; Version: 260730
; # of entries: 4,067
;
; Winapp2.ini is fully licensed under the CC-BY-SA-4.0 license agreement. Please refer to our license agreement before using Winapp2.ini: https://github.com/MoscaDotTo/Winapp2/blob/master/License.md
; You may copy, modify, remix, share, show, and transmit Winapp2 but you must redistribute under the same license and you must attribute the original work to the winapp2 project
;
; You can get the latest Winapp2.ini here: https://github.com/MoscaDotTo/Winapp2
; Any contributions are appreciated. Please refer to our ReadMe to learn to make your own entries here: https://github.com/MoscaDotTo/Winapp2/blob/master/README.md
;
; Try out Winapp2ool for many useful additional features including updating and trimming Winapp2.ini: https://github.com/MoscaDotTo/Winapp2/raw/master/winapp2ool/bin/Release/winapp2ool.exe
; You can find the Winapp2ool ReadMe here: https://github.com/MoscaDotTo/Winapp2/blob/master/winapp2ool/Readme.md
;
; Chrome/Chromium based browsers (22)

[Google Chrome Autofill Data & Search Engine Preferences *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|*Web Data
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Google\Chrome*\User Data\AutoFill*|*|REMOVESELF

[Google Chrome Autoplay Preferences *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\MEIPreload|*|REMOVESELF

[Google Chrome Bookmark Backups *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|Bookmarks.bak

[Google Chrome Bookmark Favicons *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|favicons*

[Google Chrome Caches *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Google\Chrome*\User Data|Module Info Cache
FileKey3=%LocalAppData%\Google\Chrome*\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Google\Chrome*\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Google\Chrome*\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Google\Chrome*\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Google\Chrome*\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Google\Chrome*\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Google\Chrome*\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Google\Chrome*\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Google\Chrome*\User Data\*\Search Logos|*|REMOVESELF
FileKey14=%LocalAppData%\Google\Chrome*\User Data\*\Service Worker|*|REMOVESELF
FileKey15=%LocalAppData%\Google\Chrome*\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey16=%LocalAppData%\Google\Chrome*\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Google\Chrome*\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey18=%LocalAppData%\Google\Chrome*\User Data\*Cache*|*|REMOVESELF
FileKey19=%LocalAppData%\Google\Chrome*\User Data\Avatars|*|REMOVESELF
FileKey20=%LocalAppData%\Google\Chrome*\User Data\Optimization*|*|REMOVESELF

[Google Chrome Default App Handlers *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|PreferredApps

[Google Chrome Download History *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*\shared_proto_db|*|REMOVESELF

[Google Chrome DRM Data *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Google\Chrome*\User Data\WidevineCdm|*|REMOVESELF

[Google Chrome Extension Cookies *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|Extension Cookies

[Google Chrome Pinned Tabs *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
RegKey1=HKCU\Software\Google\Chrome Beta\PreferenceMACs\Default|pinned_tabs
RegKey2=HKCU\Software\Google\Chrome Dev\PreferenceMACs\Default|pinned_tabs
RegKey3=HKCU\Software\Google\Chrome SxS\PreferenceMACs\Default|pinned_tabs
RegKey4=HKCU\Software\Google\Chrome\PreferenceMACs\Default|pinned_tabs

[Google Chrome Privacy Sandbox *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Google\Chrome*\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Google\Chrome*\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Google\Chrome*\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Google\Chrome*\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Google\Chrome*\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Google\Chrome*\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Google Chrome Progressive Web Apps *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\Web Applications|*|REMOVESELF

[Google Chrome Saved Usernames & Passwords *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|Login Data*

[Google Chrome Security & Threat Detection *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|DIPS*
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Google\Chrome*\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Google\Chrome*\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Google\Chrome*\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Google\Chrome*\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Google\Chrome*\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Google\Chrome*\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Google\Chrome*\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Google\Chrome*\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Google\Chrome*\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Google\Chrome*\User Data\ZxcvbnData|*|REMOVESELF

[Google Chrome Shopping Insights *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Google\Chrome*\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Google\Chrome*\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\parcel_tracking_db|*|REMOVESELF

[Google Chrome Storage Quota Manager *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|QuotaManager

[Google Chrome Sync Data *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\Sync Data|*|REMOVESELF

[Google Chrome Telemetry *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\Application|debug.log
FileKey2=%LocalAppData%\Google\Chrome*\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Google\Chrome*\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Google\Chrome*\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Google\Chrome*\User Data\*|*.log
FileKey6=%LocalAppData%\Google\Chrome*\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Google\Chrome*\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Google\Chrome*\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Google\Chrome*\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Google\Chrome*\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Google\Chrome*\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Google\Chrome*\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Google\Chrome*\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Google\Chrome*\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Google\Chrome*\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Google\Chrome*\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Google\Chrome*\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Google\Chrome*\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Google\Chrome*\Application|debug.log
FileKey21=%ProgramFiles%\Google\Chrome*\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Google\Chrome Beta\BlBeacon|failed_count
RegKey2=HKCU\Software\Google\Chrome Beta\BlBeacon|state
RegKey3=HKCU\Software\Google\Chrome Beta\Installer|LastChecked
RegKey4=HKCU\Software\Google\Chrome Beta\StabilityMetrics
RegKey5=HKCU\Software\Google\Chrome Dev\BlBeacon|failed_count
RegKey6=HKCU\Software\Google\Chrome Dev\BlBeacon|state
RegKey7=HKCU\Software\Google\Chrome Dev\Installer|LastChecked
RegKey8=HKCU\Software\Google\Chrome Dev\StabilityMetrics
RegKey9=HKCU\Software\Google\Chrome SxS\BlBeacon|failed_count
RegKey10=HKCU\Software\Google\Chrome SxS\BlBeacon|state
RegKey11=HKCU\Software\Google\Chrome SxS\Installer|LastChecked
RegKey12=HKCU\Software\Google\Chrome SxS\StabilityMetrics
RegKey13=HKCU\Software\Google\Chrome\BlBeacon|failed_count
RegKey14=HKCU\Software\Google\Chrome\BlBeacon|state
RegKey15=HKCU\Software\Google\Chrome\Installer|LastChecked
RegKey16=HKCU\Software\Google\Chrome\StabilityMetrics

[Google Chrome Web Browsing Cookies *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\Network|Cookies*;Device Bound Sessions*

[Google Chrome Web Browsing History *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Google Chrome Web Browsing Session *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*\Sessions|*|REMOVESELF

[Google Chrome Web Storage *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Google\Chrome*\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Google\Chrome*\User Data\*\WebStorage|*|REMOVESELF

; End of Chrome/Chromium based browsers
;
; Edge Chromium (23)

[Microsoft Edge Autofill Data & Search Engine Preferences *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|*Web Data
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\AutoFill*|*|REMOVESELF

[Microsoft Edge Autoplay Preferences *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\MEIPreload|*|REMOVESELF

[Microsoft Edge Bookmark Backups *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Bookmarks.bak

[Microsoft Edge Bookmark Favicons *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|favicons*

[Microsoft Edge Caches *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data|Module Info Cache
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*|*.ldb;CURRENT;HubApps Icons;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\*\EdgePushStorage|*|REMOVESELF
FileKey9=%LocalAppData%\Microsoft\Edge*\User Data\*\EdgePushStorageWithWinRt|*.log
FileKey10=%LocalAppData%\Microsoft\Edge*\User Data\*\File System|*|REMOVESELF
FileKey11=%LocalAppData%\Microsoft\Edge*\User Data\*\GCM Store|*|REMOVESELF
FileKey12=%LocalAppData%\Microsoft\Edge*\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey13=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|*.tmp
FileKey14=%LocalAppData%\Microsoft\Edge*\User Data\*\optimization*|*|REMOVESELF
FileKey15=%LocalAppData%\Microsoft\Edge*\User Data\*\Platform Notifications|*|REMOVESELF
FileKey16=%LocalAppData%\Microsoft\Edge*\User Data\*\Service Worker|*|REMOVESELF
FileKey17=%LocalAppData%\Microsoft\Edge*\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey18=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey19=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey20=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\*|*|RECURSE
FileKey21=%LocalAppData%\Microsoft\Edge*\User Data\*Cache*|*|REMOVESELF
FileKey22=%LocalAppData%\Microsoft\Edge*\User Data\Avatars|*|REMOVESELF
FileKey23=%LocalAppData%\Microsoft\Edge*\User Data\Optimization*|*|REMOVESELF
FileKey24=%LocalAppData%\Microsoft\Edge*\User Data\SmartScreen\local|*cache|REMOVESELF

[Microsoft Edge Default App Handlers *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|PreferredApps

[Microsoft Edge Download History *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\shared_proto_db|*|REMOVESELF

[Microsoft Edge DRM Data *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\WidevineCdm|*|REMOVESELF

[Microsoft Edge Extension Cookies *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Extension Cookies

[Microsoft Edge PDF Restore Data *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\PDF Restore Data|*|REMOVESELF

[Microsoft Edge Pinned Tabs *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
RegKey1=HKCU\Software\Microsoft\Edge Beta\PreferenceMACs\Default|pinned_tabs
RegKey2=HKCU\Software\Microsoft\Edge Dev\PreferenceMACs\Default|pinned_tabs
RegKey3=HKCU\Software\Microsoft\Edge SxS\PreferenceMACs\Default|pinned_tabs
RegKey4=HKCU\Software\Microsoft\Edge\PreferenceMACs\Default|pinned_tabs
RegKey5=HKCU\Software\Microsoft\EdgeWebView\PreferenceMACs\Default|pinned_tabs

[Microsoft Edge Privacy Sandbox *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Microsoft Edge Progressive Web Apps *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Web Applications|*|REMOVESELF

[Microsoft Edge Saved Usernames & Passwords *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Login Data*

[Microsoft Edge Security & Threat Detection *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data|Safe Browsing Cookies
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|DIPS*
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*\ClientCertificates|*|REMOVESELF
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|TransportSecurity*
FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\CertificateRevocation|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\Crowd Deny|*|REMOVESELF
FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\PKIMetadata|*|REMOVESELF
FileKey9=%LocalAppData%\Microsoft\Edge*\User Data\Safe Browsing|*|REMOVESELF
FileKey10=%LocalAppData%\Microsoft\Edge*\User Data\SafetyTips|*|REMOVESELF
FileKey11=%LocalAppData%\Microsoft\Edge*\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey12=%LocalAppData%\Microsoft\Edge*\User Data\Subresource Filter|*|REMOVESELF
FileKey13=%LocalAppData%\Microsoft\Edge*\User Data\ZxcvbnData|*|REMOVESELF

[Microsoft Edge Shopping Insights *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*\EdgeCoupons|*|REMOVESELF
FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\*\parcel_tracking_db|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\*\PriceComparison|*|REMOVESELF

[Microsoft Edge Storage Quota Manager *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|QuotaManager

[Microsoft Edge Sync Data *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Sync Data|*|REMOVESELF

[Microsoft Edge Telemetry *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log
FileKey2=%LocalAppData%\Microsoft\Edge*\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*|*.log;load_statistics.db*
FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\*\Logs|*|REMOVESELF
FileKey9=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey10=%LocalAppData%\Microsoft\Edge*\User Data\*\Nurturing|*|REMOVESELF
FileKey11=%LocalAppData%\Microsoft\Edge*\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey12=%LocalAppData%\Microsoft\Edge*\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey13=%LocalAppData%\Microsoft\Edge*\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey14=%LocalAppData%\Microsoft\Edge*\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey15=%LocalAppData%\Microsoft\Edge*\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey16=%LocalAppData%\Microsoft\Edge*\User Data\*BrowserMetrics|*|REMOVESELF
FileKey17=%LocalAppData%\Microsoft\Edge*\User Data\Crash Reports|*|REMOVESELF
FileKey18=%LocalAppData%\Microsoft\Edge*\User Data\Crashpad|*|REMOVESELF
FileKey19=%LocalAppData%\Microsoft\Edge*\User Data\Edge Cloud Config|CloudConfigLog
FileKey20=%LocalAppData%\Microsoft\Edge*\User Data\EdgeHubAppUsage|*|REMOVESELF
FileKey21=%LocalAppData%\Microsoft\Edge*\User Data\Local Traces|*|REMOVESELF
FileKey22=%LocalAppData%\Microsoft\Edge*\User Data\Nurturing|*|REMOVESELF
FileKey23=%LocalAppData%\Microsoft\Edge*\User Data\OriginTrials|*|REMOVESELF
FileKey24=%LocalAppData%\Microsoft\Edge*\User Data\Stability|*|REMOVESELF
FileKey25=%ProgramFiles%\Microsoft\Edge*\Application|debug.log
FileKey26=%ProgramFiles%\Microsoft\Edge*\Application\SetupMetrics|*|REMOVESELF
FileKey27=%ProgramFiles%\Microsoft\EdgeWebView\Application\SetupMetrics|*.pma
FileKey28=%UserProfile%\AppData\LocalLow\Microsoft\EdgeBho|*.log
RegKey1=HKCU\Software\Microsoft\Edge Beta\BlBeacon|failed_count
RegKey2=HKCU\Software\Microsoft\Edge Beta\BlBeacon|state
RegKey3=HKCU\Software\Microsoft\Edge Beta\Installer|LastChecked
RegKey4=HKCU\Software\Microsoft\Edge Beta\StabilityMetrics
RegKey5=HKCU\Software\Microsoft\Edge Dev\BlBeacon|failed_count
RegKey6=HKCU\Software\Microsoft\Edge Dev\BlBeacon|state
RegKey7=HKCU\Software\Microsoft\Edge Dev\Installer|LastChecked
RegKey8=HKCU\Software\Microsoft\Edge Dev\StabilityMetrics
RegKey9=HKCU\Software\Microsoft\Edge SxS\BlBeacon|failed_count
RegKey10=HKCU\Software\Microsoft\Edge SxS\BlBeacon|state
RegKey11=HKCU\Software\Microsoft\Edge SxS\Installer|LastChecked
RegKey12=HKCU\Software\Microsoft\Edge SxS\StabilityMetrics
RegKey13=HKCU\Software\Microsoft\Edge\BlBeacon|failed_count
RegKey14=HKCU\Software\Microsoft\Edge\BlBeacon|state
RegKey15=HKCU\Software\Microsoft\Edge\Installer|LastChecked
RegKey16=HKCU\Software\Microsoft\Edge\StabilityMetrics
RegKey17=HKCU\Software\Microsoft\EdgeWebView\BlBeacon|failed_count
RegKey18=HKCU\Software\Microsoft\EdgeWebView\BlBeacon|state
RegKey19=HKCU\Software\Microsoft\EdgeWebView\Installer|LastChecked
RegKey20=HKCU\Software\Microsoft\EdgeWebView\StabilityMetrics

[Microsoft Edge Web Browsing Cookies *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|Cookies*;Device Bound Sessions*

[Microsoft Edge Web Browsing History *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Microsoft Edge Web Browsing Session *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\Sessions|*|REMOVESELF

[Microsoft Edge Web Storage *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\*\WebStorage|*|REMOVESELF

; End of Edge Chromium
;
; Vivaldi (22)

[Vivaldi Autofill Data & Search Engine Preferences *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|*Web Data
FileKey2=%LocalAppData%\Vivaldi\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Vivaldi\User Data\AutoFill*|*|REMOVESELF

[Vivaldi Autoplay Preferences *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\MEIPreload|*|REMOVESELF

[Vivaldi Bookmark Backups *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Bookmarks.bak

[Vivaldi Bookmark Favicons *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|favicons*

[Vivaldi Caches *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Vivaldi\User Data|Module Info Cache
FileKey3=%LocalAppData%\Vivaldi\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Vivaldi\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Vivaldi\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Vivaldi\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Vivaldi\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Vivaldi\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Vivaldi\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Vivaldi\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Vivaldi\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Vivaldi\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Vivaldi\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Vivaldi\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Vivaldi\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Vivaldi\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Vivaldi\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Vivaldi\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Vivaldi\User Data\Optimization*|*|REMOVESELF

[Vivaldi Default App Handlers *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|PreferredApps

[Vivaldi Download History *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Vivaldi\User Data\*\shared_proto_db|*|REMOVESELF

[Vivaldi DRM Data *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Vivaldi\User Data\WidevineCdm|*|REMOVESELF

[Vivaldi Extension Cookies *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Extension Cookies

[Vivaldi Pinned Tabs *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
RegKey1=HKCU\Software\Vivaldi\PreferenceMACs\Default|pinned_tabs

[Vivaldi Privacy Sandbox *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Vivaldi\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Vivaldi\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Vivaldi\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Vivaldi\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Vivaldi\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Vivaldi\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Vivaldi\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Vivaldi Progressive Web Apps *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Web Applications|*|REMOVESELF

[Vivaldi Saved Usernames & Passwords *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Login Data*

[Vivaldi Security & Threat Detection *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|DIPS*
FileKey2=%LocalAppData%\Vivaldi\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Vivaldi\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Vivaldi\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Vivaldi\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Vivaldi\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Vivaldi\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Vivaldi\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Vivaldi\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Vivaldi\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Vivaldi\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Vivaldi\User Data\ZxcvbnData|*|REMOVESELF

[Vivaldi Shopping Insights *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Vivaldi\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Vivaldi\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Vivaldi\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Vivaldi\User Data\*\parcel_tracking_db|*|REMOVESELF

[Vivaldi Storage Quota Manager *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|QuotaManager

[Vivaldi Sync Data *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Sync Data|*|REMOVESELF

[Vivaldi Telemetry *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\Application|debug.log
FileKey2=%LocalAppData%\Vivaldi\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Vivaldi\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Vivaldi\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Vivaldi\User Data\*|*.log
FileKey6=%LocalAppData%\Vivaldi\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Vivaldi\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Vivaldi\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Vivaldi\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Vivaldi\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Vivaldi\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Vivaldi\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Vivaldi\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Vivaldi\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Vivaldi\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Vivaldi\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Vivaldi\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Vivaldi\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Vivaldi\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Vivaldi\Application|debug.log
FileKey21=%ProgramFiles%\Vivaldi\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Vivaldi\BlBeacon|failed_count
RegKey2=HKCU\Software\Vivaldi\BlBeacon|state
RegKey3=HKCU\Software\Vivaldi\Installer|LastChecked
RegKey4=HKCU\Software\Vivaldi\StabilityMetrics

[Vivaldi Web Browsing Cookies *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Network|Cookies*;Device Bound Sessions*

[Vivaldi Web Browsing History *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Vivaldi Web Browsing Session *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Vivaldi\User Data\*\Sessions|*|REMOVESELF

[Vivaldi Web Storage *]
LangSecRef=3033
DetectFile=%LocalAppData%\Vivaldi\User Data
FileKey1=%LocalAppData%\Vivaldi\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Vivaldi\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Vivaldi\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Vivaldi\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Vivaldi\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Vivaldi\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Vivaldi\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Vivaldi\User Data\*\WebStorage|*|REMOVESELF

; End of Vivaldi
;
; Brave (22)

[Brave Autofill Data & Search Engine Preferences *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*Web Data
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\AutoFill*|*|REMOVESELF

[Brave Autoplay Preferences *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\MEIPreload|*|REMOVESELF

[Brave Bookmark Backups *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Bookmarks.bak

[Brave Bookmark Favicons *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|favicons*

[Brave Caches *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|Module Info Cache
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Optimization*|*|REMOVESELF

[Brave Default App Handlers *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|PreferredApps

[Brave Download History *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\shared_proto_db|*|REMOVESELF

[Brave DRM Data *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\WidevineCdm|*|REMOVESELF

[Brave Extension Cookies *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Extension Cookies

[Brave Pinned Tabs *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
RegKey1=HKCU\Software\BraveSoftware\Brave-Browser\PreferenceMACs\Default|pinned_tabs
RegKey2=HKCU\Software\BraveSoftware\Brave-Browser-Beta\PreferenceMACs\Default|pinned_tabs
RegKey3=HKCU\Software\BraveSoftware\Brave-Browser-Nightly\PreferenceMACs\Default|pinned_tabs

[Brave Privacy Sandbox *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|*first_party_sets*
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Brave Progressive Web Apps *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Web Applications|*|REMOVESELF

[Brave Saved Usernames & Passwords *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Login Data*

[Brave Security & Threat Detection *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|DIPS*
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\ZxcvbnData|*|REMOVESELF

[Brave Shopping Insights *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\parcel_tracking_db|*|REMOVESELF

[Brave Storage Quota Manager *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|QuotaManager

[Brave Sync Data *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Sync Data|*|REMOVESELF

[Brave Telemetry *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\Application|debug.log
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*.log
FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Stability|*|REMOVESELF
FileKey20=%LocalAppData%\BraveSoftware\CrashReports|*|REMOVESELF
FileKey21=%ProgramFiles%\BraveSoftware\Brave-Browser*\Application|debug.log
FileKey22=%ProgramFiles%\BraveSoftware\Brave-Browser*\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\BraveSoftware\Brave-Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\BraveSoftware\Brave-Browser\BlBeacon|state
RegKey3=HKCU\Software\BraveSoftware\Brave-Browser\Installer|LastChecked
RegKey4=HKCU\Software\BraveSoftware\Brave-Browser\StabilityMetrics
RegKey5=HKCU\Software\BraveSoftware\Brave-Browser-Beta\BlBeacon|failed_count
RegKey6=HKCU\Software\BraveSoftware\Brave-Browser-Beta\BlBeacon|state
RegKey7=HKCU\Software\BraveSoftware\Brave-Browser-Beta\Installer|LastChecked
RegKey8=HKCU\Software\BraveSoftware\Brave-Browser-Beta\StabilityMetrics
RegKey9=HKCU\Software\BraveSoftware\Brave-Browser-Nightly\BlBeacon|failed_count
RegKey10=HKCU\Software\BraveSoftware\Brave-Browser-Nightly\BlBeacon|state
RegKey11=HKCU\Software\BraveSoftware\Brave-Browser-Nightly\Installer|LastChecked
RegKey12=HKCU\Software\BraveSoftware\Brave-Browser-Nightly\StabilityMetrics

[Brave Web Browsing Cookies *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Network|Cookies*;Device Bound Sessions*

[Brave Web Browsing History *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Brave Web Browsing Session *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Sessions|*|REMOVESELF

[Brave Web Storage *]
LangSecRef=3034
DetectFile=%LocalAppData%\BraveSoftware\Brave-Browser*
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\WebStorage|*|REMOVESELF

; End of Brave
;
; Opera (22)

[Opera Autofill Data & Search Engine Preferences *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|*Web Data
FileKey2=%AppData%\Opera Software\Opera*\*\AutoFill*|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera*\AutoFill*|*|REMOVESELF

[Opera Autoplay Preferences *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\MEIPreload|*|REMOVESELF

[Opera Bookmark Backups *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|Bookmarks.bak

[Opera Bookmark Favicons *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|favicons*

[Opera Caches *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*|*-journal|RECURSE
FileKey2=%AppData%\Opera Software\Opera*|Module Info Cache
FileKey3=%AppData%\Opera Software\Opera*\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate;suggestions_cache.json
FileKey4=%AppData%\Opera Software\Opera*\*\*Cache*|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera*\*\blob_storage|*|REMOVESELF
FileKey6=%AppData%\Opera Software\Opera*\*\BudgetDatabase|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera*\*\Download Service|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera*\*\File System|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera*\*\GCM Store|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera*\*\Jump List Icons*|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera*\*\JumpListIcons*|*|REMOVESELF
FileKey12=%AppData%\Opera Software\Opera*\*\optimization*|*|REMOVESELF
FileKey13=%AppData%\Opera Software\Opera*\*\Platform Notifications|*|REMOVESELF
FileKey14=%AppData%\Opera Software\Opera*\*\Service Worker|*|REMOVESELF
FileKey15=%AppData%\Opera Software\Opera*\*\Shared Dictionary\cache|*|REMOVESELF
FileKey16=%AppData%\Opera Software\Opera*\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey17=%AppData%\Opera Software\Opera*\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey18=%AppData%\Opera Software\Opera*\*Cache*|*|REMOVESELF
FileKey19=%AppData%\Opera Software\Opera*\Avatars|*|REMOVESELF
FileKey20=%AppData%\Opera Software\Opera*\Optimization*|*|REMOVESELF
FileKey21=%LocalAppData%\Opera Software\Opera*\*\*Cache*|*|REMOVESELF
FileKey22=%LocalAppData%\Opera Software\Opera*\*Cache*|*|REMOVESELF

[Opera Default App Handlers *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|PreferredApps

[Opera Download History *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|DownloadMetadata
FileKey2=%AppData%\Opera Software\Opera*\*\shared_proto_db|*|REMOVESELF

[Opera DRM Data *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera*\WidevineCdm|*|REMOVESELF

[Opera Extension Cookies *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|Extension Cookies

[Opera Preferences Backups *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*|assistant_prefs.json.backup
FileKey2=%AppData%\Opera Software\Opera*\*|*Preferences.backup

[Opera Privacy Sandbox *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*|*first_party_sets*
FileKey2=%AppData%\Opera Software\Opera*\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%AppData%\Opera Software\Opera*\*\Network|Trust Tokens*
FileKey4=%AppData%\Opera Software\Opera*\CookieReadinessList|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera*\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%AppData%\Opera Software\Opera*\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera*\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera*\TrustTokenKeyCommitments|*|REMOVESELF

[Opera Progressive Web Apps *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\Web Applications|*|REMOVESELF

[Opera Saved Usernames & Passwords *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|Login Data*

[Opera Security & Threat Detection *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|DIPS*
FileKey2=%AppData%\Opera Software\Opera*\*\ClientCertificates|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera*\*\Network|TransportSecurity*
FileKey4=%AppData%\Opera Software\Opera*\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera*\CertificateRevocation|*|REMOVESELF
FileKey6=%AppData%\Opera Software\Opera*\Crowd Deny|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera*\PKIMetadata|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera*\Safe Browsing|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera*\SafetyTips|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera*\SSLErrorAssistant|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera*\Subresource Filter|*|REMOVESELF
FileKey12=%AppData%\Opera Software\Opera*\ZxcvbnData|*|REMOVESELF

[Opera Shopping Insights *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\chrome_cart_db|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera*\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera*\*\coupon_db|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera*\*\discount*_db|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera*\*\parcel_tracking_db|*|REMOVESELF

[Opera Storage Quota Manager *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|QuotaManager

[Opera Sync Data *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\Sync Data|*|REMOVESELF

[Opera Telemetry *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Application|debug.log
FileKey2=%AppData%\Opera Software\Application\SetupMetrics|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera*|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%AppData%\Opera Software\Opera*|*.pma;LOG;LOG.old|RECURSE
FileKey5=%AppData%\Opera Software\Opera*\*|*.log
FileKey6=%AppData%\Opera Software\Opera*\*\Crash Reports|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera*\*\DataSharing|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera*\*\Feature Engagement Tracker|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera*\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey10=%AppData%\Opera Software\Opera*\*\PersistentOriginTrials|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera*\*\Site Characteristics Database|*|REMOVESELF
FileKey12=%AppData%\Opera Software\Opera*\*\VideoDecodeStats|*|REMOVESELF
FileKey13=%AppData%\Opera Software\Opera*\*\WebRTC Logs|*|REMOVESELF
FileKey14=%AppData%\Opera Software\Opera*\*\WebrtcVideoStats|*|REMOVESELF
FileKey15=%AppData%\Opera Software\Opera*\*BrowserMetrics|*|REMOVESELF
FileKey16=%AppData%\Opera Software\Opera*\Crash Reports|*|REMOVESELF
FileKey17=%AppData%\Opera Software\Opera*\Crashpad|*|REMOVESELF
FileKey18=%AppData%\Opera Software\Opera*\Local Traces|*|REMOVESELF
FileKey19=%AppData%\Opera Software\Opera*\OriginTrials|*|REMOVESELF
FileKey20=%AppData%\Opera Software\Opera*\Stability|*|REMOVESELF
FileKey21=%ProgramFiles%\Opera Software\Application|debug.log
FileKey22=%ProgramFiles%\Opera Software\Application\SetupMetrics|*|REMOVESELF

[Opera Web Browsing Cookies *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\Network|Cookies*;Device Bound Sessions*

[Opera Web Browsing History *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Opera Web Browsing Session *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\Extension State|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera*\*\Sessions|*|REMOVESELF

[Opera Web Storage *]
LangSecRef=3027
DetectFile=%AppData%\Opera Software\Opera*
FileKey1=%AppData%\Opera Software\Opera*\*\IndexedDB|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera*\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%AppData%\Opera Software\Opera*\*\Local Storage\*\Session Storage|*
FileKey4=%AppData%\Opera Software\Opera*\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%AppData%\Opera Software\Opera*\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%AppData%\Opera Software\Opera*\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera*\*\Session Storage|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera*\*\WebStorage|*|REMOVESELF

; End of Opera
;
; Firefox/Mozilla based browsers (14)

[Mozilla Firefox Autocomplete History *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|formhistory*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|formhistory*

[Mozilla Firefox Autofill Data *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|autofill-profiles.json
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|autofill-profiles.json

[Mozilla Firefox Bookmark Backups *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*\bookmarkbackups|*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\bookmarkbackups|*

[Mozilla Firefox Bookmark Favicons *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|favicons*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|favicons*

[Mozilla Firefox Caches *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Mozilla\Firefox\Profiles\*\notificationstore|*
FileKey4=%AppData%\Mozilla\Firefox\Profiles\*\security_state|*
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*\shader-cache|*
FileKey6=%AppData%\Mozilla\Firefox\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Mozilla\Firefox\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Mozilla\Firefox\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Mozilla\Firefox\Profiles\*\thumbnails|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|*.corrupt|RECURSE
FileKey11=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey12=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\*cache*|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\notificationstore|*
FileKey15=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\security_state|*
FileKey16=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\shader-cache|*
FileKey17=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\storage\temporary|*|RECURSE
FileKey18=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\thumbnails|*|REMOVESELF

[Mozilla Firefox Privacy Sandbox *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|credentialstate.sqlite
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|credentialstate.sqlite

[Mozilla Firefox Saved Usernames & Passwords *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|key4.db;logins.json
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|key4.db;logins.json

[Mozilla Firefox Synced Tabs *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|synced-tabs.db*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|synced-tabs.db*

[Mozilla Firefox Telemetry *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox|*.log|RECURSE
FileKey2=%AppData%\Mozilla\Firefox\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Mozilla\Firefox\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Mozilla\Firefox\Profiles\*\crashes|*
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Mozilla\Firefox\Profiles\*\minidumps|*
FileKey7=%AppData%\Mozilla\Firefox\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Mozilla\Firefox\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Mozilla\Firefox\Profiles\*\weave\logs|*
FileKey10=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox|*.log|RECURSE
FileKey11=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey13=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\crashes|*
FileKey14=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\datareporting|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\minidumps|*
FileKey16=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\saved-telemetry-pings|*
FileKey17=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\sessionstore-logs|*
FileKey18=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\weave\logs|*

[Mozilla Firefox Web Browsing Cookies *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|cookies*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|cookies*

[Mozilla Firefox Web Browsing Session *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|session*.json*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|session*.json*

[Mozilla Firefox Web Browsing Session Backups *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*\sessionstore-backups|*
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\sessionstore-backups|*

[Mozilla Firefox Web Storage *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*\storage\default\http*|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey4=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\storage\default\http*|*|REMOVESELF

[Mozilla Firefox Website Permissions *]
LangSecRef=3026
DetectFile1=%AppData%\Mozilla\Firefox\Profiles
DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|content-prefs.sqlite;permissions.sqlite
FileKey2=%LocalAppData%\Packages\Mozilla.Firefox_n80bbvh6b1yt2\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|content-prefs.sqlite;permissions.sqlite

; End of Firefox/Mozilla based browsers
;
; Thunderbird (14)

[Thunderbird Autocomplete History *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|formhistory*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|formhistory*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|formhistory*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|formhistory*

[Thunderbird Autofill Data *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|autofill-profiles.json
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|autofill-profiles.json
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|autofill-profiles.json
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|autofill-profiles.json

[Thunderbird Bookmark Backups *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*\bookmarkbackups|*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\bookmarkbackups|*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\bookmarkbackups|*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\bookmarkbackups|*

[Thunderbird Bookmark Favicons *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|favicons*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|favicons*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|favicons*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|favicons*

[Thunderbird Caches *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Thunderbird\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Thunderbird\Profiles\*\notificationstore|*
FileKey4=%AppData%\Thunderbird\Profiles\*\security_state|*
FileKey5=%AppData%\Thunderbird\Profiles\*\shader-cache|*
FileKey6=%AppData%\Thunderbird\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|*.corrupt|RECURSE
FileKey8=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey9=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\*cache*|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\notificationstore|*
FileKey12=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\security_state|*
FileKey13=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\shader-cache|*
FileKey14=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\storage\temporary|*|RECURSE
FileKey15=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\thumbnails|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|*.corrupt|RECURSE
FileKey17=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey18=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\*cache*|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\notificationstore|*
FileKey21=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\security_state|*
FileKey22=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\shader-cache|*
FileKey23=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\storage\temporary|*|RECURSE
FileKey24=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\thumbnails|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|*.corrupt|RECURSE
FileKey26=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey27=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\*cache*|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\notificationstore|*
FileKey30=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\security_state|*
FileKey31=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\shader-cache|*
FileKey32=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\storage\temporary|*|RECURSE
FileKey33=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\thumbnails|*|REMOVESELF
FileKey34=%LocalAppData%\Thunderbird\Profiles\*\*cache*|*|REMOVESELF
FileKey35=%LocalAppData%\Thunderbird\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey36=%LocalAppData%\Thunderbird\Profiles\*\thumbnails|*|REMOVESELF

[Thunderbird Privacy Sandbox *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|credentialstate.sqlite
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|credentialstate.sqlite
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|credentialstate.sqlite
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|credentialstate.sqlite

[Thunderbird Saved Usernames & Passwords *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|key4.db;logins.json
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|key4.db;logins.json
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|key4.db;logins.json
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|key4.db;logins.json

[Thunderbird Synced Tabs *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|synced-tabs.db*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|synced-tabs.db*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|synced-tabs.db*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|synced-tabs.db*

[Thunderbird Telemetry *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird|*.log|RECURSE
FileKey2=%AppData%\Thunderbird\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Thunderbird\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Thunderbird\Profiles\*\crashes|*
FileKey5=%AppData%\Thunderbird\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Thunderbird\Profiles\*\minidumps|*
FileKey7=%AppData%\Thunderbird\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Thunderbird\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Thunderbird\Profiles\*\weave\logs|*
FileKey10=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird|*.log|RECURSE
FileKey11=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey13=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\crashes|*
FileKey14=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\datareporting|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\minidumps|*
FileKey16=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\saved-telemetry-pings|*
FileKey17=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\sessionstore-logs|*
FileKey18=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\weave\logs|*
FileKey19=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird|*.log|RECURSE
FileKey20=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Crash Reports|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey22=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\crashes|*
FileKey23=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\datareporting|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\minidumps|*
FileKey25=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\saved-telemetry-pings|*
FileKey26=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\sessionstore-logs|*
FileKey27=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\weave\logs|*
FileKey28=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird|*.log|RECURSE
FileKey29=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Crash Reports|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey31=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\crashes|*
FileKey32=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\datareporting|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\minidumps|*
FileKey34=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\saved-telemetry-pings|*
FileKey35=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\sessionstore-logs|*
FileKey36=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\weave\logs|*

[Thunderbird Web Browsing Cookies *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|cookies*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|cookies*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|cookies*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|cookies*

[Thunderbird Web Browsing Session *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|session*.json*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|session*.json*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|session*.json*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|session*.json*

[Thunderbird Web Browsing Session Backups *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*\sessionstore-backups|*
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\sessionstore-backups|*
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\sessionstore-backups|*
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\sessionstore-backups|*

[Thunderbird Web Storage *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Thunderbird\Profiles\*\storage\default\http*|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\storage\default\http*|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey6=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\storage\default\http*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey8=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*\storage\default\http*|*|REMOVESELF

[Thunderbird Website Permissions *]
LangSecRef=3030
DetectFile1=%AppData%\Thunderbird\Profiles
DetectFile2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
DetectFile4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles
FileKey1=%AppData%\Thunderbird\Profiles\*|content-prefs.sqlite;permissions.sqlite
FileKey2=%LocalAppData%\Packages\MozillaThunderbird.MozillaThunderbirdRelease_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|content-prefs.sqlite;permissions.sqlite
FileKey3=%LocalAppData%\Packages\MozillaThunderbird.MZLA_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|content-prefs.sqlite;permissions.sqlite
FileKey4=%LocalAppData%\Packages\MozillaThunderbird.ThunderbirdBeta_h5892qc0xkpca\LocalCache\Roaming\Thunderbird\Profiles\*|content-prefs.sqlite;permissions.sqlite

; End of Thunderbird

[.NET Framework *]
LangSecRef=3025
Detect1=HKLM\Software\CBSTEST
Detect2=HKLM\Software\Microsoft\.NETFramework
FileKey1=%LocalAppData%\ApplicationHistory|*|RECURSE
FileKey2=%LocalAppData%\IsolatedStorage|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\CLR_v*|*|RECURSE
FileKey4=%SystemDrive%\BVTBin\Tests\installpackage|csilogfile.log
FileKey5=%SystemDrive%\BVTBin\Tests\installpackage\cbstest\*|CBSTest-*.wtl;CBSTestWDS.log
FileKey6=%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data|*FontCache*.dat
FileKey7=%WinDir%\assembly\NativeImages_*\Temp|*|RECURSE
FileKey8=%WinDir%\assembly\t*mp|*|REMOVESELF
FileKey9=%WinDir%\Microsoft.NET\Framework*\*|*.log
FileKey10=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*|RECURSE
FileKey11=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*|RECURSE
FileKey12=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*|RECURSE
FileKey13=%WinDir%\ServiceProfiles\LocalService\AppData\Local|*FontCache*.dat
FileKey14=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v*|*|RECURSE
FileKey15=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Microsoft\CLR_v*|*|RECURSE
FileKey16=%WinDir%\System32\URTTemp|*|RECURSE
FileKey17=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v*|*|RECURSE
FileKey18=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\Microsoft\CLR_v*|*|RECURSE
RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps
RegKey2=HKLM\Software\CBSTEST|CBSTestWDSLogFile
RegKey3=HKLM\Software\CBSTEST|CBSTestWTTLogFile

[.NET Platform *]
LangSecRef=3025
DetectFile=%UserProfile%\.dotnet
FileKey1=%SystemDrive%\Users\Default\.dotnet|*.dotnetUserLevelCache
FileKey2=%SystemDrive%\Users\Default\.dotnet\TelemetryStorageService|*
FileKey3=%UserProfile%\.dotnet|*.dotnetUserLevelCache
FileKey4=%UserProfile%\.dotnet\TelemetryStorageService|*

[.NET Reflector *]
LangSecRef=3021
DetectFile=%LocalAppData%\Red Gate\.NET Reflector 6
FileKey1=%LocalAppData%\Red Gate\.NET Reflector 6|Reflector.cfg
FileKey2=%LocalAppData%\Red Gate\.NET Reflector 6\Cache|*|RECURSE

[.Thumbnails *]
LangSecRef=3021
DetectFile=%UserProfile%\.Thumbnails
FileKey1=%UserProfile%\.Thumbnails|*|RECURSE

[//N.P.P.D. RUSH// - The Milk of Ultra Violet *]
Section=Games
DetectFile=%LocalAppData%\NPPDRUSH
FileKey1=%LocalAppData%\NPPDRUSH|Web Data*|RECURSE
FileKey2=%LocalAppData%\NPPDRUSH\*Cache|*|RECURSE

[1Browser Autofill Data & Search Engine Preferences *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\1browser\1browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\1browser\1browser\User Data\AutoFill*|*|REMOVESELF

[1Browser Autoplay Preferences *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\MEIPreload|*|REMOVESELF

[1Browser Bookmark Backups *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|Bookmarks.bak

[1Browser Bookmark Favicons *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|favicons*

[1Browser Caches *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\1browser\1browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\1browser\1browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\1browser\1browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\1browser\1browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\1browser\1browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\1browser\1browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\1browser\1browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\1browser\1browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\1browser\1browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\1browser\1browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\1browser\1browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\1browser\1browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\1browser\1browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\1browser\1browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\1browser\1browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\1browser\1browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\1browser\1browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\1browser\1browser\User Data\Optimization*|*|REMOVESELF

[1Browser Default App Handlers *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|PreferredApps

[1Browser Download History *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\1browser\1browser\User Data\*\shared_proto_db|*|REMOVESELF

[1Browser DRM Data *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\1browser\1browser\User Data\WidevineCdm|*|REMOVESELF

[1Browser Extension Cookies *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|Extension Cookies

[1Browser Pinned Tabs *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
RegKey1=HKCU\Software\1browser\1browser\PreferenceMACs\Default|pinned_tabs

[1Browser Privacy Sandbox *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\1browser\1browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\1browser\1browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\1browser\1browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\1browser\1browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\1browser\1browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\1browser\1browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\1browser\1browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[1Browser Progressive Web Apps *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\Web Applications|*|REMOVESELF

[1Browser Saved Usernames & Passwords *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|Login Data*

[1Browser Security & Threat Detection *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\1browser\1browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\1browser\1browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\1browser\1browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\1browser\1browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\1browser\1browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\1browser\1browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\1browser\1browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\1browser\1browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\1browser\1browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\1browser\1browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\1browser\1browser\User Data\ZxcvbnData|*|REMOVESELF

[1Browser Shopping Insights *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\1browser\1browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\1browser\1browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\1browser\1browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\1browser\1browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[1Browser Storage Quota Manager *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|QuotaManager

[1Browser Sync Data *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\Sync Data|*|REMOVESELF

[1Browser Telemetry *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\Application|debug.log
FileKey2=%LocalAppData%\1browser\1browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\1browser\1browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\1browser\1browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\1browser\1browser\User Data\*|*.log
FileKey6=%LocalAppData%\1browser\1browser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\1browser\1browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\1browser\1browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\1browser\1browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\1browser\1browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\1browser\1browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\1browser\1browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\1browser\1browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\1browser\1browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\1browser\1browser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\1browser\1browser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\1browser\1browser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\1browser\1browser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\1browser\1browser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\1browser\1browser\Application|debug.log
FileKey21=%ProgramFiles%\1browser\1browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\1browser\1browser\BlBeacon|failed_count
RegKey2=HKCU\Software\1browser\1browser\BlBeacon|state
RegKey3=HKCU\Software\1browser\1browser\Installer|LastChecked
RegKey4=HKCU\Software\1browser\1browser\StabilityMetrics

[1Browser Web Browsing Cookies *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[1Browser Web Browsing History *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[1Browser Web Browsing Session *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\1browser\1browser\User Data\*\Sessions|*|REMOVESELF

[1Browser Web Storage *]
Section=.1Browser Web Browser
DetectFile=%LocalAppData%\1browser\1browser\User Data
FileKey1=%LocalAppData%\1browser\1browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\1browser\1browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\1browser\1browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\1browser\1browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\1browser\1browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\1browser\1browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\1browser\1browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\1browser\1browser\User Data\*\WebStorage|*|REMOVESELF

[3 Stars of Destiny *]
Section=Games
DetectFile=%AppData%\3Stars
FileKey1=%AppData%\3Stars|*.tmp

[3delite Filesystem Dialogs Library *]
LangSecRef=3024
Detect=HKCU\Software\3delite\Filesystem Dialogs
RegKey1=HKCU\Software\3delite\Filesystem Dialogs\Last config folder|Folder

[3DMark *]
Section=Games
DetectFile=%UserProfile%\Documents\3DMark
FileKey1=%ProgramData%\UL\3DMark\tmp|*|REMOVESELF
FileKey2=%ProgramFiles%\Steam\SteamApps\common\3DMark|*.log|RECURSE
FileKey3=%UserProfile%\Documents\3DMark|*.log
FileKey4=%UserProfile%\Documents\3DMark\Log|*|REMOVESELF

[3SwitcheD *]
Section=Games
DetectFile=%LocalAppData%\3SwitcheD
FileKey1=%LocalAppData%\3SwitcheD\cache|*|RECURSE

[4K Video Downloader *]
LangSecRef=3023
Detect=HKCU\Software\4kdownload.com\4K Video Downloader
FileKey1=%LocalAppData%\4kdownload.com\4K Video Downloader\4K Video Downloader|*.bak;*.log;*.sqlite;*.xml
FileKey2=%LocalAppData%\4kdownload.com\4K Video Downloader\crashdb|*|RECURSE
FileKey3=%LocalAppData%\4kdownload.com\4K Video Downloader\QtWebEngine\Default|*|RECURSE
FileKey4=%ProgramFiles%\4KDownload\4KVideoDownloader|*.rtf;*.txt
RegKey1=HKCU\Software\4kdownload.com\4K Video Downloader\Download|downloadedItems
RegKey2=HKCU\Software\4kdownload.com\4K Video Downloader\Download|downloadedItemsDb
RegKey3=HKCU\Software\4kdownload.com\4K Video Downloader\FileWatcher
RegKey4=HKCU\Software\4kdownload.com\4K Video Downloader\Gamification
RegKey5=HKCU\Software\4kdownload.com\4K Video Downloader\Settings|outputPath

[4K YouTube to MP3 *]
LangSecRef=3023
Detect=HKCU\Software\4kdownload.com\4K YouTube to MP3
FileKey1=%LocalAppData%\4kdownload.com\4K YouTube to MP3\4K YouTube to MP3|*.xml
RegKey1=HKCU\Software\4kdownload.com\4K YouTube to MP3\Download|downloadedItems
RegKey2=HKCU\Software\4kdownload.com\4K YouTube to MP3\Settings|outputPath

[4shared Desktop *]
LangSecRef=3022
DetectFile=%AppData%\4shared desktop
FileKey1=%AppData%\4shared desktop|*.log
FileKey2=%AppData%\4shared desktop\*|dhistory.xml

[4Sync *]
LangSecRef=3024
Detect=HKCU\Software\4Sync
FileKey1=%AppData%\4Sync|*.log

[4t Tray Minimizer *]
LangSecRef=3024
DetectFile=%AppData%\4t Niagara Software\4t Tray Minimizer
FileKey1=%AppData%\4t Niagara Software\4t Tray Minimizer|*.log

[4Team MOM *]
LangSecRef=3022
DetectFile=%AppData%\4Team\MOM
FileKey1=%AppData%\4Team\MOM|*.err;*.log
FileKey2=%AppData%\4Team\MOM\Logs|*

[4Team OST2 *]
LangSecRef=3022
DetectFile=%AppData%\4Team\Ost2
FileKey1=%AppData%\4Team\Ost2|*.err;*.log
FileKey2=%AppData%\4Team\Ost2\Logs|*

[4Team Plug2Sync *]
LangSecRef=3022
DetectFile=%AppData%\4Team\Plug2Sync
FileKey1=%AppData%\4Team\Plug2Sync|*.err;*.log
FileKey2=%AppData%\4Team\Plug2Sync\Logs|*

[4Team PSTMerger *]
LangSecRef=3022
DetectFile=%AppData%\4Team\PSTMerger
FileKey1=%AppData%\4Team\PSTMerger|*.err;*.log
FileKey2=%AppData%\4Team\PSTMerger\Logs|*

[4Team PSTMover *]
LangSecRef=3022
DetectFile=%AppData%\4Team\PSTMover
FileKey1=%AppData%\4Team\PSTMover|*.err;*.log
FileKey2=%AppData%\4Team\PSTMover\Logs|*

[4Team PSTSplitter *]
LangSecRef=3022
DetectFile=%AppData%\4Team\PSTSplitter
FileKey1=%AppData%\4Team\PSTSplitter|*.err;*.log
FileKey2=%AppData%\4Team\PSTSplitter\Logs|*

[4Team SafePSTBackup *]
LangSecRef=3022
DetectFile=%AppData%\4Team\SafePSTBackup
FileKey1=%AppData%\4Team\SafePSTBackup|*.err;*.log
FileKey2=%AppData%\4Team\SafePSTBackup\Logs|*
FileKey3=%ProgramFiles%\4Team Corporation\SafePSTBackup Shadow Copy Service|*.InstallLog

[4Team Sync2 *]
LangSecRef=3022
DetectFile=%AppData%\4Team\Sync2
FileKey1=%AppData%\4Team\Sync2|*.err;*.log
FileKey2=%AppData%\4Team\Sync2\Logs|*
FileKey3=%LocalAppData%\4Team\Sync2Cloud|*.log

[4Team SyncWiz *]
LangSecRef=3022
DetectFile=%AppData%\4Team\SyncWiz
FileKey1=%AppData%\4Team\SyncWiz|*.err;*.log
FileKey2=%AppData%\4Team\SyncWiz\Logs|*

[4Team Updater *]
LangSecRef=3022
DetectFile=%AppData%\4Team\4Team-Updater
FileKey1=%AppData%\4Team\4Team-Updater\Logs|*

[4Team vCardWizard *]
LangSecRef=3022
DetectFile=%AppData%\4Team\vCardWizard
FileKey1=%AppData%\4Team\vCardWizard|*.err;*.log
FileKey2=%AppData%\4Team\vCardWizard\Logs|*

[4Team WorkgroupCalendar *]
LangSecRef=3022
DetectFile=%AppData%\4Team\WorkgroupCalendar
FileKey1=%AppData%\4Team\WorkgroupCalendar|*.err;*.log
FileKey2=%AppData%\4Team\WorkgroupCalendar\Logs|*

