegalCopyright="Copyright (C) 2009-2016, Ivo Beltchev" Hidden="1"  CmdLine="" Size="163800" Attr="rsAh" CreateDate="30.07.2016 09:05:16" ChangeDate="30.07.2016 09:05:16" MD5="5677C8C60F4659E8626AC9036EEF38DF" Vendor="IvoSoft" Product="Classic Shell" OFN="ClassicStartMenu.exe" Ver="4.3.0.0" IsPE="1" IsPE64="1" />
  <ITEM PID="3104" File="c:\program files (x86)\google\update\1.3.32.7\googlecrashhandler.exe" CheckResult="-1" Descr="Google Crash Handler" LegalCopyright="Copyright 2007-2010 Google Inc." Hidden="0"  CmdLine="&quot;C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe&quot;" Size="288920" Attr="rsAh" CreateDate="16.12.2016 23:43:33" ChangeDate="16.12.2016 23:43:21" MD5="FE40EC349D80C0ED24A5808DCFE9A0D2" Vendor="Google Inc." Product="Google Update" OFN="GoogleUpdate.exe" Ver="1.3.32.7" IsPE="1" />
  <ITEM PID="3140" File="C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe" CheckResult="-1" Descr="Google Crash Handler" LegalCopyright="Copyright 2007-2010 Google Inc." Hidden="1"  CmdLine="" Size="366232" Attr="rsAh" CreateDate="16.12.2016 23:43:33" ChangeDate="16.12.2016 23:43:21" MD5="B5C7D56B6DB76C66E24B4B735BB66509" Vendor="Google Inc." Product="Google Update" OFN="GoogleUpdate.exe" Ver="1.3.32.7" IsPE="1" IsPE64="1" />
  <ITEM PID="4772" File="c:\program files (x86)\common files\java\java update\jusched.exe" CheckResult="-1" Descr="Java Update Scheduler" LegalCopyright="Copyright © 2016" Hidden="0"  CmdLine="&quot;C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe&quot; " Size="587288" Attr="rsAh" CreateDate="22.09.2016 20:00:28" ChangeDate="22.09.2016 20:00:28" MD5="5153C06FC9D4D094D1A785545928B134" Vendor="Oracle Corporation" Product="Java Platform SE Auto Updater" OFN="jusched.exe" Ver="2.8.111.14" IsPE="1" />
  <ITEM PID="6844" File="C:\PROGRA~2\McAfee\SITEAD~1\mcsacore.exe" CheckResult="-1" Descr="McAfee WebAdvisor" LegalCopyright="Copyright © 2016 McAfee, Inc." Hidden="1"  CmdLine="" Size="163592" Attr="rsAh" CreateDate="26.11.2016 00:48:54" ChangeDate="11.07.2016 15:04:10" MD5="46FB0DCE8D46A072B4558B5309A997F2" Vendor="McAfee, Inc." Product="McAfee WebAdvisor" OFN="mcsacore.exe" Ver="4.0.3.227" IsPE="1" IsPE64="1" />
  <ITEM PID="1020" File="c:\program files (x86)\360\total security\safemon\qhactivedefense.exe" CheckResult="-1" Descr="360 Total Security" LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved." Hidden="0"  CmdLine="&quot;C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe&quot;" Size="928168" Attr="rsAh" CreateDate="04.10.2016 11:55:30" ChangeDate="25.11.2016 15:35:55" MD5="EEBDDBB9ADC46BE1BFE295EB0A501FC6" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="QHActive.exe" Ver="9.0.0.1002" IsPE="1" />
  <ITEM PID="1316" File="c:\program files (x86)\safeip\safeips.exe" CheckResult="-1" Descr="" LegalCopyright="" Hidden="0"  CmdLine="&quot;C:\Program Files (x86)\SafeIP\SafeIPs.exe&quot;" Size="4606976" Attr="rsAh" CreateDate="10.10.2016 15:10:05" ChangeDate="03.08.2015 08:52:08" MD5="67D030CE2BFC6A1F14CB3759C1239AD5" Vendor="SafeIP" Product="SafeIPS.exe" Ver="2.3.5.7" IsPE="1" />
 </PROCESS>
 <DLL>
  <ITEM File="C:\Program Files (x86)\360\Total Security\360base.dll" CheckResult="-1"  Descr="360???? ????"  LegalCopyright="(C) 360.cn Inc. All Rights Reserved."  UsedBy="1020" Hidden="0" Size="913832" Attr="rsAh" CreateDate="04.10.2016 11:55:33" ChangeDate="25.11.2016 15:35:55" MD5="C9E0DACF589E1D334094A850C6AA03F5" Vendor="360.cn" Product="360????" OFN="360Base.dll" Ver="1.0.0.1128" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\360util.dll" CheckResult="-1"  Descr="360???? ????"  LegalCopyright="(C) 360.cn All Rights Reserved."  UsedBy="1020" Hidden="0" Size="586152" Attr="rsAh" CreateDate="04.10.2016 11:55:35" ChangeDate="25.11.2016 15:35:55" MD5="EFC1C8AFD85979C06D74B6E3DBA08C9F" Vendor="360.cn" Product="360????" OFN="360Util.dll" Ver="1.0.0.1260" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\i18ngi.dll" CheckResult="-1"  Descr="360 Total Security"  LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="92280" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="D0FE061F9C3A9D9A1BA0977E21032F94" Vendor="360.cn" Product="360 Total Security" OFN="I18NGI.dll" Ver="1.0.0.1011" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\deepscan\cloudcom2.dll" CheckResult="-1"  Descr="360 Total Security 2015 Cloud Security"  LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="1208744" Attr="rsAh" CreateDate="04.10.2016 11:55:36" ChangeDate="25.11.2016 15:35:55" MD5="15DBBCC16333C699EE9C522B43F40B35" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security 2015" OFN="cloudcom.DLL" Ver="3.3.10.1116" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\360NetBase.dll" CheckResult="-1"  Descr="360???? ??????"  LegalCopyright="(C)360.cn Inc.All Rights Reserved."  UsedBy="1020" Hidden="0" Size="362608" Attr="rsAh" CreateDate="04.10.2016 11:55:33" ChangeDate="25.11.2016 15:35:55" MD5="5333ADCE19B0047C28E804EC4B27B6EE" Vendor="360.cn" Product="360????" OFN="360NetBase.dll" Ver="7.25.0.68" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\deepscan\BAPI.dll" CheckResult="-1"  Descr="BAPI"  LegalCopyright="(C)360.cn All Rights Reserved."  UsedBy="1020" Hidden="0" Size="255912" Attr="rsAh" CreateDate="04.10.2016 11:55:35" ChangeDate="25.11.2016 15:35:55" MD5="92AFCF0738B92524EF5845704FABB956" Vendor="360.cn" Product="BAPI.DLL" OFN="BAPI.DLL" Ver="2.0.0.1135" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll" CheckResult="-1"  Descr="360 Total Security"  LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="99240" Attr="rsAh" CreateDate="04.10.2016 11:55:42" ChangeDate="25.11.2016 15:35:55" MD5="DAD6308BD57301A001D7F1BDF66571DF" Product="360 Total Security" OFN="qutmload.dll" Ver="7.2.1.1189" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\ipcservice.dll" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="Copyright © 2016 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="591784" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="3251ACE45C2790BF537FF380A4CF3AC9" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="ipcservice.dll" Ver="7.1.2.1441" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\fileMgr.dll" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="Copyright © 2016 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="418216" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="4FAAA899097339DBDDBC51B6ED79F6F9" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="filemgr.dll " Ver="7.3.0.1451" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\yhregd.dll" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="Copyright © 2016 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="412584" Attr="rsAh" CreateDate="04.10.2016 11:55:52" ChangeDate="25.11.2016 15:35:55" MD5="6E517606A2FB62FBE84222F2AFEEA528" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="yhregd.dll" Ver="7.2.0.1641" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\appd.dll" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="Copyright © 2016 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="786344" Attr="rsAh" CreateDate="04.10.2016 11:55:35" ChangeDate="25.11.2016 15:35:55" MD5="230B8F8A6C6E1E0E3EF2DCF6D204F54C" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="appd.dll" Ver="7.3.6.2361" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\netdefender.dll" CheckResult="-1"  Descr="360 Internet Security Internet Protection"  LegalCopyright="Copyright © 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="322984" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="4FF21D2266651AEE228A358586C496B9" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security" OFN="NetDefender.dll" Ver="1.0.0.1129" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\360procmon.dll" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="Copyright © 2014 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="465320" Attr="rsAh" CreateDate="04.10.2016 11:55:34" ChangeDate="25.11.2016 15:35:55" MD5="47425257CF8D01125C97F190C8B5AAD0" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="360procmon.dll" Ver="7.1.1.1221" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\SelfProtectAPI2.dll" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="Copyright © 2015 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="322984" Attr="rsAh" CreateDate="04.10.2016 11:55:46" ChangeDate="25.11.2016 15:35:55" MD5="F30972B1F02BF8520DC60778B94D8A71" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="SelfProtectAPI2.dll" Ver="7.1.1.1033" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\gamemode.tpi" CheckResult="-1"  Descr="360 Total Security Game Mode Control"  LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="196008" Attr="rsAh" CreateDate="04.10.2016 11:55:24" ChangeDate="25.11.2016 15:35:55" MD5="3B38CA75D68408A198D7CCB9C82E984D" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="gamemode.tpi" Ver="9.0.0.1000" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\deepscan\qex\qex.dll" CheckResult="-1"  Descr="360 Internet Security 2016 Antivirus"  LegalCopyright="(C) 2016 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="1967016" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="509858CA90D87CB7510D7BDD138ED2BF" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security 2016" OFN="QEX.dll" Ver="4.1.10.3287" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\qutmipc.dll" CheckResult="-1"  Descr="360???? ???????"  LegalCopyright="(C) 360.cn Inc. All Rights Reserved"  UsedBy="1020" Hidden="0" Size="175016" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="F30399BA2A0193868B6F56EB2E7F43B6" Vendor="360.cn" Product="360????" OFN="qutmipc.dll" Ver="7.3.0.1257" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\SoftMgr\SomAdvUtils.dll" CheckResult="-1"  Descr="360 Safeguard PC Boost"  LegalCopyright="(C) 2016 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="896936" Attr="rsAh" CreateDate="04.10.2016 11:55:46" ChangeDate="25.11.2016 15:35:55" MD5="BAD829EF0B3F88B0B6C4662EE7A3CB84" Vendor="Qihu 360 Software Co., Ltd." Product="360 Safeguard" OFN="SomAdvUtils.dll" Ver="3.1.1.1543" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\360safemonpro.tpi" CheckResult="-1"  Descr="360 Internet Security Internet Protection"  LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="1340024" Attr="rsAh" CreateDate="04.10.2016 11:55:24" ChangeDate="25.11.2016 15:35:55" MD5="6360C1D06B8D5A6C657F8F8DA4BB85AB" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security" OFN="360safemonpro.tpi" Ver="3.1.1.2200" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\sbmon.dll" CheckResult="-1"  Descr="360 Total Security"  LegalCopyright="©Qihu 360 Software Co., Ltd. All rightsreserved."  UsedBy="1020" Hidden="0" Size="371624" Attr="rsAh" CreateDate="04.10.2016 11:55:42" ChangeDate="25.11.2016 15:35:55" MD5="E00B68B190567EF15CC24066EBE9F5F1" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="sbmon.dll" Ver="3.0.0.1071" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\appdext.dll" CheckResult="-1"  Descr="360???? ???????"  LegalCopyright="(C) 360.cn All Rights Reserved"  UsedBy="1020" Hidden="0" Size="1053096" Attr="rsAh" CreateDate="04.10.2016 11:55:35" ChangeDate="25.11.2016 15:35:55" MD5="4EE1B4D5E771F59E3CDB40BF5465ECA0" Vendor="360.cn" Product="360????" OFN="appdext.dll" Ver="1.0.0.1351" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\netmon\Netgm.dll" CheckResult="-1"  Descr="360????? ????????"  LegalCopyright="(C) 360.cn All Rights Reserved."  UsedBy="1020" Hidden="0" Size="420264" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="02E76D79AEEC9DB4854AD4702BE9A431" Vendor="360.cn" Product="360?????" OFN="Netgm.dll" Ver="9.0.0.1000" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\360HipsPopWnd.dll" CheckResult="-1"  Descr="360 Internet Security Proactive Defense"  LegalCopyright="Copyright ? 2015 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="463784" Attr="rsAh" CreateDate="04.10.2016 11:55:33" ChangeDate="25.11.2016 15:35:55" MD5="0A946C01EE4F5389BBEA3C857F6E84CE" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security" OFN="360hipsPopWnd.DLL" Ver="7.3.2.1197" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\deepscan\jcloudscan.dll" CheckResult="-1"  Descr="360???? ???????"  LegalCopyright="(C) 360.cn All Rights Reserved."  UsedBy="1020" Hidden="0" Size="1245296" Attr="rsAh" CreateDate="04.10.2016 11:55:41" ChangeDate="25.11.2016 15:35:55" MD5="F6512A282E20969E9E4EA360BF7DE267" Vendor="360.cn" Product="360???? ???????" OFN="jCloudScan.dll" Ver="1.0.0.1012" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll" CheckResult="-1"  Descr="360 Internet Security 2013 Proactive Defense"  LegalCopyright="Copyright © 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="172968" Attr="rsAh" CreateDate="04.10.2016 11:55:37" ChangeDate="25.11.2016 15:35:55" MD5="F3F0DE9DC5AEB82E4C09EDD8AAC905D2" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security 2013" OFN="DrvUtility.dll" Ver="1.0.0.1077" IsPE="1" IsDLL="1" />
  <ITEM File="C:\WINDOWS\system32\SafeIPs.dll" CheckResult="-1"  Descr=""  LegalCopyright=""  UsedBy="1020" Hidden="0" Size="384000" Attr="rsAh" CreateDate="10.10.2016 10:59:29" ChangeDate="03.08.2015 08:53:04" MD5="9AF6BA0C6A160B0874C2484F4687AB40" Vendor="SafeIP" Product="SafeIPs.dll" Ver="2.3.5.7" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\safemonhlp.dll" CheckResult="-1"  Descr="360 Internet Security Internet Protection"  LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="147368" Attr="rsAh" CreateDate="04.10.2016 11:55:42" ChangeDate="25.11.2016 15:35:55" MD5="78216BBF05616F026D7384A0411F2EDE" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security" OFN="safemonhlp.dll" Ver="1.0.0.1265" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\netmon\360gameidentify.dll" CheckResult="-1"  Descr="360????? ??????"  LegalCopyright="(C) 360.cn All Rights Reserved."  UsedBy="1020" Hidden="0" Size="234096" Attr="rsAh" CreateDate="04.10.2016 11:55:33" ChangeDate="25.11.2016 15:35:55" MD5="8676BEB472ED2C5143136DEF271AB10E" Vendor="360.cn" Product="360?????" OFN="360GameIdentify.dll" Ver="1.0.1.1050" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\ScanStub.dll" CheckResult="-1"  Descr="360 Scan Util Module"  LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="194984" Attr="rsAh" CreateDate="04.10.2016 11:55:45" ChangeDate="25.11.2016 15:35:55" MD5="392B97753A0EDE8346F8ECE53BE0AD55" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="ScanStub.dll" Ver="1.0.0.1010" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\SafeScan.dll" CheckResult="-1"  Descr="360 Scan Util Module"  LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="386984" Attr="rsAh" CreateDate="04.10.2016 11:55:42" ChangeDate="25.11.2016 15:35:55" MD5="B5931C77427EBD07548676BA4734130D" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="SafeScan.dll" Ver="1.0.0.1032" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\filemon\360rp.dll" CheckResult="-1"  Descr="360 FileMon Module"  LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="2722216" Attr="rsAh" CreateDate="04.10.2016 11:55:34" ChangeDate="25.11.2016 15:35:55" MD5="8B5704BD670AAB2532BCD938D035BB0A" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="360rp.dll" Ver="8.8.0.1002" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\360bsmon.tpi" CheckResult="-1"  Descr="360 Total Security Active Protection"  LegalCopyright="Copyright (C) 2015 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="299432" Attr="rsAh" CreateDate="04.10.2016 11:55:24" ChangeDate="25.11.2016 15:35:55" MD5="0C451901521C189D7C42C1F4E6F0EDCC" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="360bsmon.tpi" Ver="6.8.0.1246" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.dll" CheckResult="-1"  Descr="360?? ??????"  LegalCopyright="(C) 360.cn All Rights Reserved."  UsedBy="1020" Hidden="0" Size="54184" Attr="rsAh" CreateDate="04.10.2016 11:55:33" ChangeDate="25.11.2016 15:35:55" MD5="E460328EEB37790953D08FDE0FB48DED" Vendor="360.cn" Product="360??" OFN="360AvFlt.dll" Ver="1.1.0.1033" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\360SafeCamera.tpi" CheckResult="-1"  Descr="360 Total Security Proactive Defense"  LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="437368" Attr="rsAh" CreateDate="04.10.2016 11:55:24" ChangeDate="25.11.2016 15:35:55" MD5="8E92215900BB3CE685F4252F9B390ED2" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="360SafeCamera.tpi" Ver="2.0.0.1030" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\deepscan\AVE\AVEngine.dll" CheckResult="-1"  Descr="360 Internet Security 2013 AntiVirus Engine"  LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="942512" Attr="rsAh" CreateDate="04.10.2016 11:55:35" ChangeDate="25.11.2016 15:35:55" MD5="9D53F939A552C1DB3E1A0AF97C9852AF" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security 2013" OFN="AVEngine.dll" Ver="1.0.0.2014" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\i18n\ru\deepscan\DsRes.dll" CheckResult="-1"  Descr="360 Total Security Cloud Security Resource"  LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd."  UsedBy="1020" Hidden="0" Size="107952" Attr="rsAh" CreateDate="04.10.2016 11:55:38" ChangeDate="25.11.2016 15:35:55" MD5="1C2D603BEC9F4E2ED1F623F1ED142556" Vendor="Qihu 360 Software Co., Ltd." Product="360 Total Security" OFN="DsRes.dll" Ver="1.0.0.1012" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\AntiAdwa.dll" CheckResult="-1"  Descr="360 Total Security Plugin Cleanup Module"  LegalCopyright="©Qihu 360 Software Co., Ltd. All rights reserved."  UsedBy="1020" Hidden="0" Size="3018664" Attr="rsAh" CreateDate="04.10.2016 11:55:35" ChangeDate="25.11.2016 15:35:55" MD5="55CD9C43F95E4E10E467CBD31A8CE0CB" Vendor="QIHU360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="AntiAdwa.dll" Ver="6.6.0.1075" IsPE="1" IsDLL="1" />
  <ITEM File="C:\PROGRA~2\360\TOTALS~1\deepscan\temp\bd\bdcore.dll" CheckResult="-1"  Descr="Bitdefender Core"  LegalCopyright="Copyright© Bitdefender"  UsedBy="1020" Hidden="0" Size="126624" Attr="rsAh" CreateDate="04.10.2016 11:58:50" ChangeDate="04.10.2016 12:55:34" MD5="084D0C35C8B02DB50E5B12666DE848FA" Vendor="Bitdefender" Product="Bitdefender Core" OFN="bdcore.dll" Ver="11.0.1.12" IsPE="1" IsDLL="1" />
 </DLL>
 <KERNELOBJ>
  <ITEM File="C:\WINDOWS\System32\Drivers\360AntiHacker64.sys" CheckResult="-1" Base="21A4F000" MemSize="029000" Descr="360???? ??????" LegalCopyright="(C) 360.cn All Rights Reserved"  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\360AvFlt.sys" CheckResult="-1" Base="21800000" MemSize="019000" Descr="360?? ??????" LegalCopyright="(C) 360.cn All Rights Reserved." Size="86248" Attr="rsAh" CreateDate="04.10.2016 11:56:42" ChangeDate="25.11.2016 15:35:55" MD5="06DC8E24D1846A26FFE978A51B73BBA0" Vendor="360.cn" Product="360??" OFN="360AvFlt.sys" Ver="1.1.0.1056" IsPE="1" IsPE64="1" />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\360Box64.sys" CheckResult="-1" Base="1F0C5000" MemSize="057000" Descr="360Box64" LegalCopyright="(C) 360.cn Inc. All Rights Reserved."  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\360FsFlt.sys" CheckResult="-1" Base="1ED0E000" MemSize="0BC000" Descr="360 Total Security" LegalCopyright="(C)Qihu 360 Software Co., Ltd. All rights reserved."  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\BAPIDRV64.sys" CheckResult="-1" Base="1F483000" MemSize="030000" Descr="BAPIDRV" LegalCopyright="(C)360.cn Inc.All Rights Reserved."  />
  <ITEM File="C:\WINDOWS\System32\Drivers\dump_atapi.sys" CheckResult="-1" Base="20DF5000" MemSize="00A000" Descr="" LegalCopyright=""  />
  <ITEM File="C:\WINDOWS\System32\Drivers\dump_dumpata.sys" CheckResult="-1" Base="1E347000" MemSize="00D000" Descr="" LegalCopyright=""  />
  <ITEM File="C:\WINDOWS\System32\Drivers\dump_dumpfve.sys" CheckResult="-1" Base="1E1E4000" MemSize="016000" Descr="" LegalCopyright=""  />
  <ITEM File="C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys" CheckResult="-1" Base="21A00000" MemSize="00C000" Descr="McAfee WebAdvisor" LegalCopyright="Copyright © 2015 McAfee, Inc." Size="46240" Attr="rsAh" CreateDate="26.11.2016 00:48:54" ChangeDate="06.06.2016 22:08:46" MD5="DA49A90A69B3284FD11B6F02D0209A99" Vendor="McAfee, Inc." Product="McAfee WebAdvisor" OFN="mfesapsn.sys" Ver="1.0.0.111" IsPE="1" IsPE64="1" />
 </KERNELOBJ>
 <Service>
  <ITEM File="c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe" Name="McAfee SiteAdvisor Service" CheckResult="-1" Type="16" State="4" Size="163592" Attr="rsAh" CreateDate="26.11.2016 00:48:54" ChangeDate="11.07.2016 15:04:10" MD5="46FB0DCE8D46A072B4558B5309A997F2" Vendor="McAfee, Inc." Product="McAfee WebAdvisor" OFN="mcsacore.exe" Ver="4.0.3.227" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" Name="QHActiveDefense" CheckResult="-1" Type="16" State="4" Size="928168" Attr="rsAh" CreateDate="04.10.2016 11:55:30" ChangeDate="25.11.2016 15:35:55" MD5="EEBDDBB9ADC46BE1BFE295EB0A501FC6" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="QHActive.exe" Ver="9.0.0.1002" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\SafeIP\SafeIPs.exe" Name="SafeIPS" CheckResult="-1" Type="16" State="4" Size="4606976" Attr="rsAh" CreateDate="10.10.2016 15:10:05" ChangeDate="03.08.2015 08:52:08" MD5="67D030CE2BFC6A1F14CB3759C1239AD5" Vendor="SafeIP" Product="SafeIPS.exe" Ver="2.3.5.7" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" Name="AdobeARMservice" CheckResult="-1" Type="16" State="1" Size="82128" Attr="rsAh" CreateDate="21.10.2016 19:02:44" ChangeDate="21.10.2016 19:02:44" MD5="C92B0A0957ACAD3CEEF502A2CA10ACB8" Vendor="Adobe Systems Incorporated" Product="Adobe Acrobat Update Service" OFN="armsvc.exe" Ver="1.824.20.5020" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Arc\ArcService.exe" Name="ArcService" CheckResult="-1" Type="16" State="1" Size="88024" Attr="rsAh" CreateDate="07.09.2016 15:21:28" ChangeDate="07.09.2016 15:21:28" MD5="9D837CAB7D728A0CBA9A10DF364CE65A" Vendor="Perfect World Entertainment Inc" Product="Arc Service" OFN="ArcService.exe" Ver="1.0.0.1" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" Name="gupdate" CheckResult="-1" Type="16" State="1" Size="153752" Attr="rsAh" CreateDate="04.10.2016 11:37:44" ChangeDate="04.10.2016 11:37:40" MD5="A8FD9222E4D72596BB37DA8BE95C0BA4" Vendor="Google Inc." Product="Google Update" OFN="GoogleUpdate.exe" Ver="1.3.31.5" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" Name="gupdatem" CheckResult="-1" Type="16" State="1" Size="153752" Attr="rsAh" CreateDate="04.10.2016 11:37:44" ChangeDate="04.10.2016 11:37:40" MD5="A8FD9222E4D72596BB37DA8BE95C0BA4" Vendor="Google Inc." Product="Google Update" OFN="GoogleUpdate.exe" Ver="1.3.31.5" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" Name="MozillaMaintenance" CheckResult="-1" Type="16" State="1" Size="172488" Attr="rsAh" CreateDate="07.12.2016 17:38:25" ChangeDate="30.11.2016 07:21:38" MD5="7AAFF443581F9B6F86CDF761ED0A437D" Vendor="Mozilla Foundation" Product="Firefox" OFN="maintenanceservice.exe" Ver="50.0.2.6177" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe" Name="PlaysService" CheckResult="-1" Type="16" State="1" Size="32528" Attr="rsAh" CreateDate="29.09.2016 00:54:06" ChangeDate="29.09.2016 00:54:06" MD5="9C74EDBA872A55AB9732E879C84ECBDF" Vendor="Plays.tv, LLC" Product="PlaysTVService" OFN="plays_service.exe" Ver="1.0.0.0" IsPE="1"  />
  <ITEM File="C:\program files (x86)\skype\Updater\Updater.exe" Name="SkypeUpdate" CheckResult="-1" Type="16" State="1" Size="324224" Attr="RsAh" CreateDate="25.07.2016 12:36:12" ChangeDate="25.07.2016 12:36:12" MD5="4E6FAEE3F259DAC82213D935785991FB" Vendor="Skype Technologies" Product="Skype" Ver="7.0.0.436" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Common Files\Steam\SteamService.exe" Name="Steam Client Service" CheckResult="-1" Type="16" State="1" Size="1467168" Attr="rsAh" CreateDate="04.10.2016 12:01:29" ChangeDate="09.12.2016 23:48:10" MD5="3B710E79D9BE2F149B66FBBF3F57A35E" Vendor="Valve Corporation" Product="Steam Client Service" OFN="SteamService.exe" Ver="3.73.50.89" IsPE="1"  />
 </Service>
 <Drivers>
  <ITEM File="C:\WINDOWS\system32\Drivers\360AntiHacker64.sys" Name="360AntiHacker" CheckResult="-1" Type="1" State="4" Size="151784" Attr="rsAh" CreateDate="04.10.2016 11:55:58" ChangeDate="28.09.2016 09:52:08" MD5="9CC33FFF3AA4725CC3EE1ABDBDAA4CBC" Vendor="360.cn" Product="360????" OFN="360AntiHacker.sys" Ver="1.0.0.1117" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\360AvFlt.sys" Name="360AvFlt" CheckResult="-1" Type="2" State="4" Size="86248" Attr="rsAh" CreateDate="04.10.2016 11:55:58" ChangeDate="25.11.2016 15:35:55" MD5="06DC8E24D1846A26FFE978A51B73BBA0" Vendor="360.cn" Product="360??" OFN="360AvFlt.sys" Ver="1.1.0.1056" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\360Box64.sys" Name="360Box64" CheckResult="-1" Type="2" State="4" Size="330472" Attr="rsAh" CreateDate="04.10.2016 11:56:02" ChangeDate="25.11.2016 15:35:55" MD5="03882DAC88F6C1CAD9101A9FC426B3EF" Vendor="360.cn" OFN="360Box64.sys" Ver="2.1.0.1193" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\360FsFlt.sys" Name="360FsFlt" CheckResult="-1" Type="2" State="4" Size="391392" Attr="rsAh" CreateDate="04.10.2016 11:56:16" ChangeDate="28.09.2016 09:52:07" MD5="A83EC46BA2414BC4150D3151DFCF7955" Vendor="360.cn" Product="360 Total Security" OFN="360FsFlt.sys" Ver="6.9.1.1361" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\WINDOWS\system32\DRIVERS\BAPIDRV64.sys" Name="BAPIDRV" CheckResult="-1" Type="1" State="4" Size="188864" Attr="rsAh" CreateDate="04.10.2016 11:56:01" ChangeDate="28.09.2016 09:52:07" MD5="2E21AD1D7B64A7A040181A61E61A1F39" Vendor="360.cn" OFN="BAPIDRV.SYS" Ver="2.0.0.1085" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys" Name="mfesapsn" CheckResult="-1" Type="1" State="4" Size="46240" Attr="rsAh" CreateDate="26.11.2016 00:48:54" ChangeDate="06.06.2016 22:08:46" MD5="DA49A90A69B3284FD11B6F02D0209A99" Vendor="McAfee, Inc." Product="McAfee WebAdvisor" OFN="mfesapsn.sys" Ver="1.0.0.111" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\Games\ArtMoney\am74364.sys" Name="am7pro" CheckResult="-1" Type="1" State="1" Size="10240" Attr="rsAh" CreateDate="23.10.2016 21:36:09" ChangeDate="24.02.2013 16:06:34" MD5="00835536B64945BABA9FEFC35FF75C64" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\WINDOWS\system32\Drivers\DgiVecp.sys" Name="DgiVecp" CheckResult="-1" Type="1" State="1"   />
 </Drivers>
 <AUTORUN>
  <ITEM File="C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe" CheckResult="-1" Enabled="1" Type="REG" Size="71440" Attr="rsAh" CreateDate="29.09.2016 00:54:06" ChangeDate="29.09.2016 00:54:06" MD5="19AF5C8B039F995EE85FE72484108384" Vendor="Plays.tv, LLC" Product="PlaysTV" OFN="playstv_launcher.exe" Ver="1.14.1.0" IsPE="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="PlaysTV" X4="&quot;C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe&quot; --startup" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe" CheckResult="-1" Enabled="1" Type="REG" Size="58584" Attr="rsAh" CreateDate="29.09.2016 01:07:20" ChangeDate="29.09.2016 01:07:20" MD5="589ED021CF93D745B97FD17DB9013F6F" Vendor="Raptr, Inc" Product="Raptr" OFN="raptrstub.exe" Ver="5.2.7.0" IsPE="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="Raptr" X4="&quot;C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe&quot; --startup" Is64="0" />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" CheckResult="-1" Enabled="1" Type="REG" Size="345000" Attr="rsAh" CreateDate="04.10.2016 11:55:28" ChangeDate="25.11.2016 15:35:55" MD5="69D50F8B1A5C1DCA66F5FA5A267B44E1" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="360Tray.exe" Ver="8.6.0.1004" IsPE="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="QHSafeTray" X4="&quot;C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe&quot; /start" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" CheckResult="-1" Enabled="1" Type="REG" Size="587288" Attr="rsAh" CreateDate="22.09.2016 20:00:28" ChangeDate="22.09.2016 20:00:28" MD5="5153C06FC9D4D094D1A785545928B134" Vendor="Oracle Corporation" Product="Java Platform SE Auto Updater" OFN="jusched.exe" Ver="2.8.111.14" IsPE="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="SunJavaUpdateSched" X4="&quot;C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe&quot;" Is64="0" />
  <ITEM File="C:\Games\Steam\steam.exe" CheckResult="-1" Enabled="1" Type="REG" Size="2876704" Attr="rsAh" CreateDate="23.07.2016 02:36:30" ChangeDate="09.12.2016 23:48:08" MD5="ECAB32E9A6A2CA0B324026D22D1C75F8" Vendor="Valve Corporation" Product="Steam Client Bootstrapper" OFN="steam.exe" Ver="3.73.50.89" IsPE="1" X1="HKEY_CURRENT_USER" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="Steam" X4="&quot;C:\Games\Steam\steam.exe&quot; -silent" Is64="0" />
  <ITEM File="C:\Program Files (x86)\skype\Phone\Skype.exe" CheckResult="-1" Enabled="1" Type="REG" Size="29642368" Attr="RsAh" CreateDate="12.09.2016 18:57:52" ChangeDate="12.09.2016 18:57:52" MD5="86AF3E4A5C595705F47FA3E59EBD7468" Vendor="Skype Technologies S.A." Product="Skype" OFN="Skype.exe" Ver="7.28.64.101" IsPE="1" X1="HKEY_CURRENT_USER" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="Skype" X4="&quot;C:\Program Files (x86)\skype\Phone\Skype.exe&quot; /minimized /regrun" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\win32k.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X3="Kmode" X4="\SystemRoot\System32\win32k.sys" Is64="0" />