[7-Zip *]
LangSecRef=3024
Detect1=HKCU\Software\7-Zip
Detect2=HKU\.DEFAULT\Software\7-Zip
RegKey1=HKCU\Software\7-Zip\Compression|ArcHistory
RegKey2=HKCU\Software\7-Zip\Compression\ArcHistory
RegKey3=HKCU\Software\7-Zip\Extraction|PathHistory
RegKey4=HKCU\Software\7-Zip\Extraction\PathHistory
RegKey5=HKCU\Software\7-Zip\FM|CopyHistory
RegKey6=HKCU\Software\7-Zip\FM|FolderHistory
RegKey7=HKCU\Software\7-Zip\FM|PanelPath0
RegKey8=HKU\.DEFAULT\Software\7-Zip\Compression|ArcHistory
RegKey9=HKU\.DEFAULT\Software\7-Zip\Compression\ArcHistory
RegKey10=HKU\.DEFAULT\Software\7-Zip\Extraction|PathHistory
RegKey11=HKU\.DEFAULT\Software\7-Zip\Extraction\PathHistory
RegKey12=HKU\.DEFAULT\Software\7-Zip\FM|CopyHistory
RegKey13=HKU\.DEFAULT\Software\7-Zip\FM|FolderHistory
RegKey14=HKU\.DEFAULT\Software\7-Zip\FM|PanelPath0

[7-Zip ZS *]
LangSecRef=3024
Detect=HKCU\Software\7-Zip-Zstandard
RegKey1=HKCU\Software\7-Zip-Zstandard\Compression|ArcHistory
RegKey2=HKCU\Software\7-Zip-Zstandard\Extraction|PathHistory
RegKey3=HKCU\Software\7-Zip-Zstandard\FM|CopyHistory
RegKey4=HKCU\Software\7-Zip-Zstandard\FM|FolderHistory
RegKey5=HKCU\Software\7-Zip-Zstandard\FM|PanelPath0
RegKey6=HKCU\Software\7-Zip-Zstandard\FM|PanelPath1

[7+ Taskbar Tweaker *]
LangSecRef=3024
Detect=HKCU\Software\7 Taskbar Tweaker
RegKey1=HKCU\Software\7 Taskbar Tweaker|MementoSectionUsed

[7z SFX Builder *]
LangSecRef=3024
Detect=HKCU\Software\7z SFX Builder
RegKey1=HKCU\Software\7z SFX Builder\MRU

[10 Years After *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\339240
FileKey1=%ProgramFiles%\Steam\SteamApps\common\10 Years After\10 Years After_Data|output_log.txt

[18 Wheels of Steel *]
Section=Games
Detect=HKCU\Software\ValuSoft
FileKey1=%UserProfile%\Documents\18 WoS*|*.crash;*.log

[32bit Web Browser *]
LangSecRef=3022
DetectFile=%ProgramFiles%\32BITWEB
FileKey1=%ProgramFiles%\32BITWEB\Data|LastURL.da*
FileKey2=%SystemDrive%\32bw\data|LastURL.da*
RegKey1=HKCU\Software\ElectaSoft\Applications\323bw\Configure|LastOpenWebPageDir
RegKey2=HKCU\Software\ElectaSoft\Applications\323bw\Configure|LastURL

[140 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\242820
FileKey1=%ProgramFiles%\Steam\SteamApps\common\140\140_Data|output_log.txt

[360 Internet Security *]
LangSecRef=3024
Detect=HKCU\Software\360Safe
FileKey1=%AppData%\360DesktopLite\DTFence|*.bk
FileKey2=%AppData%\360Safe\360ScanLog|*
FileKey3=%AppData%\360Safe\Clean\OKClean|*.log
FileKey4=%ProgramFiles%\360\360 Internet Security|*.log*|RECURSE
FileKey5=%SystemDrive%\360SANDBOX|*.log*|RECURSE

[360 Secure Browser Autofill Data & Search Engine Preferences *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|*Web Data
FileKey2=%AppData%\360se6\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%AppData%\360se6\User Data\AutoFill*|*|REMOVESELF

[360 Secure Browser Autoplay Preferences *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\MEIPreload|*|REMOVESELF

[360 Secure Browser Bookmark Backups *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|Bookmarks.bak

[360 Secure Browser Bookmark Favicons *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|favicons*

[360 Secure Browser Caches *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360safe\SoftMgr\Cache|*|RECURSE
FileKey2=%AppData%\360safe\SoftMgr\Message\Cache|*|RECURSE
FileKey3=%AppData%\360se6\User Data|*-journal|RECURSE
FileKey4=%AppData%\360se6\User Data|Module Info Cache
FileKey5=%AppData%\360se6\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey6=%AppData%\360se6\User Data\*\*Cache*|*|REMOVESELF
FileKey7=%AppData%\360se6\User Data\*\blob_storage|*|REMOVESELF
FileKey8=%AppData%\360se6\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey9=%AppData%\360se6\User Data\*\Download Service|*|REMOVESELF
FileKey10=%AppData%\360se6\User Data\*\File System|*|REMOVESELF
FileKey11=%AppData%\360se6\User Data\*\GCM Store|*|REMOVESELF
FileKey12=%AppData%\360se6\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey13=%AppData%\360se6\User Data\*\optimization*|*|REMOVESELF
FileKey14=%AppData%\360se6\User Data\*\Platform Notifications|*|REMOVESELF
FileKey15=%AppData%\360se6\User Data\*\Service Worker|*|REMOVESELF
FileKey16=%AppData%\360se6\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey17=%AppData%\360se6\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey18=%AppData%\360se6\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey19=%AppData%\360se6\User Data\*Cache*|*|REMOVESELF
FileKey20=%AppData%\360se6\User Data\Avatars|*|REMOVESELF
FileKey21=%AppData%\360se6\User Data\Optimization*|*|REMOVESELF

[360 Secure Browser Default App Handlers *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|PreferredApps

[360 Secure Browser Download History *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|DownloadMetadata
FileKey2=%AppData%\360se6\User Data\*\shared_proto_db|*|REMOVESELF

[360 Secure Browser DRM Data *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%AppData%\360se6\User Data\WidevineCdm|*|REMOVESELF

[360 Secure Browser Extension Cookies *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|Extension Cookies

[360 Secure Browser Pinned Tabs *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
RegKey1=HKCU\360\360se6\PreferenceMACs\Default|pinned_tabs

[360 Secure Browser Privacy Sandbox *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data|*first_party_sets*
FileKey2=%AppData%\360se6\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%AppData%\360se6\User Data\*\Network|Trust Tokens*
FileKey4=%AppData%\360se6\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%AppData%\360se6\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%AppData%\360se6\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%AppData%\360se6\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%AppData%\360se6\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[360 Secure Browser Progressive Web Apps *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\Web Applications|*|REMOVESELF

[360 Secure Browser Saved Usernames & Passwords *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|Login Data*

[360 Secure Browser Security & Threat Detection *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|DIPS*
FileKey2=%AppData%\360se6\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%AppData%\360se6\User Data\*\Network|TransportSecurity*
FileKey4=%AppData%\360se6\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%AppData%\360se6\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%AppData%\360se6\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%AppData%\360se6\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%AppData%\360se6\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%AppData%\360se6\User Data\SafetyTips|*|REMOVESELF
FileKey10=%AppData%\360se6\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%AppData%\360se6\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%AppData%\360se6\User Data\ZxcvbnData|*|REMOVESELF

[360 Secure Browser Shopping Insights *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%AppData%\360se6\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%AppData%\360se6\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%AppData%\360se6\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%AppData%\360se6\User Data\*\parcel_tracking_db|*|REMOVESELF

[360 Secure Browser Storage Quota Manager *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|QuotaManager

[360 Secure Browser Sync Data *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\Sync Data|*|REMOVESELF

[360 Secure Browser Telemetry *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\Application|debug.log
FileKey2=%AppData%\360se6\Application\SetupMetrics|*|REMOVESELF
FileKey3=%AppData%\360se6\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%AppData%\360se6\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%AppData%\360se6\User Data\*|*.log
FileKey6=%AppData%\360se6\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%AppData%\360se6\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%AppData%\360se6\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%AppData%\360se6\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%AppData%\360se6\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%AppData%\360se6\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%AppData%\360se6\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%AppData%\360se6\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%AppData%\360se6\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%AppData%\360se6\User Data\Crash Reports|*|REMOVESELF
FileKey16=%AppData%\360se6\User Data\Crashpad|*|REMOVESELF
FileKey17=%AppData%\360se6\User Data\Local Traces|*|REMOVESELF
FileKey18=%AppData%\360se6\User Data\OriginTrials|*|REMOVESELF
FileKey19=%AppData%\360se6\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\360se6\Application|debug.log
FileKey21=%ProgramFiles%\360se6\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\360\360se6\BlBeacon|failed_count
RegKey2=HKCU\360\360se6\BlBeacon|state
RegKey3=HKCU\360\360se6\Installer|LastChecked
RegKey4=HKCU\360\360se6\StabilityMetrics

[360 Secure Browser Web Browsing Cookies *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\Network|Cookies*;Device Bound Sessions*

[360 Secure Browser Web Browsing History *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|360History*;History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[360 Secure Browser Web Browsing History Backups *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\HisDailyBackup|*|REMOVESELF

[360 Secure Browser Web Browsing Session *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*|UnClosed Pages
FileKey2=%AppData%\360se6\User Data\*\Extension State|*|REMOVESELF
FileKey3=%AppData%\360se6\User Data\*\Sessions|*|REMOVESELF

[360 Secure Browser Web Storage *]
Section=.360 Secure Browser Web Browser
DetectFile=%AppData%\360se6\User Data
FileKey1=%AppData%\360se6\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%AppData%\360se6\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%AppData%\360se6\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%AppData%\360se6\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%AppData%\360se6\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%AppData%\360se6\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%AppData%\360se6\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%AppData%\360se6\User Data\*\WebStorage|*|REMOVESELF

[1000 Amps *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\205690
FileKey1=%ProgramFiles%\Steam\SteamApps\common\1000 Amps|stdout.txt

[1954 Alcatraz *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\255280
FileKey1=%ProgramFiles%\Steam\SteamApps\common\1954 Alcatraz\Alcatraz_Data|output_log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Daedalic Entertainment\1954 Alcatraz|*.log

[A-PDF PDF Content Splitter *]
LangSecRef=3021
Detect=HKCU\Software\A-PDF\PDFContentSplitter
RegKey1=HKCU\Software\A-PDF\PDFContentSplitter\Setting|hloadpdfpath
RegKey2=HKCU\Software\A-PDF\PDFContentSplitter\Setting|hSaveallpdfpath
RegKey3=HKCU\Software\A-PDF\PDFContentSplitter\Setting|LastRulename

[A-PDF Watermark *]
LangSecRef=3021
Detect=HKCU\Software\A-PDF\Watermark
RegKey1=HKCU\Software\A-PDF\Watermark\Setting|hdIndir
RegKey2=HKCU\Software\A-PDF\Watermark\Setting|hdoutDir
RegKey3=HKCU\Software\A-PDF\Watermark\Setting|hloadpdfpath
RegKey4=HKCU\Software\A-PDF\Watermark\Setting|hSaveallpdfpath
RegKey5=HKCU\Software\A-PDF\Watermark\Setting|ptlastprinter

[A Hat in Time *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\HatinTime\HatinTimeGame
FileKey1=%ProgramFiles%\Steam\steamapps\common\HatinTime\HatinTimeGame\Logs|*

[A Space Adventure - Remastered Edition *]
Section=Games
DetectFile=%LocalAppData%\Simon Says Play\ASA Remastered
FileKey1=%LocalAppData%\Simon Says Play\ASA Remastered|*.log

[ABBYY FineReader *]
LangSecRef=3021
Detect1=HKCU\Software\ABBYY\FineReader
Detect2=HKCU\Software\ABBYY\FineReaderSprint
Detect3=HKCU\Software\ABBYY\Sprint\5.00
FileKey1=%LocalAppData%\ABBYY\FineReader\*|datafile.bin;SendToWorkFiles.txt
FileKey2=%LocalAppData%\ABBYY\FineReader\*\*\Dumps|*
FileKey3=%LocalAppData%\ABBYY\FineReader\*\Dumps|*
FileKey4=%LocalAppData%\ABBYY\FineReader\*\FineReaderShell|SendToWorkFiles.txt
FileKey5=%LocalAppData%\ABBYY\FineReader\16\*\Morphology\CachedUserDictionaries|*
FileKey6=%LocalAppData%\ABBYY\FineReader\16\Morphology\CachedUserDictionaries|*
FileKey7=%LocalAppData%\ABBYY\ScanManager\*|*.bmp;scantwain.txt;scanwia.txt
FileKey8=%ProgramData%\ABBYY\Bonus.ScreenshotReader\*|*.thumbnail
FileKey9=%ProgramData%\ABBYY\FineReader\*\*\*Cache|*|RECURSE
FileKey10=%ProgramData%\ABBYY\FineReader\*\*\Dumps|*
FileKey11=%ProgramData%\ABBYY\FineReader\*\*Cache|*
FileKey12=%ProgramData%\ABBYY\FineReader\*\Dumps|*
FileKey13=%ProgramData%\ABBYY\FineReader\*\Licenses|*.log
FileKey14=%ProgramFiles%\ABBYY FineReader*|*.cnt;*.log
FileKey15=%ProgramFiles%\ABBYY FineReader*\Resource\Cmap|*.lst
FileKey16=%ProgramFiles%\ABBYY FineReader*\Resource\Font|*.lst
FileKey17=%SystemDrive%\Temp\FR*|*|REMOVESELF
RegKey1=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|LoadImagePath
RegKey2=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|OpenBatchPath
RegKey3=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|SaveImagePath
RegKey4=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|SaveToPath
RegKey5=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey6=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastBatchPath
RegKey7=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastFormatsPage
RegKey8=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastOptionsPage
RegKey9=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastTAScenario
RegKey10=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastWebFoldersNames
RegKey11=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|ExportTAPath
RegKey12=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|ImportTAPath
RegKey13=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|LoadImagePath
RegKey14=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|OpenBatchPath
RegKey15=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|SaveImagePath
RegKey16=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|SaveToPath
RegKey17=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey18=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastBatchPath
RegKey19=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastFormatsPage
RegKey20=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastOptionsPage
RegKey21=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastTAScenario
RegKey22=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastWebFoldersNames
RegKey23=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|ExportTAPath
RegKey24=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|ImportTAPath
RegKey25=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|LoadImagePath
RegKey26=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|OpenBatchPath
RegKey27=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|SaveImagePath
RegKey28=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|SaveToPath
RegKey29=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey30=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastBatchPath
RegKey31=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastFormatsPage
RegKey32=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastOptionsPage
RegKey33=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastTAScenario
RegKey34=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastWebFoldersNames
RegKey35=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|LoadImagePath
RegKey36=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|OpenBatchPath
RegKey37=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|SaveImagePath
RegKey38=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|SaveToPath
RegKey39=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey40=HKCU\Software\ABBYY\FineReader\11.00\Shell\MainFrame\RecentFileList
RegKey41=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastBatchPath
RegKey42=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastFormatsPage
RegKey43=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastOptionsPage
RegKey44=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastTAScenario
RegKey45=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastWebFoldersNames
RegKey46=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|BatchDialogsMRU
RegKey47=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|LoadImagePath
RegKey48=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|OpenBatchPath
RegKey49=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|SaveImagePath
RegKey50=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|SaveToPath
RegKey51=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey52=HKCU\Software\ABBYY\FineReader\12.00\Shell\MainFrame\RecentFileList
RegKey53=HKCU\Software\ABBYY\FineReader\12.00\Shell\Options|LastBatchPath
RegKey54=HKCU\Software\ABBYY\FineReader\12.00\Shell\Options|LastFormatsPage
RegKey55=HKCU\Software\ABBYY\FineReader\12.00\Shell\Options|LastOptionsPage
RegKey56=HKCU\Software\ABBYY\FineReader\12.00\Shell\Options|LastTAScenario
RegKey57=HKCU\Software\ABBYY\FineReader\12.00\Shell\Options|LastWebFoldersNames
RegKey58=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader|LaunchCount
RegKey59=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LanguagesMRU
RegKey60=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LastRecognitionLanguage
RegKey61=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LastSaveImagePath
RegKey62=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LastUseTime
RegKey63=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|SaveTablePath
RegKey64=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|SaveTextPath
RegKey65=HKCU\Software\ABBYY\FineReader\14.00\Comparator\RateUs|RunCount
RegKey66=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell|LaunchCount
RegKey67=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|ExportTAPath
RegKey68=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|ImportTAPath
RegKey69=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath
RegKey70=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|WebFolderPath
RegKey71=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Options|LastTAScenario
RegKey72=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Options|LastWebFoldersNames
RegKey73=HKCU\Software\ABBYY\FineReader\14.00\FineUI\Dialogs\FROpenFileDialog|LastFolder
RegKey74=HKCU\Software\ABBYY\FineReader\14.00\FineUpdate|LaunchCount
RegKey75=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer|LaunchCount
RegKey76=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\PDFEngine\EraseExtraData|LastDeleteNeedlessExtraData
RegKey77=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Frame|ImportDataFolder
RegKey78=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Frame|Last signature
RegKey79=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Signature|SignatureCertificateLocation
RegKey80=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Signature|SignatureImagePath
RegKey81=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Statistics|LastUsedBuyMessages
RegKey82=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Tips|LastGetSocialTips
RegKey83=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentBatchList
RegKey84=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentCompareList
RegKey85=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentPdfList
RegKey86=HKCU\Software\ABBYY\FineReader\14.00\StatisticSender|LastSendStatisticsEvent
RegKey87=HKCU\Software\ABBYY\FineReader\14.00\StatisticSender|LaunchCount
RegKey88=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader|LaunchCount
RegKey89=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LanguagesMRU
RegKey90=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastRecognitionLanguage
RegKey91=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastSaveImagePath
RegKey92=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastUseTime
RegKey93=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|SaveTablePath
RegKey94=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|SaveTextPath
RegKey95=HKCU\Software\ABBYY\FineReader\15\Comparator\RateUs|RunCount
RegKey96=HKCU\Software\ABBYY\FineReader\15\Comparator\Shell\Options|MRURecognitionLanguages
RegKey97=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|ExportTAPath
RegKey98=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|ImportTAPath
RegKey99=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath
RegKey100=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|WebFolderPath
RegKey101=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Options|LastTAScenario
RegKey102=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Options|LastWebFoldersNames
RegKey103=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Tips|LastGetSocialTips
RegKey104=HKCU\Software\ABBYY\FineReader\15\FineUI\Dialogs\FROpenFileDialog|LastFolder
RegKey105=HKCU\Software\ABBYY\FineReader\15\PDFTransformer|LaunchCount
RegKey106=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\PDFEngine\EraseExtraData|LastDeleteNeedlessExtraData
RegKey107=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Frame|ImportDataFolder
RegKey108=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Frame|Last signature
RegKey109=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Signature|SignatureCertificateLocation
RegKey110=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Signature|SignatureImagePath
RegKey111=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Statistics|LastUsedBuyMessages
RegKey112=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Tips|LastGetSocialTips
RegKey113=HKCU\Software\ABBYY\FineReader\15\Shell\RecentBatchList
RegKey114=HKCU\Software\ABBYY\FineReader\15\Shell\RecentCompareList
RegKey115=HKCU\Software\ABBYY\FineReader\15\Shell\RecentPdfList
RegKey116=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader|LaunchCount
RegKey117=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader\Options|LanguagesMRU
RegKey118=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader\Options|LastRecognitionLanguage
RegKey119=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader\Options|LastSaveImagePath
RegKey120=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader\Options|LastUseTime
RegKey121=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader\Options|SaveTablePath
RegKey122=HKCU\Software\ABBYY\FineReader\16\Bonus.ScreenshotReader\Options|SaveTextPath
RegKey123=HKCU\Software\ABBYY\FineReader\16\Comparator\RateUs|RunCount
RegKey124=HKCU\Software\ABBYY\FineReader\16\FineReaderShell\Shell\Dialogs|ExportTAPath
RegKey125=HKCU\Software\ABBYY\FineReader\16\FineReaderShell\Shell\Dialogs|ImportTAPath
RegKey126=HKCU\Software\ABBYY\FineReader\16\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath
RegKey127=HKCU\Software\ABBYY\FineReader\16\FineReaderShell\Shell\Dialogs|WebFolderPath
RegKey128=HKCU\Software\ABBYY\FineReader\16\FineReaderShell\Shell\Options|LastTAScenario
RegKey129=HKCU\Software\ABBYY\FineReader\16\FineReaderShell\Shell\Options|LastWebFoldersNames
RegKey130=HKCU\Software\ABBYY\FineReader\16\FineUI\Dialogs\FROpenFileDialog|LastFolder
RegKey131=HKCU\Software\ABBYY\FineReader\16\PDFTransformer|LaunchCount
RegKey132=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\PDFEngine\EraseExtraData|LastDeleteNeedlessExtraData
RegKey133=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\Shell\Frame|ImportDataFolder
RegKey134=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\Shell\Frame|Last signature
RegKey135=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\Shell\Signature|SignatureCertificateLocation
RegKey136=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\Shell\Signature|SignatureImagePath
RegKey137=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\Shell\Statistics|LastUsedBuyMessages
RegKey138=HKCU\Software\ABBYY\FineReader\16\PDFTransformer\Tips|LastGetSocialTips
RegKey139=HKCU\Software\ABBYY\FineReader\16\Shell\RecentBatchList
RegKey140=HKCU\Software\ABBYY\FineReader\16\Shell\RecentCompareList
RegKey141=HKCU\Software\ABBYY\FineReader\16\Shell\RecentPdfList
RegKey142=HKCU\Software\ABBYY\Sprint\5.00\Options|ExportToFilePath
RegKey143=HKCU\Software\ABBYY\Sprint\5.00\Options|OpenImagePath
RegKey144=HKCU\Software\ABBYY\Sprint\5.00\Options|SaveImagePath

[ABBYY Lingvo *]
LangSecRef=3021
Detect=HKCU\Software\ABBYY\Lingvo\15.0
DetectFile=%ProgramFiles%\ABBYY Lingvo x5
FileKey1=%ProgramData%\ABBYY\Lingvo\*\Licenses|*.log
FileKey2=%ProgramFiles%\ABBYY Lingvo x5|*.log;*.rtf
RegKey1=HKCU\Software\ABBYY\Lingvo\15.0\Dictionaries\FavoriteDirections
RegKey2=HKCU\Software\ABBYY\Lingvo\15.0\View|LastText
RegKey3=HKCU\Software\ABBYY\Lingvo\15.0\X3M|LastActivity

[ABBYY PDFTransformer *]
LangSecRef=3021
Detect=HKCU\Software\ABBYY\PDFTransformer
DetectFile=%LocalAppData%\ABBYY\PDFTransformer
FileKey1=%LocalAppData%\ABBYY\PDFTransformer\*|*.log
FileKey2=%LocalAppData%\ABBYY\PDFTransformer\*\FontCache|*
FileKey3=%ProgramData%\ABBYY\PDFTransformer\*\Licenses|*.log
FileKey4=%ProgramFiles%\ABBYY PDF Transformer *.0|*.log
FileKey5=%SystemDrive%\Temp\PDFT*|*|REMOVESELF
RegKey1=HKCU\Software\ABBYY\PDFTransformer\3.00\Transform|MRURecognitionLanguages
RegKey2=HKCU\Software\ABBYY\PDFTransformer\3.00\Transform|TransformOpenPath
RegKey3=HKCU\Software\ABBYY\PDFTransformer\12.00\Shell\Statistics

[ABBYY ScreenshotReader *]
LangSecRef=3021
Detect1=HKCU\Software\ABBYY\Bonus.ScreenshotReader
Detect2=HKCU\Software\ABBYY\Retail.ScreenshotReader
Detect3=HKCU\Software\ABBYY\ScreenshotReader
DetectFile=%ProgramFiles%\ABBYY Screenshot Reader
FileKey1=%ProgramData%\ABBYY\*.ScreenshotReader\*|*.xml
FileKey2=%ProgramData%\ABBYY\*.ScreenshotReader\*\Licenses|*.log
FileKey3=%ProgramFiles%\ABBYY Screenshot Reader|*.log;*.rtf
RegKey1=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|LastSaveImagePath
RegKey2=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|SaveTablePath
RegKey3=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|SaveTextPath
RegKey4=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Advertising
RegKey5=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|LastSaveImagePath
RegKey6=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|SaveTablePath
RegKey7=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|SaveTextPath
RegKey8=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|LastSaveImagePath
RegKey9=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|SaveTablePath
RegKey10=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|SaveTextPath

[Abelssoft AntiBrowserSpy *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\AntiBrowserSpy
FileKey1=%LocalAppData%\Abelssoft\AntiBrowserSpy|*.log
FileKey2=%LocalAppData%\Abelssoft\AntiBrowserSpy\Backups|*

[Abelssoft AntiLogger *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\AntiLogger
FileKey1=%LocalAppData%\Abelssoft\AntiLogger|*.log

[Abelssoft AntiRansomware *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\AntiRansomware
FileKey1=%LocalAppData%\Abelssoft\AntiRansomware|*.log

[Abelssoft CheckDrive *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\CheckDrive
FileKey1=%LocalAppData%\Abelssoft\CheckDrive|*.log|RECURSE

[Abelssoft CleverPrint *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\CleverPrint
FileKey1=%LocalAppData%\Abelssoft\CleverPrint|*.log

[Abelssoft Converter4Video *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Converter4Video
FileKey1=%LocalAppData%\Abelssoft\Converter4Video|*.log

[Abelssoft CryptBox *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\CryptBox
FileKey1=%LocalAppData%\Abelssoft\CryptBox|*.log

[Abelssoft Data2Pocket *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Data2Pocket
FileKey1=%LocalAppData%\Abelssoft\Data2Pocket|*.log

[Abelssoft Easy PDF *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Abelssoft Easy PDF
FileKey1=%LocalAppData%\Abelssoft\Abelssoft Easy PDF|*.log

[Abelssoft EasyBackup *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\EasyBackup
FileKey1=%LocalAppData%\Abelssoft\EasyBackup|*.log

[Abelssoft EasyFirewall *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\EasyFirewall
FileKey1=%LocalAppData%\Abelssoft\EasyFirewall|*.log

[Abelssoft EverDoc *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\EverDoc
FileKey1=%LocalAppData%\Abelssoft\EverDoc|*.log

[Abelssoft FileCryptor *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\FileCryptor
FileKey1=%LocalAppData%\Abelssoft\FileCryptor|*.log

[Abelssoft FileFusion *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\FileFusion
FileKey1=%LocalAppData%\Abelssoft\FileFusion|*.log|RECURSE
FileKey2=%LocalAppData%\Abelssoft\FileFusion\Backups|*

[Abelssoft FileWing Shredder *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\FileWingShredder
FileKey1=%AppData%\Abelssoft\FileWingShredder|*.log

[Abelssoft FindMyFiles *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\FindMyFiles
FileKey1=%LocalAppData%\Abelssoft\FindMyFiles|*.log

[Abelssoft FolderVisualizer *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\FolderVisualizer
FileKey1=%AppData%\Abelssoft\FolderVisualizer|*.log

[Abelssoft GClean *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Abelssoft\GClean
DetectFile2=%LocalAppData%\Abelssoft\GoogleClean
FileKey1=%LocalAppData%\Abelssoft\GClean|*.log
FileKey2=%LocalAppData%\Abelssoft\GClean\Backups|*
FileKey3=%LocalAppData%\Abelssoft\GoogleClean\log|*|REMOVESELF

[Abelssoft HackCheck *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\HackCheck
FileKey1=%LocalAppData%\Abelssoft\HackCheck|*.log

[Abelssoft HappyCard *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\HappyCard
FileKey1=%LocalAppData%\Abelssoft\HappyCard|*.log;RecentImages.txt

[Abelssoft JetDrive *]
LangSecRef=3024
DetectFile=%ProgramFiles%\JetDrive
FileKey1=%LocalAppData%\Abelssoft\JetDrive|*.log;JetDrive.reports.xml
FileKey2=%ProgramFiles%\JetDrive|JetDrive.log

[Abelssoft KeyDepot *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\KeyDepot
FileKey1=%AppData%\KeyDepot\*Cache*|*|RECURSE
FileKey2=%LocalAppData%\Abelssoft\KeyDepot|*.log

[Abelssoft MalwareTerminator *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\MalwareTerminator
FileKey1=%AppData%\Abelssoft\MalwareTerminator|*.log

[Abelssoft MovieCut *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\MovieCut
FileKey1=%AppData%\Abelssoft\MovieCut|*.log

[Abelssoft mp3schneiden *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\mp3schneiden
FileKey1=%AppData%\Abelssoft\mp3schneiden|*.log

[Abelssoft MyKeyFinder *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\MyKeyFinder
FileKey1=%LocalAppData%\Abelssoft\MyKeyFinder|*.log

[Abelssoft PCFresh *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\PCFresh
FileKey1=%LocalAppData%\Abelssoft\PCFresh|*.log
FileKey2=%LocalAppData%\Abelssoft\PCFresh\Backup|*

[Abelssoft Photastic *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Photastic
FileKey1=%LocalAppData%\Abelssoft\Photastic|*.log;RecentImages.txt
FileKey2=%ProgramData%\Abelssoft\Photastic|*.log

[Abelssoft PhotoBoost *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Abelssoft\PhotoBoost
DetectFile2=%ProgramData%\Abelssoft\PhotoBoost
FileKey1=%LocalAppData%\Abelssoft\PhotoBoost|*.log
FileKey2=%ProgramData%\Abelssoft\PhotoBoost|*.log

[Abelssoft PhotoSort *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\PhotoSort
FileKey1=%LocalAppData%\Abelssoft\PhotoSort|*.log

[Abelssoft Recordify *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Recordify
FileKey1=%LocalAppData%\Abelssoft\Recordify|*.log

[Abelssoft Registry Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\RegistryCleaner
FileKey1=%AppData%\Abelssoft\RegistryCleaner|*.log

[Abelssoft RouterGuard *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\RouterGuard
FileKey1=%LocalAppData%\Abelssoft\RouterGuard|*.log

[Abelssoft Schirmfoto *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\Schirmfoto
FileKey1=%AppData%\Abelssoft\Schirmfoto|*.log

[Abelssoft ScreenVideo *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\ScreenVideo
FileKey1=%LocalAppData%\Abelssoft\ScreenVideo|*.log
FileKey2=%UserProfile%\Videos\ScreenVideo\Cache|*

[Abelssoft SendMe *]
LangSecRef=3024
DetectFile=%AppData%\SendMe
FileKey1=%AppData%\SendMe\*Cache|*|RECURSE
FileKey2=%LocalAppData%\Abelssoft\SendMe|*.log

[Abelssoft SSD Fresh *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\SSD Fresh
FileKey1=%LocalAppData%\Abelssoft\SSD Fresh|*.log;backup.*

[Abelssoft StartupStar *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\StartupStar
FileKey1=%AppData%\AbelsSoft\StartupStar|*.log
FileKey2=%LocalAppData%\Abelssoft\StartupStar|*.log;backup.xml

[Abelssoft SyncManager *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\SyncManager
FileKey1=%LocalAppData%\Abelssoft\SyncManager|*.log

[Abelssoft Tagman *]
LangSecRef=3024
DetectFile=%AppData%\Abelssoft\Tagman
FileKey1=%AppData%\Abelssoft\Tagman|*.log

[Abelssoft Undeleter *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Abelssoft Undeleter
FileKey1=%LocalAppData%\Abelssoft\Abelssoft Undeleter|*.log

[Abelssoft WashAndGo *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\WashAndGo
FileKey1=%AppData%\Abelssoft\WashAndGo\Log|*.log|RECURSE
FileKey2=%LocalAppData%\Abelssoft\WashAndGo|*.log|RECURSE
FileKey3=%LocalAppData%\Abelssoft\WashAndGo\Backups|*
FileKey4=%UserProfile%\Documents\Abelssoft\WashAndGo\Backups|*

[Abelssoft Win10PrivacyFix *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Win10PrivacyFix
FileKey1=%LocalAppData%\Abelssoft\Win10PrivacyFix|*.log

[Abelssoft Win11PrivacyFix *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\Win11PrivacyFix
FileKey1=%LocalAppData%\Abelssoft\Win11PrivacyFix|*.log

[Abelssoft YouTube Song Downloader *]
LangSecRef=3024
DetectFile=%AppData%\YouTubeSongDownloader
FileKey1=%AppData%\YouTubeSongDownloader\*Cache|*|RECURSE
FileKey2=%LocalAppData%\Abelssoft\YouTube Song Downloader|*.log

[abgx360 *]
LangSecRef=3024
Detect=HKCU\Software\abgx360gui
RegKey1=HKCU\Software\abgx360gui\RecentFiles

[Ability Office Database *]
LangSecRef=3021
Detect1=HKCU\Software\Ability 6.0\Ability Database
Detect2=HKCU\Software\Ability 7.0\Ability Database
Detect3=HKCU\Software\Ability 11.0\Ability Database
RegKey1=HKCU\Software\Ability 6.0\Ability Database\Dirs
RegKey2=HKCU\Software\Ability 6.0\Ability Database\Files
RegKey3=HKCU\Software\Ability 6.0\Ability Database\Recent File List
RegKey4=HKCU\Software\Ability 7.0\Ability Database\Dirs
RegKey5=HKCU\Software\Ability 7.0\Ability Database\Files
RegKey6=HKCU\Software\Ability 7.0\Ability Database\Recent File List
RegKey7=HKCU\Software\Ability 11.0\Ability Database\Dirs
RegKey8=HKCU\Software\Ability 11.0\Ability Database\Files
RegKey9=HKCU\Software\Ability 11.0\Ability Database\Recent File List

[Ability Office PhotoPaint *]
LangSecRef=3021
Detect1=HKCU\Software\Ability 6.0\Ability PhotoPaint
Detect2=HKCU\Software\Ability 6.0\Ability PhotoPaint Studio
Detect3=HKCU\Software\Ability 7.0\Ability PhotoPaint
Detect4=HKCU\Software\Ability 7.0\Ability PhotoPaint Studio
Detect5=HKCU\Software\Ability 11.0\Ability PhotoPaint
Detect6=HKCU\Software\Ability 11.0\Ability PhotoPaint Studio
RegKey1=HKCU\Software\Ability 6.0\Ability PhotoPaint Studio\Dirs
RegKey2=HKCU\Software\Ability 6.0\Ability PhotoPaint Studio\Files
RegKey3=HKCU\Software\Ability 6.0\Ability PhotoPaint Studio\Recent File List
RegKey4=HKCU\Software\Ability 6.0\Ability PhotoPaint\Dirs
RegKey5=HKCU\Software\Ability 6.0\Ability PhotoPaint\Files
RegKey6=HKCU\Software\Ability 6.0\Ability PhotoPaint\Recent File List
RegKey7=HKCU\Software\Ability 7.0\Ability PhotoPaint Studio\Dirs
RegKey8=HKCU\Software\Ability 7.0\Ability PhotoPaint Studio\Files
RegKey9=HKCU\Software\Ability 7.0\Ability PhotoPaint Studio\Recent File List
RegKey10=HKCU\Software\Ability 7.0\Ability PhotoPaint\Dirs
RegKey11=HKCU\Software\Ability 7.0\Ability PhotoPaint\Files
RegKey12=HKCU\Software\Ability 7.0\Ability PhotoPaint\Recent File List
RegKey13=HKCU\Software\Ability 11.0\Ability PhotoPaint Studio\Dirs
RegKey14=HKCU\Software\Ability 11.0\Ability PhotoPaint Studio\Files
RegKey15=HKCU\Software\Ability 11.0\Ability PhotoPaint Studio\Recent File List
RegKey16=HKCU\Software\Ability 11.0\Ability PhotoPaint\Dirs
RegKey17=HKCU\Software\Ability 11.0\Ability PhotoPaint\Files
RegKey18=HKCU\Software\Ability 11.0\Ability PhotoPaint\Recent File List

[Ability Office Presentation *]
LangSecRef=3021
Detect1=HKCU\Software\Ability 6.0\Ability Presentation
Detect2=HKCU\Software\Ability 7.0\Ability Presentation
Detect3=HKCU\Software\Ability 11.0\Ability Presentation
RegKey1=HKCU\Software\Ability 6.0\Ability Presentation\Dirs
RegKey2=HKCU\Software\Ability 6.0\Ability Presentation\Files
RegKey3=HKCU\Software\Ability 6.0\Ability Presentation\Recent File List
RegKey4=HKCU\Software\Ability 7.0\Ability Presentation\Dirs
RegKey5=HKCU\Software\Ability 7.0\Ability Presentation\Files
RegKey6=HKCU\Software\Ability 7.0\Ability Presentation\Recent File List
RegKey7=HKCU\Software\Ability 11.0\Ability Presentation\Dirs
RegKey8=HKCU\Software\Ability 11.0\Ability Presentation\Files
RegKey9=HKCU\Software\Ability 11.0\Ability Presentation\Recent File List

[Ability Office Spreadsheet *]
LangSecRef=3021
Detect1=HKCU\Software\Ability 6.0\Ability Spreadsheet
Detect2=HKCU\Software\Ability 7.0\Ability Spreadsheet
Detect3=HKCU\Software\Ability 11.0\Ability Spreadsheet
RegKey1=HKCU\Software\Ability 6.0\Ability Spreadsheet\Dirs
RegKey2=HKCU\Software\Ability 6.0\Ability Spreadsheet\Files
RegKey3=HKCU\Software\Ability 6.0\Ability Spreadsheet\Recent File List
RegKey4=HKCU\Software\Ability 7.0\Ability Spreadsheet\Dirs
RegKey5=HKCU\Software\Ability 7.0\Ability Spreadsheet\Files
RegKey6=HKCU\Software\Ability 7.0\Ability Spreadsheet\Recent File List
RegKey7=HKCU\Software\Ability 11.0\Ability Spreadsheet\Dirs
RegKey8=HKCU\Software\Ability 11.0\Ability Spreadsheet\Files
RegKey9=HKCU\Software\Ability 11.0\Ability Spreadsheet\Recent File List

[Ability Office Write *]
LangSecRef=3021
Detect1=HKCU\Software\Ability 6.0\Ability Write
Detect2=HKCU\Software\Ability 7.0\Ability Write
Detect3=HKCU\Software\Ability 11.0\Ability Write
RegKey1=HKCU\Software\Ability 6.0\Ability Write\Dirs
RegKey2=HKCU\Software\Ability 6.0\Ability Write\Files
RegKey3=HKCU\Software\Ability 6.0\Ability Write\Recent File List
RegKey4=HKCU\Software\Ability 7.0\Ability Write\Dirs
RegKey5=HKCU\Software\Ability 7.0\Ability Write\Files
RegKey6=HKCU\Software\Ability 7.0\Ability Write\Recent File List
RegKey7=HKCU\Software\Ability 11.0\Ability Write\Dirs
RegKey8=HKCU\Software\Ability 11.0\Ability Write\Files
RegKey9=HKCU\Software\Ability 11.0\Ability Write\Recent File List

[Ableton Live *]
LangSecRef=3023
Detect=HKLM\Software\Propellerhead Software\ReWire\Ableton Live Engine
DetectFile=%AppData%\Ableton
FileKey1=%AppData%\Ableton\*\Preferences|*.log;*Log.txt;Indexer.txt|RECURSE
FileKey2=%AppData%\Ableton\Cache|*|RECURSE
FileKey3=%AppData%\Ableton\Live Reports|Ableton Crash Report*.zip
FileKey4=%AppData%\Ableton\Live Reports\Ableton Crash Report*|*|REMOVESELF
FileKey5=%AppData%\Ableton\Live Reports\Temp|*|REMOVESELF
FileKey6=%AppData%\Ableton\Live Reports\Usage|*|REMOVESELF
FileKey7=%AppData%\Ableton\Live*\Preferences\Crash|*|RECURSE
FileKey8=%LocalAppData%\Ableton\Cache\cache\decoding|*
FileKey9=%ProgramData%\Ableton\*\Redist|vc*redist*.exe
FileKey10=%ProgramFiles%\Ableton\*\Redist|vc*redist*.exe

[AbsoluteFTP *]
LangSecRef=3022
Detect=HKCU\Software\Van Dyke Technologies\AbsoluteFTP
RegKey1=HKCU\Software\Van Dyke Technologies\AbsoluteFTP\Recent File List

[Abvent Artlantis *]
LangSecRef=3021
DetectFile1=%AppData%\Abvent\Artlantis*
DetectFile2=%AppData%\Abvent_Artlantis*
FileKey1=%AppData%\Abvent\Artlantis*|*Log.txt
FileKey2=%AppData%\Abvent\Artlantis*\*_DiagnosticReports_*|*|REMOVESELF
FileKey3=%AppData%\Abvent_Artlantis*|*Log.txt
FileKey4=%AppData%\Abvent_Artlantis*\*_DiagnosticReports_*|*|REMOVESELF

[Abyssmedia Quick Batch File Compiler *]
LangSecRef=3024
Detect1=HKCU\Software\Abyssmedia\Quick Batch File Compiler
Detect2=HKCU\Software\qbfc
RegKey1=HKCU\Software\Abyssmedia\Quick Batch File Compiler\Settings|savedir
RegKey2=HKCU\Software\qbfc\RecentFiles

[Abyssmedia ScriptCryptor Compiler *]
LangSecRef=3024
Detect=HKCU\Software\Abyssmedia\ScriptCryptor
RegKey1=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mrucount
RegKey2=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem0
RegKey3=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem1
RegKey4=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem2
RegKey5=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem3
RegKey6=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem4
RegKey7=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|savedir

[AC74 *]
LangSecRef=3021
Detect=HKCU\Software\AC74\View64
RegKey1=HKCU\Software\AC74\View64|MRU1
RegKey2=HKCU\Software\AC74\View64|MRU2
RegKey3=HKCU\Software\AC74\View64|MRU3
RegKey4=HKCU\Software\AC74\View64|MRU4
RegKey5=HKCU\Software\AC74\View64|MRU5
RegKey6=HKCU\Software\AC74\View64|MRU6
RegKey7=HKCU\Software\AC74\View64|MRU7
RegKey8=HKCU\Software\AC74\View64|MRU8

[AccessData Registry Viewer *]
LangSecRef=3024
Detect=HKCU\Software\AccessData\Registry Viewer
RegKey1=HKCU\Software\AccessData\Registry Viewer\Recent File List

[AccurateRip *]
LangSecRef=3023
DetectFile=%AppData%\AccurateRip
FileKey1=%AppData%\AccurateRip\AccurateRipCache|dBAR*.bin

[ACDSee Photo Studio *]
LangSecRef=3023
Detect1=HKCU\Software\ACD Systems\ACDSee Pro
Detect2=HKCU\Software\ACD Systems\ACDSee Professional
Detect3=HKCU\Software\ACD Systems\ACDSee Standard
Detect4=HKCU\Software\ACD Systems\ACDSee Ultimate
Detect5=HKCU\Software\ACD Systems\ACDSee\60
FileKey1=%LocalAppData%\ACD Systems\GeoTag\Cache|*|RECURSE
FileKey2=%LocalAppData%\ACD Systems\ICMCache|*|RECURSE
FileKey3=%LocalAppData%\ACD Systems\Logs|*|RECURSE
FileKey4=%LocalAppData%\ACD Systems\SavedSearches|*|RECURSE
RegKey1=HKCU\Software\ACD Systems\ACDSee Pro\90|HistMCFDestFolder
RegKey2=HKCU\Software\ACD Systems\ACDSee Pro\90|HistPaths
RegKey3=HKCU\Software\ACD Systems\ACDSee Pro\90|LastOptionPageName
RegKey4=HKCU\Software\ACD Systems\ACDSee Pro\90|OpenFolder
RegKey5=HKCU\Software\ACD Systems\ACDSee Pro\90\PrintOptions\OutputContactSheet|ContactSheetFN
RegKey6=HKCU\Software\ACD Systems\ACDSee Pro\90\PrintOptions\OutputContactSheet|ImageMapFN
RegKey7=HKCU\Software\ACD Systems\ACDSee Professional\110|HistMCFDestFolder
RegKey8=HKCU\Software\ACD Systems\ACDSee Professional\110|HistPaths
RegKey9=HKCU\Software\ACD Systems\ACDSee Professional\110|LastOptionPageName
RegKey10=HKCU\Software\ACD Systems\ACDSee Professional\110|OnlineHistPaths
RegKey11=HKCU\Software\ACD Systems\ACDSee Professional\110|OpenFolder
RegKey12=HKCU\Software\ACD Systems\ACDSee Professional\120|HistMCFDestFolder
RegKey13=HKCU\Software\ACD Systems\ACDSee Professional\120|HistPaths
RegKey14=HKCU\Software\ACD Systems\ACDSee Professional\120|LastOptionPageName
RegKey15=HKCU\Software\ACD Systems\ACDSee Professional\120|OnlineHistPaths
RegKey16=HKCU\Software\ACD Systems\ACDSee Professional\120|OpenFolder
RegKey17=HKCU\Software\ACD Systems\ACDSee Standard\210|HistMCFDestFolder
RegKey18=HKCU\Software\ACD Systems\ACDSee Standard\210|HistPaths
RegKey19=HKCU\Software\ACD Systems\ACDSee Standard\210|LastOptionPageName
RegKey20=HKCU\Software\ACD Systems\ACDSee Standard\210|OnlineHistPaths
RegKey21=HKCU\Software\ACD Systems\ACDSee Standard\210|OpenFolder
RegKey22=HKCU\Software\ACD Systems\ACDSee Standard\220|HistMCFDestFolder
RegKey23=HKCU\Software\ACD Systems\ACDSee Standard\220|HistPaths
RegKey24=HKCU\Software\ACD Systems\ACDSee Standard\220|LastOptionPageName
RegKey25=HKCU\Software\ACD Systems\ACDSee Standard\220|OnlineHistPaths
RegKey26=HKCU\Software\ACD Systems\ACDSee Standard\220|OpenFolder
RegKey27=HKCU\Software\ACD Systems\ACDSee Ultimate\110|HistMCFDestFolder
RegKey28=HKCU\Software\ACD Systems\ACDSee Ultimate\110|HistPaths
RegKey29=HKCU\Software\ACD Systems\ACDSee Ultimate\110|LastOptionPageName
RegKey30=HKCU\Software\ACD Systems\ACDSee Ultimate\110|OnlineHistPaths
RegKey31=HKCU\Software\ACD Systems\ACDSee Ultimate\110|OpenFolder
RegKey32=HKCU\Software\ACD Systems\ACDSee Ultimate\120|HistMCFDestFolder
RegKey33=HKCU\Software\ACD Systems\ACDSee Ultimate\120|HistPaths
RegKey34=HKCU\Software\ACD Systems\ACDSee Ultimate\120|LastOptionPageName
RegKey35=HKCU\Software\ACD Systems\ACDSee Ultimate\120|OnlineHistPaths
RegKey36=HKCU\Software\ACD Systems\ACDSee Ultimate\120|OpenFolder
RegKey37=HKCU\Software\ACD Systems\ACDSee\60|HistMCFDestFolder
RegKey38=HKCU\Software\ACD Systems\ACDSee\60|HistPaths
RegKey39=HKCU\Software\ACD Systems\ACDSee\60|LastOptionPageName
RegKey40=HKCU\Software\ACD Systems\ACDSee\60|OpenFolder
RegKey41=HKCU\Software\ACD Systems\ACDSee\60\PrintOptions\OutputContactSheet|ContactSheetFN
RegKey42=HKCU\Software\ACD Systems\ACDSee\60\PrintOptions\OutputContactSheet|ImageMapFN
RegKey43=HKCU\Software\ACD Systems\EditLib\Presets\Photo Repair 2|Last Used

[Ace Stream *]
LangSecRef=3023
DetectFile=%AppData%\ACEStream
FileKey1=%AppData%\.ACEStream|*.ini
FileKey2=%AppData%\.ACEStream\collected_torrent_files|*
FileKey3=%AppData%\ACEStream\engine|*.log
FileKey4=%AppData%\ACEStream\player\plugins|plugins.dat
FileKey5=%AppData%\ACEStream\updater|*.log
FileKey6=%SystemDrive%\_acestream_cache_|*|REMOVESELF
FileKey7=%UserProfile%\AppData\LocalLow\.ACEStream|*.log

[Ace Utilities *]
LangSecRef=3024
Detect=HKCU\Software\Acelogix\Ace Utilities
FileKey1=%LocalAppData%\Acelogix\Ace Utilities\Backups|*.reg
RegKey1=HKCU\Software\Acelogix\Ace Utilities\Settings|UsageHistory

[Acer Care Center *]
LangSecRef=3024
Detect1=HKLM\Software\OEM\AcerCareCenter
Detect2=HKLM\Software\OEM\CareCenter
FileKey1=%ProgramData%\Acer\CareCenter\DebugLog\SurfaceCheck|log*.txt
FileKey2=%ProgramFiles%\Acer\Care Center\DebugLog|*.log

[Acer Clear.fi *]
LangSecRef=3021
DetectFile=%LocalAppData%\Acer\Clear.fi
FileKey1=%LocalAppData%\Acer\Clear.fi\log|*.log
FileKey2=%LocalAppData%\AOP SDK\acer infra\acer\log|*.log
FileKey3=%LocalAppData%\AOP SDK\acer infra\acer\SyncAgent\logs|*|RECURSE
FileKey4=%LocalAppData%\Clear.fi\AcerCloud\SyncAgent\logs|*|RECURSE
FileKey5=%LocalAppData%\Clear.fi\log|*|RECURSE

[Acesoft Tracks Eraser Pro *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Acesoft\Tracks Eraser Pro
FileKey1=%ProgramFiles%\Acesoft\Tracks Eraser Pro|te.log