  <ITEM File="xvidvfw.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Drivers32" X3="vidc.XVID" X4="xvidvfw.dll" Is64="0" />
  <ITEM File="vp8vfw.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Drivers32" X3="VIDC.VP80" X4="vp8vfw.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\aelupsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\aelupsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\appidsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AppIDSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\appidsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\appinfo.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Appinfo\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\appinfo.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\AppReadiness.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AppReadiness\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\AppReadiness.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\appxdeploymentserver.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AppXSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\appxdeploymentserver.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\AudioEndpointBuilder.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\AudioEndpointBuilder.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Audiosrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Audiosrv\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\Audiosrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\AxInstSV.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AxInstSV\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\AxInstSV.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\bdesvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BDESVC\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\bdesvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\bfe.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BFE\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\bfe.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\qmgr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BITS\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\qmgr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\bisrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BrokerInfrastructure\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\bisrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\browser.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Browser\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\browser.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\bthserv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\bthserv\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\bthserv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\certprop.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\certprop.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\cryptsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\CryptSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\cryptsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\cscsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\CscService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\cscsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\rpcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\rpcss.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\defragsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\defragsvc\Parameters" X3="ServiceDll" X4="%Systemroot%\System32\defragsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\das.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DeviceAssociationService\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\das.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\umpnpmgr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DeviceInstall\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\umpnpmgr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\dnsrslvr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\dnsrslvr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\dot3svc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\dot3svc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\dot3svc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\dps.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DPS\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\dps.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\DeviceSetupManager.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DsmSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\DeviceSetupManager.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\eapsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eaphost\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\eapsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\efssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\EFS\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\efssvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fdPHost.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\fdPHost\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\fdPHost.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fdrespub.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\FDResPub\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\fdrespub.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fhsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\fhsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\fhsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\FntCache.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\FontCache\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\FntCache.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\gpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\gpsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\gpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\kmsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\hkmsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\kmsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\ListSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\HomeGroupListener\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\ListSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ikeext.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ikeext.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\iphlpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\iphlpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\msdtckrm.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\KtmRm\Parameters" X3="ServiceDll" X4="%systemroot%\system32\msdtckrm.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\srvsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\srvsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wkssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wkssvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\lltdsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\lltdsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\lltdsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\lmhsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\lmhosts\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\lmhsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\lsm.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\LSM\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\lsm.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\mmcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MMCSS\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\mmcss.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\mpssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\mpssvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\iscsiexe.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MSiSCSI\Parameters" X3="ServiceDll" X4="%systemroot%\system32\iscsiexe.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\KeyboardFilterSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MsKeyboardFilter\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\KeyboardFilterSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\qagentRT.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\napagent\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\qagentRT.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ncasvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\NcaSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ncasvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ncbservice.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\NcbService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ncbservice.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\NcdAutoSetup.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\NcdAutoSetup\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\NcdAutoSetup.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\netman.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Netman\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\netman.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\netprofmsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\netprofm\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\netprofmsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\nlasvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\nlasvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\nsisvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\nsi\Parameters" X3="ServiceDll" X4="%systemroot%\system32\nsisvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\pnrpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\p2pimsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\pnrpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\p2psvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\p2psvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\p2psvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\pcasvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PcaSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\pcasvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\peerdistsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PeerDistSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\peerdistsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\umpnpmgr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PlugPlay\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\umpnpmgr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\pnrpauto.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PNRPAutoReg\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\pnrpauto.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\pnrpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PNRPsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\pnrpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ipsecsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ipsecsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\umpo.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Power\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\umpo.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\profsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters" X3="ServiceDll" X4="%systemroot%\system32\profsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\rasauto.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RasAuto\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\rasauto.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\rasmans.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RasMan\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\rasmans.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\regsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\regsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\RpcEpMap.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RpcEptMapper\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\RpcEpMap.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\rpcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RpcSs\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\rpcss.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\SCardSvr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SCardSvr\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\SCardSvr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ScDeviceEnum.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\ScDeviceEnum\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ScDeviceEnum.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\schedsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Schedule\Parameters" X3="ServiceDll" X4="%systemroot%\system32\schedsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\certprop.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SCPolicySvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\certprop.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\seclogon.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\seclogon\Parameters" X3="ServiceDll" X4="%windir%\system32\seclogon.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\sens.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SENS\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\sens.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sensrsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SensrSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\sensrsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ipnathlp.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ipnathlp.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ssdpsrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SSDPSRV\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ssdpsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sstpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\sstpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wiaservc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\stisvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wiaservc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\svsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\svsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\svsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\swprv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\swprv\Parameters" X3="ServiceDll" X4="%Systemroot%\System32\swprv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sysmain.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SysMain\Parameters" X3="ServiceDll" X4="%systemroot%\system32\sysmain.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\SystemEventsBrokerServer.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SystemEventsBroker\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\SystemEventsBrokerServer.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\TabSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TabletInputService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\TabSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\termsrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TermService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\termsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\themeservice.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Themes\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\themeservice.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\mmcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\THREADORDER\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\mmcss.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\TimeBrokerServer.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TimeBroker\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\TimeBrokerServer.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\trkwks.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TrkWks\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\trkwks.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\umrdp.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\UmRdpService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\umrdp.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\vaultsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\VaultSvc\Parameters" X3="ServiceDll" X4="C:\Windows\System32\vaultsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmicguestinterface\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmicheartbeat\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmickvpexchange\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmicrdv\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmicshutdown\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmictimesync\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ICSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\vmicvss\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ICSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\w32time.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\Parameters" X3="ServiceDll" X4="%systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wbiosrvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WbioSrvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wbiosrvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wcmsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Wcmsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wcmsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wcncsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wcncsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wecsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wephostsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WEPHOSTSVC\Parameters" X3="ServiceDll" X4="%systemroot%\system32\wephostsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wercplsupport.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wercplsupport\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wercplsupport.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\WerSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WerSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\WerSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wiarpc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WiaRpc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wiarpc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wbem\WMIsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wbem\WMIsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wlansvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WlanSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wlansvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wlidsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wlidsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wlidsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\workfolderssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\workfolderssvc\Parameters" X3="ServiceDll" X4="%systemroot%\system32\workfolderssvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wpdbusenum.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WPDBusEnum\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wpdbusenum.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wscsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wscsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wscsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\WSService.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WSService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\WSService.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wuaueng.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wuauserv\Parameters" X3="ServiceDll" X4="%systemroot%\system32\wuaueng.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\WUDFSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wudfsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\WUDFSvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wwansvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WwanSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wwansvc.dll" Is64="0" />
  <ITEM File="C:\PROGRA~1\MICROS~1\Office15\OLMAPI32.DLL" CheckResult="-1" Enabled="1" Type="REG" Size="5598464" Attr="rsAh" CreateDate="23.08.2016 14:16:00" ChangeDate="23.08.2016 14:16:00" MD5="B15650667E6D12D9F23401D974F8574D" Vendor="Microsoft Corporation" Product="MAPI32" OFN="MAPI32.DLL" Ver="15.0.4859.1000" IsPE="1" IsPE64="1" IsDLL="1" X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Outlook\Performance" X3="Library" X4="C:\PROGRA~1\MICROS~1\Office15\OLMAPI32.DLL" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sysmain.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\rdyboost\Performance" X3="Library" X4="%systemroot%\system32\sysmain.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wersvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang" X3="EventMessageFile" X4="%SystemRoot%\System32\wersvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\ati2erec.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\ATIeRecord" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\ati2erec.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\icardres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\CardSpace 4.0.0.0" X3="EventMessageFile" X4="C:\Windows\System32\icardres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\dwm.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Desktop Window Manager" X3="EventMessageFile" X4="%SystemRoot%\system32\dwm.exe" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\IPSEventLogMsg.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Handwriting Recognition" X3="EventMessageFile" X4="%CommonProgramFiles%\Microsoft Shared\Ink\IPSEventLogMsg.dll" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Hotspot" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\hshld" X3="EventMessageFile" X4="C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe" Is64="0" />
  <ITEM File="Shield\bin\cmw_srv.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\hshld" X3="EventMessageFile" X4="C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\UI0Detect.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Interactive Services detection" X3="EventMessageFile" X4="%SystemRoot%\System32\UI0Detect.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\fxsevent.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax" X3="EventMessageFile" X4="C:\Windows\System32\fxsevent.dll" Is64="0" />
  <ITEM File="C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE15\MSORES.DLL" CheckResult="-1" Enabled="-1" Type="REG" Size="133598456" Attr="rsAh" CreateDate="16.08.2016 13:30:34" ChangeDate="16.08.2016 13:30:34" MD5="851C6855E4B68DB297CA2C750A7A67DA" Vendor="Microsoft Corporation" Product="Microsoft Office 2013" OFN="MsoRes.DLL" Ver="15.0.4857.1000" IsPE="1" IsPE64="1" IsDLL="1" X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Office 15" X3="EventMessageFile" X4="C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE15\MSORES.DLL" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AppModel-Runtime" X3="EventMessageFile" X4="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AppModel-State" X3="EventMessageFile" X4="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\AxInstSv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AxInstallService" X3="EventMessageFile" X4="%SystemRoot%\System32\AxInstSv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\BlbEvents.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Backup" X3="EventMessageFile" X4="%windir%\system32\BlbEvents.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\ddputils.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Deduplication" X3="EventMessageFile" X4="%SystemRoot%\System32\ddputils.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\defragsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Defrag" X3="EventMessageFile" X4="%systemroot%\system32\defragsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\eapsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EapHost" X3="EventMessageFile" X4="%systemroot%\system32\eapsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EventCollector" X3="EventMessageFile" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-SoftwareRestrictionPolicies" X3="EventMessageFile" X4="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\SrEvents.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-System-Restore" X3="EventMessageFile" X4="%windir%\system32\SrEvents.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\profsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User Profiles Service" X3="EventMessageFile" X4="%SystemRoot%\System32\profsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User-Loader" X3="EventMessageFile" X4="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\WINSAT.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WindowsSystemAssessmentTool" X3="EventMessageFile" X4="%SystemRoot%\system32\WINSAT.EXE" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\winsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Winsrv" X3="EventMessageFile" X4="%SystemRoot%\system32\winsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wbem\WinMgmtR.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WMI" X3="EventMessageFile" X4="%SystemRoot%\system32\wbem\WinMgmtR.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\profsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Profsvc" X3="EventMessageFile" X4="%SystemRoot%\System32\profsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wscsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter" X3="EventMessageFile" X4="%SystemRoot%\System32\wscsvc.dll" Is64="0" />
  <ITEM File="C:\program files (x86)\skype\Updater\Updater.exe" CheckResult="-1" Enabled="-1" Type="REG" Size="324224" Attr="RsAh" CreateDate="25.07.2016 12:36:12" ChangeDate="25.07.2016 12:36:12" MD5="4E6FAEE3F259DAC82213D935785991FB" Vendor="Skype Technologies" Product="Skype" Ver="7.0.0.436" IsPE="1" X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\SkypeUpdate" X3="EventMessageFile" X4="C:\program files (x86)\skype\Updater\Updater.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sppsvc.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Protection Platform Service" X3="EventMessageFile" X4="%SystemRoot%\system32\sppsvc.exe" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Common Files\Steam\SteamService.exe" CheckResult="-1" Enabled="-1" Type="REG" Size="1467168" Attr="rsAh" CreateDate="04.10.2016 12:01:29" ChangeDate="09.12.2016 23:48:10" MD5="3B710E79D9BE2F149B66FBBF3F57A35E" Vendor="Valve Corporation" Product="Steam Client Service" OFN="SteamService.exe" Ver="3.73.50.89" IsPE="1" X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Steam Client Service" X3="EventMessageFile" X4="C:\Program Files (x86)\Common Files\Steam\SteamService.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\srcore.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\System Restore" X3="EventMessageFile" X4="%systemroot%\system32\srcore.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmicguestinterface" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmicheartbeat" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmickvpexchange" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmicrdv" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmicshutdown" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmictimesync" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\vmicres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmicvss" X3="EventMessageFile" X4="%systemroot%\system32\vmicres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\VSSVC.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSS" X3="EventMessageFile" X4="%SystemRoot%\System32\VSSVC.EXE" Is64="0" />