[Acon Digital Acoustica *]
LangSecRef=3023
Detect1=HKCU\Software\Acon Digital\Acoustica Basic Edition 6
Detect2=HKCU\Software\Acon Digital\Acoustica Premium Edition 6
Detect3=HKCU\Software\Acon Digital\Acoustica Premium Edition 7
Detect4=HKCU\Software\Acon Digital\Acoustica Standard Edition 6
RegKey1=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\General|BrowserFolder
RegKey2=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\General|LastAudioDir
RegKey3=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\Recent File List
RegKey4=HKCU\Software\Acon Digital\Acoustica Premium Edition 7\General|BrowserFolder
RegKey5=HKCU\Software\Acon Digital\Acoustica Premium Edition 7\General|LastAudioDir
RegKey6=HKCU\Software\Acon Digital\Acoustica Premium Edition 7\Recent File List

[Acoustica CD Label Maker *]
LangSecRef=3024
DetectFile=%AppData%\Acoustica\CD Label Maker
FileKey1=%AppData%\Acoustica\CD Label Maker\*\cache|*|RECURSE
FileKey2=%AppData%\Acoustica\CD Label Maker\cache|*|RECURSE
FileKey3=%AppData%\Acoustica\CD Label Maker\shapes|*
FileKey4=%ProgramFiles%\Acoustica CD Label Maker\thumbs|*|RECURSE

[Acrok Video Converter Ultimate *]
LangSecRef=3023
DetectFile=%AppData%\Acrok\Acrok Video Converter Ultimate
FileKey1=%AppData%\Acrok Software\Blu-ray Plugin|*.log
FileKey2=%AppData%\Acrok Software\Blu-ray Plugin\Log|*.log
FileKey3=%AppData%\Acrok\Acrok Video Converter Ultimate|*.dmp
FileKey4=%AppData%\Acrok\Acrok Video Converter Ultimate\log|*
FileKey5=%AppData%\Auxre\Blu-ray Plugin|*.log
FileKey6=%AppData%\Auxre\Blu-ray Plugin\Log|*.log
FileKey7=%UserProfile%\.BDAccess|*|RECURSE

[Active@ Disk Image *]
LangSecRef=3024
DetectFile=%ProgramFiles%\LSoft Technologies\Active@ Disk Image
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ Disk Image|*.txt
FileKey2=%ProgramFiles%\LSoft Technologies\Active@ Disk Image\Logs|*|RECURSE

[Active@ File Recovery *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C34F36E0-4D8B-42E8-90AD-50C76E1AE282}_is1
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ File Recovery*|*.scn;*.xml;*Log.txt

[Active@ KillDisk *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0F62EFB8-3C1C-4EE6-B6EF-9593007F9B03}_is1
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|*.log;*.xml

[Actual Tools Actual Multiple Monitors *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Multiple Monitors
FileKey1=%AppData%\Actual Tools\Actual Multiple Monitors|*.log

[Actual Tools Actual Tabbed Explorer *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Tabbed Explorer
FileKey1=%AppData%\Actual Tools\Actual Tabbed Explorer|*.log

[Actual Tools Actual Title Buttons *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Title Buttons
FileKey1=%AppData%\Actual Tools\Actual Title Buttons|*.log

[Actual Tools Actual Transparent Window *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Transparent Window
FileKey1=%AppData%\Actual Tools\Actual Transparent Window|*.log

[Actual Tools Actual Virtual Desktops *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Virtual Desktops
FileKey1=%AppData%\Actual Tools\Actual Virtual Desktops|*.log

[Actual Tools Actual Window Guard *]
LangSecRef=3024
Detect=HKCU\Software\Actual Tools\Actual Window Guard
FileKey1=%AppData%\Actual Tools\Actual Window Guard|*.log
RegKey1=HKCU\Software\Actual Tools\Actual Window Guard|LastNagScreenDate

[Actual Tools Actual Window Manager *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Window Manager
FileKey1=%AppData%\Actual Tools\Actual Window Manager|*.log

[Actual Tools Actual Window Menu *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Window Menu
FileKey1=%AppData%\Actual Tools\Actual Window Menu|*.log

[Actual Tools Actual Window Rollup *]
LangSecRef=3024
DetectFile=%AppData%\Actual Tools\Actual Window Rollup
FileKey1=%AppData%\Actual Tools\Actual Window Rollup|*.log

[Acustica Aquarius *]
LangSecRef=3023
DetectFile=%AppData%\Acustica\Aquarius
FileKey1=%AppData%\Acustica\Aquarius\Resources\Temp|*
FileKey2=%AppData%\Acustica\Stagearea\AquariusTemp|*

[Ad-Aware Antivirus *]
LangSecRef=3021
DetectFile1=%AppData%\Ad-Aware Antivirus
DetectFile2=%ProgramData%\Ad-Aware Antivirus
DetectFile3=%ProgramData%\Lavasoft\AntiMalware
FileKey1=%AppData%\Ad-Aware Antivirus\Logs|*|RECURSE
FileKey2=%ProgramData%\Ad-Aware Antivirus\Logs|*|RECURSE
FileKey3=%ProgramData%\Lavasoft\AntiMalware\Events|*|RECURSE
FileKey4=%ProgramData%\Lavasoft\AntiMalware\History|*|RECURSE
FileKey5=%ProgramData%\Lavasoft\AntiMalware\Logs|*|RECURSE

[Ad Fundum *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Oldbut Gold\Ad Fundum
FileKey1=%UserProfile%\AppData\LocalLow\Oldbut Gold\Ad Fundum|*.log

[Adaptec's Audio CD *]
LangSecRef=3024
Detect=HKCU\Software\Adaptec
RegKey1=HKCU\Software\Adaptec\AUDIO_CD_INFO

[Adaware Privacy *]
LangSecRef=3024
DetectFile=%AppData%\Adaware\Adaware Privacy
FileKey1=%AppData%\Adaware\Adaware Privacy|dcilog.txt
FileKey2=%ProgramData%\Adaware\Adaware Privacy|*.log|RECURSE

[Adaware Web Companion *]
LangSecRef=3021
DetectFile=%AppData%\Lavasoft\Web Companion
FileKey1=%AppData%\Lavasoft\Web Companion|*log.txt
FileKey2=%ProgramData%\Lavasoft\Web Companion\Logs|*|RECURSE
FileKey3=%ProgramData%\Lavasoft\Web Companion\Options|Statistics.txt

[Add-in Express *]
LangSecRef=3021
DetectFile1=%AppData%\Add-in Express
DetectFile2=%UserProfile%\Documents\Add-in Express
FileKey1=%AppData%\Add-in Express|*.log|RECURSE
FileKey2=%UserProfile%\Documents\Add-in Express|*.log|RECURSE

[AdFender *]
LangSecRef=3022
DetectFile=%LocalAppData%\AdFender
FileKey1=%LocalAppData%\AdFender\Log|*.log

[Adobe *]
Section=Adobe
Detect=HKCU\Software\Adobe
FileKey1=%AppData%\Adobe|*.log|RECURSE
FileKey2=%AppData%\Adobe\Common\* Cache*|*|RECURSE
FileKey3=%AppData%\Adobe\Common\Peak Files|*|RECURSE
FileKey4=%LocalAppData%\Adobe|*.log|RECURSE
FileKey5=%UserProfile%\Documents\Adobe|*.log|RECURSE

[Adobe Acrobat *]
Section=Adobe
Detect=HKCU\Software\Adobe\Adobe Acrobat
FileKey1=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*|RECURSE
FileKey2=%AppData%\Adobe\OOBE|dlcanalytics.db
FileKey3=%LocalAppData%|oobelibMkey.log
FileKey4=%LocalAppData%\Adobe\Acrobat|*.idx|RECURSE
FileKey5=%LocalAppData%\Adobe\Acrobat\*DC\Cache|*.lst
FileKey6=%LocalAppData%\Adobe\Acrobat\11.0|UserCache.bin
FileKey7=%LocalAppData%\Adobe\Acrobat\11.0\Cache|*|RECURSE
FileKey8=%LocalAppData%\Adobe\Acrobat\DC|*.lst;Exchange-ProMessages;IconCacheAcro*.dat;SharedDataEvents;UserCache*.bin
FileKey9=%LocalAppData%\Adobe\Acrobat\DC\ProtectedView|*.lst;UserCache*.bin
FileKey10=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*|RECURSE
FileKey11=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE
FileKey12=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cookie|*|RECURSE
FileKey13=%LocalAppData%\Adobe\ARM|*|RECURSE
FileKey14=%LocalAppData%\Adobe\Color|*.lst
FileKey15=%LocalAppData%\Adobe\TypeSupport|*.lst
FileKey16=%ProgramData%\Adobe\ARM|*|RECURSE
FileKey17=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC|*-journal;Exchange-ProMessages
FileKey18=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Cache|*|RECURSE
FileKey19=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Cookie|*-journal
FileKey20=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB|notificationsDB
FileKey21=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync|*.db-shm;*.db-wal
FileKey22=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\CreativeCloud\CoreSync|*.log
FileKey23=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Synchronizer|*-log.txt
FileKey24=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons|*|RECURSE
FileKey25=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Search|*|RECURSE
FileKey26=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE
FileKey27=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie|*-journal
RegKey1=HKCU\Software\Adobe\Adobe Acrobat\11.0\AVGeneral\cRecentFiles
RegKey2=HKCU\Software\Adobe\Adobe Acrobat\11.0\AVGeneral\cRecentFolders
RegKey3=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFiles
RegKey4=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFolders
RegKey5=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFiles
RegKey6=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFolders
RegKey7=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFiles
RegKey8=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFolders
RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConnector\cIconCache
RegKey10=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings
RegKey11=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings
RegKey12=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|iNumAcrobatLaunches
RegKey13=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|iNumOfAVDocsOpened
RegKey14=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|uLastAppLaunchTimeStamp
RegKey15=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables
RegKey16=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles
RegKey17=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders
RegKey18=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList
RegKey19=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars
RegKey20=HKCU\Software\Adobe\Adobe Acrobat\DC\CompoundDocs\cStoredBinder
RegKey21=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles
RegKey22=HKCU\Software\Adobe\Adobe Acrobat\DC\SessionManagement|uLastAppExitTimeStamp
RegKey23=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity
RegKey24=HKCU\Software\Adobe\Adobe ARM\1.0\ARM|tLastT_Reader
RegKey25=HKCU\Software\Adobe\Adobe Customization Wizard 8\Recent File List
RegKey26=HKCU\Software\Adobe\Adobe Customization Wizard 9\Recent File List
RegKey27=HKCU\Software\Adobe\Adobe Customization Wizard X\Recent File List
RegKey28=HKCU\Software\Adobe\Adobe Customization Wizard XI\Recent File List
RegKey29=HKCU\Software\Adobe\Adobe Synchronizer\DC

[Adobe Acrobat Distiller *]
Section=Adobe
Detect=HKCU\Software\Adobe\Acrobat Distiller
FileKey1=%AppData%\Adobe\Acrobat\Distiller*|*.log
FileKey2=%AppData%\Adobe\Acrobat\Distiller*\Cache|*
FileKey3=%LocalAppData%\Adobe\Acrobat\Distiller*\Cache|*
RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl

[Adobe Acrobat Reader *]
Section=Adobe
Detect1=HKCU\Software\Adobe\Acrobat Reader
Detect2=HKCU\Software\Adobe\Backup\Preferences\brr1\Software\Adobe\Acrobat Reader
Detect3=HKCU\Software\Adobe\Backup\Preferences\brr2\Software\Adobe\Acrobat Reader
Detect4=HKLM\Software\Adobe\Acrobat Reader
DetectFile=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga
FileKey1=%AppData%\Adobe\Acrobat\*.0|*.lst;UserCache.bin
FileKey2=%AppData%\Adobe\Acrobat\6.0\AcroForm|MRUFormsList
FileKey3=%AppData%\Adobe\Acrobat\6.0\Collab|OfflineDocs;Reviews
FileKey4=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*|RECURSE
FileKey5=%CommonProgramFiles%\Adobe\Color|*.lst
FileKey6=%CommonProgramFiles%\Adobe\TypeSpt|*.lst
FileKey7=%LocalAppData%\Adobe\Acrobat\*.0\Cache|*.lst
FileKey8=%LocalAppData%\Adobe\Acrobat\DC|DCAPIDiscoveryCacheReader;IconCacheRdr*.dat;SharedDataEvents;UserCache*.bin
FileKey9=%LocalAppData%\Adobe\Acrobat\DC\Cache|*.lst
FileKey10=%LocalAppData%\Adobe\Acrobat\DC\eurekareviewdocumentsrdr|*|RECURSE
FileKey11=%LocalAppData%\Adobe\Acrobat\DC\thumbcache\reader\files|*
FileKey12=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheRdr|*|RECURSE
FileKey13=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE
FileKey14=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cookie|*
FileKey15=%LocalAppData%\Adobe\ARM|*|RECURSE
FileKey16=%LocalAppData%\Adobe\Color|*.lst
FileKey17=%LocalAppData%\Adobe\TypeSpt|*.lst
FileKey18=%LocalAppData%\Adobe\TypeSupport|*.lst
FileKey19=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\AC|*|RECURSE
FileKey20=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\Settings|*.log*
FileKey21=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\SystemAppData\Helium|*.log*
FileKey22=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\TempState|*|REMOVESELF
FileKey23=%LocalLowAppData%\Adobe\Acrobat\DC\Search|*
FileKey24=%ProgramData%\Adobe\ARM|*|RECURSE
FileKey25=%ProgramFiles%\Adobe\Reader 9.0\Reader\plug_ins3d\prc|*.lst
FileKey26=%ProgramFiles%\Adobe\Reader 9.0\Resource\Font|*.lst
FileKey27=%SystemDrive%\Documents and Settings\Default User\Local Settings\Application Data\Adobe|*.log|RECURSE
FileKey28=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC|ReaderMessages
FileKey29=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons|*|RECURSE
FileKey30=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB|notificationsDB
FileKey31=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync|*.db-shm;*.db-wal
FileKey32=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync|*.log
FileKey33=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer|*log.txt
FileKey34=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\syncuploaddir|*.pdf
FileKey35=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE
FileKey36=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie|*-journal
RegKey1=HKCU\Software\Adobe\Acrobat Reader\7.0\Collab\cWorkflowFolders
RegKey2=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionFromPDF
RegKey3=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionToPDF
RegKey4=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cDockables
RegKey5=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFolders
RegKey6=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cToolbars
RegKey7=HKCU\Software\Adobe\Acrobat Reader\11.0\RememberedViews\cNoCategoryFiles
RegKey8=HKCU\Software\Adobe\Acrobat Reader\2015\AVGeneral\cRecentFiles
RegKey9=HKCU\Software\Adobe\Acrobat Reader\2015\AVGeneral\cRecentFolders
RegKey10=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFiles
RegKey11=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFolders
RegKey12=HKCU\Software\Adobe\Acrobat Reader\2020\AVGeneral\cRecentFiles
RegKey13=HKCU\Software\Adobe\Acrobat Reader\2020\AVGeneral\cRecentFolders
RegKey14=HKCU\Software\Adobe\Acrobat Reader\DC\AVConnector\cIconCache
RegKey15=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionFromPDF
RegKey16=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionToPDF
RegKey17=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral|iNumOfAVDocsOpened
RegKey18=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral|iNumReaderLaunches
RegKey19=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cDockables
RegKey20=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentToolsList
RegKey21=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cToolbars
RegKey22=HKCU\Software\Adobe\Acrobat Reader\DC\RememberedViews\cNoCategoryFiles
RegKey23=HKCU\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent
RegKey24=HKCU\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsPrev
RegKey25=HKCU\Software\Adobe\Acrobat Reader\DC\ShareIdentity
RegKey26=HKCU\Software\Adobe\Adobe ARM\1.0\ARM|tLastT_Reader
RegKey27=HKCU\Software\Adobe\Adobe Synchronizer\11.0
RegKey28=HKCU\Software\Adobe\Adobe Synchronizer\DC
RegKey29=HKCU\Software\Adobe\Backup\Preferences\brr1\Software\Adobe\Acrobat Reader\8.0\AVGeneral\cRecentFiles
RegKey30=HKCU\Software\Adobe\Backup\Preferences\brr2\Software\Adobe\Acrobat Reader\8.0\AVGeneral\cRecentFiles
RegKey31=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\PersistedStorageItemTable\MostRecentlyUsed

[Adobe After Effects *]
Section=Adobe
DetectFile=%AppData%\Adobe\After Effects
FileKey1=%AppData%\Adobe\After Effects|*.log
FileKey2=%AppData%\Adobe\After Effects\*|*.log
FileKey3=%AppData%\Adobe\After Effects\*\Logs|*
FileKey4=%AppData%\Adobe\Common\PTX|*
FileKey5=%AppData%\Adobe\DVAAudioFilterScan\*\Logs|*
FileKey6=%AppData%\Adobe\dynamiclinkmanager\*\Logs|*
FileKey7=%AppData%\Adobe\dynamiclinkmediaserver\*|*.log
FileKey8=%AppData%\Adobe\dynamiclinkmediaserver\*\Logs|*
FileKey9=%AppData%\Adobe\ExtensibilityLibrary\Log|*
FileKey10=%AppData%\Adobe\GPUSniffer\*\Logs|*
FileKey11=%AppData%\Adobe\Lumetri\*\logs|*|RECURSE
FileKey12=%AppData%\Adobe\Team Projects Local Hub\*\Logs|*

[Adobe Air *]
Section=Adobe
DetectFile=%LocalAppData%\Adobe\Air
FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\Adobe\AIR\logs|*
FileKey2=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Adobe\AIR\logs|*

[Adobe Audition *]
Section=Adobe
DetectFile=%AppData%\Adobe\Audition
FileKey1=%AppData%\Adobe\Audition|*.log
FileKey2=%AppData%\Adobe\Audition\*|*cache.xml
FileKey3=%AppData%\Adobe\Audition\*\logs|*
FileKey4=%AppData%\Adobe\DVAAudioFilterScan\*\logs|*
FileKey5=%AppData%\Adobe\dynamiclinkmanager\*\logs|*
FileKey6=%AppData%\Adobe\dynamiclinkmediaserver\*|*.log
FileKey7=%AppData%\Adobe\dynamiclinkmediaserver\*\logs|*

[Adobe Bridge *]
Section=Adobe
DetectFile=%AppData%\Adobe\Bridge*
FileKey1=%AppData%\Adobe\Bridge*|*.log
FileKey2=%AppData%\Adobe\Bridge*\*\Logs|*
FileKey3=%AppData%\Adobe\Bridge*\CT Font Cache|*
FileKey4=%AppData%\Adobe\Bridge*\Logs|*

[Adobe Camera Raw *]
Section=Adobe
DetectFile=%AppData%\Adobe\CameraRaw
FileKey1=%AppData%\Adobe\CameraRaw\Logs|*
FileKey2=%LocalAppData%\Adobe\CameraRaw\Cache*|*

[Adobe Character Animator *]
Section=Adobe
DetectFile=%AppData%\Adobe\Character Animator
FileKey1=%AppData%\Adobe\Character Animator\*\logs|*
FileKey2=%AppData%\Adobe\dynamiclinkmanager\*\logs|*
FileKey3=%AppData%\Adobe\dynamiclinkmediaserver\*|*.log
FileKey4=%AppData%\Adobe\dynamiclinkmediaserver\*\logs|*

[Adobe Crash Reporter *]
Section=Adobe
DetectFile1=%AppData%\Adobe\CRLogs
DetectFile2=%UserProfile%\AppData\LocalLow\Adobe\CRLogs
FileKey1=%AppData%\Adobe\CRLogs|*|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\Adobe\CRLogs|*|RECURSE

[Adobe Creative Cloud *]
Section=Adobe
DetectFile1=%AppData%\com.adobe.dunamis
DetectFile2=%CommonProgramFiles%\Adobe\Creative Cloud Libraries
DetectFile3=%ProgramFiles%\Adobe\Adobe Creative Cloud Experience
FileKey1=%AppData%\Adobe\Adobe Media Encoder\*\logs|*|RECURSE
FileKey2=%AppData%\Adobe\CCX Welcome\*\clientLogs|*
FileKey3=%AppData%\Adobe\Color|*.lst
FileKey4=%AppData%\Adobe\dynamiclinkmanager\*\logs|*
FileKey5=%AppData%\Adobe\dynamiclinkmediaserver\*|*.log
FileKey6=%AppData%\Adobe\dynamiclinkmediaserver\*\logs|*
FileKey7=%AppData%\Adobe\ExtensibilityLibrary\Log|*
FileKey8=%AppData%\Adobe\Extension Manager CC\Log|*|RECURSE
FileKey9=%AppData%\Adobe\Extension Manager CC\Temp|*|RECURSE
FileKey10=%AppData%\Adobe\GPUSniffer\*\logs|*
FileKey11=%AppData%\Adobe\GUDE|*.log
FileKey12=%AppData%\Adobe\LogTransport2\Logs|*|RECURSE
FileKey13=%AppData%\Adobe\LogTransport2CC\Logs|*|RECURSE
FileKey14=%AppData%\Adobe\Lumetri\*\logs|*|RECURSE
FileKey15=%AppData%\Adobe\Team Projects Local Hub\*\logs|*
FileKey16=%AppData%\com.adobe.dunamis|*|REMOVESELF
FileKey17=%CommonProgramFiles%\Adobe\Creative Cloud Libraries|*.log|RECURSE
FileKey18=%CommonProgramFiles%\Adobe\Installers|*.log
FileKey19=%ProgramData%\Adobe\UPI\Log|*
FileKey20=%ProgramFiles%\Adobe\Adobe Creative Cloud Experience\js\node_modules\table-parser\test\output|*.log
FileKey21=%UserProfile%\Documents\Adobe\Adobe Media Encoder\*|*Log.txt;Recent Directories
FileKey22=%UserProfile%\Documents\Adobe\Adobe Media Encoder\*\logs|*|RECURSE
RegKey1=HKCU\Software\Adobe\MediaBrowser\MRU

[Adobe Dreamweaver *]
Section=Adobe
Detect=HKCU\Software\Adobe\MediaBrowser\MRU\Dreamweaver
RegKey1=HKCU\Software\Adobe\Dreamweaver CS6\Recent File List
RegKey2=HKCU\Software\Adobe\MediaBrowser\MRU\Dreamweaver\FileList

[Adobe Elements Organizer *]
Section=Adobe
Detect=HKCU\Software\Adobe\Elements Organizer
FileKey1=%AppData%\Adobe\Elements Organizer\*\Organizer|*.txt;status.dat
FileKey2=%ProgramData%|StreamingMediaTechnologyLog.txt
FileKey3=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog|*.cache
FileKey4=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog\FaceAnalysis|*.cache
FileKey5=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog\WaldoData|*.cache
FileKey6=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog\Watch Folder|*.txt;*.xml
RegKey1=HKCU\Software\Adobe\Elements Organizer\11.0\CurrentMediaFilePath
RegKey2=HKCU\Software\Adobe\Elements Organizer\12.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Elements Organizer\13.0\CurrentMediaFilePath
RegKey4=HKCU\Software\Adobe\Elements Organizer\14.0\CurrentMediaFilePath
RegKey5=HKCU\Software\Adobe\Elements Organizer\15.0\CurrentMediaFilePath
RegKey6=HKCU\Software\Adobe\Elements Organizer\16.0\CurrentMediaFilePath
RegKey7=HKCU\Software\Adobe\Elements Organizer\17.0\CurrentMediaFilePath

[Adobe Experience Platform SDK *]
Section=Adobe
DetectFile=%UserProfile%\AppData\LocalLow\Adobe\GrowthSDK
FileKey1=%UserProfile%\AppData\LocalLow\Temp\Adobe\GrowthSDK\Production|*

[Adobe Express Photos *]
Section=Adobe
DetectFile=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga
FileKey1=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga\LocalState\Dunamis\Logs\Adobe\com.adobe.dunamis|*
FileKey3=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga\Settings|*.log*
FileKey4=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga\TempState|*|REMOVESELF

[Adobe Flash Player *]
Section=Adobe
DetectFile1=%AppData%\Adobe\Flash Player
DetectFile2=%WinDir%\System32\Macromed\Flash
DetectFile3=%WinDir%\SysWOW64\Macromed\Flash
FileKey1=%AppData%\Adobe\Flash Player\*Cache|*|REMOVESELF
FileKey2=%AppData%\Macromedia\Flash Player|*|REMOVESELF
FileKey3=%WinDir%\System32\Macromed\Flash|*Install*.log
FileKey4=%WinDir%\System32\Macromed\Temp|*
FileKey5=%WinDir%\SysWOW64\Macromed\Flash|*Install*.log
FileKey6=%WinDir%\SysWOW64\Macromed\Temp|*
RegKey1=HKCU\Software\Macromedia\FlashPlayer|RecentMovie1
RegKey2=HKCU\Software\Macromedia\FlashPlayer|RecentMovie2
RegKey3=HKCU\Software\Macromedia\FlashPlayer|RecentMovie3
RegKey4=HKCU\Software\Macromedia\FlashPlayer|RecentMovie4
RegKey5=HKCU\Software\Macromedia\FlashPlayer|RecentMovie5
RegKey6=HKCU\Software\Macromedia\FlashPlayer|RecentMovie6
RegKey7=HKCU\Software\Macromedia\FlashPlayer|RecentMovie7
RegKey8=HKCU\Software\Macromedia\FlashPlayer|RecentMovie8
RegKey9=HKCU\Software\Macromedia\FlashPlayer|RecentMovie9

[Adobe Fresco *]
Section=Adobe
DetectFile=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e
FileKey1=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalCache\CRLogs|*
FileKey3=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey4=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey15=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey33=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey67=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\Settings|*.log*
FileKey68=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\SystemAppData\Helium|*.log*
FileKey69=%LocalAppData%\Packages\Adobe.Fresco_pc75e8sa7ep4e\TempState|*|REMOVESELF

[Adobe Illustrator *]
Section=Adobe
DetectFile=%AppData%\Adobe\Adobe Illustrator *
FileKey1=%AppData%\Adobe\GUDE|*.log
FileKey2=%AppData%\Adobe\Logs\Adobe Illustrator\*\Adobe Illustrator|*|RECURSE

[Adobe InCopy *]
Section=Adobe
DetectFile=%LocalAppData%\Adobe\InCopy
FileKey1=%LocalAppData%\Adobe\InCopy\Version *|AdobeWLCMCache.dat
FileKey2=%LocalAppData%\Adobe\InCopy\Version *\*\Caches|*|RECURSE

[Adobe InDesign *]
Section=Adobe
DetectFile=%AppData%\Adobe\InDesign
FileKey1=%AppData%\Adobe\InDesign*\Logs|*

[Adobe Lightroom *]
Section=Adobe
DetectFile=%AppData%\Adobe\Lightroom
FileKey1=%AppData%\Adobe\Lightroom|*.log
RegKey1=HKCU\Software\Adobe Lightroom\Lightroom Classic\Recent File List

[Adobe Media Encoder *]
Section=Adobe
DetectFile=%AppData%\Adobe\Media Encoder
FileKey1=%AppData%\Adobe\Common\PTX|*
FileKey2=%AppData%\Adobe\DVAAudioFilterScan\*\logs|*
FileKey3=%AppData%\Adobe\dynamiclinkmanager\*\logs|*
FileKey4=%AppData%\Adobe\dynamiclinkmediaserver\*|*.log
FileKey5=%AppData%\Adobe\dynamiclinkmediaserver\*\logs|*
FileKey6=%AppData%\Adobe\ExtensibilityLibrary\Log|*
FileKey7=%AppData%\Adobe\GPUSniffer\*\logs|*
FileKey8=%AppData%\Adobe\Media Encoder|*.log
FileKey9=%AppData%\Adobe\Media Encoder\*|*.log
FileKey10=%AppData%\Adobe\Media Encoder\*\logs|*
FileKey11=%AppData%\Adobe\Team Projects Local Hub\*\logs|*

[Adobe Photoshop *]
Section=Adobe
DetectFile=%AppData%\Adobe\Adobe Photoshop*
FileKey1=%AppData%\Adobe\Adobe Photoshop*\*Cache|*|RECURSE
FileKey2=%AppData%\Adobe\Adobe Photoshop*\Adobe Photoshop*Settings|PSErrorLog.txt;sniffer-*.txt
FileKey3=%AppData%\Adobe\Adobe Photoshop*\Adobe Photoshop*Settings\CrashLogs|*|RECURSE
FileKey4=%AppData%\Adobe\Adobe Photoshop*\Adobe Photoshop*Settings\web-cache-temp|*|RECURSE
FileKey5=%AppData%\Adobe\Adobe Photoshop*\Logs|*
FileKey6=%AppData%\Adobe\ExtensibilityLibrary\Log|*
FileKey7=%AppData%\Adobe\GPUSniffer\*\logs|*
FileKey8=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey9=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey10=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey11=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\*Cache*|*|REMOVESELF
FileKey12=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\AutoFill*|*|REMOVESELF
FileKey13=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Avatars|*|REMOVESELF
FileKey14=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey15=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey16=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Crash Reports|*|REMOVESELF
FileKey17=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Crashpad|*|REMOVESELF
FileKey18=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Crowd Deny|*|REMOVESELF
FileKey19=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey20=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey21=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey22=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey23=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey24=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey25=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey26=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey27=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey28=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey29=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey30=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Download Service|*|REMOVESELF
FileKey31=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Extension State|*|REMOVESELF
FileKey32=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey33=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\File System|*|REMOVESELF
FileKey34=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey35=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey36=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey37=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey38=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\optimization*|*|REMOVESELF
FileKey39=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey40=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey41=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey42=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey43=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey44=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Sessions|*|REMOVESELF
FileKey45=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey46=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey47=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey48=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey49=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey50=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey51=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey52=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey53=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey54=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey55=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey56=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Local Traces|*|REMOVESELF
FileKey57=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\MEIPreload|*|REMOVESELF
FileKey58=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Optimization*|*|REMOVESELF
FileKey59=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\OriginTrials|*|REMOVESELF
FileKey60=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\PKIMetadata|*|REMOVESELF
FileKey61=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey62=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey63=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Safe Browsing|*|REMOVESELF
FileKey64=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\SafetyTips|*|REMOVESELF
FileKey65=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\SmartScreen|*|REMOVESELF
FileKey66=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey67=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Stability|*|REMOVESELF
FileKey68=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\Subresource Filter|*|REMOVESELF
FileKey69=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey70=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\WidevineCdm|*|REMOVESELF
FileKey71=%AppData%\Adobe\UXP\PluginsStorage\PHSP\26\Shared\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey72=%LocalAppData%\Adobe\Color|ACECache11.lst
FileKey73=%LocalAppData%\Adobe\TypeSupport|AdobeFnt22.lst

[Adobe Photoshop Elements *]
Section=Adobe
Detect=HKCU\Software\Adobe\Photoshop Elements
FileKey1=%AppData%\Adobe\Photoshop Elements\*\Editor|*.txt
FileKey2=%ProgramData%\Adobe\Photoshop Elements\File Agent|WatchFolder.3.cache
RegKey1=HKCU\Software\Adobe\Photoshop Elements\11.0\common\settings\Elements MRU
RegKey2=HKCU\Software\Adobe\Photoshop Elements\11.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Photoshop Elements\11.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey4=HKCU\Software\Adobe\Photoshop Elements\12.0\common\settings\Elements MRU
RegKey5=HKCU\Software\Adobe\Photoshop Elements\12.0\CurrentMediaFilePath
RegKey6=HKCU\Software\Adobe\Photoshop Elements\12.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey7=HKCU\Software\Adobe\Photoshop Elements\13.0\common\settings\Elements MRU
RegKey8=HKCU\Software\Adobe\Photoshop Elements\13.0\CurrentMediaFilePath
RegKey9=HKCU\Software\Adobe\Photoshop Elements\13.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey10=HKCU\Software\Adobe\Photoshop Elements\14.0\common\settings\Elements MRU
RegKey11=HKCU\Software\Adobe\Photoshop Elements\14.0\CurrentMediaFilePath
RegKey12=HKCU\Software\Adobe\Photoshop Elements\14.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey13=HKCU\Software\Adobe\Photoshop Elements\15.0\common\settings\Elements MRU
RegKey14=HKCU\Software\Adobe\Photoshop Elements\15.0\CurrentMediaFilePath
RegKey15=HKCU\Software\Adobe\Photoshop Elements\15.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey16=HKCU\Software\Adobe\Photoshop Elements\16.0\common\settings\Elements MRU
RegKey17=HKCU\Software\Adobe\Photoshop Elements\16.0\CurrentMediaFilePath
RegKey18=HKCU\Software\Adobe\Photoshop Elements\16.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey19=HKCU\Software\Adobe\Photoshop Elements\17.0\common\settings\Elements MRU
RegKey20=HKCU\Software\Adobe\Photoshop Elements\17.0\CurrentMediaFilePath
RegKey21=HKCU\Software\Adobe\Photoshop Elements\17.0\VisitedDirs|STARTUPIMAGEDIRECTORY

[Adobe Premiere Elements *]
Section=Adobe
Detect=HKCU\Software\Adobe\Premiere Elements
FileKey1=%AppData%\Adobe\Common\Thumbnail Cache|thumbnailDB
FileKey2=%AppData%\Adobe\Premiere Elements\*\logs|*|RECURSE
FileKey3=%UserProfile%\Documents\NewBlueFX\Logs|*.txt
RegKey1=HKCU\Software\Adobe\Premiere Elements\11.0\MRUDocuments
RegKey2=HKCU\Software\Adobe\Premiere Elements\12.0\MRUDocuments
RegKey3=HKCU\Software\Adobe\Premiere Elements\13.0\MRUDocuments
RegKey4=HKCU\Software\Adobe\Premiere Elements\14.0\MRUDocuments
RegKey5=HKCU\Software\Adobe\Premiere Elements\15.0\MRUDocuments
RegKey6=HKCU\Software\Adobe\Premiere Elements\16.0\MRUDocuments
RegKey7=HKCU\Software\Adobe\Premiere Elements\17.0\MRUDocuments

[Adobe Premiere Pro *]
Section=Adobe
DetectFile=%AppData%\Adobe\Premiere Pro
FileKey1=%AppData%\Adobe\Common\PTX|*
FileKey2=%AppData%\Adobe\DVAAudioFilterScan\*\logs|*
FileKey3=%AppData%\Adobe\dynamiclinkmanager\*\logs|*
FileKey4=%AppData%\Adobe\dynamiclinkmediaserver\*|*.log
FileKey5=%AppData%\Adobe\dynamiclinkmediaserver\*\logs|*
FileKey6=%AppData%\Adobe\ExtensibilityLibrary\Log|*
FileKey7=%AppData%\Adobe\GPUSniffer\*\logs|*
FileKey8=%AppData%\Adobe\Lumetri\*\logs|*|RECURSE
FileKey9=%AppData%\Adobe\Premiere Pro\*|*.log
FileKey10=%AppData%\Adobe\Premiere Pro\*\logs|*
FileKey11=%AppData%\Adobe\Premiere Pro\Logs|*
FileKey12=%AppData%\Adobe\Team Projects Local Hub\*\logs|*
FileKey13=%UserProfile%\Documents\Adobe\Premiere Pro\*|*.log

[Adobe Premiere Rush *]
Section=Adobe
DetectFile=%AppData%\Adobe\Premiere Rush
FileKey1=%AppData%\Adobe\Premiere Rush\*|*.log;*cache.xml
FileKey2=%AppData%\Adobe\Premiere Rush\*\logs|*

[Adobe XD *]
Section=Adobe
DetectFile=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e
FileKey1=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e\LocalCache\CRLogs|*
FileKey3=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e\LocalState|*.log
FileKey4=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Adobe.XD_pc75e8sa7ep4e\TempState|*|REMOVESELF

[Advanced CSV Converter *]
LangSecRef=3024
Detect=HKCU\Software\csvconverter
RegKey1=HKCU\Software\csvconverter|EXPORTPATH
RegKey2=HKCU\Software\csvconverter|LASTEXPORT
RegKey3=HKCU\Software\csvconverter|LASTSRC
RegKey4=HKCU\Software\csvconverter|SRCPATH

[Advanced Registry Doctor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Advanced Registry Doctor
FileKey1=%ProgramFiles%\Advanced Registry Doctor|*.log;*.tmp
FileKey2=%ProgramFiles%\Advanced Registry Doctor\Undo|history_*.dat

[Advanced Uninstaller *]
LangSecRef=3024
Detect=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO
DetectFile=%ProgramData%\Innovative Solutions\Advanced Uninstaller PRO
FileKey1=%LocalAppData%\Innovative Solutions\Advanced Uninstaller PRO|*.dat;.ico
FileKey2=%ProgramData%\Innovative Solutions\Advanced Uninstaller PRO\HealthCheck|*|RECURSE
RegKey1=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\9\compress|listHistoryText
RegKey2=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\10\compress|listHistoryText
RegKey3=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\11\compress|listHistoryText
RegKey4=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\12\compress|listHistoryText
RegKey5=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\13\compress|listHistoryText

[Advanced XLS Converter *]
LangSecRef=3024
Detect=HKCU\Software\xlsconverter
RegKey1=HKCU\Software\xlsconverter|EXPORTPATH
RegKey2=HKCU\Software\xlsconverter|LASTEXPORT
RegKey3=HKCU\Software\xlsconverter|LASTSRC
RegKey4=HKCU\Software\xlsconverter|OPT
RegKey5=HKCU\Software\xlsconverter|RECENTS
RegKey6=HKCU\Software\xlsconverter|SRCPATH

[Adware-Removal-Tool *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Adware-Removal-Tool
FileKey1=%ProgramFiles%\Adware-Removal-Tool\Quarantine|*|RECURSE
FileKey2=%ProgramFiles%\Adware-Removal-Tool\Reports|*.txt
FileKey3=%ProgramFiles%\Adware-Removal-Tool\scanlogs|*.txt

[AdwCleaner *]
LangSecRef=3024
DetectFile=%SystemDrive%\AdwCleaner
FileKey1=%SystemDrive%|AdwCleaner*.txt
FileKey2=%SystemDrive%\AdwCleaner\Logs|*
RegKey1=HKLM\Software\AdwCleaner|DeleteCount
RegKey2=HKLM\Software\AdwCleaner|SearchCount
RegKey3=HKLM\Software\Wow6432Node\AdwCleaner|DeleteCount
RegKey4=HKLM\Software\Wow6432Node\AdwCleaner|SearchCount

[Aegisub *]
LangSecRef=3023
DetectFile=%AppData%\Aegisub
FileKey1=%AppData%\Aegisub|mru.json
FileKey2=%AppData%\Aegisub\crashdumps|*|REMOVESELF
FileKey3=%AppData%\Aegisub\log|*|REMOVESELF
FileKey4=%AppData%\Aegisub\recovered|*|REMOVESELF
FileKey5=%LocalAppData%\Aegisub\ffms2cache|*|REMOVESELF
FileKey6=%ProgramFiles%\Aegisub|*.txt

[Aegisub Backups *]
LangSecRef=3023
DetectFile=%AppData%\Aegisub
FileKey1=%AppData%\Aegisub\autoback|*|REMOVESELF
FileKey2=%AppData%\Aegisub\autosave|*|REMOVESELF

[Aero Glass *]
LangSecRef=3021
DetectFile=%SystemDrive%\AeroGlass
FileKey1=%SystemDrive%\AeroGlass|*.dmp;debug.log

[Affinity Designer *]
LangSecRef=3023
DetectFile=%AppData%\Affinity\Designer
FileKey1=%AppData%\Affinity\Designer\*|Log.txt
FileKey2=%AppData%\Affinity\Designer\*\CrashReports|*|RECURSE

[Age of Conan *]
Section=Games
DetectFile=%ProgramFiles%\Funcom\Age of Conan
FileKey1=%ProgramFiles%\Funcom\Age of Conan|*.log;*.tmp;CrashLog.txt;MiniDump.dmp
FileKey2=%ProgramFiles%\Funcom\Age of Conan\OldLogs|*

[Age of Empires *]
Section=Games
Detect1=HKLM\Software\Microsoft\Games\Age of Empires
Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires
Detect3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires 3
DetectFile=%ProgramFiles%\Steam\steamapps\common\Age Of Empires Online
FileKey1=%ProgramFiles%\Microsoft Games\Age of Mythology|*log.txt
FileKey2=%ProgramFiles%\Steam\steamapps\common\Age Of Empires Online|PatchLog*.txt
FileKey3=%UserProfile%\Documents\My Games\Age of Empires 3|*.txt
FileKey4=%UserProfile%\Documents\My Games\Age of Empires 3\RM|*.dmp.txt
FileKey5=%UserProfile%\Documents\My Games\Age of Mythology|*.txt
RegKey1=HKLM\Software\Microsoft\Games\Age of Empires\1.00|Zone
RegKey2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires|Zone
RegKey3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Expansion\1.0|Zone
RegKey4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires II: The Conquerors Expansion\1.0|Zone
RegKey5=HKLM\Software\Microsoft\Microsoft Games\Age of Empires\2.0|Zone

[Age of Oracles: Tara's Journey *]
Section=Games
DetectFile=%ProgramData%\JollyBear\Age of Oracles Taras Journey
FileKey1=%ProgramData%\JollyBear\Age of Oracles Taras Journey|error.*

[Age of Wonders II *]
Section=Games
DetectFile=%ProgramFiles%\Age of Wonders II
FileKey1=%ProgramFiles%\Age of Wonders II\Resource\FX\Spell|*.lnk
FileKey2=%ProgramFiles%\Age of Wonders Shadow Magic\Resource\Maps|*.bak
FileKey3=%ProgramFiles%\Age of Wonders*|*Log.txt

[AHA Dialer *]
LangSecRef=3022
DetectFile=%ProgramData%\DatacardService
FileKey1=%ProgramData%\DatacardService\log|*

[AhnLab V3 Lite *]
LangSecRef=3024
DetectFile=%UserProfile%\AppData\LocalLow\AhnLab\V3Lite
FileKey1=%UserProfile%\AppData\LocalLow\AhnLab\V3Lite|*.log

[AI Roboform *]
LangSecRef=3022
Detect=HKCU\Software\Siber Systems
FileKey1=%AppData%\RoboForm\_*mirrors_|*|RECURSE
FileKey2=%UserProfile%\Documents\My RoboForm Data|cache.rfo;mru.rfo|RECURSE
FileKey3=%UserProfile%\Documents\My RoboForm Data\_gsdata_|*.gsl;*.gss;*.log|RECURSE
RegKey1=HKCU\Software\Siber Systems|_InstallerDir
RegKey2=HKCU\Software\Siber Systems\RoboForm\Query-MRU

[AIDA64 *]
LangSecRef=3021
Detect=HKCU\Software\FinalWire\AIDA64
FileKey1=%UserProfile%\Documents\AIDA64 Reports|*|REMOVESELF

[Aignes Website-Watcher *]
LangSecRef=3023
DetectFile=%AppData%\aignes\WebSite-Watcher
FileKey1=%AppData%\aignes\WebSite-Watcher\config\favicons|*
FileKey2=%AppData%\aignes\WebSite-Watcher\config\log|*
FileKey3=%AppData%\aignes\WebSite-Watcher\config\settings|*.cfg_bak*
FileKey4=%AppData%\aignes\WebSite-Watcher\config\temp|*

[Aignes Website-Watcher AutoBackups *]
LangSecRef=3023
DetectFile=%AppData%\aignes\WebSite-Watcher
FileKey1=%AppData%\aignes\WebSite-Watcher\config\autobackup|*

[Aignes Website-Watcher Bookmarks *]
LangSecRef=3023
DetectFile=%AppData%\aignes\WebSite-Watcher
FileKey1=%AppData%\aignes\WebSite-Watcher\bookmarks|*

[Aimersoft *]
LangSecRef=3023
Detect=HKLM\Software\Aimersoft
FileKey1=%ProgramData%\Aimersoft\*\*Logs|*|RECURSE
FileKey2=%Public%\Documents\Aimersoft|*|REMOVESELF

[Aimersoft DRM Media Converter *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Aimersoft\DRM Media Converter
FileKey1=%ProgramFiles%\Aimersoft\DRM Media Converter\Log|*|REMOVESELF

[Aimersoft Video Converter *]
LangSecRef=3023
Detect1=HKLM\Software\Aimersoft\Aimersoft Video Converter
Detect2=HKLM\Software\Aimersoft\Aimersoft Video Converter Ultimate
FileKey1=%AppData%\Aimersoft Video Converter Ultimate\Temp|*
FileKey2=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact|ASHelper*.exe_temp;ProductUpdateLists.xml
FileKey3=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\DATADICT|*|RECURSE
FileKey4=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\Log|*|RECURSE
FileKey5=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\Temp|*|RECURSE
FileKey6=%LocalAppData%\Aimersoft\ASHelper|*.exe.tmp
FileKey7=%ProgramData%\Aimersoft Video Converter Ultimate|*.dat.bak
FileKey8=%ProgramData%\Aimersoft Video Converter Ultimate\Temp*Dir|*
FileKey9=%ProgramFiles%\Aimersoft\Video Converter Ultimate\Log|*
FileKey10=%ProgramFiles%\Aimersoft\Video Converter Ultimate\Snapshot|snap*.dat
FileKey11=%ProgramFiles%\Aimersoft\Video Converter*\TempThumbDir|*|RECURSE
FileKey12=%UserProfile%\Documents\Aimersoft MediaServer\log|*|RECURSE

[Aimersoft Video Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Aimersoft\Video Editor
FileKey1=%ProgramFiles%\Aimersoft\Video Editor\log|*|RECURSE

[AIMP *]
LangSecRef=3023
DetectFile=%AppData%\AIMP
FileKey1=%AppData%\AIMP|*.bak
FileKey2=%ProgramFiles%\AIMP\!Backup|*|REMOVESELF
FileKey3=%ProgramFiles%\AIMP\Data|*.bak|RECURSE

[AirBuccaneers *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\223630
FileKey1=%ProgramFiles%\Steam\Steamapps\common\AirBuccaneers\abu_data|output_log.txt
FileKey2=%ProgramFiles%\Steam\Steamapps\common\AirBuccaneers\logs|*

[AirDC++ *]
LangSecRef=3022
DetectFile1=%AppData%\AirDC++
DetectFile2=%LocalAppData%\AirDC++
DetectFile3=%ProgramFiles%\AirDC++\Settings
FileKey1=%AppData%\AirDC++|Recents.xml
FileKey2=%AppData%\AirDC++\FileLists|*
FileKey3=%AppData%\AirDC++\Logs|*
FileKey4=%LocalAppData%\AirDC++|Recents.xml
FileKey5=%LocalAppData%\AirDC++\FileLists|*
FileKey6=%LocalAppData%\AirDC++\Logs|*
FileKey7=%ProgramFiles%\AirDC++\Logs|*
FileKey8=%ProgramFiles%\AirDC++\Settings|Recents.xml
FileKey9=%ProgramFiles%\AirDC++\Settings\FileLists|*
FileKey10=%ProgramFiles%\AirDC++\Settings\Logs|*

[AirStrike 3D *]
Section=Games
DetectFile=%ProgramFiles%\Blimb Entertainment\AIRSTRIKE3D
FileKey1=%ProgramFiles%\Blimb Entertainment\AIRSTRIKE3D|*.log

[Aiseesoft Burnova *]
LangSecRef=3021
DetectFile=%ProgramData%\Aiseesoft Studio\Burnova
FileKey1=%UserProfile%\Documents\Log Files|dvdcore*.log

[Aiseesoft Media Converter Ultimate *]
LangSecRef=3023
Detect=HKCU\Software\Aiseesoft Studio\Aiseesoft Media Converter Ultimate
FileKey1=%LocalAppData%\Aiseesoft Studio\Aiseesoft Media Converter Ultimate|*.txt
RegKey1=HKCU\Software\Aiseesoft Studio\Aiseesoft Media Converter Ultimate\Edit|LastVideoFilePath

[Aiseesoft Screen Recorder *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Aiseesoft Studio\Aiseesoft Screen Recorder
FileKey1=%ProgramFiles%\Aiseesoft Studio\Aiseesoft Screen Recorder|*.mdmp
FileKey2=%SystemDrive%\Log Files|Screencast*.log

[Aiseesoft Video Converter Ultimate *]
LangSecRef=3023
DetectFile=%LocalAppData%\Aiseesoft Studio\Aiseesoft Video Converter Ultimate
FileKey1=%LocalAppData%\Aiseesoft Studio\Aiseesoft Video Converter Ultimate|*.log;*log.txt

[Aiseesoft Video Editor *]
LangSecRef=3023
DetectFile=%LocalAppData%\Aiseesoft Studio\Video Editor
FileKey1=%LocalAppData%\Aiseesoft Studio\Video Editor|*.log;*.txt

[Akamai *]
LangSecRef=3022
DetectFile=%LocalAppData%\Akamai
FileKey1=%LocalAppData%\Akamai\Logs|*.log

[AlbumPlayer *]
LangSecRef=3023
DetectFile=%SystemDrive%\AlbumPlayerData
FileKey1=%SystemDrive%\AlbumPlayerData\Cache|*|RECURSE
FileKey2=%SystemDrive%\AlbumPlayerData\Logging|*|RECURSE

[Alcea Alwin 6 *]
LangSecRef=3023
DetectFile=%SystemDrive%\alwin6
FileKey1=%SystemDrive%\alwin6\postgresql\9.0\data\pg_log|*

[Alchemy Mindworks GIF Construction Set *]
LangSecRef=3023
DetectFile=%AppData%\Alchemy Mindworks\GIF Construction Set Professional*
FileKey1=%AppData%\Alchemy Mindworks\GIF Construction Set Professional*|FileMenuHistory.txt
FileKey2=%AppData%\Alchemy Mindworks\GIF Construction Set Professional*\temp|*
FileKey3=%AppData%\Alchemy Mindworks\Up To Date\images|*.log
FileKey4=%AppData%\Alchemy Mindworks\Up To Date\temp|*