  <ITEM File="g:\ce2e88acfa6e35e1cd2e293a509785\DW\DW20.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup" X3="EventMessageFile" X4="g:\ce2e88acfa6e35e1cd2e293a509785\DW\DW20.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wersvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\WerSvc" X3="EventMessageFile" X4="%SystemRoot%\System32\wersvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wsepno.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Search Service Profile Notification" X3="EventMessageFile" X4="%SystemRoot%\system32\wsepno.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wininit.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wininit" X3="EventMessageFile" X4="%SystemRoot%\System32\wininit.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\winlogon.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon" X3="EventMessageFile" X4="%SystemRoot%\System32\winlogon.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\winlogon.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy" X3="EventMessageFile" X4="%SystemRoot%\System32\winlogon.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents" X3="DisplayNameFile" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\KMSVC.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service" X3="DisplayNameFile" X4="%SystemRoot%\system32\KMSVC.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sppsvc.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service\KmsRequests" X3="EventMessageFile" X4="%SystemRoot%\system32\sppsvc.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wevtsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\Microsoft-Windows-Eventlog" X3="EventMessageFile" X4="%SystemRoot%\System32\wevtsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\VSSVC.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\VSSAudit" X3="EventMessageFile" X4="%SystemRoot%\System32\VSSVC.EXE" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\acpi.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ACPI" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\acpi.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\aelupsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc" X3="EventMessageFile" X4="%SystemRoot%\System32\aelupsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\amdk8.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdK8" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\amdk8.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\ati2erec.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\amdkmdag" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\ati2erec.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\ati2erec.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\amdkmdap" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\ati2erec.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\amdppm.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdPPM" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\amdppm.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\winsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Application Popup" X3="EventMessageFile" X4="%SystemRoot%\system32\winsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\AppReadiness.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AppReadiness" X3="EventMessageFile" X4="%SystemRoot%\system32\AppReadiness.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\bxvbda.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b06bdrv" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\bxvbda.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\dxgwdi.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Display" X3="EventMessageFile" X4="%SystemRoot%\System32\dxgwdi.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\dmvscres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\dmvsc" X3="EventMessageFile" X4="%SystemRoot%\System32\dmvscres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\evbda.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ebdrv" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\evbda.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\fltmgr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\FltMgr" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\fltmgr.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\fxppm.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\FxPPM" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\fxppm.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\hidbth.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\HidBth" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\hidbth.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\hidi2c.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\hidi2c" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\hidi2c.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\i8042prt.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\i8042prt" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\i8042prt.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\iaStorAV.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStorAV" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\iaStorAV.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\iaStorV.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStorV" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\iaStorV.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\intelppm.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\intelppm" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\intelppm.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\ipmidrv.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMIDRV" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\ipmidrv.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\isapnp.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\isapnp" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\isapnp.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\iscsilog.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iScsiPrt" X3="EventMessageFile" X4="%SystemRoot%\System32\iscsilog.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\kbdclass.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdclass" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\kbdclass.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\kbdhid.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdhid" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\kbdhid.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\lsasrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv" X3="EventMessageFile" X4="%windir%\System32\lsasrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\lsm.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LSM" X3="EventMessageFile" X4="%SystemRoot%\system32\lsm.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fveapi.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-API" X3="EventMessageFile" X4="%SystemRoot%\system32\fveapi.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\fvevol.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-Driver" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\fvevol.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\qmgr.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Bits-Client" X3="EventMessageFile" X4="%systemroot%\system32\qmgr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\cofiredm.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Client" X3="EventMessageFile" X4="%SystemRoot%\system32\cofiredm.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\cofiredm.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Server" X3="EventMessageFile" X4="%SystemRoot%\system32\cofiredm.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\samsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Directory-Services-SAM" X3="EventMessageFile" X4="%SystemRoot%\System32\samsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\dfdts.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DiskDiagnostic" X3="EventMessageFile" X4="%windir%\system32\dfdts.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\WUDFPlatform.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DriverFrameworks-UserMode" X3="EventMessageFile" X4="%SystemRoot%\system32\WUDFPlatform.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\EhStorTcgDrv.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EnhancedStorage-EhStorTcgDrv" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\EhStorTcgDrv.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EventCollector" X3="EventMessageFile" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wevtsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Eventlog" X3="EventMessageFile" X4="%SystemRoot%\System32\wevtsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\exfat.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-exFAT-SQM" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\exfat.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\fastfat.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Fat-SQM" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\fastfat.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fthsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Fault-Tolerant-Heap" X3="EventMessageFile" X4="%SystemRoot%\system32\fthsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\fltmgr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FilterManager" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\fltmgr.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\mpssvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Firewall" X3="EventMessageFile" X4="%SystemRoot%\system32\mpssvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fdphost.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FunctionDiscoveryHost" X3="EventMessageFile" X4="%SystemRoot%\system32\fdphost.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\msgpioclx.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GPIO-ClassExtension" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\msgpioclx.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\gpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GroupPolicy" X3="EventMessageFile" X4="%systemroot%\system32\gpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\microsoft-windows-hal-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HAL" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-hal-events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\HTTP.SYS" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HttpEvent" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\HTTP.SYS" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\oobe\InstallEventRes.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-InstallUX" X3="EventMessageFile" X4="%SystemRoot%\system32\oobe\InstallEventRes.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\iphlpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Iphlpsvc" X3="EventMessageFile" X4="%windir%\system32\iphlpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Boot" X3="EventMessageFile" X4="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-General" X3="EventMessageFile" X4="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\microsoft-windows-kernel-processor-power-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Interrupt-Steering" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-kernel-processor-power-events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\microsoft-windows-kernel-pnp-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-PnP" X3="EventMessageFile" X4="%SystemRoot%\system32\microsoft-windows-kernel-pnp-events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Power" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-kernel-power-events.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\microsoft-windows-kernel-processor-power-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Processor-Power" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-kernel-processor-power-events.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\Drivers\VerifierExt.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-XDV" X3="EventMessageFile" X4="%SystemDrive%\Windows\System32\Drivers\VerifierExt.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\lpksetup.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-LanguagePackSetup" X3="EventMessageFile" X4="%SystemRoot%\system32\lpksetup.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\MemoryDiagnostic.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Memory-Diagnostic-Task-Handler" X3="EventMessageFile" X4="%SystemRoot%\system32\MemoryDiagnostic.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\relpost.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Results" X3="EventMessageFile" X4="%SystemRoot%\System32\relpost.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\mdsched.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Schedule" X3="EventMessageFile" X4="%SystemRoot%\System32\mdsched.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\mountmgr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MountMgr" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\mountmgr.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\ndis.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-NDIS" X3="EventMessageFile" X4="%windir%\system32\drivers\ndis.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\NdisImPlatform.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-NdisImPlatformSysEvtProvider" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\NdisImPlatform.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\bridge.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-NetworkBridge" X3="EventMessageFile" X4="%windir%\system32\drivers\bridge.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\ntfs.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Ntfs" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\ntfs.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\ntfs.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Ntfs-SQM" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\ntfs.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\ntfs.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Ntfs-UBPM" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\ntfs.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\cscsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-OfflineFiles" X3="EventMessageFile" X4="%systemroot%\system32\cscsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\wof.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-OverlayFilter" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\wof.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\sstpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-RasSstp" X3="EventMessageFile" X4="%SystemRoot%\System32\sstpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\reseteng.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResetEng" X3="EventMessageFile" X4="%windir%\system32\reseteng.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\fdrespub.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResourcePublication" X3="EventMessageFile" X4="%SystemRoot%\system32\fdrespub.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\certprop.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SCPNP" X3="EventMessageFile" X4="%SystemRoot%\system32\certprop.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\SerCx.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Serial-ClassExtension" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\SerCx.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\SerCx2.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Serial-ClassExtension-V2" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\SerCx2.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\oobe\winsetup.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Setup" X3="EventMessageFile" X4="%SystemRoot%\system32\oobe\winsetup.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\setupetw.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SetupPlatform" X3="EventMessageFile" X4="%SystemRoot%\system32\setupetw.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\SpbCx.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SPB-ClassExtension" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\SpbCx.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\hidi2c.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SPB-HIDI2C" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\hidi2c.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\csrsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Subsys-SMSS" X3="EventMessageFile" X4="%windir%\system32\csrsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\schedsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TaskScheduler" X3="EventMessageFile" X4="%SystemRoot%\system32\schedsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\lsm.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager" X3="EventMessageFile" X4="%SystemRoot%\system32\lsm.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\termsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-RemoteConnectionManager" X3="EventMessageFile" X4="%SystemRoot%\system32\termsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\w32time.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Time-Service" X3="EventMessageFile" X4="%SystemRoot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\usbxhci.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-USB-USBXHCI" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\usbxhci.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\umpo.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserModePowerService" X3="EventMessageFile" X4="%SystemRoot%\system32\umpo.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\umpnpmgr.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserPnp" X3="EventMessageFile" X4="%SystemRoot%\system32\umpnpmgr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\whealogr.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WHEA-Logger" X3="EventMessageFile" X4="%systemroot%\system32\whealogr.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\pwlauncher.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsToGo-StartupOptions" X3="EventMessageFile" X4="%SystemRoot%\System32\pwlauncher.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wuaueng.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsUpdateClient" X3="EventMessageFile" X4="%systemroot%\system32\wuaueng.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wininit.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Wininit" X3="EventMessageFile" X4="%SystemRoot%\system32\wininit.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\winlogon.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon" X3="EventMessageFile" X4="%SystemRoot%\system32\winlogon.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\wlansvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WLAN-AutoConfig" X3="EventMessageFile" X4="%windir%\system32\wlansvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\mouclass.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouclass" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\mouclass.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\mouhid.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouhid" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\mouhid.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\umdf\HidBthLE.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mshidumdf" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\umdf\HidBthLE.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\iscsiexe.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MSiSCSI" X3="EventMessageFile" X4="%systemroot%\System32\iscsiexe.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\MTConfig.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MTConfig" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\MTConfig.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\netvscres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\netvsc" X3="EventMessageFile" X4="%SystemRoot%\System32\netvscres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\ntfs.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Ntfs" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\ntfs.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\nvstor.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\nvstor" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\nvstor.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\parport.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Parport" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\parport.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\Pcmcia.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\pcmcia" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\Pcmcia.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\umpo.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Power" X3="EventMessageFile" X4="%SystemRoot%\System32\umpo.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\processr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Processor" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\processr.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\sstpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\RasSstp" X3="EventMessageFile" X4="%systemroot%\system32\sstpsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\refs.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ReFS" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\refs.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\Rt630x64.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\RTL8168" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\Rt630x64.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\samsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM" X3="EventMessageFile" X4="%SystemRoot%\System32\samsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\sbp2port.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sbp2port" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\sbp2port.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\lsasrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel" X3="EventMessageFile" X4="%windir%\System32\lsasrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\SerCx.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sercx" X3="EventMessageFile" X4="\SystemRoot\system32\drivers\SerCx.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\SerCx2.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sercx2" X3="EventMessageFile" X4="\SystemRoot\system32\drivers\SerCx2.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\serial.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Serial" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\serial.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\sermouse.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sermouse" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\sermouse.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\services.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager" X3="EventMessageFile" X4="%SystemRoot%\system32\services.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\snmptrap.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP" X3="EventMessageFile" X4="%SystemRoot%\System32\snmptrap.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\drivers\SpbCx.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\spbcx" X3="EventMessageFile" X4="\SystemRoot\system32\drivers\SpbCx.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wiaservc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage" X3="EventMessageFile" X4="%SystemRoot%\System32\wiaservc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vmstorfltres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\storflt" X3="EventMessageFile" X4="%SystemRoot%\System32\vmstorfltres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\storvsp.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\storvsp" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\storvsp.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\tcpmon.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon" X3="EventMessageFile" X4="%SystemRoot%\System32\tcpmon.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\termsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService" X3="EventMessageFile" X4="%SystemRoot%\system32\termsrv.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\tpm.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TPM" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\tpm.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\tsusbflt.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TsUsbFlt" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\tsusbflt.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\uefi.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\UEFI" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\uefi.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\umrdp.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\UmRdpService" X3="EventMessageFile" X4="%SystemRoot%\System32\umrdp.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\usbehci.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\usbehci" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\usbehci.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vdsbas.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\VDS Basic Provider" X3="EventMessageFile" X4="%SystemRoot%\System32\vdsbas.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vdsdyn.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\VDS Dynamic Provider" X3="EventMessageFile" X4="%SystemRoot%\System32\vdsdyn.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vdsvd.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\VDS Virtual Disk Provider" X3="EventMessageFile" X4="%SystemRoot%\System32\vdsvd.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vds.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Virtual Disk Service" X3="EventMessageFile" X4="%SystemRoot%\System32\vds.exe" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vmbusres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vmbus" X3="EventMessageFile" X4="%SystemRoot%\System32\vmbusres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vmbusres.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vmbusr" X3="EventMessageFile" X4="%SystemRoot%\System32\vmbusres.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\Drivers\VolSnap.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Volsnap" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\VolSnap.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\vpci.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vpci" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\vpci.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\vpcivsp.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vpcivsp" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\vpcivsp.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\w32time.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time" X3="EventMessageFile" X4="%Systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\drivers\wacompen.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WacomPen" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\wacompen.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\Wdf01000.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wdf01000" X3="EventMessageFile" X4="C:\Windows\System32\drivers\Wdf01000.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wecsvc" X3="EventMessageFile" X4="%SystemRoot%\System32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\win32k.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Win32k" X3="EventMessageFile" X4="%SystemRoot%\System32\win32k.sys" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Windows Defender\MpEvMsg.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WinDefend" X3="EventMessageFile" X4="%ProgramFiles%\Windows Defender\MpEvMsg.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\DFDTS.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Disk Diagnostic" X3="EventMessageFile" X4="%SystemRoot%\System32\DFDTS.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\w32time.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient" X3="DllName" X4="%systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\system32\w32time.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" X3="DllName" X4="%systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\WINDOWS\System32\vmictimeprovider.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider" X3="DllName" X4="%SystemRoot%\System32\vmictimeprovider.dll" Is64="0" />
  <ITEM File=".dll" CheckResult="-1" Enabled="-1" Type="?"  X1="HKEY_LOCAL_MACHINE" X2="System\CurrentControlSet\Control\Lsa" X3="Security Packages" X4="&quot;&quot;" Is64="0" />
  <ITEM File="C:\Program Files (x86)\7-Zip\7-zip32.dll" CheckResult="-1" Enabled="1" Type="REG" Size="49664" Attr="rsAh" CreateDate="04.10.2016 12:51:42" ChangeDate="28.09.2016 12:13:08" MD5="1A5BBBF26183F120D513589031FF19BD" Vendor="Igor Pavlov" Product="7-Zip" OFN="7-zip.dll" Ver="16.3.0.0" IsPE="1" IsDLL="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" X3="{23170F69-40C1-278A-1000-000100020000}" X4="7-Zip Shell Extension" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Microsoft Office\Office15\NAMEEXT.DLL" CheckResult="-1" Enabled="1" Type="REG" Size="326912" Attr="rsAh" CreateDate="16.08.2016 13:36:46" ChangeDate="16.08.2016 13:36:46" MD5="B7698163FD067A6C466F7AB28EABC394" Vendor="Microsoft Corporation" Product="Microsoft Office 2013" OFN="nameext.dll" Ver="15.0.4833.1000" IsPE="1" IsDLL="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" X3="{DB19096C-5365-4164-A246-59FEFF9D8062}" X4="Nameext" Is64="0" />
  <ITEM File="C:\Program Files\Classic Shell\ClassicStartMenu.exe" CheckResult="-1" Enabled="1" Type="REG" Size="163800" Attr="rsAh" CreateDate="30.07.2016 09:05:16" ChangeDate="30.07.2016 09:05:16" MD5="5677C8C60F4659E8626AC9036EEF38DF" Vendor="IvoSoft" Product="Classic Shell" OFN="ClassicStartMenu.exe" Ver="4.3.0.0" IsPE="1" IsPE64="1" X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="Classic Start Menu" X4="&quot;C:\Program Files\Classic Shell\ClassicStartMenu.exe&quot; -autorun" Is64="1" />
  <ITEM File="C:\PROGRA~1\MICROS~1\Office15\MLCFG32.CPL" CheckResult="-1" Enabled="1" Type="REG" Size="85264" Attr="rsAh" CreateDate="23.08.2016 14:16:00" ChangeDate="23.08.2016 14:16:00" MD5="3E4F7491C0BBCDF0A3DC2A2EE9B33026" Vendor="Microsoft Corporation" Product="Microsoft Outlook" OFN="mlcfg32.cpl" Ver="15.0.4859.1001" IsPE="1" IsPE64="1" IsDLL="1" X1="HKEY_LOCAL_MACHINE" X2="SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls" X3="mlcfg32.cpl" X4="C:\PROGRA~1\MICROS~1\Office15\MLCFG32.CPL" Is64="1" />