[Alcohol 52% *]
LangSecRef=3023
Detect=HKCU\Software\Alcohol Soft\Alcohol 52%
RegKey1=HKCU\Software\Alcohol Soft\Alcohol 52%\Basic|Image File Path
RegKey2=HKCU\Software\Alcohol Soft\Alcohol 52%\Images
RegKey3=HKCU\Software\Alcohol Soft\Alcohol 52%\Options\Image Making Wizard|ImageName

[Alcohol 120% *]
LangSecRef=3023
Detect=HKCU\Software\Alcohol Soft\Alcohol 120%
FileKey1=%ProgramFiles%\Alcohol Soft\Alcohol 120|alcohol.log
RegKey1=HKCU\Software\Alcohol Soft\Alcohol 120%\Basic\Image Finder|Current Dir
RegKey2=HKCU\Software\Alcohol Soft\Alcohol 120%\MountedMRU
RegKey3=HKCU\Software\Alcohol Soft\Alcohol 120%\Options\Burning Wizard|ImageFile

[Algorius Net Viewer *]
LangSecRef=3022
DetectFile=%LocalAppData%\Algorius\Algorius Net Viewer
FileKey1=%AppData%\Algorius Software\Algorius Net Viewer*\install|*|REMOVESELF
FileKey2=%LocalAppData%\Algorius\Algorius Net Viewer|*.log;Log.db*

[Alibaba *]
LangSecRef=3021
DetectFile=%LocalAppData%\Alibaba\AliSetup
FileKey1=%LocalAppData%\Alibaba\AliSetup\*|*.log

[Alibaba Trade Manager *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Trademanager
FileKey1=%ProgramFiles%\Trademanager|OneClickEnd.log

[Alien Swarm *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\alien swarm
FileKey1=%ProgramFiles%\Steam\steamapps\common\alien swarm\swarm|tilegen_log.txt

[Aliens: Colonial Marines *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Aliens Colonial Marines
FileKey1=%UserProfile%\Documents\My Games\Aliens Colonial Marines\PecanGame\Logs|*

[All in One Runtimes *]
LangSecRef=3024
DetectFile1=%SystemDrive%\AiO-Files
DetectFile2=%SystemDrive%\AiOLog.txt
FileKey1=%SystemDrive%|AiOLog.txt
FileKey2=%SystemDrive%\AiO-Files|*|RECURSE

[All Office Converter *]
LangSecRef=3021
DetectFile=%ProgramFiles%\All Office Converter Platinum
FileKey1=%ProgramFiles%\All Office Converter Platinum|Eventlog.txt

[All Zombies Must Die! *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\All Zombies Must Die!_is1
FileKey1=%ProgramFiles%\Doublesix Games\All Zombies Must Die!\Prerequisites|*|REMOVESELF
FileKey2=%UserProfile%\Documents\My Games\UnrealEngine3\Bzb2Game\Logs|*

[AllDup *]
LangSecRef=3024
DetectFile=%AppData%\AllDup
FileKey1=%AppData%\AllDup|*.log

[AloneWolf Brutal Force *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\BForce
RegKey1=HKCU\Software\AloneWolf\BForce|ArcName

[AloneWolf Dos Win Converter *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\DosWinConverter
RegKey1=HKCU\Software\AloneWolf\DosWinConverter|Dir

[AloneWolf FFRestorer *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\FFRestorer
RegKey1=HKCU\Software\AloneWolf\FFRestorer|SaveDir

[AloneWolf File Renamer *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\FileRen
RegKey1=HKCU\Software\AloneWolf\FileRen|Dir
RegKey2=HKCU\Software\AloneWolf\FileRen|LastExt

[AloneWolf Hide Trace *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\HideTrace
RegKey1=HKCU\Software\AloneWolf\HideTrace|LogDir
RegKey2=HKCU\Software\AloneWolf\HideTrace|PathHt

[AloneWolf HTML Optimizer *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\HTMLOpt
RegKey1=HKCU\Software\AloneWolf\HTMLOpt|Dir1
RegKey2=HKCU\Software\AloneWolf\HTMLOpt|Dir2

[AloneWolf Icon Scanner *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\IconScanner
RegKey1=HKCU\Software\AloneWolf\IconScanner|SourceFolder

[AloneWolf Later Remover *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\LRemover
RegKey1=HKCU\Software\AloneWolf\LRemover|Path

[AloneWolf Registry Search and Delete *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\RSD
RegKey1=HKCU\Software\AloneWolf\RSD|LastSearch

[AloneWolf Sign Photo *]
LangSecRef=3023
Detect=HKCU\Software\AloneWolf\SignPhoto
RegKey1=HKCU\Software\AloneWolf\SignPhoto|Dir
RegKey2=HKCU\Software\AloneWolf\SignPhoto|Text

[AloneWolf TestYourSelf *]
LangSecRef=3021
Detect=HKCU\Software\AloneWolf\TestYourSelf
RegKey1=HKCU\Software\AloneWolf\TestYourSelf|QuestionFile

[AloneWolf Text Replacer *]
LangSecRef=3024
Detect=HKCU\Software\AloneWolf\TextReplacer
RegKey1=HKCU\Software\AloneWolf\TextReplacer|Dir
RegKey2=HKCU\Software\AloneWolf\TextReplacer|String1
RegKey3=HKCU\Software\AloneWolf\TextReplacer|String2

[Alternate File Shredder *]
LangSecRef=3024
DetectFile=%AppData%\Alternate\FileShredder
FileKey1=%AppData%\Alternate\FileShredder|FileShredderLog*.txt

[ALZip *]
LangSecRef=3024
DetectFile=%AppData%\ESTsoft\ALZip
FileKey1=%AppData%\ESTsoft\ALZip|extraction_history.db

[AM-DeadLink *]
LangSecRef=3022
DetectFile=%AppData%\aignes\AM-DeadLink
FileKey1=%AppData%\aignes\AM-DeadLink|deadlink.log

[Amazing World *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\293500
DetectFile=%ProgramFiles%\Steam\SteamApps\common\Amazing World
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Amazing World\AmazingWorld_Data|output_log.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Amazing World\Cache|*|REMOVESELF

[Amazon Cloud Player *]
LangSecRef=3024
Detect1=HKCR\Amazon.AmazonMP3DownloaderPlugin
Detect2=HKCR\Software\Amazon\MP3 Downloader
DetectFile=%LocalAppData%\Amazon Cloud Player
FileKey1=%LocalAppData%\Amazon Cloud Player\Logs|*
FileKey2=%LocalAppData%\Program Files\Amazon\MP3 Downloader|InstallerLog.txt
FileKey3=%UserProfile%\Documents\Amazon MP3*\Logs|*|RECURSE

[Amazon Downloader *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\Amazon Downloader Logs
FileKey1=%UserProfile%\Documents\Amazon Downloader Logs|*|RECURSE

[Amazon Games *]
Section=Games
Detect=HKCU\SOFTWARE\Amazon\Amazon Games
DetectFile=%LocalAppData%\Amazon Games
FileKey1=%AppData%\@amzn\aga-electron-platform\Amazon Games UI\logs|*|REMOVESELF
FileKey2=%AppData%\electron-platform\Amazon Games UI\logs|*|REMOVESELF
FileKey3=%LocalAppData%\Amazon Games\App|*.log
FileKey4=%LocalAppData%\Amazon Games\Data|*.tmp
FileKey5=%LocalAppData%\Amazon Games\Data\Dumps|*|RECURSE
FileKey6=%LocalAppData%\Amazon Games\Data\Electron|*|REMOVESELF
FileKey7=%LocalAppData%\Amazon Games\Data\Logs|*|RECURSE

[Amazon Kindle for PC *]
LangSecRef=3023
Detect=HKCU\Software\Amazon\Kindle
FileKey1=%LocalAppData%\Amazon\Kindle|temp_*
FileKey2=%LocalAppData%\Amazon\Kindle\Cache|*|RECURSE
FileKey3=%LocalAppData%\Amazon\Kindle\crashdump|*
FileKey4=%LocalAppData%\Amazon\Kindle\Logs|*.txt|RECURSE
RegKey1=HKCU\Software\Amazon\Kindle\User Settings|last_getitems_date
RegKey2=HKCU\Software\Amazon\Kindle\User Settings|last_syncmetadata_date
RegKey3=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate0
RegKey4=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate1
RegKey5=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate2
RegKey6=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate3
RegKey7=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate4
RegKey8=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate5
RegKey9=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate6
RegKey10=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate7
RegKey11=HKCU\Software\Amazon\Kindle\User Settings|OpenBook
ExcludeKey1=PATH|%LocalAppData%\Amazon\Kindle\Cache\plugins\*\|*.db

[Amazon Music *]
Section=Adobe
Detect=HKCU\Software\Amazon\Amazon Music
DetectFile=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0
FileKey1=%LocalAppData%\Amazon Music\Crash Dumps|*
FileKey2=%LocalAppData%\Amazon Music\data\App Cache|*-journal;ChromeDWriteFontCache;data_*;f_*;index
FileKey3=%LocalAppData%\Amazon Music\data\App Cache\*Cache|*|RECURSE
FileKey4=%LocalAppData%\Amazon Music\data\Artwork Cache|*.jpg;*.png|RECURSE
FileKey5=%LocalAppData%\Amazon Music\data\Hammer Cache|*
FileKey6=%LocalAppData%\Amazon Music\data\S*Cache|*
FileKey7=%LocalAppData%\Amazon Music\Logs|*
FileKey8=%LocalAppData%\Amazon Music\User Data|*.pma
FileKey9=%LocalAppData%\Amazon Music\User Data\Crashpad\Reports|*
FileKey10=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\AC|*|RECURSE
FileKey11=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\Data\App Cache\*Cache*|RECURSE
FileKey12=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\Data\Artwork Cache|*.jpg;*.png|RECURSE
FileKey13=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\Data\Hammer Cache|*
FileKey14=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\Data\S*Cache|*
FileKey15=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\Logs|*
FileKey16=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\User Data|*.pma
FileKey17=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\LocalCache\Local\Amazon Music\User Data\Crashpad\Reports|*
FileKey18=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\Settings|*.log*
FileKey19=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\SystemAppData\Helium|*.log*
FileKey20=%LocalAppData%\Packages\AmazonMobileLLC.AmazonMusic_kc6t79cpj4tp0\TempState|*|REMOVESELF
FileKey21=%UserProfile%\.amu\updates|*.exe
FileKey22=%UserProfile%\Documents\Amazon Music Importer\Logs|*|RECURSE

[Amazon Prime Video *]
Section=Adobe
DetectFile=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j
FileKey1=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\AppData|*|RECURSE
FileKey3=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalCache|*|RECURSE
FileKey4=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey5=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey16=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey34=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey67=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey68=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\LocalState\Logs|*.log
FileKey69=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\Settings|*.log*
FileKey70=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\SystemAppData\Helium|*.log*
FileKey71=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\TempState|*|REMOVESELF
ExcludeKey1=FILE|%LocalAppData%\Packages\AmazonVideo.PrimeVideo_pwbj9vvecjh7j\AC\INetCookies\ESE\|container.dat

[AMD *]
LangSecRef=3024
Detect1=HKLM\Software\AMD
Detect2=HKLM\Software\ATI
Detect3=HKLM\Software\ATI Technologies
DetectFile1=%ProgramFiles%\AMD
DetectFile2=%ProgramFiles%\ATI Technologies
DetectFile3=%ProgramFiles%\RAIDXpert2
FileKey1=%LocalAppData%\AMD Ryzen Master\cache\qmlcache|*
FileKey2=%LocalAppData%\AMD\*Cache|*|RECURSE
FileKey3=%LocalAppData%\AMD\cn|*.log
FileKey4=%LocalAppData%\AMD\Fuel|ClientProxyLog*.*
FileKey5=%LocalAppData%\AMD\RadeonSoftware\Cache|*
FileKey6=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default|*-journal;*.log;*.old;LOG;LOG.old;Network Persistent State;Origin Bound Certs|RECURSE
FileKey7=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default|QuotaManager*;Visited Links
FileKey8=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\*Cache*|*|REMOVESELF
FileKey9=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\blob_storage|*|REMOVESELF
FileKey10=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\Platform Notifications|*|REMOVESELF
FileKey11=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\Service Worker\*Cache*|*|REMOVESELF
FileKey12=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\VideoDecodeStats|*|REMOVESELF
FileKey13=%LocalAppData%\AMD\RadeonSoftware\vkcache|*
FileKey14=%LocalAppData%\AMD\Ryzen Master\cache\qmlcache|*
FileKey15=%LocalAppData%\AMD\StoreMI\cache\qmlcache|*
FileKey16=%LocalAppData%\ATI\ACE|*.txt
FileKey17=%LocalAppData%\Packages\*\AC\*\AMD\DxCache|*
FileKey18=%LocalAppData%\Packages\*\AC\AMD\DxCache|*
FileKey19=%LocalAppData%\Radeon*\cache\qmlcache|*
FileKey20=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default|*-journal;*.log;*.old;LOG;LOG.old;Network Persistent State;Origin Bound Certs|RECURSE
FileKey21=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default|QuotaManager*;Visited Links
FileKey22=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default\*Cache*|*|REMOVESELF
FileKey23=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default\blob_storage|*|REMOVESELF
FileKey24=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default\Platform Notifications|*|REMOVESELF
FileKey25=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default\Service Worker\*Cache*|*|REMOVESELF
FileKey26=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default\VideoDecodeStats|*|REMOVESELF
FileKey27=%LocalAppData%\RadeonSettings\QtWebEngine\Default|*-journal;*.log;*.old;LOG;LOG.old;Network Persistent State;Origin Bound Certs|RECURSE
FileKey28=%LocalAppData%\RadeonSettings\QtWebEngine\Default|QuotaManager*;Visited Links
FileKey29=%LocalAppData%\RadeonSettings\QtWebEngine\Default\*Cache*|*|REMOVESELF
FileKey30=%LocalAppData%\RadeonSettings\QtWebEngine\Default\blob_storage|*|REMOVESELF
FileKey31=%LocalAppData%\RadeonSettings\QtWebEngine\Default\Platform Notifications|*|REMOVESELF
FileKey32=%LocalAppData%\RadeonSettings\QtWebEngine\Default\Service Worker\*Cache*|*|REMOVESELF
FileKey33=%LocalAppData%\RadeonSettings\QtWebEngine\Default\VideoDecodeStats|*|REMOVESELF
FileKey34=%LocalAppData%\Setup\cache\qmlcache|*
FileKey35=%ProgramData%\AMD AutoUpdate|*.log
FileKey36=%ProgramData%\AMD\Fuel|*.txt
FileKey37=%ProgramData%\AMD\KDB|*.log
FileKey38=%ProgramFiles%\AMD|*.log
FileKey39=%ProgramFiles%\AMD\amdkmpfd|*|REMOVESELF
FileKey40=%ProgramFiles%\AMD\CIM\Log|*.log;*.txt
FileKey41=%ProgramFiles%\AMD\CIM\Reports|*.xml;*.xsl
FileKey42=%ProgramFiles%\AMD\OverDrive|*.log
FileKey43=%ProgramFiles%\AMD\RyzenMaster|*.rtf
FileKey44=%ProgramFiles%\AMD\RyzenMaster\bin|*.bak
FileKey45=%ProgramFiles%\AMD\RyzenMaster\logs|*
FileKey46=%ProgramFiles%\ATI Technologies|*.log|RECURSE
FileKey47=%ProgramFiles%\ATI Technologies|cccutil64.txt
FileKey48=%ProgramFiles%\ATI\CIM\Reports|*
FileKey49=%ProgramFiles%\RAIDXpert2|*.log
FileKey50=%SystemDrive%\AMD|*|REMOVESELF
FileKey51=%SystemDrive%\ATI|*|REMOVESELF
FileKey52=%UserProfile%|AMDRM_Install.log;AMD_*.log;ChipsetExtraction.log;Device_ID.log
FileKey53=%UserProfile%\AppData\LocalLow\AMD\DxCache|*
FileKey54=%WinDir%\System32|CCCInstall*.log
FileKey55=%WinDir%\System32\config\systemprofile\AppData\Local\AMD\DxCache|*
FileKey56=%WinDir%\SysWOW64|CCCInstall*.log

[America's Army 2 *]
Section=Games
DetectFile=%ProgramFiles%\USArmy\America's Army 2
FileKey1=%LocalAppData%\AA2DeployClient|debug*.*
FileKey2=%ProgramFiles%\USArmy\America's Army 2|*.log|RECURSE

[AMID EVIL *]
Section=Games
DetectFile=%LocalAppData%\AmidEvil
FileKey1=%LocalAppData%\AmidEvil\Saved\Logs|*

[Amnesia: The Dark Descent *]
Section=Games
DetectFile=%UserProfile%\Documents\Amnesia
FileKey1=%UserProfile%\Documents\Amnesia|*.log|RECURSE

[AmoyShare AnyEraser *]
LangSecRef=3023
DetectFile=%LocalAppData%\AnyEraser
FileKey1=%LocalAppData%\AnyEraser\logs|*

[AmoyShare AnyMusic *]
LangSecRef=3023
DetectFile=%LocalAppData%\AnyMusic
FileKey1=%LocalAppData%\AnyMusic\Cache|*.log
FileKey2=%LocalAppData%\AnyMusic\Cache|*.pma|RECURSE
FileKey3=%LocalAppData%\AnyMusic\Cache\*Cache|*|RECURSE
FileKey4=%LocalAppData%\AnyMusic\Cache\Default\*Cache|*|RECURSE
FileKey5=%LocalAppData%\AnyMusic\Cache\QtWebEngine\Default\Cache|*
FileKey6=%LocalAppData%\AnyMusic\QtWebEngine\Default|*-journal;*.old;LOG;Network Persistent State;Visited Links|RECURSE
FileKey7=%LocalAppData%\AnyMusic\QtWebEngine\Default\blob_storage|*|RECURSE
FileKey8=%LocalAppData%\AnyMusic\QtWebEngine\Default\GPUCache|*

[AmoyShare BeeConverter *]
LangSecRef=3023
DetectFile=%LocalAppData%\BeeConverter
FileKey1=%LocalAppData%\BCDownload\Cache|*.log
FileKey2=%LocalAppData%\BCDownload\Cache|*.pma|RECURSE
FileKey3=%LocalAppData%\BCDownload\Cache\*Cache|*|RECURSE
FileKey4=%LocalAppData%\BCDownload\Cache\Default\*Cache|*|RECURSE
FileKey5=%LocalAppData%\BeeConverter\.*\cache|*|REMOVESELF
FileKey6=%LocalAppData%\BeeConverter\.*\temp|*|REMOVESELF
FileKey7=%LocalAppData%\BeeConverter\Cache|*.log
FileKey8=%LocalAppData%\BeeConverter\Cache|*.pma|RECURSE
FileKey9=%LocalAppData%\BeeConverter\Cache\*Cache|*|RECURSE
FileKey10=%LocalAppData%\BeeConverter\Cache\Default\*Cache|*|RECURSE

[AmoyShare DiReec *]
LangSecRef=3023
DetectFile=%LocalAppData%\DiReec
FileKey1=%LocalAppData%\DiReec\Cache|*.log
FileKey2=%LocalAppData%\DiReec\Cache|*.pma|RECURSE
FileKey3=%LocalAppData%\DiReec\Cache\*Cache|*|RECURSE
FileKey4=%LocalAppData%\DiReec\Cache\Default\*Cache|*|RECURSE

[AmoyShare Pixeraser *]
LangSecRef=3023
DetectFile=%LocalAppData%\Pixeraser
FileKey1=%LocalAppData%\Pixeraser\logs|*

[AmoyShare TuneBer *]
LangSecRef=3023
DetectFile=%LocalAppData%\TuneBer
FileKey1=%LocalAppData%\TuneBer*\Cache|*.log
FileKey2=%LocalAppData%\TuneBer*\Cache\*Cache|*|RECURSE
FileKey3=%LocalAppData%\TuneBer*\Cache\BrowserMetrics|*.pma
FileKey4=%LocalAppData%\TuneBer*\Cache\Default\*Cache|*|RECURSE
FileKey5=%LocalAppData%\TuneBer\.*\cache|*|REMOVESELF
FileKey6=%LocalAppData%\TuneBer\.*\temp|*|REMOVESELF

[AMP Font Viewer *]
LangSecRef=3024
Detect=HKCU\Software\AMP Soft\Font Viewer
RegKey1=HKCU\Software\AMP Soft\Font Viewer|Default copy folder
RegKey2=HKCU\Software\AMP Soft\Font Viewer|Last file operation folder
RegKey3=HKCU\Software\AMP Soft\Font Viewer|Not installed tab path

[AMYUNI PDF Converter *]
LangSecRef=3021
DetectFile=%ProgramData%\Package Cache\3DBECED19CFC2819A7E0BE14463CF18FC8720D91\amyuni_pdfconverter_5_00
FileKey1=%ProgramData%\Package Cache\3DBECED19CFC2819A7E0BE14463CF18FC8720D91\amyuni_pdfconverter_5_00|*.log|RECURSE

[AnalogX PortMapper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AnalogX\PortMapper
FileKey1=%ProgramFiles%\AnalogX\PortMapper|debug.log

[And Yet It Moves *]
Section=Games
DetectFile=%AppData%\Broken Rules\And Yet It Moves Steam
FileKey1=%AppData%\Broken Rules\And Yet It Moves Steam|console.log

[Android SDK Tools *]
LangSecRef=3023
Detect=HKLM\Software\Android SDK Tools
FileKey1=%AppData%\Android\android-sdk\temp|*|REMOVESELF
FileKey2=%UserProfile%\.android\cache|*|REMOVESELF

[Android Studio *]
LangSecRef=3021
Detect=HKCU\Software\Android Open Source Project\Emulator
FileKey1=%UserProfile%\.AndroidStudio2.3\system\log|*|REMOVESELF
FileKey2=%UserProfile%\.AndroidStudio2.3\system\tmp|*
FileKey3=%UserProfile%\.gradle|*.log|RECURSE

[Anfibia Deskman *]
LangSecRef=3024
DetectFile=%ProgramData%\DNET*
FileKey1=%ProgramData%\DNET*|*.log

[Anim8or *]
LangSecRef=3021
Detect=HKCU\Software\Silicon Valley Software\Anim8or
RegKey1=HKCU\Software\Silicon Valley Software\Anim8or|File1
RegKey2=HKCU\Software\Silicon Valley Software\Anim8or|File2
RegKey3=HKCU\Software\Silicon Valley Software\Anim8or|File3
RegKey4=HKCU\Software\Silicon Valley Software\Anim8or|File4

[Ankama Dofus *]
Section=Games
DetectFile=%LocalAppData%\Ankama\Dofus*
FileKey1=%LocalAppData%\Ankama\Dofus*\Logs|*

[Ankama Wakfu *]
Section=Games
DetectFile=%LocalAppData%\Ankama\Wakfu
FileKey1=%LocalAppData%\Ankama\Wakfu\Game\logs|*
FileKey2=%LocalAppData%\Ankama\Wakfu\Logs|*
FileKey3=%LocalAppData%\Ankama\Wakfu\user_data\Game\Logs|*
FileKey4=%LocalAppData%\Ankama\Wakfu\user_data\Logs|*

[Anki Backups *]
LangSecRef=3021
DetectFile=%AppData%\.anki
FileKey1=%AppData%\.anki\backups|*

[Annie's Millions *]
Section=Games
DetectFile=%AppData%\PoBros\Annies Millions
FileKey1=%AppData%\PoBros\Annies Millions|logfile.txt

[Anno 1404 *]
Section=Games
DetectFile=%ProgramFiles%\Anno1404
FileKey1=%ProgramFiles%\Anno1404|AnnoCrash.log
FileKey2=%ProgramFiles%\Anno1404\CrashDumps|*

[ANNO 2070 *]
Section=Games
DetectFile=%AppData%\Ubisoft\ANNO 2070
FileKey1=%AppData%\Ubisoft\ANNO 2070\Cache|*|REMOVESELF
FileKey2=%AppData%\Ubisoft\ANNO 2070\Logs|*.dmp;*.log|RECURSE

[AnnyStudio JPEG Lossless Rotator *]
LangSecRef=3023
Detect=HKCU\Software\AnnyStudio\JPEGRotator
RegKey1=HKCU\Software\AnnyStudio\JPEGRotator\Main|LastFolder

[Anonymizer Universal *]
LangSecRef=3022
DetectFile=%AppData%\Anonymizer\Anonymizer Universal
FileKey1=%AppData%\Anonymizer\Anonymizer Universal|*.log

[Ant Video Downloader *]
LangSecRef=3022
Detect=HKCU\Software\Ant.com\AVD\Ant Video downloader
RegKey1=HKCU\Software\Ant.com\AVD\Ant Video downloader\Settings|TemporaryFilesLocation

[Anthropic Claude *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Claude_pzs8sxrjxfjjc
FileKey1=%LocalAppData%\claude-cli-nodejs\Cache|*.jsonl|RECURSE
FileKey2=%LocalAppData%\Packages\Claude_pzs8sxrjxfjjc\AC|*|RECURSE
FileKey3=%LocalAppData%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\logs|*
FileKey4=%LocalAppData%\Packages\Claude_pzs8sxrjxfjjc\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Claude_pzs8sxrjxfjjc\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Claude_pzs8sxrjxfjjc\TempState|*|REMOVESELF
FileKey7=%ProgramData%\Claude\Logs|*
FileKey8=%UserProfile%\.claude\telemetry|*

[Antichamber *]
Section=Games
DetectFile=%ProgramFiles%\Steam\SteamApps\common\Antichamber
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Antichamber\UDKGame\Logs|*

[AnvSoft Any Audio Converter *]
LangSecRef=3023
DetectFile=%AppData%\AnvSoft\Any Audio Converter
FileKey1=%AppData%\AnvSoft|*.tmp
FileKey2=%AppData%\AnvSoft\Any Audio Converter|*.log;histroy_v3.db

[AnvSoft Any DVD Converter *]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft\Any DVD Converter Professional
FileKey1=%AppData%\AnvSoft\Any DVD Converter Professional|*.db;*.log

[AnvSoft Any Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft\Any Video Converter
FileKey1=%AppData%\AnvSoft\Any Video Converter|*.log;history*.db|RECURSE
FileKey2=%AppData%\AnvSoft\Any Video Converter\thumbs|*|RECURSE
FileKey3=%AppData%\Any Video Converter Professional|*.log;history*.db
FileKey4=%AppData%\Any Video Converter\*Cache|*|RECURSE
FileKey5=%AppData%\Any Video Converter\logs|*|RECURSE
FileKey6=%AppData%\Any Video Converter\Partitions\*\*Cache|*|RECURSE
FileKey7=%LocalAppData%\any video converter-updater|*|RECURSE

[AnvSoft AVCLabs Photo Enhancer AI *]
LangSecRef=3023
DetectFile=%AppData%\AVCLabs Photo Enhancer AI
FileKey1=%AppData%\AVCLabs Photo Enhancer AI|*.log
FileKey2=%AppData%\AVCLabs Photo Enhancer AI\*Cache|*|RECURSE
FileKey3=%AppData%\AVCLabs Photo Enhancer AI\logs|*

[AnvSoft AVCLabs PhotoPro AI *]
LangSecRef=3023
DetectFile=%AppData%\AVCLabs PhotoPro AI
FileKey1=%AppData%\AVCLabs PhotoPro AI|*.log
FileKey2=%AppData%\AVCLabs PhotoPro AI\*Cache|*|RECURSE
FileKey3=%AppData%\AVCLabs PhotoPro AI\logs|*

[AnvSoft AVCLabs Video Blur AI *]
LangSecRef=3023
DetectFile=%AppData%\AVCLabs Video Blur AI
FileKey1=%AppData%\AVCLabs Video Blur AI|*.log
FileKey2=%AppData%\AVCLabs Video Blur AI\*Cache|*|RECURSE
FileKey3=%AppData%\AVCLabs Video Blur AI\logs|*

[AnvSoft AVCLabs Video Enhancer AI *]
LangSecRef=3023
DetectFile=%AppData%\AVCLabs Video Enhancer AI
FileKey1=%AppData%\AVCLabs Video Enhancer AI|*.log
FileKey2=%AppData%\AVCLabs Video Enhancer AI\*Cache|*|RECURSE
FileKey3=%AppData%\AVCLabs Video Enhancer AI\logs|*

[AnvSoft PDFMate *]
LangSecRef=3023
DetectFile=%AppData%\AnvsoftPdfTools
FileKey1=%AppData%\AnvsoftPdfTools\tmp\log|*|RECURSE
FileKey2=%UserProfile%\Documens\Anvsoft\PDF *\tmp|*|REMOVESELF

[AnvSoft Syncios D-Savior *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Syncios D-Savior
FileKey1=%ProgramFiles%\Syncios D-Savior\cache\logs|*|RECURSE

[AnvSoft Syncios Data Recovery *]
LangSecRef=3023
DetectFile=%AppData%\Syncios Data Recovery
FileKey1=%AppData%\Local\Temp\iTunes Component\iTunesCache\12.11.0.26.64|*|REMOVESELF
FileKey2=%AppData%\Syncios Data Recovery|*.log
FileKey3=%AppData%\Syncios Data Recovery\*Cache|*|RECURSE
FileKey4=%AppData%\Syncios Data Recovery\logs|*

[AnvSoft Syncios iOS Eraser Pro *]
LangSecRef=3023
DetectFile=%AppData%\Syncios iOS Eraser Pro
FileKey1=%AppData%\Syncios iOS Eraser Pro|*.log
FileKey2=%AppData%\Syncios iOS Eraser Pro\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios iOS Eraser Pro\logs|*

[AnvSoft Syncios Location Changer *]
LangSecRef=3023
DetectFile=%AppData%\Syncios Location Changer
FileKey1=%AppData%\Syncios Location Changer|*.log
FileKey2=%AppData%\Syncios Location Changer\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios Location Changer\logs|*

[AnvSoft Syncios Mobile Manager *]
LangSecRef=3023
DetectFile=%AppData%\Syncios Mobile Manager
FileKey1=%AppData%\Syncios Mobile Manager|*.log
FileKey2=%AppData%\Syncios Mobile Manager\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios Mobile Manager\logs|*

[AnvSoft Syncios Passcode Unlocker *]
LangSecRef=3023
DetectFile=%AppData%\Syncios Passcode Unlocker
FileKey1=%AppData%\Syncios Passcode Unlocker|*.log
FileKey2=%AppData%\Syncios Passcode Unlocker\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios Passcode Unlocker\logs|*

[AnvSoft Syncios Toolkit *]
LangSecRef=3023
DetectFile=%AppData%\Syncios Toolkit
FileKey1=%AppData%\Syncios Toolkit|*.log
FileKey2=%AppData%\Syncios Toolkit\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios Toolkit\logs|*

[AnvSoft Syncios WhatsApp Transfer *]
LangSecRef=3023
DetectFile=%AppData%\Syncios WhatsApp Transfer
FileKey1=%AppData%\Syncios WhatsApp Transfer|*.log
FileKey2=%AppData%\Syncios WhatsApp Transfer\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios WhatsApp Transfer\logs|*

[AnvSoft Syncios YouTube Video Downloader *]
LangSecRef=3023
DetectFile=%AppData%\Syncios YouTube Video Downloader
FileKey1=%AppData%\Syncios YouTube Video Downloader|*.log
FileKey2=%AppData%\Syncios YouTube Video Downloader\*Cache|*|RECURSE
FileKey3=%AppData%\Syncios YouTube Video Downloader\logs|*

[Any.do *]
LangSecRef=3021
DetectFile=%AppData%\@anydo
FileKey1=%AppData%\@anydo\electron-app|*.old;LOG|RECURSE
FileKey2=%AppData%\@anydo\electron-app\*Cache|*|RECURSE
FileKey3=%LocalAppData%\@anydoelectron-app-updater|*

[AnyBurn *]
LangSecRef=3021
DetectFile=%AppData%\AnyBurn
FileKey1=%AppData%\AnyBurn\Upgrade|anyburn_setup.exe

[AnyDesk *]
LangSecRef=3024
DetectFile=%AppData%\AnyDesk
FileKey1=%AppData%\AnyDesk|ad.trace;connection_trace.txt

[AnyMP4 DVD Ripper *]
LangSecRef=3023
DetectFile=%LocalAppData%\AnyMP4 Studio\AnyMP4 DVD Ripper
FileKey1=%LocalAppData%\AnyMP4 Studio\AnyMP4 DVD Ripper|*.log;*log.txt

[AnywaySoft Any VPN *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\AnywaySoftInc.AnyVPN_0qkrc2qacwvfm
FileKey1=%LocalAppData%\Packages\AnywaySoftInc.AnyVPN_0qkrc2qacwvfm\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AnywaySoftInc.AnyVPN_0qkrc2qacwvfm\Settings|*.log*
FileKey3=%LocalAppData%\Packages\AnywaySoftInc.AnyVPN_0qkrc2qacwvfm\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\AnywaySoftInc.AnyVPN_0qkrc2qacwvfm\TempState|*|REMOVESELF

[AOL Shield Autofill Data & Search Engine Preferences *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|*Web Data
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data\AutoFill*|*|REMOVESELF

[AOL Shield Autoplay Preferences *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\MEIPreload|*|REMOVESELF

[AOL Shield Bookmark Backups *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|Bookmarks.bak

[AOL Shield Bookmark Favicons *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|favicons*

[AOL Shield Caches *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data|Module Info Cache
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\AOL\AOL Shield\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\AOL\AOL Shield\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\AOL\AOL Shield\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\AOL\AOL Shield\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\AOL\AOL Shield\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\AOL\AOL Shield\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\AOL\AOL Shield\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\AOL\AOL Shield\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\AOL\AOL Shield\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\AOL\AOL Shield\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\AOL\AOL Shield\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\AOL\AOL Shield\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\AOL\AOL Shield\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\AOL\AOL Shield\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\AOL\AOL Shield\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\AOL\AOL Shield\User Data\Optimization*|*|REMOVESELF

[AOL Shield Default App Handlers *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|PreferredApps

[AOL Shield Download History *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*\shared_proto_db|*|REMOVESELF

[AOL Shield DRM Data *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\WidevineCdm|*|REMOVESELF

[AOL Shield Extension Cookies *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|Extension Cookies

[AOL Shield Pinned Tabs *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
RegKey1=HKCU\AOL\AOL Shield\PreferenceMACs\Default|pinned_tabs

[AOL Shield Privacy Sandbox *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data|*first_party_sets*
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\AOL\AOL Shield\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\AOL\AOL Shield\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\AOL\AOL Shield\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\AOL\AOL Shield\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\AOL\AOL Shield\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[AOL Shield Progressive Web Apps *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\Web Applications|*|REMOVESELF

[AOL Shield Saved Usernames & Passwords *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|Login Data*

[AOL Shield Security & Threat Detection *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|DIPS*
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\AOL\AOL Shield\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\AOL\AOL Shield\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\AOL\AOL Shield\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\AOL\AOL Shield\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\AOL\AOL Shield\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\AOL\AOL Shield\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\AOL\AOL Shield\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\AOL\AOL Shield\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\AOL\AOL Shield\User Data\ZxcvbnData|*|REMOVESELF

[AOL Shield Shopping Insights *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\AOL\AOL Shield\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\AOL\AOL Shield\User Data\*\parcel_tracking_db|*|REMOVESELF

[AOL Shield Storage Quota Manager *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|QuotaManager

[AOL Shield Sync Data *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\Sync Data|*|REMOVESELF

[AOL Shield Telemetry *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\Application|debug.log
FileKey2=%LocalAppData%\AOL\AOL Shield\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\AOL\AOL Shield\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\AOL\AOL Shield\User Data\*|*.log
FileKey6=%LocalAppData%\AOL\AOL Shield\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\AOL\AOL Shield\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\AOL\AOL Shield\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\AOL\AOL Shield\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\AOL\AOL Shield\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\AOL\AOL Shield\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\AOL\AOL Shield\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\AOL\AOL Shield\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\AOL\AOL Shield\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\AOL\AOL Shield\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\AOL\AOL Shield\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\AOL\AOL Shield\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\AOL\AOL Shield\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\AOL\AOL Shield\User Data\Stability|*|REMOVESELF
FileKey20=%LocalAppData%\SentryBay\CrashReports|*|REMOVESELF
FileKey21=%ProgramFiles%\AOL\AOL Shield\Application|debug.log
FileKey22=%ProgramFiles%\AOL\AOL Shield\Application\SetupMetrics|*|REMOVESELF
FileKey23=%ProgramFiles%\SentryBay\CrashReports|*|REMOVESELF
RegKey1=HKCU\AOL\AOL Shield\BlBeacon|failed_count
RegKey2=HKCU\AOL\AOL Shield\BlBeacon|state
RegKey3=HKCU\AOL\AOL Shield\Installer|LastChecked
RegKey4=HKCU\AOL\AOL Shield\StabilityMetrics

[AOL Shield Web Browsing Cookies *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\Network|Cookies*;Device Bound Sessions*

[AOL Shield Web Browsing History *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[AOL Shield Web Browsing Session *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*\Sessions|*|REMOVESELF

[AOL Shield Web Storage *]
Section=AOL Shield Web Browser
DetectFile=%LocalAppData%\AOL\AOL Shield\User Data
FileKey1=%LocalAppData%\AOL\AOL Shield\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\AOL\AOL Shield\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\AOL\AOL Shield\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\AOL\AOL Shield\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\AOL\AOL Shield\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\AOL\AOL Shield\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\AOL\AOL Shield\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\AOL\AOL Shield\User Data\*\WebStorage|*|REMOVESELF

[AOMEI Backupper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AOMEI Backupper
FileKey1=%LocalAppData%\AOMEI Backupper\cache|*
FileKey2=%ProgramData%\AomeiBR|brlog.xml
FileKey3=%ProgramFiles%\AOMEI Backupper\AOMEI Image Deploy\log|*
FileKey4=%ProgramFiles%\AOMEI Backupper\log|*

[AOMEI Cloner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AOMEI Cloner
FileKey1=%ProgramFiles%\AOMEI Cloner\log|*.log

[AOMEI FastRecovery *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AOMEI FastRecovery
FileKey1=%ProgramFiles%\AOMEI FastRecovery|*.log

[AOMEI Partition Assistant *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AOMEI Partition Assistant
FileKey1=%ProgramFiles%\AOMEI Partition Assistant\log|*.log

[APC PowerChute Personal Edition *]
LangSecRef=3024
DetectFile=%ProgramFiles%\APC\PowerChute Personal Edition
FileKey1=%ProgramFiles%\APC\PowerChute Personal Edition|PCPELog.txt
FileKey2=%WinDir%\System32|PCPELog.txt
FileKey3=%WinDir%\SysWOW64|PCPELog.txt

[ApexDC++ *]
LangSecRef=3022
DetectFile1=%AppData%\ApexDC++
DetectFile2=%LocalAppData%\ApexDC++
DetectFile3=%ProgramFiles%\ApexDC++\Settings
FileKey1=%AppData%\ApexDC++|files.xml.bz2;FinishedTransfers.xml;Queue.bkp.xml;Queue.xml.bak;Recents.xml
FileKey2=%AppData%\ApexDC++\FileLists|*
FileKey3=%AppData%\ApexDC++\Logs|*
FileKey4=%LocalAppData%\ApexDC++|files.xml.bz2;FinishedTransfers.xml;Queue.bkp.xml;Queue.xml.bak;Recents.xml
FileKey5=%LocalAppData%\ApexDC++\FileLists|*
FileKey6=%LocalAppData%\ApexDC++\Logs|*
FileKey7=%ProgramFiles%\ApexDC++\Logs|*
FileKey8=%ProgramFiles%\ApexDC++\Settings|files.xml.bz2;FinishedTransfers.xml;Queue.bkp.xml;Queue.xml.bak;Recents.xml
FileKey9=%ProgramFiles%\ApexDC++\Settings\FileLists|*
FileKey10=%ProgramFiles%\ApexDC++\Settings\Logs|*

[Apowersoft ApowerCompress *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerCompress
FileKey1=%AppData%\Apowersoft\ApowerCompress|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerCompress\log|*

[Apowersoft ApowerManager *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerManager
FileKey1=%AppData%\Apowersoft\ApowerManager|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerManager\*cache|*
FileKey3=%AppData%\Apowersoft\ApowerManager\log|*
FileKey4=%ProgramFiles%\Apowersoft\ApowerManager|*.log

[Apowersoft ApowerMirror *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerMirror
FileKey1=%AppData%\Apowersoft\ApowerMirror|*.log;CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerMirror\log|*

[Apowersoft ApowerREC *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerREC
FileKey1=%AppData%\Apowersoft\ApowerREC|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerREC\log|*

[Apowersoft ApowerRecover *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerRecover
FileKey1=%AppData%\Apowersoft\ApowerRecover|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerRecover\log|*
FileKey3=%ProgramFiles%\Apowersoft\ApowerRecover|*.dmp;*.log

[Apowersoft ApowerRescue *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerRescue
FileKey1=%AppData%\Apowersoft\ApowerRescue|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerRescue\*cache|*
FileKey3=%AppData%\Apowersoft\ApowerRescue\log|*

[Apowersoft ApowerShow *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\ApowerShow
FileKey1=%AppData%\Apowersoft\ApowerShow|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\ApowerShow\log*|*

[Apowersoft Background Easer *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft background eraser
FileKey1=%AppData%\Apowersoft\Apowersoft background eraser|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft background eraser\log|*

[Apowersoft CAD Viewer *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft CAD Viewer
FileKey1=%AppData%\Apowersoft\Apowersoft CAD Viewer|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft CAD Viewer\log|*

[Apowersoft Casttingo *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Casttingo
FileKey1=%AppData%\Apowersoft\Casttingo|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Casttingo\log|*
FileKey3=%AppData%\Apowersoft\chromatool\log|*

[Apowersoft GIF *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft GIF
FileKey1=%AppData%\Apowersoft\Apowersoft GIF|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft GIF\Log|*

[Apowersoft GitMind *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\GitMind
FileKey1=%AppData%\Apowersoft\GitMind\Cache|*
FileKey2=%AppData%\Apowersoft\GitMind\logs|*
FileKey3=%AppData%\Apowersoft\GitMind\webview\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey4=%AppData%\Apowersoft\GitMind\webview\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey5=%AppData%\Apowersoft\GitMind\webview\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey6=%AppData%\Apowersoft\GitMind\webview\EBWebView\*Cache*|*|REMOVESELF
FileKey7=%AppData%\Apowersoft\GitMind\webview\EBWebView\AutoFill*|*|REMOVESELF
FileKey8=%AppData%\Apowersoft\GitMind\webview\EBWebView\Avatars|*|REMOVESELF
FileKey9=%AppData%\Apowersoft\GitMind\webview\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey10=%AppData%\Apowersoft\GitMind\webview\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey11=%AppData%\Apowersoft\GitMind\webview\EBWebView\Crash Reports|*|REMOVESELF
FileKey12=%AppData%\Apowersoft\GitMind\webview\EBWebView\Crashpad|*|REMOVESELF
FileKey13=%AppData%\Apowersoft\GitMind\webview\EBWebView\Crowd Deny|*|REMOVESELF
FileKey14=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey15=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey16=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey17=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey18=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey19=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey20=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey21=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey22=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey23=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey24=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey25=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Download Service|*|REMOVESELF
FileKey26=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Extension State|*|REMOVESELF
FileKey27=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey28=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\File System|*|REMOVESELF
FileKey29=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey30=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey32=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey33=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\optimization*|*|REMOVESELF
FileKey34=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey35=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey36=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey37=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey38=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey39=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Sessions|*|REMOVESELF
FileKey40=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey41=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey42=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey43=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey44=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey45=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey46=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey47=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey48=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey49=%AppData%\Apowersoft\GitMind\webview\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey50=%AppData%\Apowersoft\GitMind\webview\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey51=%AppData%\Apowersoft\GitMind\webview\EBWebView\Local Traces|*|REMOVESELF
FileKey52=%AppData%\Apowersoft\GitMind\webview\EBWebView\MEIPreload|*|REMOVESELF
FileKey53=%AppData%\Apowersoft\GitMind\webview\EBWebView\Optimization*|*|REMOVESELF
FileKey54=%AppData%\Apowersoft\GitMind\webview\EBWebView\OriginTrials|*|REMOVESELF
FileKey55=%AppData%\Apowersoft\GitMind\webview\EBWebView\PKIMetadata|*|REMOVESELF
FileKey56=%AppData%\Apowersoft\GitMind\webview\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey57=%AppData%\Apowersoft\GitMind\webview\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey58=%AppData%\Apowersoft\GitMind\webview\EBWebView\Safe Browsing|*|REMOVESELF
FileKey59=%AppData%\Apowersoft\GitMind\webview\EBWebView\SafetyTips|*|REMOVESELF
FileKey60=%AppData%\Apowersoft\GitMind\webview\EBWebView\SmartScreen|*|REMOVESELF
FileKey61=%AppData%\Apowersoft\GitMind\webview\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey62=%AppData%\Apowersoft\GitMind\webview\EBWebView\Stability|*|REMOVESELF
FileKey63=%AppData%\Apowersoft\GitMind\webview\EBWebView\Subresource Filter|*|REMOVESELF
FileKey64=%AppData%\Apowersoft\GitMind\webview\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey65=%AppData%\Apowersoft\GitMind\webview\EBWebView\WidevineCdm|*|REMOVESELF
FileKey66=%AppData%\Apowersoft\GitMind\webview\EBWebView\ZxcvbnData|*|REMOVESELF

[Apowersoft HEIC Converter *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft Heic Converter
FileKey1=%AppData%\Apowersoft\Apowersoft Heic Converter|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft Heic Converter\Log|*

[Apowersoft Photo Viewer *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft Photo Viewer
FileKey1=%AppData%\Apowersoft\Apowersoft Photo Viewer|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft Photo Viewer\Log|*
FileKey3=%UserProfile%\Pictures\Apowersoft\Apowersoft Photo Viewer\Screenshots|*

[Apowersoft RecCloud *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\RecCloud
FileKey1=%AppData%\Apowersoft\RecCloud|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\RecCloud\log|*
FileKey3=%AppData%\Apowersoft\Video Editor Pro|CommUtilities.Report.*
FileKey4=%AppData%\Apowersoft\Video Editor Pro\CacheProjects|*
FileKey5=%AppData%\Apowersoft\Video Editor Pro\log|*
FileKey6=%ProgramData%\Apowersoft\Video Editor Pro\Renamed Cache|*|RECURSE

[Apowersoft Screen Capture Pro *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft Screen Capture Pro
FileKey1=%AppData%\Apowersoft\Apowersoft Screen Capture Pro|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft Screen Capture Pro\Log|*

[Apowersoft Streaming Audio Recorder *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Streaming Audio Recorder
FileKey1=%AppData%\Apowersoft\Streaming Audio Recorder|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Streaming Audio Recorder\log|*

[Apowersoft Video Download Capture *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Video Download Capture*
FileKey1=%AppData%\Apowersoft\Video Download Capture*\CefCache|*
FileKey2=%AppData%\Apowersoft\Video Download Capture*\Log|*

[Apowersoft Video Editor *]
LangSecRef=3023
DetectFile=%AppData%\Apowersoft\Apowersoft Video Editor
FileKey1=%AppData%\Apowersoft\Apowersoft Video Editor|CommUtilities.Report.*
FileKey2=%AppData%\Apowersoft\Apowersoft Video Editor\Log|*

[Apple Devices *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa
FileKey1=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\LocalCache\Local\Logs|*
FileKey3=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\LocalCache\Roaming\Apple Computer\Logs|*
FileKey4=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\LocalState\Logs|*
FileKey5=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\Settings|*.log*
FileKey6=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\TempState|*|REMOVESELF

[Apple iCloud *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa
FileKey1=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\LocalCache\Local\iCloudPhotoLibrary\ThumbsHigh|*|RECURSE
FileKey3=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\LocalCache\Local\Logs|*|RECURSE
FileKey4=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\LocalCache\Roaming\Apple Computer\MediaStream\Thumbnails|*
FileKey5=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\Settings|*.log*
FileKey6=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\TempState|*|REMOVESELF

[Apple iTunes *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa
FileKey1=%AppData%\Apple Computer\iTunes|*.ipcc;*.ipsw;*.log
FileKey2=%AppData%\Apple Computer\iTunes\Cookies|Cookies.binarycookies
FileKey3=%AppData%\Apple Computer\Logs*|*|RECURSE
FileKey4=%LocalAppData%\Apple Computer\iTunes|Cache.db
FileKey5=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\AC|*|RECURSE
FileKey6=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\LocalCache\Local\Apple Computer\iTunes|*.xml;Cache.db
FileKey7=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\LocalCache\Local\Microsoft\Windows\Caches|*|RECURSE
FileKey8=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE
FileKey9=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\LocalCache\Roaming\Apple Computer\iTunes\Cookies|Cookies.binarycookies
FileKey10=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\LocalCache\Roaming\Apple Computer\Logs|*|RECURSE
FileKey11=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\Settings|*.log*
FileKey12=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium|*.log*
FileKey13=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\Cache|*|RECURSE
FileKey14=%LocalAppData%\Packages\AppleInc.iTunes_nzyj5cx40ttqa\TempState|*|REMOVESELF
FileKey15=%ProgramData%\Apple Computer\iTunes\iPhone Temporary Files|*|RECURSE
FileKey16=%UserProfile%\Desktop\iTunes Crash Logs|*.dmp
FileKey17=%UserProfile%\Music\iTunes|*.tmp|RECURSE
FileKey18=%UserProfile%\Music\iTunes\Album Artwork\Cache|*|RECURSE
FileKey19=%WinDir%\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*|RECURSE
FileKey20=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*|RECURSE

[Apple Music *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa
FileKey1=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\LocalCache\Local\Apple Computer|*
FileKey3=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\LocalCache\Local\Apple\AMPLibraryAgent\*\artwork|*
FileKey4=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\LocalCache\Local\Logs|*
FileKey5=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\LocalCache\Roaming\Apple Computer\Logs|*
FileKey6=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\LocalCache\Roaming\Apple\AMPLibraryAgent\com.apple.AMPLibraryAgent\iTunes Migration|*
FileKey7=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\LocalState\Logs|*
FileKey8=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\Settings|*.log*
FileKey9=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\AppleInc.AppleMusicWin_nzyj5cx40ttqa\TempState|*|REMOVESELF

[Apple Software Update *]
LangSecRef=3021
DetectFile=%LocalAppData%\Apple Software Update
FileKey1=%LocalAppData%\Apple Software Update|*.msi
FileKey2=%LocalAppData%\Apple Software Update\DistCache|*|RECURSE

[Apple TV *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa
FileKey1=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalCache\local\Apple\AMPLibraryAgent\*\artwork|*
FileKey3=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalCache\local\Logs|*
FileKey4=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalCache\Logs|*
FileKey5=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalCache\Roaming\Apple Computer\Logs|*
FileKey6=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalCache\Roaming\Apple\AMPLibraryAgent\com.apple.AMPLibraryAgent\iTunes Migration|*
FileKey7=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalState\Apple\CS\AppleTV|*.HDS
FileKey8=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\LocalState\Logs|*
FileKey9=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\Settings|*.log*
FileKey10=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\SystemAppData\Helium|*.log*
FileKey11=%LocalAppData%\Packages\AppleInc.AppleTVWin_nzyj5cx40ttqa\TempState|*|REMOVESELF

[Arasan Chess *]
Section=Games
Detect=HKCU\Software\Arasan\Arasan
RegKey1=HKCU\Software\Arasan\Arasan\Recent File List

[Arc Autofill Data & Search Engine Preferences *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|*Web Data
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\AutoFill*|*|REMOVESELF

[Arc Autoplay Preferences *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\MEIPreload|*|REMOVESELF

[Arc Bookmark Backups *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|Bookmarks.bak

[Arc Bookmark Favicons *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|favicons*

[Arc Caches *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\*cache|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data|*-journal|RECURSE
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data|Module Info Cache
FileKey4=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey5=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\blob_storage|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Download Service|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\File System|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\GCM Store|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\optimization*|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Platform Notifications|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Service Worker|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*Cache*|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Avatars|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Optimization*|*|REMOVESELF

[Arc Default App Handlers *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|PreferredApps

[Arc Download History *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\shared_proto_db|*|REMOVESELF

[Arc DRM Data *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\WidevineCdm|*|REMOVESELF

[Arc Extension Cookies *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|Extension Cookies

[Arc Privacy Sandbox *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Arc Progressive Web Apps *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Web Applications|*|REMOVESELF

[Arc Saved Usernames & Passwords *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|Login Data*

[Arc Security & Threat Detection *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|DIPS*
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\ZxcvbnData|*|REMOVESELF

[Arc Shopping Insights *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\parcel_tracking_db|*|REMOVESELF

[Arc Storage Quota Manager *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|QuotaManager

[Arc Sync Data *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Sync Data|*|REMOVESELF

[Arc Telemetry *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\Application|debug.log
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|*.log
FileKey6=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\Application|debug.log
FileKey21=%ProgramFiles%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\Application\SetupMetrics|*|REMOVESELF

[Arc Web Browsing Cookies *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Network|Cookies*;Device Bound Sessions*

[Arc Web Browsing History *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Arc Web Browsing Session *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Sessions|*|REMOVESELF

[Arc Web Storage *]
LangSecRef=3039
DetectFile=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data
FileKey1=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\WebStorage|*|REMOVESELF

[Arcane Worlds *]
Section=Games
DetectFile=%AppData%\ArcaneWorlds
FileKey1=%AppData%\ArcaneWorlds|log.txt

[ArcGIS ArcMap *]
LangSecRef=3021
Detect1=HKCU\Software\ESRI\ArcMap
Detect2=HKCU\Software\ESRI\Desktop10.0\ArcMap
Detect3=HKCU\Software\ESRI\Desktop10.1\ArcMap
RegKey1=HKCU\Software\ESRI\ArcMap\Recent File List
RegKey2=HKCU\Software\ESRI\Desktop10.0\ArcMap\Recent File List
RegKey3=HKCU\Software\ESRI\Desktop10.1\ArcMap\Recent File List

[Arduino LLC Arduino IDE *]
LangSecRef=3021
DetectFile1=%AppData%\Arduino IDE
DetectFile2=%LocalAppData%\Packages\ArduinoLLC.ArduinoIDE_mdqgnx93n4wtt
FileKey1=%AppData%\Arduino IDE|*.log
FileKey2=%AppData%\arduino-ide\*cache*|*|RECURSE
FileKey3=%LocalAppData%\Packages\ArduinoLLC.ArduinoIDE_mdqgnx93n4wtt\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\ArduinoLLC.ArduinoIDE_mdqgnx93n4wtt\Settings|*.log*
FileKey5=%LocalAppData%\Packages\ArduinoLLC.ArduinoIDE_mdqgnx93n4wtt\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\ArduinoLLC.ArduinoIDE_mdqgnx93n4wtt\TempState|*|REMOVESELF

[Ares *]
LangSecRef=3022
Detect=HKCU\Software\Ares
FileKey1=%LocalAppData%\Ares\Temp|*temp.txt
RegKey1=HKCU\Software\Ares|GUI.LastChatRoomBrowse
RegKey2=HKCU\Software\Ares|GUI.LastSearch

[Argus Monitor *]
LangSecRef=3024
Detect=HKCU\Software\Argotronic\Argus Monitor
FileKey1=%ProgramFiles%|ArgusMonitor_*Log.*
FileKey2=%UserProfile%\Documents|ArgusMonitor_*Log.*

[Artifex GSview *]
LangSecRef=3021
Detect=HKCU\Software\Artifex Software\gsview 6.0
RegKey1=HKCU\Software\Artifex Software\gsview 6.0|File
RegKey2=HKCU\Software\Artifex Software\gsview 6.0|Page
RegKey3=HKCU\Software\Artifex Software\gsview 6.0\Files

[Artipic *]
LangSecRef=3023
DetectFile=%LocalAppData%\Artipic AB\Artipic
FileKey1=%LocalAppData%\Artipic AB\Artipic\log|*

[ArtisBrowser Autocomplete History *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|formhistory*

[ArtisBrowser Autofill Data *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|autofill-profiles.json

[ArtisBrowser Bookmark Backups *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\bookmarkbackups|*

[ArtisBrowser Bookmark Favicons *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|favicons*

[ArtisBrowser Caches *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\notificationstore|*
FileKey4=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\security_state|*
FileKey5=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\shader-cache|*
FileKey6=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\ArtistScope\ArtisBrowser\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\ArtistScope\ArtisBrowser\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\ArtistScope\ArtisBrowser\Profiles\*\thumbnails|*|REMOVESELF

[ArtisBrowser Privacy Sandbox *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|credentialstate.sqlite

[ArtisBrowser Saved Usernames & Passwords *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|key4.db;logins.json

[ArtisBrowser Synced Tabs *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|synced-tabs.db*

[ArtisBrowser Telemetry *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser|*.log|RECURSE
FileKey2=%AppData%\ArtistScope\ArtisBrowser\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\crashes|*
FileKey5=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\minidumps|*
FileKey7=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\weave\logs|*

[ArtisBrowser Web Browsing Cookies *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|cookies*

[ArtisBrowser Web Browsing Session *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|session*.json*

[ArtisBrowser Web Browsing Session Backups *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\sessionstore-backups|*

[ArtisBrowser Web Storage *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\storage\default\http*|*|REMOVESELF

[ArtisBrowser Website Permissions *]
Section=ArtistScope ArtisBrowser
DetectFile=%AppData%\ArtistScope\ArtisBrowser\Profiles
FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|content-prefs.sqlite;permissions.sqlite

[ASAP Utilities *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\ASAP Utilities
RegKey1=HKCU\Software\VB and VBA Program Settings\ASAP Utilities\TimeSavers

[ASCOMP Cleaning Suite *]
LangSecRef=3024
Detect=HKCU\Software\ASCOMP\Cleaning Suite
DetectFile=%AppData%\ASCOMP Software\Cleaning Suite
FileKey1=%AppData%\ASCOMP Software\Cleaning Suite|*.log
FileKey2=%AppData%\ASCOMP Software\Cleaning Suite\Restore|*|RECURSE
RegKey1=HKCU\Software\ASCOMP\Cleaning Suite|ClientID

[Ashampoo 3D CAD *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\Ashampoo 3D CAD *
FileKey1=%UserProfile%\Documents\Ashampoo 3D CAD *|*.log

[Ashampoo Action Click *]
LangSecRef=3024
DetectFile=%LocalAppData%\Action Click
FileKey1=%LocalAppData%\Action Click\Logs|*|RECURSE
FileKey2=%LocalAppData%\ActionClick.WebView2\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey3=%LocalAppData%\ActionClick.WebView2\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\ActionClick.WebView2\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\ActionClick.WebView2\EBWebView\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\ActionClick.WebView2\EBWebView\AutoFill*|*|REMOVESELF
FileKey7=%LocalAppData%\ActionClick.WebView2\EBWebView\Avatars|*|REMOVESELF
FileKey8=%LocalAppData%\ActionClick.WebView2\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey9=%LocalAppData%\ActionClick.WebView2\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey10=%LocalAppData%\ActionClick.WebView2\EBWebView\Crash Reports|*|REMOVESELF
FileKey11=%LocalAppData%\ActionClick.WebView2\EBWebView\Crashpad|*|REMOVESELF
FileKey12=%LocalAppData%\ActionClick.WebView2\EBWebView\Crowd Deny|*|REMOVESELF
FileKey13=%LocalAppData%\ActionClick.WebView2\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey15=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey16=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey17=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey20=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey22=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey23=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey24=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Download Service|*|REMOVESELF
FileKey25=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Extension State|*|REMOVESELF
FileKey26=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\File System|*|REMOVESELF
FileKey28=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey31=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey32=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\optimization*|*|REMOVESELF
FileKey33=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey34=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey35=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey37=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey38=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Sessions|*|REMOVESELF
FileKey39=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey40=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey41=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey42=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey43=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey44=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey45=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey46=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey47=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey48=%LocalAppData%\ActionClick.WebView2\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey49=%LocalAppData%\ActionClick.WebView2\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey50=%LocalAppData%\ActionClick.WebView2\EBWebView\Local Traces|*|REMOVESELF
FileKey51=%LocalAppData%\ActionClick.WebView2\EBWebView\MEIPreload|*|REMOVESELF
FileKey52=%LocalAppData%\ActionClick.WebView2\EBWebView\Optimization*|*|REMOVESELF
FileKey53=%LocalAppData%\ActionClick.WebView2\EBWebView\OriginTrials|*|REMOVESELF
FileKey54=%LocalAppData%\ActionClick.WebView2\EBWebView\PKIMetadata|*|REMOVESELF
FileKey55=%LocalAppData%\ActionClick.WebView2\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey56=%LocalAppData%\ActionClick.WebView2\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey57=%LocalAppData%\ActionClick.WebView2\EBWebView\Safe Browsing|*|REMOVESELF
FileKey58=%LocalAppData%\ActionClick.WebView2\EBWebView\SafetyTips|*|REMOVESELF
FileKey59=%LocalAppData%\ActionClick.WebView2\EBWebView\SmartScreen|*|REMOVESELF
FileKey60=%LocalAppData%\ActionClick.WebView2\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey61=%LocalAppData%\ActionClick.WebView2\EBWebView\Stability|*|REMOVESELF
FileKey62=%LocalAppData%\ActionClick.WebView2\EBWebView\Subresource Filter|*|REMOVESELF
FileKey63=%LocalAppData%\ActionClick.WebView2\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey64=%LocalAppData%\ActionClick.WebView2\EBWebView\WidevineCdm|*|REMOVESELF
FileKey65=%LocalAppData%\ActionClick.WebView2\EBWebView\ZxcvbnData|*|REMOVESELF

[Ashampoo ActionCam *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo ActionCam
FileKey1=%UserProfile%\Documents|Ashampoo ActionCam.tmp

[Ashampoo AI Filter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\AI Filter #*
FileKey1=%UserProfile%\AI 1 *|*.log

[Ashampoo ANALOG *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\ANALOG #*
FileKey1=%UserProfile%\Analog *|*.log

[Ashampoo App *]
LangSecRef=3024
DetectFile=%LocalAppData%\Ashampoo\Ashampoo App
FileKey1=%LocalAppData%\Ashampoo\Ashampoo App\libraryItems|*|RECURSE
FileKey2=%LocalAppData%\Ashampoo\Ashampoo App\logs|*
FileKey3=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey4=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey6=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\*Cache*|*|REMOVESELF
FileKey7=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\AutoFill*|*|REMOVESELF
FileKey8=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Avatars|*|REMOVESELF
FileKey9=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey10=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey11=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Crashpad|*|REMOVESELF
FileKey13=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Crowd Deny|*|REMOVESELF
FileKey14=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey15=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey17=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey18=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey19=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey20=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey21=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey22=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey23=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey24=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey25=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Download Service|*|REMOVESELF
FileKey26=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Extension State|*|REMOVESELF
FileKey27=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey28=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\File System|*|REMOVESELF
FileKey29=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey30=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey32=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey33=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\optimization*|*|REMOVESELF
FileKey34=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey35=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey36=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey37=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey38=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey39=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Sessions|*|REMOVESELF
FileKey40=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey41=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey42=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey43=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey44=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey45=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey46=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey47=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey48=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey49=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey50=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey51=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Local Traces|*|REMOVESELF
FileKey52=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\MEIPreload|*|REMOVESELF
FileKey53=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Optimization*|*|REMOVESELF
FileKey54=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\OriginTrials|*|REMOVESELF
FileKey55=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\PKIMetadata|*|REMOVESELF
FileKey56=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey57=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey58=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Safe Browsing|*|REMOVESELF
FileKey59=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\SafetyTips|*|REMOVESELF
FileKey60=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\SmartScreen|*|REMOVESELF
FileKey61=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey62=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Stability|*|REMOVESELF
FileKey63=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\Subresource Filter|*|REMOVESELF
FileKey64=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey65=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\WidevineCdm|*|REMOVESELF
FileKey66=%LocalAppData%\Ashampoo\Ashampoo App\webview\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey67=%LocalAppData%\Ashampoo\boxshots|*.png
FileKey68=%ProgramData%\Ashampoo|ico_ashampoo_deals.ico

[Ashampoo Backup *]
LangSecRef=3024
DetectFile=%LocalAppData%\Ashampoo Backup PB*
FileKey1=%LocalAppData%\Ashampoo Backup PB*|log*

[Ashampoo BLACK & WHITE *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\BLACK & WHITE #*
FileKey1=%UserProfile%\BlackWhite *|*.log

[Ashampoo Burning Studio *]
LangSecRef=3024
Detect1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5
Detect2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6
Detect3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7
Detect4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8
Detect5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12
Detect6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14
Detect7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15
Detect8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16
Detect9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18
Detect10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19
Detect11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20
Detect12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21
Detect13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22
Detect14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23
Detect15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24
Detect16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25
Detect17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26
Detect18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007
Detect19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009
Detect20=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012
Detect21=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016
Detect22=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017
Detect23=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018
Detect24=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019
Detect25=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024
Detect26=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025
Detect27=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026
FileKey1=%ProgramData%\Ashampoo\drivers|driverdatabase.xml|REMOVESELF
RegKey1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Burn Image Project\AddDialog
RegKey2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Burn Image Project\SelectImage
RegKey3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\AddDialog
RegKey4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\DumpImage
RegKey5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Unknown Project\AddDialog
RegKey6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Burn Image Project\AddDialog
RegKey7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Burn Image Project\SelectImage
RegKey8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Data Disc Project\AddDialog
RegKey9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Data Disc Project\DumpImage
RegKey10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Unknown Project\AddDialog
RegKey11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Burn Image Project\AddDialog
RegKey12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Burn Image Project\SelectImage
RegKey13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Data Disc Project\AddDialog
RegKey14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Data Disc Project\DumpImage
RegKey15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Unknown Project\AddDialog
RegKey16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Burn Image Project\AddDialog
RegKey17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Burn Image Project\SelectImage
RegKey18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Data Disc Project\AddDialog
RegKey19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Data Disc Project\DumpImage
RegKey20=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Unknown Project\AddDialog
RegKey21=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey22=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Backup Project\BackupOptions|CustomLocation
RegKey23=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey24=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Browse Image Project\BrowseImageFile|ImagePath
RegKey25=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey26=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey27=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Burn Image Project\SelectImage|ImagePath
RegKey28=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Data Disc Project\DumpImage|ImagePath
RegKey29=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey30=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\DVD-Video Disc Project\MoviesPage|Path
RegKey31=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey32=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Logs
RegKey33=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\tempFiles
RegKey34=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\Unknown Project
RegKey35=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey36=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey37=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey38=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey39=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Backup Project\BackupOptions|CustomLocation
RegKey40=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey41=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Browse Image Project\BrowseImageFile|ImagePath
RegKey42=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey43=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey44=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Burn Image Project\SelectImage|ImagePath
RegKey45=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Data Disc Project\DumpImage|ImagePath
RegKey46=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey47=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\DVD-Video Disc Project\MoviesPage|Path
RegKey48=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey49=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Logs
RegKey50=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\tempFiles
RegKey51=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Unknown Project
RegKey52=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey53=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey54=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey55=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey56=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Backup Project\BackupOptions|CustomLocation
RegKey57=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey58=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Browse Image Project\BrowseImageFile|ImagePath
RegKey59=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey60=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey61=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Burn Image Project\SelectImage|ImagePath
RegKey62=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Data Disc Project\DumpImage|ImagePath
RegKey63=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey64=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\DVD-Video Disc Project\MoviesPage|Path
RegKey65=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey66=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Logs
RegKey67=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\tempFiles
RegKey68=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Unknown Project
RegKey69=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey70=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey71=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey72=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey73=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Backup Project\BackupOptions|CustomLocation
RegKey74=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey75=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\BrowseImageFile|ImagePath
RegKey76=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey77=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey78=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SelectImage|ImagePath
RegKey79=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\DumpImage|ImagePath
RegKey80=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey81=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\MoviesPage|Path
RegKey82=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey83=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Logs
RegKey84=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\tempFiles
RegKey85=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Unknown Project
RegKey86=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey87=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey88=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey89=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey90=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Backup Project\BackupOptions|CustomLocation
RegKey91=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey92=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\BrowseImageFile|ImagePath
RegKey93=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey94=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey95=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SelectImage|ImagePath
RegKey96=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\DumpImage|ImagePath
RegKey97=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey98=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\MoviesPage|Path
RegKey99=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey100=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Logs
RegKey101=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\tempFiles
RegKey102=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Unknown Project
RegKey103=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey104=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey105=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey106=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey107=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Backup Project\BackupOptions|CustomLocation
RegKey108=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey109=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\BrowseImageFile|ImagePath
RegKey110=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey111=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey112=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SelectImage|ImagePath
RegKey113=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\DumpImage|ImagePath
RegKey114=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey115=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\MoviesPage|Path
RegKey116=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey117=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Logs
RegKey118=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\tempFiles
RegKey119=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Unknown Project
RegKey120=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey121=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey122=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey123=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey124=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Backup Project\BackupOptions|CustomLocation
RegKey125=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey126=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Browse Image Project\BrowseImageFile|ImagePath
RegKey127=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey128=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey129=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Burn Image Project\SelectImage|ImagePath
RegKey130=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Data Disc Project\DumpImage|ImagePath
RegKey131=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey132=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\DVD-Video Disc Project\MoviesPage|Path
RegKey133=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey134=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Logs
RegKey135=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\tempFiles
RegKey136=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Unknown Project
RegKey137=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey138=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey139=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey140=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey141=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Backup Project\BackupOptions|CustomLocation
RegKey142=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey143=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Browse Image Project\BrowseImageFile|ImagePath
RegKey144=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey145=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey146=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Burn Image Project\SelectImage|ImagePath
RegKey147=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Data Disc Project\DumpImage|ImagePath
RegKey148=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey149=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\DVD-Video Disc Project\MoviesPage|Path
RegKey150=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey151=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Logs
RegKey152=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\tempFiles
RegKey153=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\Unknown Project
RegKey154=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey155=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey156=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey157=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey158=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Backup Project\BackupOptions|CustomLocation
RegKey159=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey160=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Browse Image Project\BrowseImageFile|ImagePath
RegKey161=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey162=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey163=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Burn Image Project\SelectImage|ImagePath
RegKey164=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Data Disc Project\DumpImage|ImagePath
RegKey165=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey166=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\DVD-Video Disc Project\MoviesPage|Path
RegKey167=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey168=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Logs
RegKey169=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\tempFiles
RegKey170=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Unknown Project
RegKey171=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey172=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey173=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey174=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey175=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Backup Project\BackupOptions|CustomLocation
RegKey176=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey177=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Browse Image Project\BrowseImageFile|ImagePath
RegKey178=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey179=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey180=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Burn Image Project\SelectImage|ImagePath
RegKey181=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Data Disc Project\DumpImage|ImagePath
RegKey182=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey183=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\DVD-Video Disc Project\MoviesPage|Path
RegKey184=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey185=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Logs
RegKey186=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\tempFiles
RegKey187=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Unknown Project
RegKey188=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey189=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey190=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey191=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey192=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Backup Project\BackupOptions|CustomLocation
RegKey193=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey194=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Browse Image Project\BrowseImageFile|ImagePath
RegKey195=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey196=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey197=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Burn Image Project\SelectImage|ImagePath
RegKey198=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Data Disc Project\DumpImage|ImagePath
RegKey199=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey200=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\DVD-Video Disc Project\MoviesPage|Path
RegKey201=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey202=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Logs
RegKey203=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\tempFiles
RegKey204=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Unknown Project
RegKey205=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey206=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey207=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey208=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey209=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Backup Project\BackupOptions|CustomLocation
RegKey210=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey211=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Browse Image Project\BrowseImageFile|ImagePath
RegKey212=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey213=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey214=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Burn Image Project\SelectImage|ImagePath
RegKey215=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Data Disc Project\DumpImage|ImagePath
RegKey216=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey217=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\DVD-Video Disc Project\MoviesPage|Path
RegKey218=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey219=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Logs
RegKey220=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\tempFiles
RegKey221=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\Unknown Project
RegKey222=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey223=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey224=HKCU\Software\Ashampoo\Ashampoo Burning Studio 25\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey225=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey226=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Backup Project\BackupOptions|CustomLocation
RegKey227=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey228=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Browse Image Project\BrowseImageFile|ImagePath
RegKey229=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey230=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey231=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Burn Image Project\SelectImage|ImagePath
RegKey232=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Data Disc Project\DumpImage|ImagePath
RegKey233=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey234=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\DVD-Video Disc Project\MoviesPage|Path
RegKey235=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey236=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Logs
RegKey237=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\tempFiles
RegKey238=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\Unknown Project
RegKey239=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey240=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey241=HKCU\Software\Ashampoo\Ashampoo Burning Studio 26\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey242=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Burn Image Project\AddDialog
RegKey243=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Burn Image Project\SelectImage
RegKey244=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Data Disc Project\AddDialog
RegKey245=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Data Disc Project\DumpImage
RegKey246=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Dump Image Project\DumpImage
RegKey247=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Unknown Project\AddDialog
RegKey248=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey249=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Backup Project\BackupOptions|CustomLocation
RegKey250=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey251=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Browse Image Project\BrowseImageFile|ImagePath
RegKey252=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey253=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey254=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Burn Image Project\SelectImage|ImagePath
RegKey255=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Data Disc Project\DumpImage|ImagePath
RegKey256=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey257=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\DVD-Video Disc Project\MoviesPage|Path
RegKey258=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey259=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Logs
RegKey260=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\tempFiles
RegKey261=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\Unknown Project
RegKey262=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey263=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey264=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey265=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey266=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Backup Project\BackupOptions|CustomLocation
RegKey267=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey268=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Browse Image Project\BrowseImageFile|ImagePath
RegKey269=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey270=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey271=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Burn Image Project\SelectImage|ImagePath
RegKey272=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Data Disc Project\DumpImage|ImagePath
RegKey273=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey274=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\DVD-Video Disc Project\MoviesPage|Path
RegKey275=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey276=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Logs
RegKey277=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\tempFiles
RegKey278=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Unknown Project
RegKey279=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey280=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey281=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey282=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey283=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Backup Project\BackupOptions|CustomLocation
RegKey284=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey285=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\BrowseImageFile|ImagePath
RegKey286=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey287=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey288=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SelectImage|ImagePath
RegKey289=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\DumpImage|ImagePath
RegKey290=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey291=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\DVD-Video Disc Project\MoviesPage|Path
RegKey292=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey293=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Logs
RegKey294=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\tempFiles
RegKey295=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Unknown Project
RegKey296=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey297=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey298=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey299=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey300=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Backup Project\BackupOptions|CustomLocation
RegKey301=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey302=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\BrowseImageFile|ImagePath
RegKey303=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey304=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey305=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SelectImage|ImagePath
RegKey306=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\DumpImage|ImagePath
RegKey307=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey308=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\DVD-Video Disc Project\MoviesPage|Path
RegKey309=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey310=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Logs
RegKey311=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\tempFiles
RegKey312=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Unknown Project
RegKey313=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey314=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey315=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey316=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey317=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Backup Project\BackupOptions|CustomLocation
RegKey318=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey319=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Browse Image Project\BrowseImageFile|ImagePath
RegKey320=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey321=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey322=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Burn Image Project\SelectImage|ImagePath
RegKey323=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Data Disc Project\DumpImage|ImagePath
RegKey324=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey325=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\DVD-Video Disc Project\MoviesPage|Path
RegKey326=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey327=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Logs
RegKey328=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\tempFiles
RegKey329=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Unknown Project
RegKey330=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey331=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey332=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey333=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey334=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Backup Project\BackupOptions|CustomLocation
RegKey335=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey336=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Browse Image Project\BrowseImageFile|ImagePath
RegKey337=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey338=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey339=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Burn Image Project\SelectImage|ImagePath
RegKey340=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Data Disc Project\DumpImage|ImagePath
RegKey341=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey342=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\DVD-Video Disc Project\MoviesPage|Path
RegKey343=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey344=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Logs
RegKey345=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\tempFiles
RegKey346=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Unknown Project
RegKey347=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey348=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey349=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey350=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey351=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Backup Project\BackupOptions|CustomLocation
RegKey352=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey353=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Browse Image Project\BrowseImageFile|ImagePath
RegKey354=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey355=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey356=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Burn Image Project\SelectImage|ImagePath
RegKey357=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Data Disc Project\DumpImage|ImagePath
RegKey358=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey359=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\DVD-Video Disc Project\MoviesPage|Path
RegKey360=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey361=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Logs
RegKey362=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\tempFiles
RegKey363=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\Unknown Project
RegKey364=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey365=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey366=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2024\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey367=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey368=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Backup Project\BackupOptions|CustomLocation
RegKey369=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey370=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Browse Image Project\BrowseImageFile|ImagePath
RegKey371=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey372=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey373=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Burn Image Project\SelectImage|ImagePath
RegKey374=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Data Disc Project\DumpImage|ImagePath
RegKey375=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey376=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\DVD-Video Disc Project\MoviesPage|Path
RegKey377=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey378=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Logs
RegKey379=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\tempFiles
RegKey380=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\Unknown Project
RegKey381=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey382=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey383=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2025\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey384=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey385=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Backup Project\BackupOptions|CustomLocation
RegKey386=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey387=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Browse Image Project\BrowseImageFile|ImagePath
RegKey388=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey389=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey390=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Burn Image Project\SelectImage|ImagePath
RegKey391=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Data Disc Project\DumpImage|ImagePath
RegKey392=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey393=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\DVD-Video Disc Project\MoviesPage|Path
RegKey394=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey395=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Logs
RegKey396=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\tempFiles
RegKey397=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\Unknown Project
RegKey398=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey399=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey400=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2026\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey401=HKCU\Software\Ashampoo\common\Ashampoo Burning Studio\Recent Projects

[Ashampoo Cinemagraph *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Cinemagraph
FileKey1=%AppData%\Ashampoo\Ashampoo Cinemagraph|*log*.txt
FileKey2=%UserProfile%\Documents|Ashampoo Cinemagraph.tmp

[Ashampoo COLOR *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\COLOR #*
FileKey1=%UserProfile%\Color *|*.log

[Ashampoo DENOISE *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\DENOISE #*
FileKey1=%UserProfile%\DeNoise *|*.log

[Ashampoo Driver Updater *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Driver Updater
FileKey1=%AppData%\Ashampoo\Ashampoo Driver Updater|errorlog.txt

[Ashampoo FOCUS *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\FOCUS #*
FileKey1=%UserProfile%\Focus *|*.log

[Ashampoo Foto 3D *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\Foto3D #*
FileKey1=%UserProfile%\Foto3D *|*.log

[Ashampoo HDR *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\HDR #*
FileKey1=%UserProfile%\HDR *|*.log

[Ashampoo Money *]
LangSecRef=3024
DetectFile=%LocalAppData%\com.ashampoo.money
FileKey1=%LocalAppData%\com.ashampoo.money\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey2=%LocalAppData%\com.ashampoo.money\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey3=%LocalAppData%\com.ashampoo.money\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey4=%LocalAppData%\com.ashampoo.money\EBWebView\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\com.ashampoo.money\EBWebView\AutoFill*|*|REMOVESELF
FileKey6=%LocalAppData%\com.ashampoo.money\EBWebView\Avatars|*|REMOVESELF
FileKey7=%LocalAppData%\com.ashampoo.money\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey8=%LocalAppData%\com.ashampoo.money\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey9=%LocalAppData%\com.ashampoo.money\EBWebView\Crash Reports|*|REMOVESELF
FileKey10=%LocalAppData%\com.ashampoo.money\EBWebView\Crashpad|*|REMOVESELF
FileKey11=%LocalAppData%\com.ashampoo.money\EBWebView\Crowd Deny|*|REMOVESELF
FileKey12=%LocalAppData%\com.ashampoo.money\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey13=%LocalAppData%\com.ashampoo.money\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey14=%LocalAppData%\com.ashampoo.money\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey15=%LocalAppData%\com.ashampoo.money\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey16=%LocalAppData%\com.ashampoo.money\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey17=%LocalAppData%\com.ashampoo.money\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey18=%LocalAppData%\com.ashampoo.money\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey19=%LocalAppData%\com.ashampoo.money\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey20=%LocalAppData%\com.ashampoo.money\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey21=%LocalAppData%\com.ashampoo.money\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey22=%LocalAppData%\com.ashampoo.money\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey23=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Download Service|*|REMOVESELF
FileKey24=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Extension State|*|REMOVESELF
FileKey25=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey26=%LocalAppData%\com.ashampoo.money\EBWebView\Default\File System|*|REMOVESELF
FileKey27=%LocalAppData%\com.ashampoo.money\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey28=%LocalAppData%\com.ashampoo.money\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey29=%LocalAppData%\com.ashampoo.money\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey30=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey31=%LocalAppData%\com.ashampoo.money\EBWebView\Default\optimization*|*|REMOVESELF
FileKey32=%LocalAppData%\com.ashampoo.money\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey33=%LocalAppData%\com.ashampoo.money\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey34=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey35=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey36=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey37=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Sessions|*|REMOVESELF
FileKey38=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey39=%LocalAppData%\com.ashampoo.money\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey40=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey41=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey42=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey43=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey44=%LocalAppData%\com.ashampoo.money\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey45=%LocalAppData%\com.ashampoo.money\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey46=%LocalAppData%\com.ashampoo.money\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey47=%LocalAppData%\com.ashampoo.money\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey48=%LocalAppData%\com.ashampoo.money\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey49=%LocalAppData%\com.ashampoo.money\EBWebView\Local Traces|*|REMOVESELF
FileKey50=%LocalAppData%\com.ashampoo.money\EBWebView\MEIPreload|*|REMOVESELF
FileKey51=%LocalAppData%\com.ashampoo.money\EBWebView\Optimization*|*|REMOVESELF
FileKey52=%LocalAppData%\com.ashampoo.money\EBWebView\OriginTrials|*|REMOVESELF
FileKey53=%LocalAppData%\com.ashampoo.money\EBWebView\PKIMetadata|*|REMOVESELF
FileKey54=%LocalAppData%\com.ashampoo.money\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey55=%LocalAppData%\com.ashampoo.money\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey56=%LocalAppData%\com.ashampoo.money\EBWebView\Safe Browsing|*|REMOVESELF
FileKey57=%LocalAppData%\com.ashampoo.money\EBWebView\SafetyTips|*|REMOVESELF
FileKey58=%LocalAppData%\com.ashampoo.money\EBWebView\SmartScreen|*|REMOVESELF
FileKey59=%LocalAppData%\com.ashampoo.money\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey60=%LocalAppData%\com.ashampoo.money\EBWebView\Stability|*|REMOVESELF
FileKey61=%LocalAppData%\com.ashampoo.money\EBWebView\Subresource Filter|*|REMOVESELF
FileKey62=%LocalAppData%\com.ashampoo.money\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey63=%LocalAppData%\com.ashampoo.money\EBWebView\WidevineCdm|*|REMOVESELF
FileKey64=%LocalAppData%\com.ashampoo.money\EBWebView\ZxcvbnData|*|REMOVESELF

[Ashampoo Movie Studio *]
LangSecRef=3024
DetectFile=%LocalAppData%\Ashampoo Movie Studio *
FileKey1=%LocalAppData%\Ashampoo Movie Studio *\cache|*|RECURSE

[Ashampoo NEAT *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\NEAT #*
FileKey1=%UserProfile%\Neat *|*.log

[Ashampoo PDF *]
LangSecRef=3024
Detect1=HKCU\Software\Ashampoo\Ashampoo PDF
Detect2=HKCU\Software\Ashampoo\Ashampoo PDF Pro 2
FileKey1=%LocalAppData%\Ashampoo PDF\*|fontcache;lastFileOpenned.txt
RegKey1=HKCU\Software\Ashampoo\Ashampoo PDF\Find Replace
RegKey2=HKCU\Software\Ashampoo\Ashampoo PDF\Recent File List

[Ashampoo Photo Organizer *]
LangSecRef=3024
DetectFile=%LocalAppData%\Ashampoo Photo Organizer
FileKey1=%LocalAppData%\Ashampoo Photo Organizer\analytics|*
FileKey2=%LocalAppData%\Ashampoo Photo Organizer\crashlogs|*|RECURSE

[Ashampoo PhotoCommander *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Photo Commander *
FileKey1=%AppData%\Ashampoo\Ashampoo Photo Commander *|*.log
FileKey2=%AppData%\Ashampoo\Ashampoo Photo Commander *\Cache|*
RegKey1=HKCU\Software\Ashampoo\Ashampoo Photo Commander 19|LastOpenDir
RegKey2=HKCU\Software\Ashampoo\Ashampoo Photo Commander 19|LastSaveDir
RegKey3=HKCU\Software\Ashampoo\Ashampoo Photo Commander Free|LastOpenDir
RegKey4=HKCU\Software\Ashampoo\Ashampoo Photo Commander Free|LastSaveDir

[Ashampoo Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo Registry Cleaner*
FileKey1=%ProgramFiles%\Ashampoo\Ashampoo Registry Cleaner*\Backups|*

[Ashampoo SHARPEN *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\SHARPEN #*
FileKey1=%UserProfile%\Sharpen *|*.log
FileKey2=%UserProfile%\SharpenVideo *|*.log

[Ashampoo Snap *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo Snap*
FileKey1=%ProgramFiles%\Ashampoo\Ashampoo Snap*|_NLogMsg.txt

[Ashampoo Snap AutoSaves *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo Snap*
FileKey1=%UserProfile%\Pictures\Ashampoo Snap*\_SNAPDOC|*|RECURSE

[Ashampoo SoundStage *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo Soundstage
FileKey1=%AppData%\Ashampoo Soundstage\logs|*

[Ashampoo Video Converter *]
LangSecRef=3024
DetectFile=%LocalAppData%\Ashampoo Video Converter
FileKey1=%LocalAppData%\Ashampoo Video Converter\cache|*|RECURSE

[Ashampoo Video Deflicker *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Video Deflicker
FileKey1=%AppData%\Ashampoo\Ashampoo Video Deflicker|*log*.txt
FileKey2=%UserProfile%\Documents|Ashampoo Video Deflicker.tmp

[Ashampoo Video Filters and Exposure *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Video Filters and Exposure
FileKey1=%AppData%\Ashampoo\Ashampoo Video Filters and Exposure|*log*.txt
FileKey2=%UserProfile%\Documents|Ashampoo Video Filters and Exposure.tmp

[Ashampoo Video Fisheye Removal *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Video Fisheye Removal
FileKey1=%AppData%\Ashampoo\Ashampoo Video Fisheye Removal|*log*.txt
FileKey2=%UserProfile%\Documents|Ashampoo Video Fisheye Removal.tmp

[Ashampoo Video Optimizer Pro *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Video Optimizer Pro
FileKey1=%UserProfile%\Documents|Ashampoo Video Optimizer Pro.tmp

[Ashampoo Video Stabilization *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Video Stabilization
FileKey1=%AppData%\Ashampoo\Ashampoo Video Stabilization|*log*.txt
FileKey2=%UserProfile%\Documents|Ashampoo Video Stabilization.tmp

[Ashampoo Video Tilt-Shift *]
LangSecRef=3024
DetectFile=%AppData%\Ashampoo\Ashampoo Video Tilt-Shift
FileKey1=%AppData%\Ashampoo\Ashampoo Video Tilt-Shift|*log*.txt
FileKey2=%UserProfile%\Documents|Ashampoo Video Tilt-Shift.tmp

[Ashampoo WinOptimizer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo WinOptimizer*
FileKey1=%ProgramFiles%\Ashampoo\Ashampoo WinOptimizer*\Backups|*.ini;*.reg

[Ashampoo Write *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\SoftMaker
FileKey1=%UserProfile%\Documents\SoftMaker|tmlog.txt

[Ashampoo ZOOM *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Ashampoo\Ashampoo App\products\ZOOM #*
FileKey1=%UserProfile%\Documents\Zoom *|*.log

[Ashes of the Singularity *]
Section=Games
DetectFile=%LocalAppData%\Ashes of the Singularity
FileKey1=%LocalAppData%\Ashes of the Singularity\Stardock\Tachyon|*.txt

[Ashley Jones and the Heart of Egypt *]
Section=Games
DetectFile=%ProgramData%\Fenomen Games\Ashley Jones - The Heart Of Egypt
FileKey1=%ProgramData%\Fenomen Games\Ashley Jones - The Heart Of Egypt|*.log

[Asmwsoft PC Optimizer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Asmwsoft PC Optimizer
FileKey1=%ProgramFiles%\Asmwsoft PC Optimizer|eraselog.txt

[Astase PowerBatch *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Astase\PowerBatch
FileKey1=%ProgramFiles%\Astase\PowerBatch|recents.ini

[AstroGrep *]
LangSecRef=3024
DetectFile=%AppData%\AstroGrep
FileKey1=%AppData%\AstroGrep|AstroGrep.general.config
FileKey2=%AppData%\AstroGrep\Log|*.log

[ASUS *]
LangSecRef=3024
Detect=HKLM\Software\ASUS\SmartCore
DetectFile1=%AppData%\ASUS WebStorage
DetectFile2=%LocalAppData%\AcSdkInsLog
DetectFile3=%ProgramData%\ASUS
DetectFile4=%ProgramFiles%\ASUS\AI Suite
FileKey1=%AppData%\*WebStorage\Logs|*
FileKey2=%LocalAppData%\AcLoader|*.log
FileKey3=%LocalAppData%\AcSdkInsLog|*
FileKey4=%ProgramData%\ASUS|*.bak;*.log*;*Log.txt;Thumbs.db|RECURSE
FileKey5=%ProgramData%\ASUS\ARMOURY CRATE Diagnosis\ASUS Update\ACS|*.txt
FileKey6=%ProgramData%\ASUS\ARMOURY CRATE Diagnosis\LightingService|*
FileKey7=%ProgramData%\ASUS\ARMOURY CRATE Diagnosis\ROG Live Service\InstallLog|*|RECURSE
FileKey8=%ProgramData%\ASUS\ASUS System Control Interface\AsusSoftwareManager\AsusLiveUpdate\Log|*_logtrack.txt
FileKey9=%ProgramData%\ASUS\ASUS System Control Interface\AsusSoftwareManager\AsusLiveUpdate\Temp|*
FileKey10=%ProgramData%\ASUS\ASUS System Control Interface\AsusSystemDiagnosis|*.txt
FileKey11=%ProgramData%\ASUS\ASUS System Control Interface\log|*
FileKey12=%ProgramFiles%\ASUS\*|*.log;*.tmp;*log*.txt|RECURSE
FileKey13=%Public%\ASUSFlipLog|*
FileKey14=%SystemDrive%|wifi.log
ExcludeKey1=FILE|%ProgramData%\ASUS\*\|install.log

[ASUS Dial & Control Panel *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\B9ECED6F.ASUSDialASUSControlPanel_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ASUSDialASUSControlPanel_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ASUSDialASUSControlPanel_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ASUSDialASUSControlPanel_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ASUSDialASUSControlPanel_qmba6cd70vzyy\TempState|*|REMOVESELF
FileKey5=%ProgramData%\ASUS\ASUS Dial Control Panel Toolkit\Log|*

[ASUS eSupport *]
LangSecRef=3024
DetectFile=%SystemDrive%\eSupport\eDriver
FileKey1=%SystemDrive%\eSupport\eDriver\Software|*.log;URLLog.dat|RECURSE

[ASUS Expert Site Manager *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\B9ECED6F.ASUSMulti-SiteManager_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ASUSMulti-SiteManager_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ASUSMulti-SiteManager_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ASUSMulti-SiteManager_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ASUSMulti-SiteManager_qmba6cd70vzyy\TempState|*|REMOVESELF

[ASUS ExpertWidget *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\B9ECED6F.ASUSExpertWidget_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ASUSExpertWidget_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ASUSExpertWidget_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ASUSExpertWidget_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ASUSExpertWidget_qmba6cd70vzyy\TempState|*|REMOVESELF

[ASUS GlideX *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\LocalState|aoac_glidexremote.txt
FileKey3=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\LocalState\BulletinCache|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\LocalState\log|*
FileKey5=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\Settings|*.log*
FileKey6=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\B9ECED6F.Glidex_qmba6cd70vzyy\TempState|*|REMOVESELF
FileKey8=%ProgramData%\ASUS\GlideX\log|*

[ASUS Keyboard Hotkeys *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\B9ECED6F.ASUSKeyboardHotkeys_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ASUSKeyboardHotkeys_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ASUSKeyboardHotkeys_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ASUSKeyboardHotkeys_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ASUSKeyboardHotkeys_qmba6cd70vzyy\TempState|*|REMOVESELF

[ASUS ProArt Creator Hub *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy\LocalState\ASUS\ProArt Creator Hub\Bulletin\Cache|*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy\LocalState\log|*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy\Settings|*.log*
FileKey5=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\B9ECED6F.ProArtCreatorCenter_qmba6cd70vzyy\TempState|*|REMOVESELF
FileKey7=%ProgramData%\ASUS\ProArt Creator Hub\log|*

[ASUS Quick Launch *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\B9ECED6F.ASUSQuickLaunch_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ASUSQuickLaunch_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ASUSQuickLaunch_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ASUSQuickLaunch_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ASUSQuickLaunch_qmba6cd70vzyy\TempState|*|REMOVESELF

[ASUS ROG GameVisual *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\B9ECED6F.GameVisual_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.GameVisual_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.GameVisual_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.GameVisual_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.GameVisual_qmba6cd70vzyy\TempState|*|REMOVESELF

[ASUS TUF Aura Core *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\B9ECED6F.TUFAuraCore_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.TUFAuraCore_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.TUFAuraCore_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.TUFAuraCore_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.TUFAuraCore_qmba6cd70vzyy\TempState|*|REMOVESELF

[ASUS USB Charger Plus *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\B9ECED6F.USBChargerPlus_qmba6cd70vzyy
DetectFile2=%ProgramData%\USBChargerPlus
FileKey1=%LocalAppData%\Packages\B9ECED6F.USBChargerPlus_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.USBChargerPlus_qmba6cd70vzyy\LocalState\log|*
FileKey3=%LocalAppData%\Packages\B9ECED6F.USBChargerPlus_qmba6cd70vzyy\Settings|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.USBChargerPlus_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\B9ECED6F.USBChargerPlus_qmba6cd70vzyy\TempState|*|REMOVESELF
FileKey6=%ProgramData%|AsACPLog.*
FileKey7=%ProgramData%\ASUS\USBChargerPlus|*.log

[ASUS Windows Mixed Reality Headset *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\B9ECED6F.ASUSWindowsMixedRealityHMDDCA_qmba6cd70vzyy
FileKey1=%LocalAppData%\Packages\B9ECED6F.ASUSWindowsMixedRealityHMDDCA_qmba6cd70vzyy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\B9ECED6F.ASUSWindowsMixedRealityHMDDCA_qmba6cd70vzyy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\B9ECED6F.ASUSWindowsMixedRealityHMDDCA_qmba6cd70vzyy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\B9ECED6F.ASUSWindowsMixedRealityHMDDCA_qmba6cd70vzyy\TempState|*|REMOVESELF

[Athentech Perfectly Clear *]
LangSecRef=3021
Detect=HKLM\Software\Athentech
FileKey1=%LocalAppData%\cache\Athentech|*|REMOVESELF

[Atlantis Quest *]
Section=Games
DetectFile=%ProgramFiles%\GameTop.com\Atlantis Quest
FileKey1=%ProgramFiles%\GameTop.com\Atlantis Quest|Error.log

[Atlantis Word Processor *]
LangSecRef=3021
Detect=HKCU\Software\Atlantis Word Processor
FileKey1=%AppData%\Atlantis|*.tmp|RECURSE
FileKey2=%ProgramData%\Atlantis|Update.log
RegKey1=HKCU\Software\Atlantis Word Processor\ClipLib|AddGraphicClip_RecentFolder
RegKey2=HKCU\Software\Atlantis Word Processor\ClipLib|AddTextClip_RecentFolder
RegKey3=HKCU\Software\Atlantis Word Processor\ClipLib|RecentClip
RegKey4=HKCU\Software\Atlantis Word Processor\InsertDoc_Files
RegKey5=HKCU\Software\Atlantis Word Processor\InsertPicture_Files
RegKey6=HKCU\Software\Atlantis Word Processor\InsertPicture_Folders
RegKey7=HKCU\Software\Atlantis Word Processor\Internal|ImportStyles_LastUsedFile
RegKey8=HKCU\Software\Atlantis Word Processor\Internal|InitDir
RegKey9=HKCU\Software\Atlantis Word Processor\Internal|LastBulPic
RegKey10=HKCU\Software\Atlantis Word Processor\Internal|LastFavSubfolder
RegKey11=HKCU\Software\Atlantis Word Processor\Internal|LastUsedDocTemplate
RegKey12=HKCU\Software\Atlantis Word Processor\Internal\Envelopes|LastAddr
RegKey13=HKCU\Software\Atlantis Word Processor\Internal\Envelopes|LastAddrBook
RegKey14=HKCU\Software\Atlantis Word Processor\Internal\Envelopes|RetAddr
RegKey15=HKCU\Software\Atlantis Word Processor\Internal\FindReplace
RegKey16=HKCU\Software\Atlantis Word Processor\LangHistory
RegKey17=HKCU\Software\Atlantis Word Processor\LoadSave|DocFolder
RegKey18=HKCU\Software\Atlantis Word Processor\LoadSave|DocsToReload
RegKey19=HKCU\Software\Atlantis Word Processor\LoadSave|Ebook_LastSavedDoc
RegKey20=HKCU\Software\Atlantis Word Processor\OpenDoc_Files
RegKey21=HKCU\Software\Atlantis Word Processor\RecentDocs
RegKey22=HKCU\Software\Atlantis Word Processor\SaveDocAs_Files

[Attila *]
Section=Games
DetectFile=%AppData%\The Creative Assembly\Attila
FileKey1=%AppData%\The Creative Assembly\Attila\*_cache|*|RECURSE
FileKey2=%AppData%\The Creative Assembly\Attila\Logs|*

[aTube Catcher *]
LangSecRef=3023
DetectFile=%ProgramFiles%\dsnet Corp\aTube Catcher*
FileKey1=%AppData%\aTubeCatcher_10\FavIcons|*
FileKey2=%ProgramFiles%\dsnet Corp\aTube Catcher*|ScrRecX.log

[Audacity *]
LangSecRef=3023
DetectFile=%AppData%\Audacity
FileKey1=%AppData%\Audacity|lastlog.txt
FileKey2=%LocalAppData%\Audacity\CrashReports|*
RegKey1=HKCU\Software\Audacity\Audacity|DefaultOpenPath

[Audials *]
LangSecRef=3023
DetectFile=%LocalAppData%\RapidSolution\Audials_Software
FileKey1=%LocalAppData%\RapidSolution\Audials_*\Log|*.log;*.txt|RECURSE
FileKey2=%LocalAppData%\RapidSolution\Audials_Software\RapidSolution\Audials_*\Log|*.log;*.txt|RECURSE
FileKey3=%ProgramData%\RapidSolution\Audials_*\ChildMSILogs|*.txt