  <ITEM File="auditcse.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{16be69fa-4209-4250-88cb-716cf41954e0}" X3="DLLName" X4="auditcse.dll" Is64="1" />
  <ITEM File="C:\WINDOWS\System32\TsUsbRedirectionGroupPolicyExtension.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}" X3="DLLName" X4="C:\WINDOWS\System32\TsUsbRedirectionGroupPolicyExtension.dll" Is64="1" />
  <ITEM File="WorkFoldersGPExt.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4d968b55-cac2-4ff5-983f-0a54603781a3}" X3="DLLName" X4="WorkFoldersGPExt.dll" Is64="1" />
  <ITEM File="pwlauncher.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}" X3="DLLName" X4="pwlauncher.dll" Is64="1" />
  <ITEM File="pwlauncher.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C34B2751-1CF4-44F5-9262-C3FC39666591}" X3="DLLName" X4="pwlauncher.dll" Is64="1" />
  <ITEM File="auditcse.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}" X3="DLLName" X4="auditcse.dll" Is64="1" />
  <ITEM File="C:\Windows\System32\WUDFHost.exe" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\WUDF\Services\{193a1820-d9ac-4997-8c55-be817523f6aa}" X3="HostProcessImagePath" X4="C:\Windows\System32\WUDFHost.exe" Is64="1" />
  <ITEM File="C:\Program Files\MediaTek\SP Driver\SPDriverInstall" CheckResult="-1" Enabled="1" Type="LNK"  X1="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" X2="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SPDriverInstall.lnk" X3="" X4="" Is64="0" />
  <ITEM File="G:\games\Carmageddon Reincarnation\Carmageddon_Reincarnation.exe" CheckResult="-1" Enabled="1" Type="LNK" Size="37026304" Attr="rsAh" CreateDate="22.10.2016 03:01:11" ChangeDate="12.12.1999 00:00:00" MD5="75E3D03B6075D62842895C3C757B913F" IsPE="1" X1="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\" X2="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Carmageddon Reincarnation.lnk" X3="" X4="" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" CheckResult="-1" Enabled="1" Type="LNK" Size="1104728" Attr="rsAh" CreateDate="04.10.2016 11:38:13" ChangeDate="08.12.2016 11:03:12" MD5="638EC39FFA5EB20E09F03E3433E9746E" Vendor="Google Inc." Product="Google Chrome" OFN="chrome.exe" Ver="55.0.2883.87" IsPE="1" IsPE64="1" X1="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\" X2="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk" X3="" X4="" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" CheckResult="-1" Enabled="1" Type="LNK" Size="1104728" Attr="rsAh" CreateDate="04.10.2016 11:38:13" ChangeDate="08.12.2016 11:03:12" MD5="638EC39FFA5EB20E09F03E3433E9746E" Vendor="Google Inc." Product="Google Chrome" OFN="chrome.exe" Ver="55.0.2883.87" IsPE="1" IsPE64="1" X1="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\" X2="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Helium Backup.lnk" X3="" X4="" Is64="0" />
  <ITEM File="C:\Program Files (x86)\SafeIP\SafeIP.exe" CheckResult="-1" Enabled="1" Type="LNK" Size="580672" Attr="rsAh" CreateDate="10.10.2016 15:10:05" ChangeDate="17.09.2016 00:16:14" MD5="2EF9BB35CDB4C7AE1F60DECA09D6795B" Vendor="SafeIP" Product="SafeIP" OFN="SafeIP.exe" Ver="2.0.0.2616" IsPE="1" X1="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\" X2="C:\Users\Graels\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SafeIP.lnk" X3="" X4="" Is64="0" />
 </AUTORUN>
 <BHO>
  <ITEM File="C:\Program Files\Classic Shell\ClassicExplorer32.dll" CheckResult="-1" Enabled="1" BHOType="1" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" CLSID="{449D0D6E-2412-4E61-B68F-1CB625CD9E52}" Descr="Adds classic Windows Explorer features" LegalCopyright="Copyright (C) 2009-2016, Ivo Beltchev" Size="759768" Attr="rsAh" CreateDate="30.07.2016 09:05:14" ChangeDate="30.07.2016 09:05:14" MD5="2469911CBE27325EFBBAA1025F1D35E9" Vendor="IvoSoft" Product="Classic Shell" OFN="ClassicExplorer.dll" Ver="4.3.0.0" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll" CheckResult="-1" Enabled="1" BHOType="1" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" CLSID="{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" Descr="Java(TM) Platform SE binary" LegalCopyright="Copyright © 2016" Size="473152" Attr="rsAh" CreateDate="23.10.2016 16:16:38" ChangeDate="23.10.2016 16:16:38" MD5="5C9188D55288BE35FF0C5D70297090AC" Vendor="Oracle Corporation" Product="Java(TM) Platform SE 8 U111" OFN="ssv.dll" Ver="11.111.2.14" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files (x86)\Arc\Plugins\ArcPluginIE.dll" CheckResult="-1" Enabled="1" BHOType="1" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" CLSID="{84BFE29A-8139-402a-B2A4-C23AE9E1A75F}" Descr="ArcPlugin Dynamic Link Library Supporting IE" LegalCopyright="Copyright(C)2010. Perfect World Entertainment Inc.All rights reserved." Size="120792" Attr="rsAh" CreateDate="07.09.2016 15:21:30" ChangeDate="07.09.2016 15:21:30" MD5="D789923B216F60EB4D98BF27E1B1819C" Vendor="Perfect World Entertainment Inc" Product="ArcPlugin" OFN="ArcPluginIE.dll" Ver="1.0.0.1" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files (x86)\360\Total Security\safemon\safemon.dll" CheckResult="-1" Enabled="1" BHOType="1" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" CLSID="{B69F34DD-F0F9-42DC-9EDD-957187DA688D}" Descr="360 Internet Security Internet Protection" LegalCopyright="(C) 2013 Qihu 360 Software Co., Ltd." Size="1450920" Attr="rsAh" CreateDate="04.10.2016 11:55:42" ChangeDate="25.11.2016 15:35:55" MD5="B424DB9685EC2FED690548244C9CB8A1" Vendor="Qihu 360 Software Co., Ltd." Product="360 Internet Security" OFN="safemon.dll" Ver="8.4.0.1400" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll" CheckResult="-1" Enabled="1" BHOType="1" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" CLSID="{DBC80044-A445-435b-BC74-9C25C1C588A9}" Descr="Java(TM) Platform SE binary" LegalCopyright="Copyright © 2016" Size="186944" Attr="rsAh" CreateDate="23.10.2016 16:16:37" ChangeDate="23.10.2016 16:16:37" MD5="F679C03DEE56E10D4196192E1DCEFB03" Vendor="Oracle Corporation" Product="Java(TM) Platform SE 8 U111" OFN="jp2ssv.dll" Ver="11.111.2.14" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files\Classic Shell\ClassicIEDLL_32.dll" CheckResult="-1" Enabled="1" BHOType="1" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" CLSID="{EA801577-E6AD-4BD5-8F71-4BE0154331A4}" Descr="Customizations for the title bar and status bar of IE" LegalCopyright="Copyright (C) 2009-2016, Ivo Beltchev" Size="505816" Attr="rsAh" CreateDate="30.07.2016 09:05:14" ChangeDate="30.07.2016 09:05:14" MD5="1739C49106056269134C92C6B2AD0D84" Vendor="IvoSoft" Product="Classic Shell" OFN="ClassicIEDLL.dll" Ver="4.3.0.0" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files\Classic Shell\ClassicExplorer32.dll" CheckResult="-1" Enabled="1" BHOType="2" RegKey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" CLSID="{553891B7-A0D5-4526-BE18-D3CE461D6310}" Descr="Adds classic Windows Explorer features" LegalCopyright="Copyright (C) 2009-2016, Ivo Beltchev" Size="759768" Attr="rsAh" CreateDate="30.07.2016 09:05:14" ChangeDate="30.07.2016 09:05:14" MD5="2469911CBE27325EFBBAA1025F1D35E9" Vendor="IvoSoft" Product="Classic Shell" OFN="ClassicExplorer.dll" Ver="4.3.0.0" IsPE="1" IsDLL="1"  />
  <ITEM File="" CheckResult="-1" Enabled="1" BHOType="3" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" CLSID="{2670000A-7350-4f3c-8081-5663EE0C6C49}" Descr="" LegalCopyright=""   />
  <ITEM File="C:\Program Files\Classic Shell\ClassicIE_32.exe" CheckResult="-1" Enabled="1" BHOType="3" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" CLSID="{56753E59-AF1D-4FBA-9E15-31557124ADA2}" Descr="Classic IE" LegalCopyright="Copyright (C) 2009-2016, Ivo Beltchev" Size="104408" Attr="rsAh" CreateDate="30.07.2016 09:05:14" ChangeDate="30.07.2016 09:05:14" MD5="F8B703598ABE9BCB30B9224812C1C574" Vendor="IvoSoft" Product="Classic Shell" OFN="ClassicIE.exe" Ver="4.3.0.0" IsPE="1"  />
  <ITEM File="" CheckResult="-1" Enabled="1" BHOType="3" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" CLSID="{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}" Descr="" LegalCopyright=""   />
 </BHO>
 <ExplorerExt>
  <ITEM File="" CheckResult="-1" Enabled="1" ExtType="1" ExtName="Contacts folder" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" CLSID="{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}" Descr="" LegalCopyright=""   />
  <ITEM File="" CheckResult="-1" Enabled="1" ExtType="1" ExtName="WebCheck" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" CLSID="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" Descr="" LegalCopyright=""   />
  <ITEM File="" CheckResult="-1" Enabled="1" ExtType="1" ExtName="Catalyst Context Menu extension" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" CLSID="{5E2121EE-0300-11D4-8D3B-444553540000}" Descr="" LegalCopyright=""   />
  <ITEM File="C:\Program Files (x86)\7-Zip\7-zip32.dll" CheckResult="-1" Enabled="1" ExtType="1" ExtName="7-Zip Shell Extension" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" CLSID="{23170F69-40C1-278A-1000-000100020000}" Descr="7-Zip Shell Extension" LegalCopyright="Copyright (c) 1999-2016 Igor Pavlov" Size="49664" Attr="rsAh" CreateDate="04.10.2016 12:51:42" ChangeDate="28.09.2016 12:13:08" MD5="1A5BBBF26183F120D513589031FF19BD" Vendor="Igor Pavlov" Product="7-Zip" OFN="7-zip.dll" Ver="16.3.0.0" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\Program Files (x86)\Microsoft Office\Office15\NAMEEXT.DLL" CheckResult="-1" Enabled="1" ExtType="1" ExtName="Nameext" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" CLSID="{DB19096C-5365-4164-A246-59FEFF9D8062}" Descr="Microsoft Office 2013 component" LegalCopyright="" Size="326912" Attr="rsAh" CreateDate="16.08.2016 13:36:46" ChangeDate="16.08.2016 13:36:46" MD5="B7698163FD067A6C466F7AB28EABC394" Vendor="Microsoft Corporation" Product="Microsoft Office 2013" OFN="nameext.dll" Ver="15.0.4833.1000" IsPE="1" IsDLL="1"  />
 </ExplorerExt>
 <PrintEXT>
  <ITEM File="localspl.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="FXSMON.DLL" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="tcpmon.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="usbmon.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="WSDMon.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="xrxs1l6.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="inetpp.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Providers" Descr="" LegalCopyright=""   />
  <ITEM File="win32spl.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Providers" Descr="" LegalCopyright=""   />
 </PrintEXT>
 <TaskScheduler>
  <ITEM File="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" JobName="Adobe Acrobat Update Task" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="Adobe Reader and Acrobat Manager" LegalCopyright="" SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe " is64="1" TaskMode="2" Size="1156824" Attr="rsAh" CreateDate="21.10.2016 19:02:44" ChangeDate="21.10.2016 19:02:44" MD5="220ADB2D8475CF40556F61688D3A3EA3" Vendor="Adobe Systems Incorporated" Product="Adobe Reader and Acrobat Manager" OFN="AdobeARM.exe" Ver="1.824.20.5020" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" JobName="GoogleUpdateTaskMachineCore" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="Óñòàíîâùèê Google" LegalCopyright="© Google Inc., 2007–2010 ãã." SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe  /c" is64="1" TaskMode="2" Size="153752" Attr="rsAh" CreateDate="04.10.2016 11:37:44" ChangeDate="04.10.2016 11:37:40" MD5="A8FD9222E4D72596BB37DA8BE95C0BA4" Vendor="Google Inc." Product="Google Update" OFN="GoogleUpdate.exe" Ver="1.3.31.5" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" JobName="GoogleUpdateTaskMachineUA" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="Óñòàíîâùèê Google" LegalCopyright="© Google Inc., 2007–2010 ãã." SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe  /ua /installsource scheduler" is64="1" TaskMode="2" Size="153752" Attr="rsAh" CreateDate="04.10.2016 11:37:44" ChangeDate="04.10.2016 11:37:40" MD5="A8FD9222E4D72596BB37DA8BE95C0BA4" Vendor="Google Inc." Product="Google Update" OFN="GoogleUpdate.exe" Ver="1.3.31.5" IsPE="1"  />
  <ITEM File=" aitagent  /increment" JobName="AitAgent" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="" LegalCopyright="" SHPath="C:\WINDOWS\system32\Tasks\Microsoft\Windows\Application Experience\" FullCmd=" aitagent  /increment" is64="1" TaskMode="2"   />
  <ITEM File="G:\games\Mafia\Game.exe" JobName="{35FC510C-BE0B-4091-AA1F-7084C8529FD7}" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="" LegalCopyright="" SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\WINDOWS\system32\pcalua.exe  -a G:\games\Mafia\Game.exe -d G:\games\Mafia" is64="1" TaskMode="2"   />
  <ITEM File="..\EPSETUP.EXE" JobName="{CE4BDE83-42E8-4AB6-9A7E-85DA55A124F7}" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="" LegalCopyright="" SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\WINDOWS\system32\pcalua.exe  -a E:\_SETIMG\EPSSWT.EXE -d E:\ -c /NODISP:&quot;ALL&quot; /NOWIZ:&quot;..\EPSETUP.EXE&quot; /ST:&quot;2500,WIN98,WINME&quot; /WIZ:&quot;&quot;" is64="1" TaskMode="2"   />
  <ITEM File="E:\_SETIMG\EPSSWT.EXE" JobName="{CE4BDE83-42E8-4AB6-9A7E-85DA55A124F7}" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="Wizard Process Checking Utility" LegalCopyright="Copyright (C) 2003 SEIKO EPSON CORPORATION. All Rights Reserved." SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\WINDOWS\system32\pcalua.exe  -a E:\_SETIMG\EPSSWT.EXE -d E:\ -c /NODISP:&quot;ALL&quot; /NOWIZ:&quot;..\EPSETUP.EXE&quot; /ST:&quot;2500,WIN98,WINME&quot; /WIZ:&quot;&quot;" is64="1" TaskMode="2" Size="110592" Attr="Rsah" CreateDate="08.01.2004 04:03:00" ChangeDate="08.01.2004 04:03:00" MD5="111B7C2B704B1AB477471E086381BF73" Vendor="SEIKO EPSON CORPORATION" Product="Wizard Process Checking Utility" OFN="EPSSWT.EXE" Ver="1.0.3.2" IsPE="1"  />
  <ITEM File="C:\Users\Graels\AppData\Roaming\Nox\bin\Nox_unload.exe" JobName="{DA453641-AA17-47EA-8DB4-F5B646004F2B}" Status="908578560" CheckResult="-1" Enabled="55556624" Descr="" LegalCopyright="" SHPath="C:\WINDOWS\system32\Tasks\" FullCmd=" C:\WINDOWS\system32\pcalua.exe  -a C:\Users\Graels\AppData\Roaming\Nox\bin\Nox_unload.exe" is64="1" TaskMode="2"   />
 </TaskScheduler>
 <SPI>
  <ITEM File="C:\WINDOWS\system32\SafeIPs.dll" CheckResult="-1" SPIType="3" SPINaim="SafeIP over [MSAFD Tcpip [TCP/IP]]" Descr="" LegalCopyright="" Size="384000" Attr="rsAh" CreateDate="10.10.2016 10:59:29" ChangeDate="03.08.2015 08:53:04" MD5="9AF6BA0C6A160B0874C2484F4687AB40" Vendor="SafeIP" Product="SafeIPs.dll" Ver="2.3.5.7" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\WINDOWS\system32\SafeIPs.dll" CheckResult="-1" SPIType="3" SPINaim="SafeIP over [MSAFD Tcpip [UDP/IP]]" Descr="" LegalCopyright="" Size="384000" Attr="rsAh" CreateDate="10.10.2016 10:59:29" ChangeDate="03.08.2015 08:53:04" MD5="9AF6BA0C6A160B0874C2484F4687AB40" Vendor="SafeIP" Product="SafeIPs.dll" Ver="2.3.5.7" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\WINDOWS\system32\SafeIPs.dll" CheckResult="-1" SPIType="3" SPINaim="SafeIP over [MSAFD Tcpip [TCP/IPv6]]" Descr="" LegalCopyright="" Size="384000" Attr="rsAh" CreateDate="10.10.2016 10:59:29" ChangeDate="03.08.2015 08:53:04" MD5="9AF6BA0C6A160B0874C2484F4687AB40" Vendor="SafeIP" Product="SafeIPs.dll" Ver="2.3.5.7" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\WINDOWS\system32\SafeIPs.dll" CheckResult="-1" SPIType="3" SPINaim="SafeIP over [MSAFD Tcpip [UDP/IPv6]]" Descr="" LegalCopyright="" Size="384000" Attr="rsAh" CreateDate="10.10.2016 10:59:29" ChangeDate="03.08.2015 08:53:04" MD5="9AF6BA0C6A160B0874C2484F4687AB40" Vendor="SafeIP" Product="SafeIPs.dll" Ver="2.3.5.7" IsPE="1" IsDLL="1"  />
  <ITEM File="C:\WINDOWS\system32\SafeIPs.dll" CheckResult="-1" SPIType="3" SPINaim="SafeIP" Descr="" LegalCopyright="" Size="384000" Attr="rsAh" CreateDate="10.10.2016 10:59:29" ChangeDate="03.08.2015 08:53:04" MD5="9AF6BA0C6A160B0874C2484F4687AB40" Vendor="SafeIP" Product="SafeIPs.dll" Ver="2.3.5.7" IsPE="1" IsDLL="1"  />
 </SPI>
 <PORTS>
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="1" LocalPort="135" RemotePort="0" RemoteHost="0.0.0.0" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="System.exe" CheckResult="-1" PortType="1" LocalPort="139" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="System.exe" CheckResult="-1" PortType="1" LocalPort="445" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="System.exe" CheckResult="-1" PortType="1" LocalPort="5357" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="c:\program files (x86)\safeip\safeips.exe" CheckResult="-1" PortType="1" LocalPort="12344" RemotePort="0" RemoteHost="0.0.0.0" Size="4606976" Attr="rsAh" CreateDate="10.10.2016 15:10:05" ChangeDate="03.08.2015 08:52:08" MD5="67D030CE2BFC6A1F14CB3759C1239AD5" Vendor="SafeIP" Product="SafeIPS.exe" Ver="2.3.5.7" IsPE="1"  />
  <ITEM File="wininit.exe" CheckResult="-1" PortType="1" LocalPort="49152" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="1" LocalPort="49153" RemotePort="0" RemoteHost="0.0.0.0" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="lsass.exe" CheckResult="-1" PortType="1" LocalPort="49154" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="1" LocalPort="49155" RemotePort="0" RemoteHost="0.0.0.0" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="spoolsv.exe" CheckResult="-1" PortType="1" LocalPort="49156" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="services.exe" CheckResult="-1" PortType="1" LocalPort="49160" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="c:\program files (x86)\360\total security\safemon\qhactivedefense.exe" CheckResult="-1" PortType="1" LocalPort="52819" RemotePort="80" RemoteHost="54.76.166.0" Size="928168" Attr="rsAh" CreateDate="04.10.2016 11:55:30" ChangeDate="25.11.2016 15:35:55" MD5="EEBDDBB9ADC46BE1BFE295EB0A501FC6" Vendor="QIHU 360 SOFTWARE CO. LIMITED" Product="360 Total Security" OFN="QHActive.exe" Ver="9.0.0.1002" IsPE="1"  />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58386" RemotePort="443" RemoteHost="173.194.222.95"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58388" RemotePort="443" RemoteHost="64.233.161.84"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58389" RemotePort="80" RemoteHost="93.171.223.59"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58390" RemotePort="80" RemoteHost="93.171.223.59"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58391" RemotePort="80" RemoteHost="93.171.223.59"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58392" RemotePort="80" RemoteHost="93.171.223.59"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58395" RemotePort="80" RemoteHost="138.201.21.81"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58397" RemotePort="80" RemoteHost="104.27.156.222"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58399" RemotePort="443" RemoteHost="173.194.222.95"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58400" RemotePort="443" RemoteHost="108.177.14.93"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58401" RemotePort="443" RemoteHost="74.125.131.95"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58402" RemotePort="443" RemoteHost="74.125.232.227"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58403" RemotePort="443" RemoteHost="64.233.161.84"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58404" RemotePort="443" RemoteHost="74.125.232.227"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58405" RemotePort="80" RemoteHost="52.48.233.160"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58406" RemotePort="80" RemoteHost="52.48.233.160"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58411" RemotePort="443" RemoteHost="173.194.32.151"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58413" RemotePort="443" RemoteHost="87.250.250.41"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58414" RemotePort="443" RemoteHost="136.243.152.144"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58415" RemotePort="443" RemoteHost="213.251.139.49"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58416" RemotePort="80" RemoteHost="138.201.21.81"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58417" RemotePort="80" RemoteHost="138.201.21.81"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58424" RemotePort="80" RemoteHost="91.228.155.94"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58425" RemotePort="80" RemoteHost="91.228.155.94"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58432" RemotePort="80" RemoteHost="5.45.79.6"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58433" RemotePort="80" RemoteHost="5.45.79.6"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58442" RemotePort="443" RemoteHost="87.240.131.114"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58443" RemotePort="443" RemoteHost="87.240.131.114"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58444" RemotePort="443" RemoteHost="87.240.131.114"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58445" RemotePort="443" RemoteHost="87.240.131.114"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58446" RemotePort="443" RemoteHost="87.240.131.114"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58447" RemotePort="443" RemoteHost="87.240.131.114"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58451" RemotePort="80" RemoteHost="91.225.238.162"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58452" RemotePort="80" RemoteHost="91.225.238.162"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="58456" RemotePort="80" RemoteHost="5.45.75.23"   />
  <ITEM File="System.exe" CheckResult="-1" PortType="2" LocalPort="137" RemotePort="0" RemoteHost=""   />
  <ITEM File="System.exe" CheckResult="-1" PortType="2" LocalPort="138" RemotePort="0" RemoteHost=""   />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="1900" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="1900" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="dasHost.exe" CheckResult="-1" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost=""   />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="dasHost.exe" CheckResult="-1" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost=""   />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="5355" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="dasHost.exe" CheckResult="-1" PortType="2" LocalPort="61247" RemotePort="0" RemoteHost=""   />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="61249" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="64991" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="65325" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
  <ITEM File="C:\WINDOWS\SYSTEM32\svchost.exe" CheckResult="0" PortType="2" LocalPort="65326" RemotePort="0" RemoteHost="" Size="31552" Attr="rsAh" CreateDate="22.08.2013 05:48:05" ChangeDate="22.08.2013 08:30:58" MD5="425E22D9F5C01616AFC92987791B19E9" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.3.9600.16384" IsPE="1"  />
 </PORTS>
 <DPF>
 </DPF>
 <CPL>
  <ITEM File="C:\WINDOWS\system32\FlashPlayerCPLApp.cpl" CheckResult="-1" Enabled="1" Descr="Adobe Flash Player Control Panel Applet" LegalCopyright="Copyright © 1996-2016 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries." Size="176632" Attr="rsAh" CreateDate="12.10.2016 09:19:08" ChangeDate="07.09.2016 04:11:48" MD5="A636D341E03F15A161068383B538EFF1" Vendor="Adobe Systems Incorporated" Product="Adobe Flash Player Control Panel Applet" OFN="FlashPlayerCPLApp.cpl" Ver="23.0.0.162" IsPE="1" IsDLL="1"  />
 </CPL>
 <ActiveSetup>
 </ActiveSetup>
 <HOSTS>
 </HOSTS>
 <ProtocolExt>
  <ITEM File="C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL" CheckResult="-1" Enabled="1" RegKey="SOFTWARE\Classes\PROTOCOLS\Handler\osf" CLSID="{D924BDC6-C83A-4BD5-90D0-095128A113D1}" Descr="Microsoft Office 2013 component" LegalCopyright="" Size="68344" Attr="rsAh" CreateDate="16.08.2016 13:36:46" ChangeDate="16.08.2016 13:36:46" MD5="099D78B073783E1B81E0D3A7C68F7E95" Vendor="Microsoft Corporation" Product="Microsoft Office 2013" OFN="msosb.dll" Ver="15.0.4825.1000" IsPE="1" IsDLL="1"  />
 </ProtocolExt>
 <NET_SHARE>
  <ITEM Name="ADMIN$" Path="C:\WINDOWS" Connections="0"  />
  <ITEM Name="C$" Path="C:\" Connections="0"  />
  <ITEM Name="D$" Path="D:\" Connections="0"  />
  <ITEM Name="F$" Path="F:\" Connections="0"  />
  <ITEM Name="G$" Path="G:\" Connections="0"  />
  <ITEM Name="IPC$" Path="" Connections="0"  />
 </NET_SHARE>
<WMI_INFO>
 <SecurityCenter>
  <AntiVirusProduct>
  </AntiVirusProduct>
  <FireWallProduct>
  </FireWallProduct>
 </SecurityCenter>
 <SecurityCenter2>
  <AntiVirusProduct>
    <Data Name="Windows Defender" pathToSignedProductExe="%ProgramFiles%\Windows Defender\MSASCui.exe" ProductState="393472" />
    <Data Name="360 Total Security" pathToSignedProductExe="C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe" ProductState="331776" />
  </AntiVirusProduct>
  <FireWallProduct>
  </FireWallProduct>
  <AntiSpywareProduct>
    <Data Name="Windows Defender" pathToSignedProductExe="%ProgramFiles%\Windows Defender\MSASCui.exe" ProductState="393472" />
    <Data Name="360 Total Security" pathToSignedProductExe="C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe" ProductState="331776" />
  </AntiSpywareProduct>
 </SecurityCenter2>
</WMI_INFO>
<NET_DIAG>
 <DNS>
  <Host Name="yandex.ru" IP="77.88.55.77,77.88.55.88,5.255.255.88,5.255.255.5" Ping="1" PingInfo="0,3,77.88.55.77" />
  <Host Name="google.ru" IP="74.125.232.247,74.125.232.255,74.125.232.239,74.125.232.248" Ping="1" PingInfo="0,2,74.125.232.247" />
  <Host Name="google.com" IP="173.194.122.231,173.194.122.232,173.194.122.229,173.194.122.225,173.194.122.228,173.194.122.238,173.194.122.227,173.194.122.226,173.194.122.230,173.194.122.224,173.194.122.233" Ping="1" PingInfo="0,2,173.194.122.231" />
  <Host Name="www.kaspersky.com" IP="93.159.228.16" Ping="1" PingInfo="0,2,93.159.228.16" />
  <Host Name="www.kaspersky.ru" IP="93.159.228.19" Ping="1" PingInfo="0,4,93.159.228.19" />
  <Host Name="dnl-03.geo.kaspersky.com" IP="95.167.139.6" Ping="1" PingInfo="0,1,95.167.139.6" />
  <Host Name="dnl-11.geo.kaspersky.com" IP="62.128.100.79" Ping="1" PingInfo="0,2,62.128.100.79" />
  <Host Name="activation-v2.kaspersky.com" IP="212.5.89.37" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="odnoklassniki.ru" IP="5.61.23.5,217.20.156.159,217.20.155.58" Ping="1" PingInfo="0,2,5.61.23.5" />
  <Host Name="vk.com" IP="87.240.165.85,87.240.165.86,87.240.165.87" Ping="1" PingInfo="0,15,87.240.165.85" />
  <Host Name="vkontakte.ru" IP="95.213.4.229,95.213.4.228" Ping="1" PingInfo="0,11,95.213.4.229" />
  <Host Name="twitter.com" IP="104.244.42.1,104.244.42.65" Ping="1" PingInfo="0,62,104.244.42.1" />
  <Host Name="facebook.com" IP="31.13.92.36" Ping="1" PingInfo="0,42,31.13.92.36" />
  <Host Name="ru-ru.facebook.com" IP="31.13.72.8" Ping="1" PingInfo="0,20,31.13.72.8" />
 </DNS>
 <IE_Setup>
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="AutoConfigURL" VAL="" />
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="AutoConfigProxy" VAL="wininet.dll" />
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="ProxyOverride" VAL="" />
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="ProxyServer" VAL="" />
  <Key RegKey="HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies" Name="" VAL="" />
 </IE_Setup>
 <TCP_IP>
 </TCP_IP>
 <TCP_IP_PR>
 </TCP_IP_PR>
</NET_DIAG>
 <RK_UM>
  <ITEM DLL="kernel32.dll"  FNaim="ReadConsoleInputExA" FIndx="1093" HookPtr="77581A00" HookType="1" />
  <ITEM DLL="kernel32.dll"  FNaim="ReadConsoleInputExW" FIndx="1094" HookPtr="77581A30" HookType="1" />
  <ITEM DLL="ntdll.dll"  FNaim="NtCreateFile" FIndx="253" HookPtr="7216B775" HookType="1" />
  <ITEM DLL="ntdll.dll"  FNaim="NtSetInformationFile" FIndx="534" HookPtr="7216B6F1" HookType="1" />
  <ITEM DLL="ntdll.dll"  FNaim="NtSetValueKey" FIndx="565" HookPtr="7216C69D" HookType="1" />
  <ITEM DLL="ntdll.dll"  FNaim="ZwCreateFile" FIndx="1641" HookPtr="7216B775" HookType="1" />
  <ITEM DLL="ntdll.dll"  FNaim="ZwSetInformationFile" FIndx="1920" HookPtr="7216B6F1" HookType="1" />
  <ITEM DLL="ntdll.dll"  FNaim="ZwSetValueKey" FIndx="1951" HookPtr="7216C69D" HookType="1" />
  <ITEM DLL="user32.dll"  FNaim="CallNextHookEx" FIndx="28" HookPtr="7216B6DB" HookType="1" />
  <ITEM DLL="user32.dll"  FNaim="SetWindowsHookExW" FIndx="792" HookPtr="7216C801" HookType="1" />
 </RK_UM>
 <IPU>
  <ITEM Code="1" X1="TermService" X2="Ñëóæáû óäàëåííûõ ðàáî÷èõ ñòîëîâ" />
  <ITEM Code="1" X1="SSDPSRV" X2="Îáíàðóæåíèå SSDP" />
  <ITEM Code="1" X1="Schedule" X2="Ïëàíèðîâùèê çàäàíèé" />
  <ITEM Code="2" />
  <ITEM Code="3" />
  <ITEM Code="5" />
  <ITEM Code="6" X1="1201" />
  <ITEM Code="6" X1="1001" />
  <ITEM Code="6" X1="1004" />
  <ITEM Code="6" X1="2201" />
  <ITEM Code="6" X1="1804" />
  <ITEM Code="8" X1="1" />
 </IPU>
 <WIZARD-TSW>
  <ITEM ID="16" Level="3" Fixed="0" />
  <ITEM ID="17" Level="2" Fixed="0" />
  <ITEM ID="18" Level="3" Fixed="0" />
  <ITEM ID="19" Level="2" Fixed="0" />
  <ITEM ID="20" Level="3" Fixed="0" />
  <ITEM ID="58" Level="3" Fixed="0" />
  <ITEM ID="59" Level="3" Fixed="0" />
  <ITEM ID="61" Level="2" Fixed="0" />
 </WIZARD-TSW>
</AVZ>