[Auslogics BitReplica *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\BitReplica
FileKey1=%ProgramData%\Auslogics\BitReplica\*|*.err;*cache.dat
FileKey2=%ProgramData%\Auslogics\BitReplica\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\BitReplica\*\Logs|*
FileKey4=%ProgramData%\Auslogics\BitReplica\*\Temp|*

[Auslogics BoostSpeed *]
LangSecRef=3024
Detect=HKCU\Software\Auslogics\BoostSpeed
DetectFile=%ProgramData%\Auslogics\BoostSpeed
FileKey1=%ProgramData%\Auslogics\BoostSpeed\*.x|*.err
FileKey2=%ProgramData%\Auslogics\BoostSpeed\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\BoostSpeed\*\Logs|*
FileKey4=%ProgramData%\Auslogics\BoostSpeed\*\Reports|*
FileKey5=%ProgramFiles%\Auslogics\Auslogics BoostSpeed|rdboot.log
RegKey1=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsFailed
RegKey2=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsFound
RegKey3=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsRemoved
RegKey4=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsRemovedTotal
RegKey5=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.LastScan
RegKey6=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey7=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey8=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey9=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey10=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.LastScan
RegKey11=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.DateTimeHi
RegKey12=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.DateTimeLo
RegKey13=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.FailedToRemove
RegKey14=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.Found
RegKey15=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.Removed
RegKey16=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.DisksList.SelectedDrives
RegKey17=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DateTime
RegKey18=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DisksList
RegKey19=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.FilesCount
RegKey20=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey21=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey22=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey23=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey24=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.LastScan
RegKey25=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.DisksList.SelectedDrives
RegKey26=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DateTime
RegKey27=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DisksList
RegKey28=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.FilesCount
RegKey29=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey30=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey31=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey32=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey33=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.LastScan

[Auslogics ChillMate *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\ChillMate
FileKey1=%ProgramData%\Auslogics\ChillMate\*|*.err
FileKey2=%ProgramData%\Auslogics\ChillMate\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\ChillMate\*\Logs|*
FileKey4=%ProgramData%\Auslogics\ChillMate\*\Temp|*

[Auslogics Disk Defrag *]
LangSecRef=3024
Detect1=HKLM\Software\Auslogics\Disk Defrag
Detect2=HKLM\Software\Auslogics\Disk Defrag Portable
Detect3=HKLM\Software\Auslogics\Disk Defrag Professional
DetectFile=%ProgramData%\Auslogics\Disk Defrag*
FileKey1=%AppData%\Auslogics\Disk Defrag*\Reports|*|RECURSE
FileKey2=%ProgramData%\Auslogics\Disk Defrag*\*|*.err
FileKey3=%ProgramData%\Auslogics\Disk Defrag*\*\DeliveredAction|*
FileKey4=%ProgramData%\Auslogics\Disk Defrag*\*\Logs|*
FileKey5=%ProgramData%\Auslogics\Disk Defrag*\*\Reports|*
FileKey6=%ProgramFiles%\Auslogics\Disk Defrag*|ndefrg.log

[Auslogics Driver Updater *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\File Recovery
FileKey1=%ProgramData%\Auslogics\File Recovery\*|*.err
FileKey2=%ProgramData%\Auslogics\File Recovery\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\File Recovery\*\Logs|*
FileKey4=%ProgramData%\Auslogics\File Recovery\*\Temp|*

[Auslogics Duplicate File Finder *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\Duplicate File Finder
FileKey1=%ProgramData%\Auslogics\Duplicate File Finder\*|*.err
FileKey2=%ProgramData%\Auslogics\Duplicate File Finder\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\Duplicate File Finder\*\Logs|*
FileKey4=%ProgramData%\Auslogics\Duplicate File Finder\*\Reports|*
RegKey1=HKLM\Software\Wow6432Node\Auslogics\Duplicate File Finder\7.x\Settings|DuplicateFileFinder.CheckDrives

[Auslogics Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\Registry Cleaner
FileKey1=%ProgramData%\Auslogics\Registry Cleaner\*|*.err
FileKey2=%ProgramData%\Auslogics\Registry Cleaner\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\Registry Cleaner\*\Logs|*
FileKey4=%ProgramData%\Auslogics\Registry Cleaner\*\Reports|*
FileKey5=%ProgramData%\Auslogics\Registry Cleaner\*\Rescue\Auslogics Registry Cleaner|*.rsc
RegKey1=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey2=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey3=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey4=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey5=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.LastScan
RegKey6=HKLM\Software\Auslogics\DeliveredActions
RegKey7=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey8=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey9=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey10=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey11=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.LastScan
RegKey12=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey13=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey14=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey15=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey16=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.LastScan
RegKey17=HKLM\Software\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey18=HKLM\Software\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey19=HKLM\Software\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey20=HKLM\Software\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey21=HKLM\Software\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.LastScan
RegKey22=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey23=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey24=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey25=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey26=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.LastScan
RegKey27=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey28=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey29=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey30=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey31=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.LastScan
RegKey32=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey33=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey34=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey35=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey36=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.x\Settings|RegCleaner.AppLogic.LastScan

[Auslogics Registry Defrag *]
LangSecRef=3024
DetectFile1=%AppData%\Auslogics\Registry Defrag
DetectFile2=%ProgramData%\Auslogics\Registry Defrag
FileKey1=%AppData%\Auslogics\Registry Defrag\Logs|*
FileKey2=%AppData%\Auslogics\Registry Defrag\Reports|*
FileKey3=%ProgramData%\Auslogics\Registry Defrag\*|*.err
FileKey4=%ProgramData%\Auslogics\Registry Defrag\*\DeliveredAction|*
FileKey5=%ProgramData%\Auslogics\Registry Defrag\*\Logs|*
FileKey6=%ProgramData%\Auslogics\Registry Defrag\*\Reports|*

[Auslogics SSD Optimizer *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\SSD Optimizer
FileKey1=%ProgramData%\Auslogics\SSD Optimizer\*|*.err
FileKey2=%ProgramData%\Auslogics\SSD Optimizer\*\Logs|*
FileKey3=%ProgramData%\Auslogics\SSD Optimizer\*\Reports|*

[Auslogics Video Grabber *]
LangSecRef=3024
DetectFile=%LocalAppData%\VideoGrabber
FileKey1=%LocalAppData%\VideoGrabber|ErrorLog.txt
FileKey2=%LocalAppData%\VideoGrabber\thumbnails|*

[Auslogics Windows Slimmer *]
LangSecRef=3024
DetectFile=%ProgramData%\Auslogics\Windows Slimmer
FileKey1=%ProgramData%\Auslogics\Windows Slimmer\*|*.err
FileKey2=%ProgramData%\Auslogics\Windows Slimmer\*\DeliveredAction|*
FileKey3=%ProgramData%\Auslogics\Windows Slimmer\*\Logs|*
FileKey4=%ProgramData%\Auslogics\Windows Slimmer\*\Reports|*

[Autodesk AutoCAD *]
LangSecRef=3021
Detect1=HKCU\Software\Autodesk\AutoCAD\R17.0
Detect2=HKCU\Software\Autodesk\AutoCAD\R18.0
Detect3=HKCU\Software\Autodesk\AutoCAD\R18.1
Detect4=HKCU\Software\Autodesk\AutoCAD\R19.0
Detect5=HKCU\Software\Autodesk\AutoCAD\R20.0
Detect6=HKCU\Software\Autodesk\AutoCAD\R23.0
Detect7=HKCU\Software\Autodesk\R19.0
Detect8=HKCU\Software\Autodesk\R22.0
FileKey1=%AppData%\Autodesk\ACA*\*\Recent|*.lnk|RECURSE
FileKey2=%AppData%\Autodesk\ADPSDK\JSON\Upload|logstats.json
FileKey3=%AppData%\Autodesk\AutoCAD*\r*\*\Recent|*.lnk|RECURSE
FileKey4=%LocalAppData%\Autodesk\AutoCAD*|*.log|RECURSE
FileKey5=%LocalAppData%\Autodesk\AutoCAD*\r*\*\BrowserCache|data_*;index
FileKey6=%LocalAppData%\Autodesk\Autodesk Desktop App\BrowserCache|data_*;f_*;index
FileKey7=%LocalAppData%\Autodesk\Web Services|*.log
FileKey8=%UserProfile%\Documents|plot.log
RegKey1=HKCU\Software\Autodesk\AutoCAD\R17.0\ACAD-5001:409\Recent File List
RegKey2=HKCU\Software\Autodesk\AutoCAD\R18.0\ACAD-8001:409\Recent File List
RegKey3=HKCU\Software\Autodesk\AutoCAD\R18.0\ACAD-8001:411\Recent File List
RegKey4=HKCU\Software\Autodesk\AutoCAD\R18.1\ACAD-9000:409\Recent File List
RegKey5=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B000:409\Recent File List
RegKey6=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B001:409\Recent File List
RegKey7=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B004:409\Recent File List
RegKey8=HKCU\Software\Autodesk\AutoCAD\R20.0\ACAD-8001:409\Recent File List
RegKey9=HKCU\Software\Autodesk\AutoCAD\R23.0\ACAD-A001:409\Recent File List
RegKey10=HKCU\Software\Autodesk\R19.0\ACAD-B005:409\Recent File List
RegKey11=HKCU\Software\Autodesk\R22.0\ACAD-1001:409\Recent File List

[Autodesk Design Review *]
LangSecRef=3023
Detect=HKCU\Software\AutoDesk\DWF Common
RegKey1=HKCU\Software\AutoDesk\DWF Common\Preferences\MRUList

[Autodesk Installer *]
LangSecRef=3021
DetectFile=%AppData%\Autodesk Installer
FileKey1=%AppData%\Autodesk Installer|Network Persistent State
FileKey2=%AppData%\Autodesk Installer\blob_storage|*|RECURSE
FileKey3=%AppData%\Autodesk Installer\GPUCache|*
FileKey4=%AppData%\Autodesk Installer\Logs|*

[Autodesk Inventor *]
LangSecRef=3021
Detect1=HKCU\Software\Autodesk\Inventor\RegistryVersion19.0
Detect2=HKCU\Software\Autodesk\Inventor\RegistryVersion20.0
Detect3=HKCU\Software\Autodesk\Inventor\RegistryVersion21.0
Detect4=HKCU\Software\Autodesk\Inventor\RegistryVersion22.0
Detect5=HKCU\Software\Autodesk\Inventor\RegistryVersion23.0
Detect6=HKCU\Software\Autodesk\Inventor\RegistryVersion24.0
RegKey1=HKCU\Software\Autodesk\Inventor\RegistryVersion19.0\Recent File List
RegKey2=HKCU\Software\Autodesk\Inventor\RegistryVersion20.0\Recent File List
RegKey3=HKCU\Software\Autodesk\Inventor\RegistryVersion21.0\Recent File List
RegKey4=HKCU\Software\Autodesk\Inventor\RegistryVersion22.0\Recent File List
RegKey5=HKCU\Software\Autodesk\Inventor\RegistryVersion23.0\Recent File List
RegKey6=HKCU\Software\Autodesk\Inventor\RegistryVersion24.0\Recent File List

[Autodesk Revit *]
LangSecRef=3021
DetectFile=%AppData%\Autodesk\Revit\Autodesk Revit*
FileKey1=%AppData%\Autodesk\Revit\Autodesk Revit*\*\components|*.log
FileKey2=%AppData%\Autodesk\Revit\Autodesk Revit*\RecentFileCache|*.jpg
FileKey3=%LocalAppData%\Microsoft\Microsoft SQL Server Local DB\Instances\SteelConnections*|*.log;*.mdmp;*log.ldf;log*.trc;SQLDump*.txt;system_health_*.xel

[AutoIt3 *]
LangSecRef=3021
Detect=HKCU\Software\AutoIt v3
FileKey1=%UserProfile%|SciTE.*
RegKey1=HKCU\Software\AutoIt v3\Aut2Exe|LastExeDir
RegKey2=HKCU\Software\AutoIt v3\Aut2Exe|LastIcon
RegKey3=HKCU\Software\AutoIt v3\Aut2Exe|LastIconDir
RegKey4=HKCU\Software\AutoIt v3\Aut2Exe|LastScriptDir

[AV Stumpfl Wings Platinum *]
LangSecRef=3023
DetectFile=%ProgramFiles%\AV Stumpfl\Wings Platinum
FileKey1=%ProgramFiles%\AV Stumpfl\Wings Platinum|*Log.txt

[Avast *]
LangSecRef=3024
Detect=HKCU\Software\AVAST Software\Avast
DetectFile=%ProgramFiles%\Alwil Software\Avast*
FileKey1=%AppData%\AVAST Software\Avast\Cache|*-journal;LOG;LOG.old;Network Persistent State;Visited Links|RECURSE
FileKey2=%AppData%\AVAST Software\Avast\Cache\*Cache|*|RECURSE
FileKey3=%AppData%\AVAST Software\Avast\Cache\blob_storage|*|RECURSE
FileKey4=%AppData%\AVAST Software\Avast\log|*|RECURSE
FileKey5=%LocalAppData%\Background_Fault|debug.log
FileKey6=%ProgramData%\Alwil Software\Avast*\log|*|RECURSE
FileKey7=%ProgramData%\Alwil Software\Avast*\report|*.txt
FileKey8=%ProgramData%\AVAST Software\Avast|*.obsolete;*.old;backend.txt;Log.db
FileKey9=%ProgramData%\AVAST Software\Avast\backup|*|RECURSE
FileKey10=%ProgramData%\AVAST Software\Avast\log|*|RECURSE
FileKey11=%ProgramData%\AVAST Software\Avast\report|*.txt
FileKey12=%ProgramData%\AVAST Software\Browser|*|RECURSE
FileKey13=%ProgramData%\AVAST Software\Persistent Data\Avast\Logs|*.log
FileKey14=%ProgramFiles%\Alwil Software\Avast*\Setup|*.log
FileKey15=%ProgramFiles%\AVAST Software\Avast|*.tmp
RegKey1=HKCU\Software\AVAST Software\Avast Browser Cleanup

[Avast Cleanup *]
LangSecRef=3024
Detect1=HKCU\Software\AVAST Software\Tuneup
Detect2=HKLM\Software\AVAST Software\Tuneup
DetectFile=%ProgramData%\Avast Software\Cleanup
FileKey1=%AppData%\Avast Software\Cleanup\Cache|*|RECURSE
FileKey2=%AppData%\Avast Software\Cleanup\log|*|RECURSE
FileKey3=%ProgramData%\Avast Software|notiylimit.lock
FileKey4=%ProgramData%\Avast Software\Cleanup|crl_cache.json
FileKey5=%ProgramData%\Avast Software\Cleanup\Cache|*|RECURSE
FileKey6=%ProgramData%\Avast Software\Cleanup\log|*|RECURSE
FileKey7=%ProgramData%\Avast Software\Cleanup\Software Updater|state_cache.json
FileKey8=%ProgramData%\Avast Software\Cleanup\StateHistory|*.dat
FileKey9=%ProgramData%\Avast Software\Icarus|*.lck
FileKey10=%ProgramData%\Avast Software\Icarus\Logs|*|RECURSE
RegKey1=HKCU\Software\AVAST Software\Tuneup\FixProblems
RegKey2=HKLM\Software\AVAST Software\Tuneup\FixProblems

[Avast Secure Browser Autofill Data & Search Engine Preferences *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Avast Software\Browser\User Data\AutoFill*|*|REMOVESELF

[Avast Secure Browser Autoplay Preferences *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\MEIPreload|*|REMOVESELF

[Avast Secure Browser Bookmark Backups *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|Bookmarks.bak

[Avast Secure Browser Bookmark Favicons *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|favicons*

[Avast Secure Browser Caches *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Avast Software\Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\Avast Software\Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Avast Software\Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Avast Software\Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Avast Software\Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Avast Software\Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Avast Software\Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Avast Software\Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Avast Software\Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Avast Software\Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Avast Software\Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Avast Software\Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Avast Software\Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Avast Software\Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Avast Software\Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Avast Software\Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Avast Software\Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Avast Software\Browser\User Data\Optimization*|*|REMOVESELF

[Avast Secure Browser Default App Handlers *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|PreferredApps

[Avast Secure Browser Download History *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*\shared_proto_db|*|REMOVESELF

[Avast Secure Browser DRM Data *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\WidevineCdm|*|REMOVESELF

[Avast Secure Browser Extension Cookies *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|Extension Cookies

[Avast Secure Browser Pinned Tabs *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
RegKey1=HKCU\Software\AVAST Software\Browser\PreferenceMACs\Default|pinned_tabs

[Avast Secure Browser Privacy Sandbox *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Avast Software\Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Avast Software\Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Avast Software\Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Avast Software\Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Avast Software\Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Avast Software\Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Avast Secure Browser Progressive Web Apps *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\Web Applications|*|REMOVESELF

[Avast Secure Browser Saved Usernames & Passwords *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|Login Data*

[Avast Secure Browser Security & Threat Detection *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Avast Software\Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Avast Software\Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Avast Software\Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Avast Software\Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Avast Software\Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Avast Software\Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Avast Software\Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Avast Software\Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Avast Software\Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Avast Software\Browser\User Data\ZxcvbnData|*|REMOVESELF

[Avast Secure Browser Shopping Insights *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Avast Software\Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Avast Software\Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Avast Software\Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Avast Secure Browser Storage Quota Manager *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|QuotaManager

[Avast Secure Browser Sync Data *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\Sync Data|*|REMOVESELF

[Avast Secure Browser Telemetry *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\Application|debug.log
FileKey2=%LocalAppData%\Avast Software\Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\AVAST Software\Browser\CrashReports|*|REMOVESELF
FileKey4=%LocalAppData%\Avast Software\Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey5=%LocalAppData%\Avast Software\Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Avast Software\Browser\User Data\*|*.log
FileKey7=%LocalAppData%\Avast Software\Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey8=%LocalAppData%\Avast Software\Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey9=%LocalAppData%\Avast Software\Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey10=%LocalAppData%\Avast Software\Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey11=%LocalAppData%\Avast Software\Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey12=%LocalAppData%\Avast Software\Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey13=%LocalAppData%\Avast Software\Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey14=%LocalAppData%\Avast Software\Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey15=%LocalAppData%\Avast Software\Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey16=%LocalAppData%\Avast Software\Browser\User Data\Crash Reports|*|REMOVESELF
FileKey17=%LocalAppData%\Avast Software\Browser\User Data\Crashpad|*|REMOVESELF
FileKey18=%LocalAppData%\Avast Software\Browser\User Data\Local Traces|*|REMOVESELF
FileKey19=%LocalAppData%\Avast Software\Browser\User Data\OriginTrials|*|REMOVESELF
FileKey20=%LocalAppData%\Avast Software\Browser\User Data\Stability|*|REMOVESELF
FileKey21=%ProgramFiles%\Avast Software\Browser\Application|debug.log
FileKey22=%ProgramFiles%\Avast Software\Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\AVAST Software\Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\AVAST Software\Browser\BlBeacon|state
RegKey3=HKCU\Software\AVAST Software\Browser\Installer|LastChecked
RegKey4=HKCU\Software\AVAST Software\Browser\StabilityMetrics

[Avast Secure Browser Web Browsing Cookies *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Avast Secure Browser Web Browsing History *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Avast Secure Browser Web Browsing Session *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*\Sessions|*|REMOVESELF

[Avast Secure Browser Web Storage *]
LangSecRef=3037
DetectFile=%LocalAppData%\Avast Software\Browser\User Data
FileKey1=%LocalAppData%\Avast Software\Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Avast Software\Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Avast Software\Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Avast Software\Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Avast Software\Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Avast Software\Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Avast Software\Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Avast Software\Browser\User Data\*\WebStorage|*|REMOVESELF

[AVG *]
LangSecRef=3024
Detect1=HKCU\Software\AVG
Detect2=HKLM\Software\AVG
FileKey1=%LocalAppData%\Avg\Log|*|RECURSE
FileKey2=%LocalAppData%\AvgSetupLog|*|REMOVESELF
FileKey3=%WinDir%\System32\config\systemprofile\AppData\Local\Avg\log|*|RECURSE
FileKey4=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg\log|*|RECURSE

[AVG AntiVirus *]
LangSecRef=3024
Detect=HKLM\Software\AVG
FileKey1=%AppData%\AVG\Antivirus\cache|ChromeDWriteFontCache
FileKey2=%AppData%\AVG\Antivirus\log|*|RECURSE
FileKey3=%LocalAppData%\MFAData\logs|*.log*
FileKey4=%ProgramData%\AVG\Antivirus|*.old
FileKey5=%ProgramData%\AVG\Antivirus\GrimeFighter2|*.txt
FileKey6=%ProgramData%\AVG\Antivirus\log|*.log
FileKey7=%ProgramData%\AVG\Antivirus\opm|*|RECURSE
FileKey8=%ProgramData%\AVG\Antivirus\report|*|RECURSE
FileKey9=%ProgramData%\AVG\Antivirus\SWCUData\Cache|*|RECURSE
FileKey10=%ProgramData%\AVG\Antivirus\SWCUData\icons|*|RECURSE
FileKey11=%ProgramData%\AVG\Persistent Data\Antivirus\Logs|*|RECURSE
FileKey12=%ProgramFiles%\AVG\Antivirus|*.tmp|RECURSE
FileKey13=%WinDir%\System32\config\systemprofile\AppData\Local\AvgSetupLog|*|REMOVESELF
FileKey14=%WinDir%\System32\config\systemprofile\AppData\Local\MFAData\logs|*|RECURSE
FileKey15=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\AvgSetupLog|*|REMOVESELF
FileKey16=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\MFAData\logs|*|RECURSE
RegKey1=HKLM\Software\AVG\Antivirus\PUB-Detected
RegKey2=HKLM\Software\AVG\Antivirus\PUB-Removed
RegKey3=HKLM\Software\Wow6432Node\AVG\Antivirus\PUB-Detected
RegKey4=HKLM\Software\Wow6432Node\AVG\Antivirus\PUB-Removed

[AVG PC TuneUp *]
LangSecRef=3024
Detect1=HKCU\Software\AVG\AWL\RegistryCleaner
Detect2=HKCU\Software\TuneUp
DetectFile=%AppData%\AVG TuneUp
FileKey1=%AppData%\AVG TuneUp\Cache|*|RECURSE
FileKey2=%AppData%\AVG TuneUp\log|*
FileKey3=%AppData%\AVG\AVG TuneUp\Cache|ChromeDWriteFontCache;data_*;f_*;index
FileKey4=%AppData%\AVG\AVG TuneUp\log|*
FileKey5=%AppData%\AVG\AWL*\CrashDumps|*
FileKey6=%AppData%\AVG\TuneUp\log|*
FileKey7=%AppData%\TuneUp Software\TuneUp Utilities\CrashDumps|*
FileKey8=%LocalAppData%\Avg\AWL*\Log|*.log|RECURSE
FileKey9=%LocalAppData%\Avg\dumps\fmw1|*
FileKey10=%LocalAppData%\Microsoft\Windows|*_tureg_new.LOG*;*_tureg_old
FileKey11=%LocalAppData%\TuneUp Software|*.log|RECURSE
FileKey12=%ProgramData%|*_tureg_new.LOG*;*_tureg_old
FileKey13=%ProgramData%\AVG\AVG TuneUp\Backups|*.rcb
FileKey14=%ProgramData%\AVG\AVG TuneUp\Cache|*.log|RECURSE
FileKey15=%ProgramData%\AVG\AVG TuneUp\log|*
FileKey16=%ProgramData%\AVG\AWL*|*.tudb
FileKey17=%ProgramData%\AVG\Icarus\Logs|*
FileKey18=%ProgramData%\AVG\TuneUp|*.bak;*.old
FileKey19=%ProgramData%\AVG\TuneUp\log|*|RECURSE
FileKey20=%ProgramData%\TuneUp Software\tu*|*.tudb
FileKey21=%ProgramData%\TuneUp Software\TuneUp Utilities*|*.log|RECURSE
FileKey22=%ProgramData%\TuneUp Software\TuneUp Utilities\Program Statistics|*.tudb
FileKey23=%ProgramFiles%\AVG\AVG TuneUp\DATA\log|*
FileKey24=%ProgramFiles%\AVG\AVG TuneUp\x*\DATA\log|*
FileKey25=%ProgramFiles%\AVG\TuneUp\DATA\log|*
FileKey26=%ProgramFiles%\AVG\TuneUp\DATA\report|*
FileKey27=%Public%|*_tureg_new.LOG*;*_tureg_old
FileKey28=%SystemDrive%\Boot|BCD_tureg_new.LOG*;BCD_tureg_old
FileKey29=%SystemDrive%\Documents and Settings\LocalService*|*_tureg_new.LOG*;*_tureg_old
FileKey30=%SystemDrive%\Documents and Settings\NetworkService*|*_tureg_new.LOG*;*_tureg_old
FileKey31=%SystemDrive%\Users\Default\AppData\Local\Avg\Log\tu*|*.log|RECURSE
FileKey32=%UserProfile%|*_tureg_new.LOG*;*_tureg_old
FileKey33=%WinDir%\ServiceProfiles\*|*_tureg_new.LOG*;*_tureg_old
FileKey34=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows|*_tureg_new.LOG*;*_tureg_old
FileKey35=%WinDir%\System32\config|*_tureg_new.LOG*;*_tureg_old

[AVG Secure Browser Autofill Data & Search Engine Preferences *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\AVG\Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\AVG\Browser\User Data\AutoFill*|*|REMOVESELF

[AVG Secure Browser Autoplay Preferences *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\MEIPreload|*|REMOVESELF

[AVG Secure Browser Bookmark Backups *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|Bookmarks.bak

[AVG Secure Browser Bookmark Favicons *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|favicons*

[AVG Secure Browser Caches *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\AVG\Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\AVG\Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\AVG\Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\AVG\Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\AVG\Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\AVG\Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\AVG\Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\AVG\Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\AVG\Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\AVG\Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\AVG\Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\AVG\Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\AVG\Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\AVG\Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\AVG\Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\AVG\Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\AVG\Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\AVG\Browser\User Data\Optimization*|*|REMOVESELF

[AVG Secure Browser Default App Handlers *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|PreferredApps

[AVG Secure Browser Download History *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\AVG\Browser\User Data\*\shared_proto_db|*|REMOVESELF

[AVG Secure Browser DRM Data *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\AVG\Browser\User Data\WidevineCdm|*|REMOVESELF

[AVG Secure Browser Extension Cookies *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|Extension Cookies

[AVG Secure Browser Pinned Tabs *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
RegKey1=HKCU\Software\AVG\Browser\PreferenceMACs\Default|pinned_tabs

[AVG Secure Browser Privacy Sandbox *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\AVG\Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\AVG\Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\AVG\Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\AVG\Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\AVG\Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\AVG\Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\AVG\Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[AVG Secure Browser Progressive Web Apps *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\Web Applications|*|REMOVESELF

[AVG Secure Browser Saved Usernames & Passwords *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|Login Data*

[AVG Secure Browser Security & Threat Detection *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\AVG\Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\AVG\Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\AVG\Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\AVG\Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\AVG\Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\AVG\Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\AVG\Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\AVG\Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\AVG\Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\AVG\Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\AVG\Browser\User Data\ZxcvbnData|*|REMOVESELF

[AVG Secure Browser Shopping Insights *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\AVG\Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\AVG\Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\AVG\Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\AVG\Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[AVG Secure Browser Storage Quota Manager *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|QuotaManager

[AVG Secure Browser Sync Data *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\Sync Data|*|REMOVESELF

[AVG Secure Browser Telemetry *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\Application|debug.log
FileKey2=%LocalAppData%\AVG\Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\AVG\Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\AVG\Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\AVG\Browser\User Data\*|*.log
FileKey6=%LocalAppData%\AVG\Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\AVG\Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\AVG\Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\AVG\Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\AVG\Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\AVG\Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\AVG\Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\AVG\Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\AVG\Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\AVG\Browser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\AVG\Browser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\AVG\Browser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\AVG\Browser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\AVG\Browser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\AVG\Browser\Application|debug.log
FileKey21=%ProgramFiles%\AVG\Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\AVG\Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\AVG\Browser\BlBeacon|state
RegKey3=HKCU\Software\AVG\Browser\Installer|LastChecked
RegKey4=HKCU\Software\AVG\Browser\StabilityMetrics

[AVG Secure Browser Web Browsing Cookies *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[AVG Secure Browser Web Browsing History *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[AVG Secure Browser Web Browsing Session *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\AVG\Browser\User Data\*\Sessions|*|REMOVESELF

[AVG Secure Browser Web Storage *]
LangSecRef=3038
DetectFile=%LocalAppData%\AVG\Browser\User Data
FileKey1=%LocalAppData%\AVG\Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\AVG\Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\AVG\Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\AVG\Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\AVG\Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\AVG\Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\AVG\Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\AVG\Browser\User Data\*\WebStorage|*|REMOVESELF

[Avi-Mux GUI *]
LangSecRef=3023
DetectFile=%ProgramFiles%\AVIMuxGUI
FileKey1=%ProgramFiles%\AVIMuxGUI|*.dmp;AVI-Mux GUI - Logfile*.*

[AVIcodec *]
LangSecRef=3023
Detect=HKLM\Software\AVIcodec
RegKey1=HKLM\Software\AVIcodec|szInitDir

[Avid *]
LangSecRef=3023
DetectFile1=%AppData%\Digidesign
DetectFile2=%LocalAppData%\Avid
FileKey1=%AppData%\Digidesign\Recent Files|*|RECURSE
FileKey2=%AppData%\Digidesign\Recent Folders|*|RECURSE
FileKey3=%LocalAppData%\Avid\Crashlog|*
FileKey4=%LocalAppData%\Avid\Logs|*.dlog;*_log.txt
FileKey5=%LocalAppData%\Avid\Pro Tools\Cache|*|RECURSE

[Avidemux *]
LangSecRef=3023
DetectFile=%AppData%\avidemux
FileKey1=%AppData%\avidemux|admlog.txt

[Avira AntiVir Desktop *]
LangSecRef=3024
Detect1=HKCU\Software\Avira\Antivirus
Detect2=HKLM\Software\Avira\AntiVir Desktop
FileKey1=%ProgramData%\Avira\Antivir*\EVENTDB\Logs|*
FileKey2=%ProgramData%\Avira\AntiVir*\IPM|*|RECURSE
FileKey3=%ProgramData%\Avira\AntiVir*\REPORTS|*
FileKey4=%ProgramData%\Avira\OptimizerHost\Logs|*
FileKey5=%ProgramFiles%\Avira GmbH|*.log|RECURSE

[Avira Launcher *]
LangSecRef=3021
DetectFile=%ProgramData%\Avira\Launcher
FileKey1=%ProgramData%\Avira\Launcher|*.backup
FileKey2=%ProgramData%\Avira\Launcher\Logfiles*|*
FileKey3=%ProgramData%\Avira\Launcher\Temp|*|RECURSE
FileKey4=%ProgramFiles%\Avira\Launcher|*.backup

[Avira Phantom VPN *]
LangSecRef=3022
DetectFile=%ProgramData%\Avira\VPN
FileKey1=%ProgramData%\Avira\VPN|*.log

[Avira Secure Browser Autofill Data & Search Engine Preferences *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\Avira\Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Avira\Browser\User Data\AutoFill*|*|REMOVESELF

[Avira Secure Browser Autoplay Preferences *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\MEIPreload|*|REMOVESELF

[Avira Secure Browser Bookmark Backups *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|Bookmarks.bak

[Avira Secure Browser Bookmark Favicons *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|favicons*

[Avira Secure Browser Caches *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Avira\Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\Avira\Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Avira\Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Avira\Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Avira\Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Avira\Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Avira\Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Avira\Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Avira\Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Avira\Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Avira\Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Avira\Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Avira\Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Avira\Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Avira\Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Avira\Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Avira\Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Avira\Browser\User Data\Optimization*|*|REMOVESELF

[Avira Secure Browser Default App Handlers *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|PreferredApps

[Avira Secure Browser Download History *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Avira\Browser\User Data\*\shared_proto_db|*|REMOVESELF

[Avira Secure Browser DRM Data *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Avira\Browser\User Data\WidevineCdm|*|REMOVESELF

[Avira Secure Browser Extension Cookies *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|Extension Cookies

[Avira Secure Browser Pinned Tabs *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
RegKey1=HKCU\Software\Avira\Browser\PreferenceMACs\Default|pinned_tabs

[Avira Secure Browser Privacy Sandbox *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Avira\Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Avira\Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Avira\Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Avira\Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Avira\Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Avira\Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Avira\Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Avira Secure Browser Progressive Web Apps *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\Web Applications|*|REMOVESELF

[Avira Secure Browser Saved Usernames & Passwords *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|Login Data*

[Avira Secure Browser Security & Threat Detection *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\Avira\Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Avira\Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Avira\Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Avira\Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Avira\Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Avira\Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Avira\Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Avira\Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Avira\Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Avira\Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Avira\Browser\User Data\ZxcvbnData|*|REMOVESELF

[Avira Secure Browser Shopping Insights *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Avira\Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Avira\Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Avira\Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Avira\Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Avira Secure Browser Storage Quota Manager *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|QuotaManager

[Avira Secure Browser Sync Data *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\Sync Data|*|REMOVESELF

[Avira Secure Browser Telemetry *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\Application|debug.log
FileKey2=%LocalAppData%\Avira\Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Avira\Browser\CrashReports|*|REMOVESELF
FileKey4=%LocalAppData%\Avira\Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey5=%LocalAppData%\Avira\Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Avira\Browser\User Data\*|*.log
FileKey7=%LocalAppData%\Avira\Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey8=%LocalAppData%\Avira\Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey9=%LocalAppData%\Avira\Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey10=%LocalAppData%\Avira\Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey11=%LocalAppData%\Avira\Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey12=%LocalAppData%\Avira\Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey13=%LocalAppData%\Avira\Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey14=%LocalAppData%\Avira\Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey15=%LocalAppData%\Avira\Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey16=%LocalAppData%\Avira\Browser\User Data\Crash Reports|*|REMOVESELF
FileKey17=%LocalAppData%\Avira\Browser\User Data\Crashpad|*|REMOVESELF
FileKey18=%LocalAppData%\Avira\Browser\User Data\Local Traces|*|REMOVESELF
FileKey19=%LocalAppData%\Avira\Browser\User Data\OriginTrials|*|REMOVESELF
FileKey20=%LocalAppData%\Avira\Browser\User Data\Stability|*|REMOVESELF
FileKey21=%ProgramFiles%\Avira\Browser\Application|debug.log
FileKey22=%ProgramFiles%\Avira\Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Avira\Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\Avira\Browser\BlBeacon|state
RegKey3=HKCU\Software\Avira\Browser\Installer|LastChecked
RegKey4=HKCU\Software\Avira\Browser\StabilityMetrics

[Avira Secure Browser Web Browsing Cookies *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Avira Secure Browser Web Browsing History *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Avira Secure Browser Web Browsing Session *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Avira\Browser\User Data\*\Sessions|*|REMOVESELF

[Avira Secure Browser Web Storage *]
LangSecRef=3044
DetectFile=%LocalAppData%\Avira\Browser\User Data
FileKey1=%LocalAppData%\Avira\Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Avira\Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Avira\Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Avira\Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Avira\Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Avira\Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Avira\Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Avira\Browser\User Data\*\WebStorage|*|REMOVESELF

[Avira System Speedup *]
LangSecRef=3024
DetectFile=%ProgramData%\Avira\SystemSpeedup
FileKey1=%LocalAppData%\AviraSpeedup\logs|*
FileKey2=%ProgramData%\Avira\Launcher\Logfiles|*.log
FileKey3=%ProgramData%\Avira\SystemSpeedup\Errors|*
FileKey4=%ProgramData%\Avira\SystemSpeedup\Logs|*
FileKey5=%ProgramData%\Avira\SystemSpeedup\Update|*.exe

[AVS Audio Converter *]
LangSecRef=3023
DetectFile=%AppData%\AVS4YOU\AVSAudioConverter*
FileKey1=%AppData%\AVS4YOU\AVSAudioConverter*|*.log;RecentFiles.*

[AVS Audio Editor *]
LangSecRef=3023
DetectFile=%AppData%\AVS4YOU\AVSAudioEditor
FileKey1=%AppData%\AVS4YOU\AVSAudioEditor|*.log;Recent*.txt
FileKey2=%AppData%\AVS4YOU\AVSAudioEditor\Temp|*

[AVS Registry Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\AVS4YOU\AVSRegistryCleaner
FileKey1=%AppData%\AVS4YOU\AVSRegistryCleaner\Logs|*.log
FileKey2=%AppData%\AVS4YOU\AVSRegistryCleaner\RollBack|*|RECURSE

[AxCrypt *]
LangSecRef=3024
DetectFile=%LocalAppData%\AxCrypt
FileKey1=%LocalAppData%\AxCrypt|ReportSnapshot.txt

[Axialis CursorWorkshop *]
LangSecRef=3023
Detect=HKCU\Software\Axialis\CursorWorkshop
RegKey1=HKCU\Software\Axialis\CursorWorkshop\Axialis Recent Files
RegKey2=HKCU\Software\Axialis\CursorWorkshop\folders|CurrentOpenDirectory
RegKey3=HKCU\Software\Axialis\CursorWorkshop\folders|LibrarianLastPath

[Axialis IconVectors *]
LangSecRef=3023
Detect=HKCU\Software\Axialis\IconVectors
RegKey1=HKCU\Software\Axialis\IconVectors|file1
RegKey2=HKCU\Software\Axialis\IconVectors|file2
RegKey3=HKCU\Software\Axialis\IconVectors|file3
RegKey4=HKCU\Software\Axialis\IconVectors|file4
RegKey5=HKCU\Software\Axialis\IconVectors|file5
RegKey6=HKCU\Software\Axialis\IconVectors|file6
RegKey7=HKCU\Software\Axialis\IconVectors|file7
RegKey8=HKCU\Software\Axialis\IconVectors|file8
RegKey9=HKCU\Software\Axialis\IconVectors|file9
RegKey10=HKCU\Software\Axialis\IconVectors|file10
RegKey11=HKCU\Software\Axialis\IconVectors|file11
RegKey12=HKCU\Software\Axialis\IconVectors|file12
RegKey13=HKCU\Software\Axialis\IconVectors|file13
RegKey14=HKCU\Software\Axialis\IconVectors|file14
RegKey15=HKCU\Software\Axialis\IconVectors|file15
RegKey16=HKCU\Software\Axialis\IconVectors|file16
RegKey17=HKCU\Software\Axialis\IconVectors|file17
RegKey18=HKCU\Software\Axialis\IconVectors|file18
RegKey19=HKCU\Software\Axialis\IconVectors|file19
RegKey20=HKCU\Software\Axialis\IconVectors|file20
RegKey21=HKCU\Software\Axialis\IconVectors\folders|CurrentOpenDirectory
RegKey22=HKCU\Software\Axialis\IconVectors\folders|LibrarianLastPath

[Axialis IconWorkshop *]
LangSecRef=3023
Detect=HKCU\Software\Axialis\IconWorkshop
FileKey1=%AppData%\Axialis\Temporary Preview Files|*|RECURSE
FileKey2=%LocalAppData%\Axialis\Temporary Preview Files|*|RECURSE
FileKey3=%UserProfile%\Documents\Axialis Librarian\Deleted Items|*.del;*.ii
RegKey1=HKCU\Software\Axialis\IconWorkshop\folders|CurrentExportDirectory
RegKey2=HKCU\Software\Axialis\IconWorkshop\folders|CurrentImportDirectory
RegKey3=HKCU\Software\Axialis\IconWorkshop\folders|CurrentOpenDirectory
RegKey4=HKCU\Software\Axialis\IconWorkshop\folders|LibrarianLastPath
RegKey5=HKCU\Software\Axialis\IconWorkshop\rss|Axialis Recent Files
RegKey6=HKCU\Software\Axialis\IconWorkshop\rss|CoolBarList
RegKey7=HKCU\Software\Axialis\IconWorkshop\rss|MostRecentNewsId
RegKey8=HKCU\Software\Axialis\IconWorkshop\rss|News1
RegKey9=HKCU\Software\Axialis\IconWorkshop\rss|News2
RegKey10=HKCU\Software\Axialis\IconWorkshop\rss|News3
RegKey11=HKCU\Software\Axialis\IconWorkshop\rss|News4
RegKey12=HKCU\Software\Axialis\IconWorkshop\rss|News5
RegKey13=HKCU\Software\Axialis\IconWorkshop\rss|News6
RegKey14=HKCU\Software\Axialis\IconWorkshop\rss|News7
RegKey15=HKCU\Software\Axialis\IconWorkshop\rss|News8
RegKey16=HKCU\Software\Axialis\IconWorkshop\rss|News9
RegKey17=HKCU\Software\Axialis\IconWorkshop\rss|News10
RegKey18=HKCU\Software\Axialis\IconWorkshop\rss|News11
RegKey19=HKCU\Software\Axialis\IconWorkshop\rss|News12
RegKey20=HKCU\Software\Axialis\IconWorkshop\rss|News13
RegKey21=HKCU\Software\Axialis\IconWorkshop\rss|News14
RegKey22=HKCU\Software\Axialis\IconWorkshop\rss|News15
RegKey23=HKCU\Software\Axialis\IconWorkshop\rss|News16
RegKey24=HKCU\Software\Axialis\IconWorkshop\rss|News17
RegKey25=HKCU\Software\Axialis\IconWorkshop\rss|News18
RegKey26=HKCU\Software\Axialis\IconWorkshop\rss|News19
RegKey27=HKCU\Software\Axialis\IconWorkshop\rss|News20
RegKey28=HKCU\Software\Axialis\IconWorkshop\rss|Recent File List
RegKey29=HKCU\Software\Axialis\IconWorkshop\rss|UnreadNews

[Axialis Screensaver Producer *]
LangSecRef=3023
Detect=HKCU\Software\Axialis\Screensaver Producer
FileKey1=%LocalAppData%\Axialis\Temporary Preview Files|*|RECURSE
RegKey1=HKCU\Software\Axialis\Screensaver Producer\folders|CurrentOpenDirectory
RegKey2=HKCU\Software\Axialis\Screensaver Producer\folders|LibrarianLastPath
RegKey3=HKCU\Software\Axialis\Screensaver Producer\Recent File List
RegKey4=HKCU\Software\Axialis\Screensaver Producer\rss|MostRecentNewsId
RegKey5=HKCU\Software\Axialis\Screensaver Producer\rss|News1
RegKey6=HKCU\Software\Axialis\Screensaver Producer\rss|News2
RegKey7=HKCU\Software\Axialis\Screensaver Producer\rss|News3
RegKey8=HKCU\Software\Axialis\Screensaver Producer\rss|News4
RegKey9=HKCU\Software\Axialis\Screensaver Producer\rss|News5
RegKey10=HKCU\Software\Axialis\Screensaver Producer\rss|News6
RegKey11=HKCU\Software\Axialis\Screensaver Producer\rss|News7
RegKey12=HKCU\Software\Axialis\Screensaver Producer\rss|News8
RegKey13=HKCU\Software\Axialis\Screensaver Producer\rss|News9
RegKey14=HKCU\Software\Axialis\Screensaver Producer\rss|News10
RegKey15=HKCU\Software\Axialis\Screensaver Producer\rss|News11
RegKey16=HKCU\Software\Axialis\Screensaver Producer\rss|News12
RegKey17=HKCU\Software\Axialis\Screensaver Producer\rss|News13
RegKey18=HKCU\Software\Axialis\Screensaver Producer\rss|News14
RegKey19=HKCU\Software\Axialis\Screensaver Producer\rss|News15
RegKey20=HKCU\Software\Axialis\Screensaver Producer\rss|News16
RegKey21=HKCU\Software\Axialis\Screensaver Producer\rss|News17
RegKey22=HKCU\Software\Axialis\Screensaver Producer\rss|News18
RegKey23=HKCU\Software\Axialis\Screensaver Producer\rss|News19
RegKey24=HKCU\Software\Axialis\Screensaver Producer\rss|News20
RegKey25=HKCU\Software\Axialis\Screensaver Producer\rss|UnreadNews

[Axigen Mail Server *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Axigen Mail Server
FileKey1=%ProgramFiles%\Axigen Mail Server\Log|LOG_FILE.txt

[Azahar *]
Section=Games
DetectFile=%AppData%\Azahar
FileKey1=%AppData%\Azahar\log|azahar_log*

[AzureWave *]
LangSecRef=3022
DetectFile=%ProgramData%\AzureWave
FileKey1=%ProgramData%\AzureWave|*.log

[Babylon *]
LangSecRef=3024
Detect=HKCU\Software\Babylon\Babylon Translator
FileKey1=%AppData%\Babylon|log_file.txt
RegKey1=HKCU\Software\Babylon\Babylon Translator\UserInfo\History

[Backyard Basketball 2004 *]
Section=Games
DetectFile=%ProgramFiles%\Atari\Backyard Basketball 2004
FileKey1=%ProgramFiles%\Atari\Backyard Basketball 2004|*.log

[Bad Piggies *]
Section=Games
DetectFile=%ProgramFiles%\Rovio\Bad Piggies
FileKey1=%ProgramFiles%\Rovio\Bad Piggies\BadPiggies_Data|output_log.txt

[Badlion Client *]
Section=Games
DetectFile=%AppData%\Badlion Client
FileKey1=%AppData%\Badlion Client|*.log
FileKey2=%AppData%\Badlion Client\GPUCache|*
FileKey3=%AppData%\Badlion Client\logs\launcher|*

[Baldur's Gate 3 *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\Baldur's Gate 3
FileKey1=%ProgramFiles%\Steam\steamapps\common\Baldur's Gate 3\bin|*.log|RECURSE

[Baldur's Gate II: Enhanced Edition *]
Section=Games
DetectFile=%UserProfile%\Documents\Baldur's Gate II - Enhanced Edition
FileKey1=%UserProfile%\Documents\Baldur's Gate II - Enhanced Edition\Scrnshot|*.png

[Banished *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\242920
FileKey1=%UserProfile%\Documents\Banished\Save|Crash*.dmp

[Basilisk Autocomplete History *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|formhistory*

[Basilisk Autofill Data *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|autofill-profiles.json

[Basilisk Bookmark Backups *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\bookmarkbackups|*

[Basilisk Bookmark Favicons *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|favicons*

[Basilisk Caches *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\notificationstore|*
FileKey4=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\security_state|*
FileKey5=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\shader-cache|*
FileKey6=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*\thumbnails|*|REMOVESELF

[Basilisk Privacy Sandbox *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|credentialstate.sqlite

[Basilisk Saved Usernames & Passwords *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|key4.db;logins.json

[Basilisk Synced Tabs *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|synced-tabs.db*

[Basilisk Telemetry *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk|*.log|RECURSE
FileKey2=%AppData%\Basilisk-Dev\Basilisk\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\crashes|*
FileKey5=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\minidumps|*
FileKey7=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\weave\logs|*

[Basilisk Web Browsing Cookies *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|cookies*

[Basilisk Web Browsing Session *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|session*.json*

[Basilisk Web Browsing Session Backups *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\sessionstore-backups|*

[Basilisk Web Storage *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\storage\default\http*|*|REMOVESELF

[Basilisk Website Permissions *]
Section=Basilisk Web Browser
DetectFile=%AppData%\Basilisk-Dev\Basilisk\Profiles
FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Batman: Arkham Asylum *]
Section=Games
Detect1=HKLM\Software\Eidos Interactive Limited\Batman: Arkham Asylum
Detect2=HKLM\Software\RocksteadyLtd\Batman Arkham Asylum
FileKey1=%UserProfile%\Documents\*\Batman Arkham Asylum*\BmGame|*.log|RECURSE

[Batman: Arkham City *]
Section=Games
DetectFile=%UserProfile%\Documents\WB Games\Batman Arkham City*
FileKey1=%UserProfile%\Documents\WB Games\Batman Arkham City*\BmGame\Logs|*

[Batman: Arkham Origins *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\Batman Arkham Origins
FileKey1=%ProgramFiles%\Steam\steamapps\common\Batman Arkham Origins\SinglePlayer\BMGame\Logs|*

[Battle Islands *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\305260
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Battle Islands\BattleIslands_Data|output_log.txt

[Battle.net *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Battle.net
FileKey1=%AppData%\Battle.net\Telemetry|*
FileKey2=%LocalAppData%\Battle.net|CachedData.db
FileKey3=%LocalAppData%\Battle.net\*Cache|*|REMOVESELF
FileKey4=%LocalAppData%\Battle.net\BrowserCaches\common|*|RECURSE
FileKey5=%LocalAppData%\Battle.net\Errors|*
FileKey6=%LocalAppData%\Battle.net\Logs|*|RECURSE
FileKey7=%LocalAppData%\Blizzard Entertainment\Battle.net\Cache|*|RECURSE
FileKey8=%LocalAppData%\Blizzard Entertainment\System Survey|*.log;log.txt|RECURSE
FileKey9=%LocalAppData%\Blizzard Entertainment\Telemetry|*
FileKey10=%ProgramData%\Battle.net|*.log|RECURSE
FileKey11=%ProgramData%\Battle.net\*\Logs|*|RECURSE
FileKey12=%ProgramData%\Battle.net\Agent\Agent.*\Logs|*|RECURSE
FileKey13=%ProgramData%\Battle.net\Agent\data\*cache|*|RECURSE
FileKey14=%ProgramData%\Battle.net\Client\Blizzard Launcher.*\Logs|*|RECURSE
FileKey15=%ProgramData%\Battle.net\Setup\*\Logs|*
FileKey16=%ProgramData%\Battle.net\Telemetry|*
FileKey17=%ProgramData%\Battle.net_components\battlenet_helpersvc\Logs|*
FileKey18=%ProgramData%\Blizzard Entertainment\Battle.net\Cache|*|RECURSE
FileKey19=%ProgramFiles%\Blizzard App\Logs|*.log

[BDtoAVCHD *]
LangSecRef=3023
DetectFile=%ProgramFiles%\BDtoAVCHD
FileKey1=%ProgramFiles%\BDtoAVCHD\*ac3to|log.txt

[Be My Eyes *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt
FileKey1=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey3=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\AutoFill*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Avatars|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Crash Reports|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Crashpad|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Crowd Deny|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Download Service|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Extension State|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\File System|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey32=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\optimization*|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Sessions|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Local Traces|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\MEIPreload|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Optimization*|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\OriginTrials|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\PKIMetadata|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Safe Browsing|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\SafetyTips|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\SmartScreen|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Stability|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\Subresource Filter|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\WidevineCdm|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\Be My Eyes\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\LocalCache\Local\BeMyEyes\Be My Eyes\logs|*
FileKey67=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\Settings|*.log*
FileKey68=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\SystemAppData\Helium|*.log*
FileKey69=%LocalAppData%\Packages\BeMyEyes.BeMyEyes_7yeb8xxw19svt\TempState|*|REMOVESELF

[BeamNG.drive *]
Section=Games
DetectFile=%UserProfile%\Documents\BeamNG.drive
FileKey1=%UserProfile%\Documents\BeamNG.drive|*.log

[Beckhoff TwinCat *]
LangSecRef=3021
Detect=HKCU\Software\Beckhoff
FileKey1=%SystemDrive%\TwinCAT\3.1\Components\TcEventLogger\EventConfigurator|~evtCfgTmp*.html
FileKey2=%UserProfile%|*TwinCat*.log;TC*.log;TF*.log

[Behringer SYNTHTRIBE *]
LangSecRef=3023
DetectFile=%LocalAppData%\Behringer\Synthtribe
FileKey1=%LocalAppData%\Behringer\Synthtribe\Cache\qmlcache|*

[Belarc Advisor *]
LangSecRef=3024
Detect=HKCU\Software\Belarc
FileKey1=%ProgramFiles%\Belarc\*Advisor|*.bci;install.log
FileKey2=%ProgramFiles%\Belarc\*Advisor\System|Progress.Log
FileKey3=%ProgramFiles%\Belarc\*Advisor\System\Security\BelNotify|*.log
FileKey4=%ProgramFiles%\Belarc\*Advisor\System\Tmp|*

[Benthic PLEdit *]
LangSecRef=3024
Detect=HKCU\Software\Benthic\PLEdit32
RegKey1=HKCU\Software\Benthic\PLEdit32\RecentFiles

[Betrayer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\243120
FileKey1=%UserProfile%\Documents\Betrayer\UDKGame\Logs|*

[Big City Adventure *]
Section=Games
DetectFile=%ProgramData%\JollyBear\Big City Adventure *
FileKey1=%ProgramData%\JollyBear\Big City Adventure *|error.*

[Big Fish Games *]
Section=Games
Detect=HKCU\Software\Big Fish Games
FileKey1=%ProgramData%\Big Fish Games\Game Manager\resources-old|*|RECURSE
FileKey2=%ProgramData%\Big Fish\Game Manager\Addons\BFGameLauncher|*.log|RECURSE
FileKey3=%ProgramData%\BigFishCache|*.exe|RECURSE
FileKey4=%ProgramData%\BigFishCache\GameManager\log|*.txt|RECURSE
FileKey5=%ProgramData%\BigFishGamesCache\GameManager\log|*

[BiglyBT *]
LangSecRef=3022
Detect=HKCU\Software\BiglyBT
FileKey1=%AppData%\BiglyBT|ipfilter.cache
FileKey2=%AppData%\BiglyBT\active|*.bak
FileKey3=%AppData%\BiglyBT\logs|*
FileKey4=%AppData%\BiglyBT\tmp|*
FileKey5=%ProgramFiles%\BiglyBT|*.log|RECURSE

[BioShock Infinite *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\BioShock Infinite
FileKey1=%UserProfile%\Documents\My Games\BioShock Infinite\Benchmarks|*

[Bit Dungeon III *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\KintoGames\bd3
FileKey1=%UserProfile%\AppData\LocalLow\KintoGames\bd3\Unity|*|REMOVESELF

[BIT.TRIP *]
Section=Games
DetectFile=%LocalAppData%\BIT.TRIP *
FileKey1=%LocalAppData%\BIT.TRIP *|*.txt

[Bitcoin *]
LangSecRef=3022
DetectFile=%AppData%\Bitcoin
FileKey1=%AppData%\Bitcoin|*.log;*.old

[Bitdefender *]
LangSecRef=3024
Detect1=HKLM\Software\Bitdefender\Bitdefender Internet Security
Detect2=HKLM\Software\Bitdefender\Bitdefender Total Security
Detect3=HKLM\Software\Bitdefender\Bitdefender Total Security 2015
Detect4=HKLM\Software\Softwin\Bitdefender Antivirus
FileKey1=%AppData%\Bitdefender\Desktop\profiles\Logs\*|*.xml
FileKey2=%ProgramData%\Bitdefender\DTrace|*.log
FileKey3=%ProgramFiles%\Softwin\Bitdefender*\Logs|*
FileKey4=%SystemDrive%|bdlog.txt

[BitTorrent *]
LangSecRef=3022
DetectFile1=%AppData%\BitTorrent
DetectFile2=%ProgramFiles%\BitTorrent
FileKey1=%AppData%\BitTorrent\ie|*.tmp
FileKey2=%AppData%\BitTorrent\Updates|*.exe|REMOVESELF
FileKey3=%UserProfile%\AppData\LocalLow\BitTorrent|BitTorrent_*

[BitTorrent Incomplete Downloads *]
LangSecRef=3022
Detect=HKCU\Software\BitTorrent
FileKey1=%AppData%\BitTorrent\incomplete|*

[Bitwarden *]
LangSecRef=3024
DetectFile=%AppData%\Bitwarden
FileKey1=%AppData%\Bitwarden|*-journal;*.old;LOG;Network Persistent State;Visited Links|RECURSE
FileKey2=%AppData%\Bitwarden\*Cache|*|RECURSE
FileKey3=%AppData%\Bitwarden\Bitwarden\Logs|*
FileKey4=%AppData%\Bitwarden\blob_storage|*|RECURSE
FileKey5=%AppData%\Bitwarden\Logs|*
FileKey6=%LocalAppData%\Bitwarden-Updater|package.7z

[bkspot BatteryCare *]
LangSecRef=3024
DetectFile=%AppData%\BatteryCare
FileKey1=%AppData%\BatteryCare|log.txt

[BlackBeltPrivacy DarkNet *]
LangSecRef=3023
DetectFile=%LocalAppData%\BlackBeltPrivacy
FileKey1=%AppData%\i2pd|i2pd.log
FileKey2=%LocalAppData%\BlackBeltPrivacy\3rdParty|*|REMOVESELF
FileKey3=%LocalAppData%\BlackBeltPrivacy\DarkNet\logs|*|RECURSE
FileKey4=%LocalAppData%\BlackBeltPrivacy\Docs|*
FileKey5=%LocalAppData%\BlackBeltPrivacy\Logs|*|RECURSE
FileKey6=%LocalAppData%\BlackBeltPrivacy\MicroSip|MicroSIP.log
ExcludeKey1=FILE|%LocalAppData%\BlackBeltPrivacy\Docs\|readme.pdf

[BlackBerry Desktop *]
LangSecRef=3023
Detect=HKCU\Software\Research In Motion\BlackBerry
FileKey1=%AppData%|Rim*.log
FileKey2=%AppData%\Research In Motion\BlackBerry Desktop|*.dmp
FileKey3=%AppData%\Research In Motion\BlackBerry\AddinSync|sync.log
FileKey4=%AppData%\Research In Motion\BlackBerry\Intellisync|*.log|RECURSE
FileKey5=%LocalAppData%\Research In Motion\BlackBerry*Desktop\*\*|*.backup
FileKey6=%LocalAppData%\Research In Motion\BlackBerry*Desktop\*\*\Log|*.html
FileKey7=%LocalAppData%\Research In Motion\BlackBerry*Desktop\Logs|*|REMOVESELF

[Blackmagic Design DaVinci Resolve *]
LangSecRef=3023
Detect=HKCU\SOFTWARE\Blackmagic Design\DaVinci Resolve
FileKey1=%AppData%\Blackmagic Design\DaVinci Resolve\Support\logs|*|REMOVESELF
FileKey2=%ProgramData%\Blackmagic Design\DaVinci Resolve\Support\logs|*|REMOVESELF

[Blade Symphony *]
Section=Games
DetectFile=%ProgramFiles%\Steam\Steamapps\common\Blade Symphony
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Blade Symphony\workshop_temp|*|RECURSE

[Blades of Time *]
Section=Games
DetectFile=%LocalAppData%\BladesOfTime
FileKey1=%LocalAppData%\BladesOfTime\_debuginfo|*

[BleachBit *]
LangSecRef=3024
Detect=HKCU\Software\BleachBit
FileKey1=%ProgramFiles%\BleachBit|bleachbit.exe.log

[Blender *]
LangSecRef=3023
Detect=HKLM\Software\BlenderFoundation
FileKey1=%AppData%\Blender Foundation\Blender\*\config|recent-files.txt

[Blood Bowl: Legendary Edition *]
Section=Games
DetectFile=%UserProfile%\Documents\BloodBowlLegendary
FileKey1=%UserProfile%\Documents\BloodBowlLegendary|*.log
FileKey2=%UserProfile%\Documents\BloodBowlLegendary\Cache\3d|*|REMOVESELF
FileKey3=%UserProfile%\Documents\BloodBowlLegendary\Cache\DB|*|REMOVESELF

[Bloodstained: Ritual of the Night *]
Section=Games
DetectFile=%LocalAppData%\BloodstainedRotN
FileKey1=%LocalAppData%\BloodstainedRotN\Saved\Logs|*|RECURSE

[Blue Prince *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Dogubomb\BLUE PRINCE
FileKey1=%ProgramFiles%\Steam\steamapps\common\Blue Prince\MelonLoader|*.log|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\Dogubomb\BLUE PRINCE|*log

[Blueberry Software Camigo *]
LangSecRef=3023
DetectFile=%AppData%\Blueberry Software\Camigo
FileKey1=%AppData%\Blueberry Software\Camigo|*.bak;*stat.dat
FileKey2=%ProgramData%\Blueberry Software\Camigo\Logs|*|REMOVESELF
FileKey3=%ProgramFiles%\Blueberry Software\Camigo|*.log

[Blueberry Software FlashBack Express *]
LangSecRef=3023
DetectFile=%AppData%\Blueberry Software\FlashbackExpress*
FileKey1=%AppData%\Blueberry Software\FlashbackExpress*|*.bak;*stat.dat
FileKey2=%AppData%\Blueberry Software\FlashbackExpress*\RecordThumbs|*
FileKey3=%ProgramData%\Blueberry Software\FlashbackExpress*\Logs|*|REMOVESELF
FileKey4=%ProgramFiles%\Blueberry Software\Flashback Express *|*.log

[Blueberry Software FlashbackSDK *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Blueberry Software\FlashBack SDK 5
FileKey1=%ProgramFiles%\Blueberry Software\FlashBack SDK 5|install.log

[Blueberry Software FlashbackVideoConverter *]
LangSecRef=3023
DetectFile=%AppData%\Blueberry Software\FlashbackVideoConverter
FileKey1=%AppData%\Blueberry Software\FlashbackVideoConverter|*.bak;*stat.dat
FileKey2=%AppData%\Blueberry Software\FlashbackVideoConverter\*Thumbs|*
FileKey3=%ProgramData%\Blueberry Software\FlashbackVideoConverter\Logs|*|REMOVESELF
FileKey4=%ProgramFiles%\Blueberry Software\Flashback Video Converter|install.log

[BlueStacks *]
LangSecRef=3021
DetectFile1=%AppData%\bluestacks-services
DetectFile2=%ProgramData%\BlueStacks
FileKey1=%AppData%\bluestacks-services\*Cache|*|RECURSE
FileKey2=%LocalAppData%\BlueStacks|*.log
FileKey3=%LocalAppData%\bluestacks-services-updater|*
FileKey4=%LocalAppData%\BlueStacksSetup|BlueStacksInstaller*.exe
FileKey5=%LocalAppData%\HD-Player\cache|*|RECURSE
FileKey6=%ProgramData%\BlueStacks\CefData\Cache|*|RECURSE
FileKey7=%ProgramData%\BlueStacks\Engine|*.log*|RECURSE
FileKey8=%ProgramData%\BlueStacks\Logs|*.log|RECURSE
FileKey9=%ProgramData%\BlueStacks_nxt\Dumps|*|RECURSE
FileKey10=%ProgramData%\BlueStacksSetup|*.apk
FileKey11=%UserProfile%\Pictures\BlueStacks|*_Screenshot_*.jpg

[Bluetack Blocklist Manager *]
LangSecRef=3024
Detect=HKCU\Software\Bluetack\Blocklist Manager
FileKey1=%ProgramFiles%\Bluetack\Blocklist Manager\Cache|*

[Blumentals Easy GIF Animator *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Easy GIF Animator_is1
FileKey1=%ProgramFiles%\Easy GIF Animator|*.txt|RECURSE

[Boilsoft Video Joiner *]
LangSecRef=3023
DetectFile=%AppData%\Boilsoft Video Joiner
FileKey1=%AppData%\Boilsoft Video Joiner\*Cache|*|RECURSE
FileKey2=%AppData%\Boilsoft Video Joiner\tempDir|*|REMOVESELF
FileKey3=%LocalAppData%\boilsoft-video-joiner-updater|*

[Boilsoft Video Splitter *]
LangSecRef=3023
DetectFile=%AppData%\Boilsoft Video Splitter
FileKey1=%AppData%\Boilsoft Video Splitter\*Cache|*|RECURSE
FileKey2=%AppData%\Boilsoft Video Splitter\tempDir|*|REMOVESELF
FileKey3=%LocalAppData%\boilsoft-video-splitter-updater|*

[BOINC Manager *]
LangSecRef=3024
DetectFile=%LocalAppData%\BOINC Manager
FileKey1=%LocalAppData%\BOINC Manager\EBWebView\*Cache|*|RECURSE
FileKey2=%LocalAppData%\BOINC Manager\EBWebView\crashpad|*|RECURSE
FileKey3=%LocalAppData%\BOINC Manager\EBWebView\Default\*Cache|*|RECURSE
FileKey4=%ProgramData%\BOINC|std*.txt;time_stats_log
FileKey5=%ProgramFiles%\BOINC|stderr*.*;stdout*.*

[Borderlands *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Borderlands*
FileKey1=%UserProfile%\Documents\My Games\Borderlands*\WillowGame\Logs|*

[Borland C++ Builder 5.0 *]
LangSecRef=3024
Detect=HKCU\Software\Borland\C++Builder\5.0
RegKey1=HKCU\Software\Borland\C++Builder\5.0\Closed Files
RegKey2=HKCU\Software\Borland\C++Builder\5.0\Closed Projects
RegKey3=HKCU\Software\Borland\C++Builder\5.0\Session

[Borland Delphi 7 *]
LangSecRef=3024
Detect=HKCU\Software\Borland\Delphi\7.0
RegKey1=HKCU\Software\Borland\Delphi\7.0\Closed Files
RegKey2=HKCU\Software\Borland\Delphi\7.0\Closed Projects
RegKey3=HKCU\Software\Borland\Delphi\7.0\Session

[Borland Developer Studio 2006 *]
LangSecRef=3024
Detect=HKCU\Software\Borland\BDS\4.0
RegKey1=HKCU\Software\Borland\BDS\4.0\Closed Files
RegKey2=HKCU\Software\Borland\BDS\4.0\Closed Projects
RegKey3=HKCU\Software\Borland\BDS\4.0\Session

[Box Drive *]
LangSecRef=3021
DetectFile=%LocalAppData%\Box\Box
FileKey1=%LocalAppData%\Box\Box\logs|*
FileKey2=%ProgramData%\Box\Box\Logs|*

[Box For Office *]
LangSecRef=3021
DetectFile=%LocalAppData%\Box\BoxforOffice*
FileKey1=%LocalAppData%\Box\BoxforOfficeLogs|*

[Brave Origin Autofill Data & Search Engine Preferences *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|*Web Data
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\AutoFill*|*|REMOVESELF

[Brave Origin Autoplay Preferences *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\MEIPreload|*|REMOVESELF

[Brave Origin Bookmark Backups *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|Bookmarks.bak

[Brave Origin Bookmark Favicons *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|favicons*

[Brave Origin Caches *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data|Module Info Cache
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Optimization*|*|REMOVESELF

[Brave Origin Default App Handlers *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|PreferredApps

[Brave Origin Download History *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\shared_proto_db|*|REMOVESELF

[Brave Origin DRM Data *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\WidevineCdm|*|REMOVESELF

[Brave Origin Extension Cookies *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|Extension Cookies

[Brave Origin Pinned Tabs *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
RegKey1=HKCU\Software\BraveSoftware\Brave-Origin\PreferenceMACs\Default|pinned_tabs

[Brave Origin Privacy Sandbox *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data|*first_party_sets*
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Brave Origin Progressive Web Apps *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Web Applications|*|REMOVESELF

[Brave Origin Saved Usernames & Passwords *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|Login Data*

[Brave Origin Security & Threat Detection *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|DIPS*
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\ZxcvbnData|*|REMOVESELF

[Brave Origin Shopping Insights *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\parcel_tracking_db|*|REMOVESELF

[Brave Origin Storage Quota Manager *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|QuotaManager

[Brave Origin Sync Data *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Sync Data|*|REMOVESELF

[Brave Origin Telemetry *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\Application|debug.log
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\BraveSoftware\Brave-Origin\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|*.log
FileKey6=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\BraveSoftware\Brave-Origin\Application|debug.log
FileKey21=%ProgramFiles%\BraveSoftware\Brave-Origin\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\BraveSoftware\Brave-Origin\BlBeacon|failed_count
RegKey2=HKCU\Software\BraveSoftware\Brave-Origin\BlBeacon|state
RegKey3=HKCU\Software\BraveSoftware\Brave-Origin\Installer|LastChecked
RegKey4=HKCU\Software\BraveSoftware\Brave-Origin\StabilityMetrics

[Brave Origin Web Browsing Cookies *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Network|Cookies*;Device Bound Sessions*

[Brave Origin Web Browsing History *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Brave Origin Web Browsing Session *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Sessions|*|REMOVESELF

[Brave Origin Web Storage *]
Section=Brave Origin Web Browser
DetectFile=%LocalAppData%\BraveSoftware\Brave-Origin\User Data
FileKey1=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\BraveSoftware\Brave-Origin\User Data\*\WebStorage|*|REMOVESELF

[Bree AI *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\BREEAITECHPTE.LTD.BreeAI_z5nd0wyapdvva
FileKey1=%LocalAppData%\Packages\BREEAITECHPTE.LTD.BreeAI_z5nd0wyapdvva\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\BREEAITECHPTE.LTD.BreeAI_z5nd0wyapdvva\LocalCache\Local\BreeAI\Logs|*
FileKey3=%LocalAppData%\Packages\BREEAITECHPTE.LTD.BreeAI_z5nd0wyapdvva\Settings|*.log*
FileKey4=%LocalAppData%\Packages\BREEAITECHPTE.LTD.BreeAI_z5nd0wyapdvva\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\BREEAITECHPTE.LTD.BreeAI_z5nd0wyapdvva\TempState|*|REMOVESELF

[Breevy *]
LangSecRef=3021
DetectFile1=%AppData%\aBreevy8
DetectFile2=%AppData%\Breevy
FileKey1=%AppData%\aBreevy8\Backups|*
FileKey2=%AppData%\Breevy\Backups|*

[BreeZip *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\3138AweZip.AweZip_ffd303wmbhcjt
FileKey1=%LocalAppData%\Packages\3138AweZip.AweZip_ffd303wmbhcjt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\3138AweZip.AweZip_ffd303wmbhcjt\Settings|*.log*
FileKey3=%LocalAppData%\Packages\3138AweZip.AweZip_ffd303wmbhcjt\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\3138AweZip.AweZip_ffd303wmbhcjt\TempState|*|REMOVESELF

[BriskBard Autofill Data & Search Engine Preferences *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|*Web Data
FileKey2=%LocalAppData%\BriskBard\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard\AutoFill*|*|REMOVESELF
FileKey4=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|*Web Data
FileKey5=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\AutoFill*|*|REMOVESELF
FileKey6=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\AutoFill*|*|REMOVESELF

[BriskBard Autoplay Preferences *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\MEIPreload|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\MEIPreload|*|REMOVESELF

[BriskBard Bookmark Backups *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|Bookmarks.bak
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|Bookmarks.bak

[BriskBard Bookmark Favicons *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|favicons*
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|favicons*

[BriskBard Caches *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard|*-journal|RECURSE
FileKey2=%LocalAppData%\BriskBard|Module Info Cache
FileKey3=%LocalAppData%\BriskBard\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\BriskBard\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\BriskBard\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\BriskBard\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\BriskBard\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\BriskBard\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\BriskBard\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\BriskBard\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\BriskBard\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\BriskBard\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\BriskBard\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\BriskBard\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\BriskBard\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\BriskBard\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\BriskBard\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\BriskBard\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\BriskBard\Optimization*|*|REMOVESELF
FileKey20=%LocalAppData%\BriskBard\WebView\UserData\EBWebView|*-journal|RECURSE
FileKey21=%LocalAppData%\BriskBard\WebView\UserData\EBWebView|Module Info Cache
FileKey22=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey23=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\*Cache*|*|REMOVESELF
FileKey24=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\blob_storage|*|REMOVESELF
FileKey25=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\BudgetDatabase|*|REMOVESELF
FileKey26=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Download Service|*|REMOVESELF
FileKey27=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\File System|*|REMOVESELF
FileKey28=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\optimization*|*|REMOVESELF
FileKey31=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Platform Notifications|*|REMOVESELF
FileKey32=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Service Worker|*|REMOVESELF
FileKey33=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Shared Dictionary\cache|*|REMOVESELF
FileKey34=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey35=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*Cache*|*|REMOVESELF
FileKey37=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Avatars|*|REMOVESELF
FileKey38=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Optimization*|*|REMOVESELF

[BriskBard Default App Handlers *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|PreferredApps
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|PreferredApps

[BriskBard Download History *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|DownloadMetadata
FileKey2=%LocalAppData%\BriskBard\*\shared_proto_db|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|DownloadMetadata
FileKey4=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\shared_proto_db|*|REMOVESELF

[BriskBard DRM Data *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\WidevineCdm|*|REMOVESELF
FileKey4=%LocalAppData%\BriskBard\WidevineCdm|*|REMOVESELF

[BriskBard Extension Cookies *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|Extension Cookies
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|Extension Cookies

[BriskBard Privacy Sandbox *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard|*first_party_sets*
FileKey2=%LocalAppData%\BriskBard\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\BriskBard\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\BriskBard\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\BriskBard\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\BriskBard\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\BriskBard\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\BriskBard\TrustTokenKeyCommitments|*|REMOVESELF
FileKey9=%LocalAppData%\BriskBard\WebView\UserData\EBWebView|*first_party_sets*
FileKey10=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey11=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Network|Trust Tokens*
FileKey12=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey13=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey14=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey15=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey16=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF

[BriskBard Progressive Web Apps *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\Web Applications|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Web Applications|*|REMOVESELF

[BriskBard Saved Usernames & Passwords *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|Login Data*
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|Login Data*

[BriskBard Security & Threat Detection *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|DIPS*
FileKey2=%LocalAppData%\BriskBard\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\BriskBard\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\BriskBard\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\BriskBard\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\BriskBard\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\BriskBard\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\BriskBard\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\BriskBard\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\BriskBard\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|DIPS*
FileKey13=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\ClientCertificates|*|REMOVESELF
FileKey14=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Network|TransportSecurity*
FileKey15=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Safe Browsing Network|*|REMOVESELF
FileKey16=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey17=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Crowd Deny|*|REMOVESELF
FileKey18=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\PKIMetadata|*|REMOVESELF
FileKey19=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Safe Browsing|*|REMOVESELF
FileKey20=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\SafetyTips|*|REMOVESELF
FileKey21=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey22=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Subresource Filter|*|REMOVESELF
FileKey23=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey24=%LocalAppData%\BriskBard\ZxcvbnData|*|REMOVESELF

[BriskBard Shopping Insights *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\BriskBard\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\BriskBard\*\parcel_tracking_db|*|REMOVESELF
FileKey6=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\chrome_cart_db|*|REMOVESELF
FileKey7=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\commerce_subscription_db|*|REMOVESELF
FileKey8=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\coupon_db|*|REMOVESELF
FileKey9=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\discount*_db|*|REMOVESELF
FileKey10=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\parcel_tracking_db|*|REMOVESELF

[BriskBard Storage Quota Manager *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|QuotaManager
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|QuotaManager

[BriskBard Sync Data *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\Sync Data|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Sync Data|*|REMOVESELF

[BriskBard Telemetry *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\Application|debug.log
FileKey2=%LocalAppData%\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\BriskBard|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\BriskBard\*|*.log
FileKey6=%LocalAppData%\BriskBard\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\BriskBard\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\BriskBard\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\BriskBard\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\BriskBard\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\BriskBard\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\BriskBard\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\BriskBard\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\BriskBard\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\BriskBard\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\BriskBard\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\BriskBard\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\BriskBard\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\BriskBard\Stability|*|REMOVESELF
FileKey20=%LocalAppData%\BriskBard\WebView\UserData\Application|debug.log
FileKey21=%LocalAppData%\BriskBard\WebView\UserData\Application\SetupMetrics|*|REMOVESELF
FileKey22=%LocalAppData%\BriskBard\WebView\UserData\EBWebView|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey23=%LocalAppData%\BriskBard\WebView\UserData\EBWebView|*.pma;LOG;LOG.old|RECURSE
FileKey24=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|*.log
FileKey25=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\DataSharing|*|REMOVESELF
FileKey26=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey28=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\PersistentOriginTrials|*|REMOVESELF
FileKey29=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Site Characteristics Database|*|REMOVESELF
FileKey30=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\VideoDecodeStats|*|REMOVESELF
FileKey31=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\WebRTC Logs|*|REMOVESELF
FileKey32=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\WebrtcVideoStats|*|REMOVESELF
FileKey33=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey34=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Crash Reports|*|REMOVESELF
FileKey35=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Crashpad|*|REMOVESELF
FileKey36=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Local Traces|*|REMOVESELF
FileKey37=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\OriginTrials|*|REMOVESELF
FileKey38=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\Stability|*|REMOVESELF
FileKey39=%ProgramFiles%\Application|debug.log
FileKey40=%ProgramFiles%\Application\SetupMetrics|*|REMOVESELF
FileKey41=%ProgramFiles%\BriskBard\WebView\UserData\Application|debug.log
FileKey42=%ProgramFiles%\BriskBard\WebView\UserData\Application\SetupMetrics|*|REMOVESELF

[BriskBard Web Browsing Cookies *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\Network|Cookies*;Device Bound Sessions*
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Network|Cookies*;Device Bound Sessions*

[BriskBard Web Browsing History *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*
FileKey2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[BriskBard Web Browsing Session *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\*\Sessions|*|REMOVESELF
FileKey3=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Extension State|*|REMOVESELF
FileKey4=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Sessions|*|REMOVESELF

[BriskBard Web Storage *]
Section=BriskBard Web Browser
DetectFile1=%LocalAppData%\BriskBard
DetectFile2=%LocalAppData%\BriskBard\WebView\UserData\EBWebView
FileKey1=%LocalAppData%\BriskBard\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\BriskBard\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\BriskBard\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\BriskBard\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\BriskBard\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\BriskBard\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\BriskBard\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\BriskBard\*\WebStorage|*|REMOVESELF
FileKey9=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\IndexedDB|*|REMOVESELF
FileKey10=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Local Storage\*\IndexedDB\https*|*
FileKey11=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Local Storage\*\Session Storage|*
FileKey12=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey13=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Local Storage\*\WebStorage|*|RECURSE
FileKey14=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Local Storage\leveldb|*|REMOVESELF
FileKey15=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\Session Storage|*|REMOVESELF
FileKey16=%LocalAppData%\BriskBard\WebView\UserData\EBWebView\*\WebStorage|*|REMOVESELF

[Broadcom Wireless LAN Driver *]
LangSecRef=3021
DetectFile=%SystemDrive%\Drivers\Broadcom Wireless LAN Driver
FileKey1=%SystemDrive%\Drivers\Broadcom Wireless LAN Driver|*.log|RECURSE

[Broforce *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Free Lives\Broforce
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Broforce\*\Broforce Logs|*.csv
FileKey2=%UserProfile%\AppData\LocalLow\Free Lives\Broforce\Crashes|*|REMOVESELF
FileKey3=%UserProfile%\AppData\LocalLow\Free Lives\Broforce\Unity|*|REMOVESELF

[Brother P-touch *]
LangSecRef=3021
DetectFile=%LocalAppData%\Brother\P-touch Update Software
FileKey1=%LocalAppData%\Brother\P-touch Update Software|*.log

[Brother Printer Drivers *]
LangSecRef=3024
DetectFile=%ProgramData%\Brother
FileKey1=%ProgramData%\Brother\BrLog|*.log
FileKey2=%ProgramFiles%\Brother|*.tmp|RECURSE

[Brothers - A Tale of Two Sons *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225080
FileKey1=%UserProfile%\Documents\my games\UnrealEngine3\P13\Logs|*

[BrowserOS Autofill Data & Search Engine Preferences *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|*Web Data
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data\AutoFill*|*|REMOVESELF

[BrowserOS Autoplay Preferences *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\MEIPreload|*|REMOVESELF

[BrowserOS Bookmark Backups *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|Bookmarks.bak

[BrowserOS Bookmark Favicons *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|favicons*

[BrowserOS Caches *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data|Module Info Cache
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\BrowserOS\BrowserOS\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\BrowserOS\BrowserOS\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\BrowserOS\BrowserOS\User Data\Optimization*|*|REMOVESELF

[BrowserOS Default App Handlers *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|PreferredApps

[BrowserOS Download History *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\shared_proto_db|*|REMOVESELF

[BrowserOS DRM Data *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\WidevineCdm|*|REMOVESELF

[BrowserOS Extension Cookies *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|Extension Cookies

[BrowserOS Pinned Tabs *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
RegKey1=HKCU\Software\BrowserOS\BrowserOS\PreferenceMACs\Default|pinned_tabs

[BrowserOS Privacy Sandbox *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data|*first_party_sets*
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\BrowserOS\BrowserOS\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\BrowserOS\BrowserOS\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\BrowserOS\BrowserOS\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\BrowserOS\BrowserOS\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\BrowserOS\BrowserOS\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[BrowserOS Progressive Web Apps *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Web Applications|*|REMOVESELF

[BrowserOS Saved Usernames & Passwords *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|Login Data*

[BrowserOS Security & Threat Detection *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|DIPS*
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\BrowserOS\BrowserOS\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\BrowserOS\BrowserOS\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\BrowserOS\BrowserOS\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\BrowserOS\BrowserOS\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\BrowserOS\BrowserOS\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\BrowserOS\BrowserOS\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\BrowserOS\BrowserOS\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\BrowserOS\BrowserOS\User Data\ZxcvbnData|*|REMOVESELF

[BrowserOS Shopping Insights *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\parcel_tracking_db|*|REMOVESELF

[BrowserOS Storage Quota Manager *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|QuotaManager

[BrowserOS Sync Data *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Sync Data|*|REMOVESELF

[BrowserOS Telemetry *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\Application|debug.log
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\BrowserOS\BrowserOS\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|*.log
FileKey6=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\BrowserOS\BrowserOS\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\BrowserOS\BrowserOS\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\BrowserOS\BrowserOS\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\BrowserOS\BrowserOS\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\BrowserOS\BrowserOS\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\BrowserOS\BrowserOS\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\BrowserOS\BrowserOS\Application|debug.log
FileKey21=%ProgramFiles%\BrowserOS\BrowserOS\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\BrowserOS\BrowserOS\BlBeacon|failed_count
RegKey2=HKCU\Software\BrowserOS\BrowserOS\BlBeacon|state
RegKey3=HKCU\Software\BrowserOS\BrowserOS\Installer|LastChecked
RegKey4=HKCU\Software\BrowserOS\BrowserOS\StabilityMetrics

[BrowserOS Web Browsing Cookies *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Network|Cookies*;Device Bound Sessions*

[BrowserOS Web Browsing History *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[BrowserOS Web Browsing Session *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Sessions|*|REMOVESELF

[BrowserOS Web Storage *]
Section=BrowserOS Web Browser
DetectFile=%LocalAppData%\BrowserOS\BrowserOS\User Data
FileKey1=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\BrowserOS\BrowserOS\User Data\*\WebStorage|*|REMOVESELF

[BSPlayer *]
LangSecRef=3021
Detect1=HKCU\Software\BST\bsplayer
Detect2=HKCU\Software\BST\bsplayerv1
DetectFile1=%ProgramFiles%\BSPlayer
DetectFile2=%ProgramFiles%\Webteh\BSPlayer
FileKey1=%AppData%\BSplayer\*|unreg.log
FileKey2=%AppData%\BSplayer\AC3 Filter|Changes.txt
FileKey3=%AppData%\BSplayer\cache|*
FileKey4=%ProgramFiles%\BSPlayer|bugreport.txt
FileKey5=%ProgramFiles%\BSPlayer\lang|lang_changes.txt
FileKey6=%ProgramFiles%\Webteh\BSplayerPro|*.jpg
FileKey7=%ProgramFiles%\Webteh\BSplayerPro\cache|*.mpos

[Bugsplat *]
LangSecRef=3024
Detect=HKCU\Software\Bugsplat
RegKey1=HKCU\Software\Bugsplat\gaspowered\SupremeCommander
RegKey2=HKCU\Software\Bugsplat\lol_beta_riotgames_com\LOL_Public
RegKey3=HKCU\Software\Bugsplat\Pando_win\Pando
RegKey4=HKCU\Software\Bugsplat\Relic\CoH
RegKey5=HKCU\Software\Bugsplat\Relic\RelicDownloader

[Bulk Image Downloader *]
LangSecRef=3022
DetectFile=%LocalAppData%\Bulk Image Downloader
FileKey1=%AppData%\BID\cef\cache|*
FileKey2=%AppData%\BID\Log|*.log
FileKey3=%LocalAppData%\Bulk Image Downloader\BID_CEF|*.7z
FileKey4=%LocalAppData%\Bulk Image Downloader\BID_Chilkat|*.7z
RegKey1=HKCU\Software\Antibody Software\Bulk Image Downloader\frmBIM|edDir.Text
RegKey2=HKCU\Software\Antibody Software\Bulk Image Downloader\frmBIM|OpenDialog1.InitialDir
RegKey3=HKCU\Software\Antibody Software\Bulk Image Downloader\frmBIM|SaveDialog1.InitialDir

[Bullzip PDF Printer *]
LangSecRef=3022
DetectFile=%AppData%\PDF Writer\Bullzip PDF Printer
FileKey1=%AppData%\PDF Writer\Bullzip PDF Printer|user.ini

[Burger Shop *]
Section=Games
Detect1=HKCU\Software\GoBit\BurgerShop
Detect2=HKCU\Software\GoBit\BurgerShop2
FileKey1=%ProgramData%\GoBit Games\BurgerShop2\*\cached|*|REMOVESELF
FileKey2=%ProgramFiles%\Burger Shop|*.db;*.txt|RECURSE
FileKey3=%ProgramFiles%\Burger Shop\cached|*|REMOVESELF
FileKey4=%ProgramFiles%\GoBit Games\Burger Shop 2|*.db;*.txt|RECURSE

[Burn Zombie Burn! *]
Section=Games
Detect=HKLM\Software\Burn Zombie Burn
FileKey1=%ProgramFiles%\P2 Games\Burn Zombie Burn|*.log
FileKey2=%ProgramFiles%\P2 Games\Burn Zombie Burn\REQS\NET|*|REMOVESELF

[Bus-Simulator 2009 *]
Section=Games
DetectFile=%ProgramFiles%\Bus-Simulator 2009
FileKey1=%ProgramFiles%\Bus-Simulator 2009|*.dmp;*.log|RECURSE

[Business Objects Enterprise 11 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Business Objects\Business Objects Enterprise 11
FileKey1=%ProgramFiles%\Business Objects\Business Objects Enterprise 11\Logging|*

[ByteFence Anti-Malware *]
LangSecRef=3024
Detect=HKCU\Software\ByteFence\RTOP
FileKey1=%ProgramData%\ByteFence\RTOP|uclogfile.bin
FileKey2=%ProgramFiles%\ByteFence\Logs|*

[CA Security Center *]
LangSecRef=3021
Detect=HKLM\Software\CA\CAPF
FileKey1=%ProgramData%\CA|*.log;*.txt|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\CA\Consumer\APH|*.log

[Caesium Image Compressor *]
LangSecRef=3024
DetectFile=%LocalAppData%\SaeraSoft\Caesium Image Compressor
FileKey1=%AppData%\SaeraSoft\Caesium Image Compressor|*.log
FileKey2=%LocalAppData%\SaeraSoft\Caesium Image Compressor\cache|*

[Calendar Magic *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\EuroSoft\Calendar Magic
DetectFile2=%SystemDrive%\EuroSoft\Calendar Magic
FileKey1=%ProgramFiles%\EuroSoft\Calendar Magic|*.bak;debug.txt
FileKey2=%SystemDrive%\EuroSoft\Calendar Magic|*.bak;debug.txt

[Calibre *]
LangSecRef=3021
DetectFile=%LocalAppData%\calibre-cache
FileKey1=%LocalAppData%\calibre-cache|*|RECURSE
FileKey2=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\OffTheRecord\GPUCache|*|RECURSE
FileKey3=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup|Network Persistent State;Visited Links
FileKey4=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\blob_storage|*|RECURSE
FileKey5=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\GPUCache|*|RECURSE
FileKey6=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\Platform Notifications|*|RECURSE
FileKey7=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\Session Storage|*|RECURSE

[Calico *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Peachy Keen Games\Calico
FileKey1=%UserProfile%\AppData\LocalLow\Peachy Keen Games\Calico|*log
FileKey2=%UserProfile%\AppData\LocalLow\Peachy Keen Games\Calico\Unity|*|REMOVESELF

[Call of Atlantis *]
Section=Games
Detect=HKLM\Software\Playrix\Call of Atlantis
FileKey1=%ProgramData%\Playrix Entertainment\Call of Atlantis*\Log|*

[Call of Juarez *]
Section=Games
DetectFile=%UserProfile%\Documents\Call Of Juarez*
FileKey1=%UserProfile%\Documents\Call Of Juarez*\Out\logs|*.log|RECURSE

[Cameyo *]
LangSecRef=3021
Detect=HKCU\Software\VOS
FileKey1=%AppData%\VOS|*|REMOVESELF
RegKey1=HKCU\Software\VOS

[CamStudio *]
LangSecRef=3023
Detect=HKCU\Software\CamStudioOpenSource for Nick
FileKey1=%UserProfile%\Documents\My CamStudio Temp Files|*

[Camtasia *]
LangSecRef=3023
Detect=HKCU\Software\TechSmith\Camtasia Studio
FileKey1=%AppData%\TechSmith\CamtasiaStudio\Logs|*|RECURSE
FileKey2=%LocalAppData%\TechSmith\Camtasia Studio\*\Trackerbird_Files|tblog.log
FileKey3=%LocalAppData%\TechSmith\Logs|*|RECURSE
FileKey4=%ProgramData%\TechSmith\Camtasia Studio *\Library *\Temp|*|RECURSE
RegKey1=HKCU\Software\TechSmith\Camtasia Studio\8.0\Camtasia Recorder\8.0\General|lstLastSaveDir
RegKey2=HKCU\Software\TechSmith\Camtasia Studio\8.0\Camtasia Studio\8.0|ExportAsZipMru
RegKey3=HKCU\Software\TechSmith\Camtasia Studio\8.0\Camtasia Studio\8.0|FileSaveAsMru
RegKey4=HKCU\Software\TechSmith\Camtasia Studio\8.0\Camtasia Studio\8.0|MRUImportFolder
RegKey5=HKCU\Software\TechSmith\Camtasia Studio\8.0\Camtasia Studio\8.0|MRUOpenProjectFolder
RegKey6=HKCU\Software\TechSmith\Camtasia Studio\8.0\Camtasia Studio\8.0|RecentRecordingsMru
RegKey7=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Recorder\9.0\General|lstLastSaveDir
RegKey8=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|ExportAsZipMru
RegKey9=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|FileSaveAsMru
RegKey10=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|MRUImportFolder
RegKey11=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|MRUOpenProjectFolder
RegKey12=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|RecentRecordingsMru
RegKey13=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Recorder\18.0\General|lstLastSaveDir
RegKey14=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|ExportAsZipMru
RegKey15=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|FileSaveAsMru
RegKey16=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|MRUImportFolder
RegKey17=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|MRUOpenProjectFolder
RegKey18=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|RecentRecordingsMru

[Canon *]
LangSecRef=3021
DetectFile=%ProgramData%\CanonBJ\IJPrinter\CNMWindows
FileKey1=%ProgramData%\CanonBJ\IJPrinter\CNMWindows|*log*.*|RECURSE

[Canon Digital Photo Professional 4 *]
LangSecRef=3021
Detect=HKLM\Software\Canon_Inc_IC\DPP4
DetectFile=%ProgramFiles%\Canon\Digital Photo Professional 4
FileKey1=%AppData%\Canon_Inc_IC\DPP4\Application\Temp|*|RECURSE
FileKey2=%AppData%\Canon_Inc_IC\DPP4\DppMWare\Cache|*|RECURSE
FileKey3=%AppData%\Canon_Inc_IC\ServiceLog\AutoUpdateService|*.txt
FileKey4=%AppData%\Canon_Inc_IC\ServiceLog\imagebrowserexservice|*.txt
FileKey5=%ProgramData%\Canon_Inc_IC\UniversalInstaller\ServiceLog|*.TXT

[Canon PRINT *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\34791E63.CanonInkjetSmartConnect_6e5tt8cgb93ep
FileKey1=%LocalAppData%\Packages\34791E63.CanonInkjetSmartConnect_6e5tt8cgb93ep\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\34791E63.CanonInkjetSmartConnect_6e5tt8cgb93ep\Settings|*.log*
FileKey3=%LocalAppData%\Packages\34791E63.CanonInkjetSmartConnect_6e5tt8cgb93ep\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\34791E63.CanonInkjetSmartConnect_6e5tt8cgb93ep\TempState|*|REMOVESELF

[Canon Print Assistant *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\34791E63.CanonPrintAssistant_6e5tt8cgb93ep
FileKey1=%LocalAppData%\Packages\34791E63.CanonPrintAssistant_6e5tt8cgb93ep\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\34791E63.CanonPrintAssistant_6e5tt8cgb93ep\Settings|*.log*
FileKey3=%LocalAppData%\Packages\34791E63.CanonPrintAssistant_6e5tt8cgb93ep\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\34791E63.CanonPrintAssistant_6e5tt8cgb93ep\TempState|*|REMOVESELF

[Canon Zoom Browser *]
LangSecRef=3021
Detect=HKCU\Software\Canon\ZoomBrowser Ex
DetectFile1=%AppData%\ZoomBrowser EX
DetectFile2=%UserProfile%\Pictures\My Pictures\ZbThumbnail.info
DetectFile3=%UserProfile%\Pictures\ZbThumbnail.info
FileKey1=%UserProfile%\Pictures|ZbThumbnail.info|RECURSE

[Caphyon *]
LangSecRef=3024
DetectFile=%ProgramData%\Caphyon
FileKey1=%ProgramData%\Caphyon|*|REMOVESELF

[Caprine *]
LangSecRef=3022
DetectFile=%AppData%\Caprine
FileKey1=%AppData%\Caprine|*-journal;LOG;LOG.old;Network Persistent State|RECURSE
FileKey2=%AppData%\Caprine\*Cache|*|RECURSE
FileKey3=%AppData%\Caprine\blob_storage|*|RECURSE
FileKey4=%AppData%\Caprine\Caprine\logs|*
FileKey5=%AppData%\Caprine\logs|*
FileKey6=%AppData%\Caprine\Session Storage|*|RECURSE
FileKey7=%LocalAppData%\caprine-updater|*|RECURSE

[Captcha Brotherhood *]
LangSecRef=3024
DetectFile=%LocalAppData%\Captcha_Brotherhood
FileKey1=%LocalAppData%\Captcha_Brotherhood|*log*.txt

[CareUEyes *]
LangSecRef=3021
DetectFile=%AppData%\careueyes
FileKey1=%AppData%\careueyes\log|*

[Casper *]
LangSecRef=3024
DetectFile=%ProgramData%\Future Systems Solutions\Casper
FileKey1=%ProgramData%\Future Systems Solutions\Casper\Minidump|*

[Castle of Illusion *]
Section=Games
DetectFile=%ProgramFiles%\Castle of Illusion
FileKey1=%ProgramFiles%\Castle of Illusion\_CommonRedist\vcredist\*|vc*redist_x*.exe

[Casual Arts *]
Section=Games
DetectFile=%AppData%\CasualArts
FileKey1=%AppData%\casualArts\*|*.txt;logfile.*|RECURSE
FileKey2=%ProgramData%\casualArts|*|REMOVESELF

[Cave Story+ *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\200900
FileKey1=%ProgramFiles%\Steam\steamapps\common\cave story+|log.txt
FileKey2=%ProgramFiles%\Steam\steamapps\common\cave story+\data|*.DS_STORE|RECURSE

[CC Magic *]
Section=Games
DetectFile=%UserProfile%\Documents\Electronic Arts\CC Magic\Logs
FileKey1=%UserProfile%\Documents\Electronic Arts\CC Magic\Logs|*.log|RECURSE

[CCDump *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CCleaner\CCDump.exe
FileKey1=%ProgramFiles%\CCleaner|regkeys.output.txt;winapp.ini;winreg.ini;winsys.ini

[CCleaner *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\CCleaner
DetectFile1=%AppData%\CCleaner
DetectFile2=%ProgramFiles%\CCleaner Network\Management Server
FileKey1=%AppData%\CCleaner\Dumps|*
FileKey2=%AppData%\CCleaner\EBWebView\*cache|*|RECURSE
FileKey3=%AppData%\CCleaner\EBWebView\BrowserMetrics|*
FileKey4=%AppData%\CCleaner\EBWebView\crashpad|*|RECURSE
FileKey5=%AppData%\CCleaner\EBWebView\Default|*.log
FileKey6=%AppData%\CCleaner\Logs|*
FileKey7=%AppData%\CCleanr\EBWebView\Default\*Cache|*|RECURSE
FileKey8=%ProgramData%\Gibraltar\Local Logs\CCleaner Network|*.glf
FileKey9=%ProgramData%\Piriform\CCleaner 7\log|*
FileKey10=%ProgramData%\Piriform\Icarus\Logs|*|RECURSE
FileKey11=%ProgramFiles%\CCleaner|*.dmp;*.log;CCleaner_log*.txt;gcapi_*.dll|RECURSE
FileKey12=%ProgramFiles%\CCleaner Network\Management Server\Logs|*
FileKey13=%ProgramFiles%\CCleaner\Data\log|*
FileKey14=%ProgramFiles%\CCleaner\LOG|*
FileKey15=%ProgramFiles%\CCleaner\Setup|*|REMOVESELF
FileKey16=%ProgramFiles%\CCleaner\temp_ccupdate|*|REMOVESELF
FileKey17=%ProgramFiles%\Piriform\CCleaner 7\data\log|*
FileKey18=%ProgramFiles%\Piriform\CCleaner 7\log|*
FileKey19=%UserProfile%|CCleaner_log*.txt
RegKey1=HKLM\Software\Piriform\CCleaner|(Cfg)ABTestingNames
RegKey2=HKLM\Software\Piriform\CCleaner|(Cfg)DTNP
RegKey3=HKLM\Software\Piriform\CCleaner|(Cfg)DUNP
RegKey4=HKLM\Software\Piriform\CCleaner|(Cfg)LastUpdate
RegKey5=HKLM\Software\Piriform\CCleaner|BCD
RegKey6=HKLM\Software\Piriform\CCleaner|FTU
RegKey7=HKLM\Software\Piriform\CCleaner|GD
RegKey8=HKLM\Software\Piriform\CCleaner|LatestICS
RegKey9=HKLM\Software\Piriform\CCleaner|LLSR
RegKey10=HKLM\Software\Piriform\CCleaner|PPC
RegKey11=HKLM\Software\Piriform\CCleaner|RunICS
RegKey12=HKLM\Software\Piriform\CCleaner|StateSig
RegKey13=HKLM\Software\Piriform\CCleaner|STS
RegKey14=HKLM\Software\Piriform\CCleaner|UpdateKey

[CCleaner Browser Autofill Data & Search Engine Preferences *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\CCleaner Browser\User Data\AutoFill*|*|REMOVESELF

[CCleaner Browser Autoplay Preferences *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\MEIPreload|*|REMOVESELF

[CCleaner Browser Bookmark Backups *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|Bookmarks.bak

[CCleaner Browser Bookmark Favicons *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|favicons*

[CCleaner Browser Caches *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\CCleaner Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\CCleaner Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\CCleaner Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\CCleaner Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\CCleaner Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\CCleaner Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\CCleaner Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\CCleaner Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\CCleaner Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\CCleaner Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\CCleaner Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\CCleaner Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\CCleaner Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\CCleaner Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\CCleaner Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\CCleaner Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\CCleaner Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\CCleaner Browser\User Data\Optimization*|*|REMOVESELF

[CCleaner Browser Default App Handlers *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|PreferredApps

[CCleaner Browser Download History *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*\shared_proto_db|*|REMOVESELF

[CCleaner Browser DRM Data *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\CCleaner Browser\User Data\WidevineCdm|*|REMOVESELF

[CCleaner Browser Extension Cookies *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|Extension Cookies

[CCleaner Browser Pinned Tabs *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
RegKey1=HKCU\Software\Piriform\Browser\PreferenceMACs\Default|pinned_tabs

[CCleaner Browser Privacy Sandbox *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\CCleaner Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\CCleaner Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\CCleaner Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\CCleaner Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\CCleaner Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\CCleaner Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[CCleaner Browser Progressive Web Apps *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\Web Applications|*|REMOVESELF

[CCleaner Browser Saved Usernames & Passwords *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|Login Data*

[CCleaner Browser Security & Threat Detection *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\CCleaner Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\CCleaner Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\CCleaner Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\CCleaner Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\CCleaner Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\CCleaner Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\CCleaner Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\CCleaner Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\CCleaner Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\CCleaner Browser\User Data\ZxcvbnData|*|REMOVESELF

[CCleaner Browser Shopping Insights *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\CCleaner Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\CCleaner Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\CCleaner Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[CCleaner Browser Storage Quota Manager *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|QuotaManager

[CCleaner Browser Sync Data *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\Sync Data|*|REMOVESELF

[CCleaner Browser Telemetry *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\Application|debug.log
FileKey2=%LocalAppData%\CCleaner Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\CCleaner Browser\CrashReports|*|REMOVESELF
FileKey4=%LocalAppData%\CCleaner Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey5=%LocalAppData%\CCleaner Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\CCleaner Browser\User Data\*|*.log
FileKey7=%LocalAppData%\CCleaner Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey8=%LocalAppData%\CCleaner Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey9=%LocalAppData%\CCleaner Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey10=%LocalAppData%\CCleaner Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey11=%LocalAppData%\CCleaner Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey12=%LocalAppData%\CCleaner Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey13=%LocalAppData%\CCleaner Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey14=%LocalAppData%\CCleaner Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey15=%LocalAppData%\CCleaner Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey16=%LocalAppData%\CCleaner Browser\User Data\Crash Reports|*|REMOVESELF
FileKey17=%LocalAppData%\CCleaner Browser\User Data\Crashpad|*|REMOVESELF
FileKey18=%LocalAppData%\CCleaner Browser\User Data\Local Traces|*|REMOVESELF
FileKey19=%LocalAppData%\CCleaner Browser\User Data\OriginTrials|*|REMOVESELF
FileKey20=%LocalAppData%\CCleaner Browser\User Data\Stability|*|REMOVESELF
FileKey21=%ProgramFiles%\CCleaner Browser\Application|debug.log
FileKey22=%ProgramFiles%\CCleaner Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Piriform\Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\Piriform\Browser\BlBeacon|state
RegKey3=HKCU\Software\Piriform\Browser\Installer|LastChecked
RegKey4=HKCU\Software\Piriform\Browser\StabilityMetrics

[CCleaner Browser Web Browsing Cookies *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[CCleaner Browser Web Browsing History *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[CCleaner Browser Web Browsing Session *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*\Sessions|*|REMOVESELF

[CCleaner Browser Web Storage *]
LangSecRef=3032
DetectFile=%LocalAppData%\CCleaner Browser\User Data
FileKey1=%LocalAppData%\CCleaner Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\CCleaner Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\CCleaner Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\CCleaner Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\CCleaner Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\CCleaner Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\CCleaner Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\CCleaner Browser\User Data\*\WebStorage|*|REMOVESELF

[CCTV Security *]
LangSecRef=3021
DetectFile=%ProgramFiles%\CCTV Security
FileKey1=%ProgramFiles%\CCTV Security\Log|*

[CD-R Diagnostic *]
LangSecRef=3024
Detect=HKCU\Software\CDROM_Productions\CDRDIAG
FileKey1=%ProgramFiles%\CDRDiagnostic|*.cnt
FileKey2=%UserProfile%\Documents|ERRORLOG.TXT
RegKey1=HKCU\Software\CDROM_Productions\CDRDIAG|LastCopyDir
RegKey2=HKCU\Software\CDROM_Productions\CDRDIAG|LastDevice

[CDBurnerXP *]
LangSecRef=3024
Detect=HKCU\Software\Canneverbe Limited\CDBurnerXP
FileKey1=%AppData%\Canneverbe Limited\CDBurnerXP|*.log

[CDex *]
LangSecRef=3024
Detect=HKLM\Software\CDex
FileKey1=%UserProfile%\Music\CDDB|*.txt

[CefSharp *]
LangSecRef=3022
DetectFile=%LocalAppData%\CefSharp
FileKey1=%LocalAppData%\CefSharp\Cache|*|RECURSE

[Cent Browser Autofill Data & Search Engine Preferences *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|*Web Data
FileKey2=%LocalAppData%\CentBrowser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\CentBrowser\User Data\AutoFill*|*|REMOVESELF

[Cent Browser Autoplay Preferences *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\MEIPreload|*|REMOVESELF

[Cent Browser Bookmark Backups *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|Bookmarks.bak

[Cent Browser Bookmark Favicons *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|favicons*

[Cent Browser Caches *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\CentBrowser\User Data|Module Info Cache
FileKey3=%LocalAppData%\CentBrowser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\CentBrowser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\CentBrowser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\CentBrowser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\CentBrowser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\CentBrowser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\CentBrowser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\CentBrowser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\CentBrowser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\CentBrowser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\CentBrowser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\CentBrowser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\CentBrowser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\CentBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\CentBrowser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\CentBrowser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\CentBrowser\User Data\Optimization*|*|REMOVESELF

[Cent Browser Default App Handlers *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|PreferredApps

[Cent Browser Download History *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\CentBrowser\User Data\*\shared_proto_db|*|REMOVESELF

[Cent Browser DRM Data *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\CentBrowser\User Data\WidevineCdm|*|REMOVESELF

[Cent Browser Extension Cookies *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|Extension Cookies

[Cent Browser Pinned Tabs *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
RegKey1=HKCU\Software\CentBrowser\PreferenceMACs\Default|pinned_tabs

[Cent Browser Privacy Sandbox *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\CentBrowser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\CentBrowser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\CentBrowser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\CentBrowser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\CentBrowser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\CentBrowser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\CentBrowser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Cent Browser Progressive Web Apps *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\Web Applications|*|REMOVESELF

[Cent Browser Saved Usernames & Passwords *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|Login Data*

[Cent Browser Security & Threat Detection *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|DIPS*
FileKey2=%LocalAppData%\CentBrowser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\CentBrowser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\CentBrowser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\CentBrowser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\CentBrowser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\CentBrowser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\CentBrowser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\CentBrowser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\CentBrowser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\CentBrowser\User Data\ZxcvbnData|*|REMOVESELF

[Cent Browser Shopping Insights *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\CentBrowser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\CentBrowser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\CentBrowser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\CentBrowser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Cent Browser Storage Quota Manager *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|QuotaManager

[Cent Browser Sync Data *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\Sync Data|*|REMOVESELF

[Cent Browser Telemetry *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\Application|debug.log
FileKey2=%LocalAppData%\CentBrowser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\CentBrowser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\CentBrowser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\CentBrowser\User Data\*|*.log
FileKey6=%LocalAppData%\CentBrowser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\CentBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\CentBrowser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\CentBrowser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\CentBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\CentBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\CentBrowser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\CentBrowser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\CentBrowser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\CentBrowser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\CentBrowser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\CentBrowser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\CentBrowser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\CentBrowser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\CentBrowser\Application|debug.log
FileKey21=%ProgramFiles%\CentBrowser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\CentBrowser\BlBeacon|failed_count
RegKey2=HKCU\Software\CentBrowser\BlBeacon|state
RegKey3=HKCU\Software\CentBrowser\Installer|LastChecked
RegKey4=HKCU\Software\CentBrowser\StabilityMetrics

[Cent Browser Web Browsing Cookies *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Cent Browser Web Browsing History *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Cent Browser Web Browsing Session *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\CentBrowser\User Data\*\Sessions|*|REMOVESELF

[Cent Browser Web Storage *]
Section=CentBrowser Web Browser
DetectFile=%LocalAppData%\CentBrowser\User Data
FileKey1=%LocalAppData%\CentBrowser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\CentBrowser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\CentBrowser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\CentBrowser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\CentBrowser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\CentBrowser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\CentBrowser\User Data\*\WebStorage|*|REMOVESELF

[Centarsia *]
LangSecRef=3021
Detect=HKCU\Software\Centarsia
RegKey1=HKCU\Software\Centarsia|RecentImage0
RegKey2=HKCU\Software\Centarsia|RecentImage1
RegKey3=HKCU\Software\Centarsia|RecentImage2
RegKey4=HKCU\Software\Centarsia|RecentImage3
RegKey5=HKCU\Software\Centarsia|RecentImage4
RegKey6=HKCU\Software\Centarsia|RecentImage5
RegKey7=HKCU\Software\Centarsia|RecentImage6

[Ceville *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\23460
FileKey1=%AppData%|ceville_console_history.txt
FileKey2=%UserProfile%\Documents\Ceville\logs|*

[CFE Exam Prep Course *]
LangSecRef=3021
DetectFile=%ProgramFiles%\CFE Exam Prep Course
FileKey1=%AppData%\ACFEExamPrep|*.log
FileKey2=%ProgramFiles%\CFE Exam Prep Course\Log|*|RECURSE

[cFosSpeed *]
LangSecRef=3022
DetectFile=%ProgramData%\cFos\cFosSpeed
FileKey1=%ProgramData%\cFos\cFosSpeed\Logs|*.ini

[Chameleon *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\Chameleon Files
FileKey1=%UserProfile%\Documents\Chameleon Files\Cache|*|RECURSE
FileKey2=%UserProfile%\Documents\Chameleon Files\Log|*|RECURSE

[Chameleon Clock *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Chameleon Clock
FileKey1=%ProgramFiles%\Chameleon Clock|clock.lo0.txt

[Chameleon Startup Manager *]
LangSecRef=3024
Detect=HKCU\Software\NeoSoftTools\System Manager
RegKey1=HKCU\Software\NeoSoftTools\System Manager\Common\FileInfo

[Champions Online *]
Section=Games
Detect1=HKCU\Software\Cryptic\Champions Online
Detect2=HKCU\Software\Valve\Steam\Apps\9880
FileKey1=%ProgramFiles%\Steam\Steamapps\Common\Champions Online\*\Logs\GameClient|*
FileKey2=%ProgramFiles%\Steam\Steamapps\Common\Champions Online\Champions Online\*\Cache|*
FileKey3=%Public%\Games\cryptic studios\Champions Online\*\Cache|*
FileKey4=%Public%\Games\cryptic studios\Champions Online\*\Logs\GameClient|*

[Cheat Engine *]
LangSecRef=3021
Detect=HKCU\Software\Cheat Engine
FileKey1=%ProgramFiles%\Cheat Engine*|*.tmp
RegKey1=HKCU\SOFTWARE\Cheat Engine|Recent Files

[CheatBook *]
LangSecRef=3021
Detect=HKLM\Software\CheatBook
FileKey1=%ProgramFiles%\Cheatbook Database *|*log.txt

[Chicken Hunter *]
Section=Games
Detect=HKLM\Software\Chicken Hunter
FileKey1=%ProgramFiles%\Chicken Hunter|debug.txt

[Chicken Invaders *]
Section=Games
DetectFile1=%AppData%\InterAction studios\CI3demo
DetectFile2=%ProgramData%\InterAction studios\CI2rmdemo
DetectFile3=%ProgramFiles%\Chicken*Invaders*
FileKey1=%AppData%\InterAction studios|*.log|RECURSE
FileKey2=%ProgramData%\InterAction studios|*.log|RECURSE
FileKey3=%ProgramFiles%\*\Chicken Invaders*|*.html;*.log;*.png|RECURSE
FileKey4=%ProgramFiles%\Chicken*Invaders*|*.log|RECURSE

[Children of the Nile *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17100
FileKey1=%UserProfile%\Documents\Tilted Mill\Children of the Nile|*.log

[Chivalry: Medieval Warfare *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219640
FileKey1=%UserProfile%\Documents\My Games\Chivalry Medieval Warfare*\UDKGame\Logs|*

[Chocolatey *]
LangSecRef=3024
DetectFile1=%ProgramData%\chocolatey
DetectFile2=%ProgramData%\chocoportable
FileKey1=%AppData%\ChocolateyGUI\Logs|*
FileKey2=%ProgramData%\chocolatey\lib\*|*.txt
FileKey3=%ProgramData%\chocolatey\logs|*.log
FileKey4=%ProgramData%\chocoportable\logs|*
FileKey5=%UserProfile%\.chocolatey\http-cache|*|RECURSE

[ChomikBox *]
LangSecRef=3022
DetectFile=%LocalAppData%\ChomikBox
FileKey1=%LocalAppData%\ChomikBox|*.log;queue-download-*.ini
FileKey2=%LocalAppData%\ChomikBox\Backup|*.log
FileKey3=%LocalAppData%\ChomikBox\Cache\Thumbs|*

[Christmas Adventure: Candy Storm *]
Section=Games
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Adventure - Candy Storm1.1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Adventure - Candy Stormv1.3
DetectFile=%ProgramFiles%\Christmas Adventure - Candy Storm
FileKey1=%AppData%\Argali|*.log|RECURSE
FileKey2=%ProgramFiles%\Christmas Adventure - Candy Storm|*.nfo;*.txt
FileKey3=%ProgramFiles%\Foxy Games\Christmas Adventure - Candy Storm|*.html;*.msi;*.nfo;*.txt;*.url

[Christmas Griddlers 2014 *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Griddlers 20141.1
FileKey1=%ProgramFiles%\*\Christmas Griddlers*|*.html;*.ico;*.nfo;*.txt;*.url;*msi|RECURSE
FileKey2=%ProgramFiles%\Christmas Griddlers*|*.html;*.ico;*.nfo;*.txt;*.url;*msi|RECURSE

[Christmas Wonderland *]
Section=Games
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 2
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 3 1.0
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 4 1.0.4
Detect4=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 21.0
Detect5=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 31.0
Detect6=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 41.1
FileKey1=%ProgramFiles%\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE
FileKey2=%ProgramFiles%\Foxy Games\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE
FileKey3=%SystemDrive%\Games\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE

[Chroma Squad *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad
FileKey1=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad|*txt
FileKey2=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad\Crashes|*
FileKey3=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad\Unity|*|REMOVESELF

[Chromium Autofill Data & Search Engine Preferences *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|*Web Data
FileKey2=%LocalAppData%\Chromium\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Chromium\User Data\AutoFill*|*|REMOVESELF

[Chromium Autoplay Preferences *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\MEIPreload|*|REMOVESELF

[Chromium Bookmark Backups *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|Bookmarks.bak

[Chromium Bookmark Favicons *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|favicons*

[Chromium Caches *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Chromium\User Data|Module Info Cache
FileKey3=%LocalAppData%\Chromium\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Chromium\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Chromium\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Chromium\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Chromium\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Chromium\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Chromium\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Chromium\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Chromium\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Chromium\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Chromium\User Data\*\Search Logos|*|REMOVESELF
FileKey14=%LocalAppData%\Chromium\User Data\*\Service Worker|*|REMOVESELF
FileKey15=%LocalAppData%\Chromium\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey16=%LocalAppData%\Chromium\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Chromium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey18=%LocalAppData%\Chromium\User Data\*Cache*|*|REMOVESELF
FileKey19=%LocalAppData%\Chromium\User Data\Avatars|*|REMOVESELF
FileKey20=%LocalAppData%\Chromium\User Data\Optimization*|*|REMOVESELF

[Chromium Default App Handlers *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|PreferredApps

[Chromium Download History *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Chromium\User Data\*\shared_proto_db|*|REMOVESELF

[Chromium DRM Data *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Chromium\User Data\WidevineCdm|*|REMOVESELF

[Chromium Embedded Framework *]
LangSecRef=3022
DetectFile=%LocalAppData%\CEF\User Data
FileKey1=%LocalAppData%\CEF\User Data|*.pma

[Chromium Extension Cookies *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|Extension Cookies

[Chromium Pinned Tabs *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
RegKey1=HKCU\Software\Chromium\PreferenceMACs\Default|pinned_tabs

[Chromium Privacy Sandbox *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Chromium\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Chromium\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Chromium\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Chromium\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Chromium\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Chromium\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Chromium\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Chromium Progressive Web Apps *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\Web Applications|*|REMOVESELF

[Chromium Saved Usernames & Passwords *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|Login Data*

[Chromium Security & Threat Detection *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|DIPS*
FileKey2=%LocalAppData%\Chromium\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Chromium\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Chromium\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Chromium\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Chromium\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Chromium\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Chromium\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Chromium\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Chromium\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Chromium\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Chromium\User Data\ZxcvbnData|*|REMOVESELF

[Chromium Shopping Insights *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Chromium\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Chromium\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Chromium\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Chromium\User Data\*\parcel_tracking_db|*|REMOVESELF

[Chromium Storage Quota Manager *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|QuotaManager

[Chromium Sync Data *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\Sync Data|*|REMOVESELF

[Chromium Telemetry *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\Application|debug.log
FileKey2=%LocalAppData%\Chromium\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Chromium\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Chromium\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*|*.log
FileKey6=%LocalAppData%\Chromium\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Chromium\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Chromium\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Chromium\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Chromium\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Chromium\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Chromium\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Chromium\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Chromium\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Chromium\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Chromium\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Chromium\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Chromium\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Chromium\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Chromium\Application|debug.log
FileKey21=%ProgramFiles%\Chromium\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Chromium\BlBeacon|failed_count
RegKey2=HKCU\Software\Chromium\BlBeacon|state
RegKey3=HKCU\Software\Chromium\Installer|LastChecked
RegKey4=HKCU\Software\Chromium\StabilityMetrics

[Chromium Web Browsing Cookies *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\Network|Cookies*;Device Bound Sessions*

[Chromium Web Browsing History *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Chromium Web Browsing Session *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Chromium\User Data\*\Sessions|*|REMOVESELF

[Chromium Web Storage *]
Section=Chromium Web Browser
DetectFile=%LocalAppData%\Chromium\User Data
FileKey1=%LocalAppData%\Chromium\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Chromium\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Chromium\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Chromium\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Chromium\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Chromium\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Chromium\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Chromium\User Data\*\WebStorage|*|REMOVESELF

[Chronos Atomic Clock Synchronizer *]
LangSecRef=3024
Detect=HKLM\Software\Chronos
RegKey1=HKLM\Software\Chronos|LastCorrectionTime
RegKey2=HKLM\Software\Chronos|LastCorrectionValue

[Chuzzle Deluxe *]
Section=Games
DetectFile=%ProgramFiles%\HP Games\Chuzzle Deluxe
FileKey1=%ProgramFiles%\HP Games\Chuzzle Deluxe|DEBUG.TXT

[Cinema Tycoon *]
Section=Games
DetectFile=%ProgramFiles%\Cinema Tycoon*
FileKey1=%ProgramFiles%\Cinema Tycoon*|*.txt;flashplayer7_winax.exe

[Cisco Connect *]
LangSecRef=3022
DetectFile=%ProgramData%\Cisco Systems\Cisco Connect
FileKey1=%ProgramData%\Cisco Systems\Cisco Connect\Log|*

[Cisco HostScan *]
LangSecRef=3021
DetectFile=%LocalAppData%\Cisco\Cisco HostScan
FileKey1=%LocalAppData%\Cisco\Cisco HostScan\log|*.log

[Cisco VPN *]
LangSecRef=3022
DetectFile=%UserProfile%\.cisco\VPN
FileKey1=%UserProfile%\.cisco\VPN\Log|*.txt

[Cisco WebEx *]
LangSecRef=3022
DetectFile=%LocalAppData%\WebEx
FileKey1=%LocalAppData%\CiscoSparkLauncher|*
FileKey2=%LocalAppData%\WebEx|webex_*.ini.bk
FileKey3=%LocalAppData%\WebEx\wbxcache|*|RECURSE

[Cities in Motion *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\73010
FileKey1=%UserProfile%\Documents\Cities in Motion|log_metro.txt

[Citrix Online Plug-in Web Setup Files *]
LangSecRef=3021
Detect=HKLM\Software\Citrix\ICA Client
FileKey1=%ProgramData%\Citrix\Citrix Online Plug-in - Web|*.cab;*.msi;eula*.rtf

[Citrix Receiver *]
LangSecRef=3021
Detect=HKLM\Software\Citrix\ICA Client
DetectFile=%LocalAppData%\Citrix\Receiver
FileKey1=%AppData%\Citrix\ICA Client\Cache|*|RECURSE
FileKey2=%AppData%\ICAClient|wfcwin*.log
FileKey3=%AppData%\ICAClient\Cache|*|RECURSE
FileKey4=%LocalAppData%\Citrix\AuthManager\Logs|*
FileKey5=%LocalAppData%\Citrix\Citrix Files\Logs|*
FileKey6=%LocalAppData%\Citrix\Receiver|*.log*;ErrorLog.xml
FileKey7=%LocalAppData%\Citrix\SelfService\Temp|*
FileKey8=%ProgramFiles%\Citrix\ICA Client|wfclient.log
RegKey1=HKLM\Software\Citrix\ICA Client\Default

[Civilization *]
Section=Games
Detect1=HKCU\Software\Firaxis\Civilization5
Detect2=HKLM\Software\Firaxis Games
DetectFile=%AppData%\My Games\Civilizaton 4
FileKey1=%AppData%\My Games\Beyond the Sword\cache|*.dat
FileKey2=%AppData%\My Games\Civilizaton 4\Cache|*|RECURSE
FileKey3=%AppData%\My Games\Sid Meier's Civilization*\cache|*.dat
FileKey4=%AppData%\My Games\Warlords\cache|*.dat
FileKey5=%LocalAppData%\My Games\Beyond the Sword\cache|*.dat
FileKey6=%LocalAppData%\My Games\Sid Meier's Civilization*\cache|*.dat
FileKey7=%LocalAppData%\My Games\Warlords\cache|*.dat
FileKey8=%ProgramFiles%\2K Games\Firaxis Games\Sid Meier's Civilization IV Colonization|*.txt
FileKey9=%ProgramFiles%\Firaxis Games\Sid Meier's Civilization 4|*.txt
FileKey10=%ProgramFiles%\Firaxis Games\Sid Meier's Civilization 4\*|*.txt
FileKey11=%UserProfile%\Documents\My Games\Beyond the Sword\Logs|*
FileKey12=%UserProfile%\Documents\My Games\Sid Meier's Civilization*\cache|*|RECURSE
FileKey13=%UserProfile%\Documents\My Games\Sid Meier's Civilization*\Logs|*
FileKey14=%UserProfile%\Documents\My Games\Warlords\Logs|*

[Civilization 5 Installers *]
Section=Games
Detect=HKCU\Software\Firaxis\Civilization5
FileKey1=%ProgramFiles%\Civilization V*\DirectX|*|REMOVESELF
FileKey2=%ProgramFiles%\Civilization V*\VCRedist|*|REMOVESELF

[Civilization 5 Old AutoSaves *]
Section=Games
Detect=HKCU\Software\Firaxis\Civilization5
FileKey1=%UserProfile%\Documents\My Games\Sid Meier's Civilization 5\Saves\*\auto\prev|*.Civ5Save

[Clam Sentinel *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{060FE577-1BDF-4330-ACCA-B6760AB07191}_is1
FileKey1=%AppData%\ClamSentinel|*.txt
FileKey2=%ProgramFiles%\ClamSentinel|*.txt

[ClamWin *]
LangSecRef=3021
Detect1=HKCU\Software\ClamWin
Detect2=HKLM\Software\ClamWin
DetectFile=%SystemDrive%\PortableApps\ClamWinPortable
FileKey1=%AppData%\.clamwin\log|*|RECURSE
FileKey2=%ProgramData%\.clamwin\log|*|RECURSE
FileKey3=%ProgramFiles%\ClamWin\bin|*.txt
FileKey4=%SystemDrive%\PortableApps\ClamWinPortable\Data\db\clamav*|*|REMOVESELF
FileKey5=%SystemDrive%\PortableApps\ClamWinPortable\Data\db\tmp.*|*|REMOVESELF

[ClassicShell *]
LangSecRef=3024
Detect=HKCU\Software\IvoSoft\ClassicStartMenu
RegKey1=HKCU\Software\IvoSoft\ClassicStartMenu\MRU

[Clean Genius 3 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CleanGenius 3\Update
FileKey1=%ProgramFiles%\CleanGenius 3\Update|update.log

[Clean Master *]
LangSecRef=3024
Detect=HKCU\Software\cmcm\cleanMaster
DetectFile=%ProgramFiles%\cmcm\Clean Master
FileKey1=%ProgramFiles%\Clean Master|*.log*
FileKey2=%ProgramFiles%\Clean Master\log|*
FileKey3=%ProgramFiles%\cmcm\Clean Master\log|ktrashscan.benchmark

[CleanMyPC Registry Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\CleanMyPC\CleanMyPC - Registry Cleaner
FileKey1=%AppData%\CleanMyPC Software\CleanMyPC Registry Cleaner|fixlog.ini
RegKey1=HKCU\Software\CleanMyPC\CleanMyPC - Registry Cleaner\Recent File List

[CleanUp! *]
LangSecRef=3024
Detect=HKCU\Software\stevengould.org\CleanUp!
FileKey1=%AppData%|CleanUp!.log
RegKey1=HKCU\Software\stevengould.org\CleanUp!\Statistics

[ClearProg *]
LangSecRef=3024
DetectFile=%AppData%\ClearProg
FileKey1=%AppData%\ClearProg|ClearProg.log
RegKey1=HKCU\Software\ClearProg|PlugIns

[Clementine *]
LangSecRef=3023
Detect=HKCU\Software\Clementine
FileKey1=%UserProfile%\.config\Clementine\networkcache\http|*.cache|RECURSE

[Click.to *]
LangSecRef=3021
DetectFile=%LocalAppData%\click.to
FileKey1=%LocalAppData%\click.to|*.txt|RECURSE

[ClickFree Full Imaging Backup *]
LangSecRef=3024
DetectFile=%ProgramData%\ClickFree\FullImagingBackup
FileKey1=%ProgramData%\ClickFree\FullImagingBackup|*.log

[ClipGrab *]
LangSecRef=3023
DetectFile=%LocalAppData%\ClipGrab\ClipGrab
FileKey1=%LocalAppData%\ClipGrab\ClipGrab\QtWebEngine\Default|Visited Links
FileKey2=%LocalAppData%\ClipGrab\ClipGrab\QtWebEngine\Default\blob_storage|*|RECURSE
FileKey3=%LocalAppData%\ClipGrab\ClipGrab\QtWebEngine\Default\GPUCache|*

[ClipX *]
LangSecRef=3024
DetectFile=%LocalAppData%\ClipX
FileKey1=%LocalAppData%\ClipX\Storage|*

[Clockify *]
LangSecRef=3024
DetectFile=%AppData%\Clockify
FileKey1=%AppData%\Clockify\*Cache|*
FileKey2=%AppData%\Clockify\*logs|*

[CloneDVD *]
LangSecRef=3021
Detect=HKCU\Software\Elaborate Bytes\CloneDVD2
RegKey1=HKCU\Software\Elaborate Bytes\CloneDVD2|AnimationProcessingPath
RegKey2=HKCU\Software\Elaborate Bytes\CloneDVD2|AnimationWritingPath
RegKey3=HKCU\Software\Elaborate Bytes\CloneDVD2|LogFilePath
RegKey4=HKCU\Software\Elaborate Bytes\CloneDVD2|VideoFilesPath

[CloneSpy *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CloneSpy
FileKey1=%ProgramFiles%\CloneSpy|CloneSpy.log
FileKey2=%UserProfile%\Documents\CloneSpy|CloneSpy.log

[Cloudflare Warp VPN *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Cloudflare\Cloudflare WARP
FileKey1=%LocalAppData%\Cloudflare|WARP-GUI.log

[Clover *]
LangSecRef=3024
Detect=HKCU\Software\Clover
FileKey1=%LocalAppData%\Clover\User Data\Default|Bookmarks.bak;Current *;Last *
FileKey2=%LocalAppData%\Clover\User Data\Default\JumpListIcons*|*tmp
FileKey3=%LocalAppData%\Clover\User Data\temp|*|RECURSE

[CLZ Movie Collector *]
LangSecRef=3023
Detect=HKCU\Software\Collectorz.com\Movie
FileKey1=%LocalAppData%\Collectorz.com\Movie Collector\Temp\Images|*
FileKey2=%UserProfile%\Documents\Movie Collector\Images|*.tmp

[Cobian Backup *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Cobian Backup*
FileKey1=%ProgramFiles%\Cobian Backup*\Logs|*
FileKey2=%ProgramFiles%\Cobian Backup*\Settings|Cobian Backup*last updated.ini

[CobraTek PC Info *]
LangSecRef=3024
Detect=HKCU\Software\CobraTek\PC Info
FileKey1=%LocalAppData%\CobraTek\PC Info\ChangeLog|*.txt
FileKey2=%LocalAppData%\CobraTek\PC Info\Log|*

[Coc Coc Autofill Data & Search Engine Preferences *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\CocCoc\Browser\User Data\AutoFill*|*|REMOVESELF

[Coc Coc Autoplay Preferences *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\MEIPreload|*|REMOVESELF

[Coc Coc Bookmark Backups *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|Bookmarks.bak

[Coc Coc Bookmark Favicons *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|favicons*

[Coc Coc Caches *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\CocCoc\Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\CocCoc\Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\CocCoc\Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\CocCoc\Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\CocCoc\Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\CocCoc\Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\CocCoc\Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\CocCoc\Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\CocCoc\Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\CocCoc\Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\CocCoc\Browser\User Data\*\Sidebar|Ad Icons
FileKey16=%LocalAppData%\CocCoc\Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey17=%LocalAppData%\CocCoc\Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey18=%LocalAppData%\CocCoc\Browser\User Data\*Cache*|*|REMOVESELF
FileKey19=%LocalAppData%\CocCoc\Browser\User Data\Avatars|*|REMOVESELF
FileKey20=%LocalAppData%\CocCoc\Browser\User Data\Coccoc Notifications|*|REMOVESELF
FileKey21=%LocalAppData%\CocCoc\Browser\User Data\Optimization*|*|REMOVESELF

[Coc Coc Default App Handlers *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|PreferredApps

[Coc Coc Download History *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*\shared_proto_db|*|REMOVESELF

[Coc Coc DRM Data *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\WidevineCdm|*|REMOVESELF

[Coc Coc Extension Cookies *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|Extension Cookies

[Coc Coc Pinned Tabs *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
RegKey1=HKCU\Software\CocCoc\Browser\PreferenceMACs\Default|pinned_tabs

[Coc Coc Privacy Sandbox *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\CocCoc\Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\CocCoc\Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\CocCoc\Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Coc Coc Progressive Web Apps *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\Web Applications|*|REMOVESELF

[Coc Coc Saved Usernames & Passwords *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|Login Data*

[Coc Coc Security & Threat Detection *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\CocCoc\Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\CocCoc\Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\CocCoc\Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\CocCoc\Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\CocCoc\Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\CocCoc\Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\CocCoc\Browser\User Data\ZxcvbnData|*|REMOVESELF

[Coc Coc Shopping Insights *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\CocCoc\Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Coc Coc Storage Quota Manager *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|QuotaManager

[Coc Coc Sync Data *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\Sync Data|*|REMOVESELF

[Coc Coc Telemetry *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\Application|debug.log
FileKey2=%LocalAppData%\CocCoc\Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\CocCoc\Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\CocCoc\Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*|*.log
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\CocCoc\Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\CocCoc\Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\CocCoc\Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\CocCoc\Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\CocCoc\Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\CocCoc\Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\CocCoc\Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\CocCoc\Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\CocCoc\Browser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\CocCoc\Browser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\CocCoc\Browser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\CocCoc\Browser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\CocCoc\Browser\User Data\Stability|*|REMOVESELF
FileKey20=%LocalAppData%\CocCoc\CrashReports|*|REMOVESELF
FileKey21=%ProgramData%\CocCoc\CrashReports|*|REMOVESELF
FileKey22=%ProgramFiles%\CocCoc\Browser\Application|debug.log
FileKey23=%ProgramFiles%\CocCoc\Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\CocCoc\Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\CocCoc\Browser\BlBeacon|state
RegKey3=HKCU\Software\CocCoc\Browser\Installer|LastChecked
RegKey4=HKCU\Software\CocCoc\Browser\StabilityMetrics

[Coc Coc Web Browsing Cookies *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Coc Coc Web Browsing History *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Coc Coc Web Browsing Session *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*\Sessions|*|REMOVESELF

[Coc Coc Web Storage *]
Section=Coc Coc Web Browser
DetectFile=%LocalAppData%\CocCoc\Browser\User Data
FileKey1=%LocalAppData%\CocCoc\Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\CocCoc\Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\CocCoc\Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\CocCoc\Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\CocCoc\Browser\User Data\*\WebStorage|*|REMOVESELF

[Cocosenor System Tuner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Cocosenor System Tuner
FileKey1=%ProgramFiles%\Cocosenor System Tuner|*.log

[CodeGear RAD Studio 2009 *]
LangSecRef=3024
Detect=HKCU\Software\CodeGear\BDS\6.0
RegKey1=HKCU\Software\CodeGear\BDS\6.0\Closed Files
RegKey2=HKCU\Software\CodeGear\BDS\6.0\Closed Projects
RegKey3=HKCU\Software\CodeGear\BDS\6.0\Session

[CodeMeter *]
LangSecRef=3023
DetectFile=%ProgramData%\CodeMeter
FileKey1=%ProgramData%\CodeMeter\Logs|*

[CoffeeCup GIF Animator *]
LangSecRef=3024
Detect=HKCU\Software\CoffeeCup Software\GIF Animator
RegKey1=HKCU\Software\CoffeeCup Software\GIF Animator\Settings\MRU

[Cogs *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\26500
FileKey1=%LocalAppData%\Lazy 8 Studio\Cogs|log.txt

[CoinManage *]
LangSecRef=3021
Detect1=HKCU\Software\Liberty Street Software\CoinManage
Detect2=HKCU\Software\Liberty Street Software\CoinManage Canada
FileKey1=%ProgramFiles%\CoinManage*|*.txt
FileKey2=%UserProfile%\Documents|CoinManage.zip;CRASH.DMP;ERRORLOG.TXT;XCrashReport.ini;XCRASHREPORT_Mon1.bmp

[Colors for Command Palette *]
Section=Command Palette
DetectFile=%LocalAppData%\Packages\JiriPolasek.ColorsforCommandPalette_15b1mzc2p8w76
FileKey1=%LocalAppData%\Packages\JiriPolasek.ColorsforCommandPalette_15b1mzc2p8w76\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\JiriPolasek.ColorsforCommandPalette_15b1mzc2p8w76\LocalCache\Local\JPSoftworks\ColorsExtension|*
FileKey3=%LocalAppData%\Packages\JiriPolasek.ColorsforCommandPalette_15b1mzc2p8w76\Settings|*.log*
FileKey4=%LocalAppData%\Packages\JiriPolasek.ColorsforCommandPalette_15b1mzc2p8w76\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\JiriPolasek.ColorsforCommandPalette_15b1mzc2p8w76\TempState|*|REMOVESELF

[ColorSchemer *]
LangSecRef=3023
Detect=HKCU\Software\ColorSchemer
FileKey1=%AppData%\ColorSchemer\Studio\*|recentfiles.xml

[ComboFix *]
LangSecRef=3024
DetectFile=%SystemDrive%\Qoobox
FileKey1=%SystemDrive%|ComboFix.txt
FileKey2=%SystemDrive%\*.tmp|*|REMOVESELF
FileKey3=%SystemDrive%\Qoobox|*.txt
FileKey4=%SystemDrive%\Qoobox\LastRun|*|REMOVESELF
FileKey5=%SystemDrive%\Qoobox\Quarantine|*.log
FileKey6=%SystemDrive%\Qoobox\Test*|*|REMOVESELF

[Comet Autofill Data & Search Engine Preferences *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|*Web Data
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Perplexity\Comet\User Data\AutoFill*|*|REMOVESELF

[Comet Autoplay Preferences *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\MEIPreload|*|REMOVESELF

[Comet Bookmark Backups *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|Bookmarks.bak

[Comet Bookmark Favicons *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|favicons*

[Comet Caches *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Perplexity\Comet\User Data|Module Info Cache
FileKey3=%LocalAppData%\Perplexity\Comet\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Perplexity\Comet\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Perplexity\Comet\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Perplexity\Comet\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Perplexity\Comet\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Perplexity\Comet\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Perplexity\Comet\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Perplexity\Comet\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Perplexity\Comet\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Perplexity\Comet\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Perplexity\Comet\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Perplexity\Comet\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Perplexity\Comet\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Perplexity\Comet\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Perplexity\Comet\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Perplexity\Comet\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Perplexity\Comet\User Data\Optimization*|*|REMOVESELF

[Comet Default App Handlers *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|PreferredApps

[Comet Download History *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*\shared_proto_db|*|REMOVESELF

[Comet DRM Data *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\WidevineCdm|*|REMOVESELF

[Comet Extension Cookies *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|Extension Cookies

[Comet Pinned Tabs *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
RegKey1=HKCU\Software\Perplexity\Comet\PreferenceMACs\Default|pinned_tabs

[Comet Privacy Sandbox *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Perplexity\Comet\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Perplexity\Comet\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Perplexity\Comet\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Perplexity\Comet\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Perplexity\Comet\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Perplexity\Comet\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Comet Progressive Web Apps *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\Web Applications|*|REMOVESELF

[Comet Saved Usernames & Passwords *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|Login Data*

[Comet Security & Threat Detection *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|DIPS*
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Perplexity\Comet\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Perplexity\Comet\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Perplexity\Comet\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Perplexity\Comet\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Perplexity\Comet\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Perplexity\Comet\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Perplexity\Comet\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Perplexity\Comet\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Perplexity\Comet\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Perplexity\Comet\User Data\ZxcvbnData|*|REMOVESELF

[Comet Shopping Insights *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Perplexity\Comet\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Perplexity\Comet\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Perplexity\Comet\User Data\*\parcel_tracking_db|*|REMOVESELF

[Comet Storage Quota Manager *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|QuotaManager

[Comet Sync Data *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\Sync Data|*|REMOVESELF

[Comet Telemetry *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\Application|debug.log
FileKey2=%LocalAppData%\Perplexity\Comet\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Perplexity\Comet\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Perplexity\Comet\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Perplexity\Comet\User Data\*|*.log
FileKey6=%LocalAppData%\Perplexity\Comet\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Perplexity\Comet\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Perplexity\Comet\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Perplexity\Comet\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Perplexity\Comet\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Perplexity\Comet\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Perplexity\Comet\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Perplexity\Comet\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Perplexity\Comet\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Perplexity\Comet\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Perplexity\Comet\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Perplexity\Comet\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Perplexity\Comet\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Perplexity\Comet\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Perplexity\Comet\Application|debug.log
FileKey21=%ProgramFiles%\Perplexity\Comet\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Perplexity\Comet\BlBeacon|failed_count
RegKey2=HKCU\Software\Perplexity\Comet\BlBeacon|state
RegKey3=HKCU\Software\Perplexity\Comet\Installer|LastChecked
RegKey4=HKCU\Software\Perplexity\Comet\StabilityMetrics

[Comet Web Browsing Cookies *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\Network|Cookies*;Device Bound Sessions*

[Comet Web Browsing History *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Comet Web Browsing Session *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*\Sessions|*|REMOVESELF

[Comet Web Storage *]
Section=Perplexity Comet Web Browser
DetectFile=%LocalAppData%\Perplexity\Comet\User Data
FileKey1=%LocalAppData%\Perplexity\Comet\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Perplexity\Comet\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Perplexity\Comet\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Perplexity\Comet\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Perplexity\Comet\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Perplexity\Comet\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Perplexity\Comet\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Perplexity\Comet\User Data\*\WebStorage|*|REMOVESELF

[Comfort Keys Pro *]
LangSecRef=3021
DetectFile=%AppData%\ComfortSoftware
FileKey1=%AppData%\ComfortSoftware\CKeys|*

[ComicRack *]
LangSecRef=3021
DetectFile=%LocalAppData%\cYo\ComicRack
FileKey1=%LocalAppData%\cYo\ComicRack\Cache\Images|*|RECURSE
FileKey2=%LocalAppData%\cYo\ComicRack\Cache\Thumbnails|*|RECURSE

[Command Line Shell *]
LangSecRef=3024
Detect=HKCU\Software\Juan M. Aguirregabiria\CmdShEd
RegKey1=HKCU\Software\Juan M. Aguirregabiria\CmdShEd\Previous

[Comodo *]
LangSecRef=3024
Detect=HKCU\Software\ComodoGroup
FileKey1=%AppData%\Comodo\CCE\Logs|*
FileKey2=%AppData%\ComodoGroup\CSC\Cache|*
FileKey3=%LocalAppData%\COMODO|*.tmp
FileKey4=%ProgramData%\Comodo Downloader|*
FileKey5=%ProgramData%\Comodo\Cis\Quarantine\Temp\TempFiles|*
FileKey6=%ProgramData%\Comodo\CisDumps|*
FileKey7=%ProgramData%\Comodo\Firewall Pro|cislogs.sdb
FileKey8=%ProgramData%\Comodo\Installer|*
FileKey9=%ProgramFiles%\COMODO\COMODO Internet Security|*.tmp;cmdagent.zip;CRASH.DMP

[Comodo AV Sandbox *]
LangSecRef=3024
DetectFile=%SystemDrive%\VritualRoot
FileKey1=%SystemDrive%\VritualRoot|*|RECURSE

[Comodo CertSentry *]
LangSecRef=3022
Detect=HKLM\Software\COMODO\CertSentry
FileKey1=%LocalAppData%\COMODO\CertSentry|*.log

[Comodo Dragon Autofill Data & Search Engine Preferences *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|*Web Data
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Comodo\Dragon\User Data\AutoFill*|*|REMOVESELF

[Comodo Dragon Autoplay Preferences *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\MEIPreload|*|REMOVESELF

[Comodo Dragon Bookmark Backups *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|Bookmarks.bak

[Comodo Dragon Bookmark Favicons *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|favicons*

[Comodo Dragon Caches *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Comodo\Dragon\User Data|Module Info Cache
FileKey3=%LocalAppData%\Comodo\Dragon\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Comodo\Dragon\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Comodo\Dragon\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Comodo\Dragon\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Comodo\Dragon\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Comodo\Dragon\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Comodo\Dragon\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Comodo\Dragon\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Comodo\Dragon\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Comodo\Dragon\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Comodo\Dragon\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Comodo\Dragon\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Comodo\Dragon\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Comodo\Dragon\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Comodo\Dragon\User Data\Optimization*|*|REMOVESELF

[Comodo Dragon Default App Handlers *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|PreferredApps

[Comodo Dragon Download History *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*\shared_proto_db|*|REMOVESELF

[Comodo Dragon DRM Data *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\WidevineCdm|*|REMOVESELF

[Comodo Dragon Extension Cookies *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|Extension Cookies

[Comodo Dragon Pinned Tabs *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
RegKey1=HKCU\Software\Comodo\Dragon\PreferenceMACs\Default|pinned_tabs

[Comodo Dragon Privacy Sandbox *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Comodo\Dragon\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Comodo\Dragon\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Comodo\Dragon\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Comodo\Dragon\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Comodo\Dragon\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Comodo Dragon Progressive Web Apps *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\Web Applications|*|REMOVESELF

[Comodo Dragon Saved Usernames & Passwords *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|Login Data*

[Comodo Dragon Security & Threat Detection *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|DIPS*
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Comodo\Dragon\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Comodo\Dragon\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Comodo\Dragon\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Comodo\Dragon\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Comodo\Dragon\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Comodo\Dragon\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Comodo\Dragon\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Comodo\Dragon\User Data\ZxcvbnData|*|REMOVESELF

[Comodo Dragon Shopping Insights *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Comodo\Dragon\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Comodo\Dragon\User Data\*\parcel_tracking_db|*|REMOVESELF

[Comodo Dragon Storage Quota Manager *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|QuotaManager

[Comodo Dragon Sync Data *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\Sync Data|*|REMOVESELF

[Comodo Dragon Telemetry *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\Application|debug.log
FileKey2=%LocalAppData%\Comodo\Dragon\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Comodo\Dragon\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Comodo\Dragon\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Comodo\Dragon\User Data\*|*.log
FileKey6=%LocalAppData%\Comodo\Dragon\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Comodo\Dragon\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Comodo\Dragon\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Comodo\Dragon\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Comodo\Dragon\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Comodo\Dragon\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Comodo\Dragon\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Comodo\Dragon\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Comodo\Dragon\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Comodo\Dragon\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Comodo\Dragon\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Comodo\Dragon\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Comodo\Dragon\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Comodo\Dragon\Application|debug.log
FileKey21=%ProgramFiles%\Comodo\Dragon\Application\SetupMetrics|*|REMOVESELF
FileKey22=%WinDir%\temp\Comodo LogsFolder|*|REMOVESELF
RegKey1=HKCU\Software\Comodo\Dragon\BlBeacon|failed_count
RegKey2=HKCU\Software\Comodo\Dragon\BlBeacon|state
RegKey3=HKCU\Software\Comodo\Dragon\Installer|LastChecked
RegKey4=HKCU\Software\Comodo\Dragon\StabilityMetrics

[Comodo Dragon Web Browsing Cookies *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\Network|Cookies*;Device Bound Sessions*

[Comodo Dragon Web Browsing History *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Comodo Dragon Web Browsing Session *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*\Sessions|*|REMOVESELF

[Comodo Dragon Web Storage *]
Section=Comodo Dragon Web Browser
DetectFile=%LocalAppData%\Comodo\Dragon\User Data
FileKey1=%LocalAppData%\Comodo\Dragon\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Comodo\Dragon\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Comodo\Dragon\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Comodo\Dragon\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Comodo\Dragon\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Comodo\Dragon\User Data\*\WebStorage|*|REMOVESELF

[Comodo GeekBuddy *]
LangSecRef=3021
Detect=HKLM\Software\GeekBuddyRSP
DetectFile=%ProgramFiles%\Comodo\GeekBuddy
FileKey1=%ProgramFiles%\Comodo\GeekBuddy\logs|*|RECURSE

[Comodo System Utilities *]
LangSecRef=3024
DetectFile=%ProgramFiles%\COMODO\COMODO System Utilities
FileKey1=%ProgramFiles%\COMODO\COMODO System Utilities\backup|*|RECURSE
FileKey2=%ProgramFiles%\COMODO\COMODO System Utilities\dumps|*|RECURSE
FileKey3=%ProgramFiles%\COMODO\COMODO System Utilities\logs|*|RECURSE
FileKey4=%ProgramFiles%\COMODO\COMODO System Utilities\temp|*|RECURSE
FileKey5=%ProgramFiles%\COMODO\COMODO System Utilities\update|*|RECURSE

[Company of Heroes *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Company of Heroes*
FileKey1=%UserProfile%\Documents\My Games\Company of Heroes*|*.log
FileKey2=%UserProfile%\Documents\My Games\Company of Heroes*\Cache|*
FileKey3=%UserProfile%\Documents\My Games\Company of Heroes*\LogFiles|*
FileKey4=%UserProfile%\Documents\My Games\RelicDownloader|*.log

[Complete Internet Repair *]
LangSecRef=3024
DetectFile=%AppData%\Rizonesoft\ComIntRep
FileKey1=%AppData%\Rizonesoft\ComIntRep\Logging|*|RECURSE

[Composer Dependency Manager for PHP *]
LangSecRef=3024
DetectFile=%ProgramData%\ComposerSetup\bin\composer.phar
FileKey1=%AppData%\Composer|*-old.phar
FileKey2=%LocalAppData%\Composer\files|*|REMOVESELF
FileKey3=%LocalAppData%\Composer\repo|*|REMOVESELF
FileKey4=%LocalAppData%\Composer\vcs|*|REMOVESELF

[Conceiva Mezzmo *]
LangSecRef=3023
Detect=HKLM\Software\Conceiva\Mezzmo
FileKey1=%LocalAppData%\Conceiva\Logs|*|REMOVESELF
FileKey2=%LocalAppData%\Conceiva\Mezzmo|DebugCERwrite.txt
FileKey3=%LocalAppData%\Conceiva\Mezzmo\Temporary_*_Files|*|REMOVESELF
FileKey4=%ProgramData%\Conceiva\*|*.bat;*.exe;*.txt
FileKey5=%ProgramData%\Conceiva\Mezzmo\CER|*.zip
FileKey6=%ProgramFiles%\Conceiva\Mezzmo|*.txt
FileKey7=%ProgramFiles%\Conceiva\Mezzmo\Third\MKVToolNix|*.txt
FileKey8=%ProgramFiles%\Conceiva\Mezzmo\Third\OGMDemuxer\doc|*|REMOVESELF
RegKey1=HKCU\Software\Conceiva\Mezzmo\General|LastWatchFolder

[Conexant *]
LangSecRef=3024
Detect=HKCU\Software\Conexant
FileKey1=%ProgramData%\Conexant\UCILogs\COINST|*.log
FileKey2=%Public%|CAFADEBUG.log

[Connectify Hotspot *]
LangSecRef=3022
Detect=HKLM\Software\Connectify
FileKey1=%ProgramData%\Connectify\cache|*.cache;*.runtime;*.time
FileKey2=%ProgramFiles%\Connectify\Installer|*|REMOVESELF
FileKey3=%ProgramFiles%\Connectify\Portal|*|REMOVESELF

[Conquer Online *]
Section=Games
DetectFile=%ProgramFiles%\NetDragon\Conquer Online 2.0\AutoPatch
FileKey1=%ProgramFiles%\NetDragon\Conquer Online 2.0\AutoPatch|Update.log

[ConTEXT *]
LangSecRef=3021
Detect=HKCU\Software\Eden\ConTEXT
RegKey1=HKCU\Software\Eden\ConTEXT\FileHistory
RegKey2=HKCU\Software\Eden\ConTEXT\FindHistory

[Cook'n *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n
FileKey1=%AppData%\Mozilla\eclipse\Cache|*
FileKey2=%LocalAppData%\DVO\Cook'n*App|*.log|RECURSE
FileKey3=%LocalAppData%\DVO\Cook'n10App\plugins|Getting Started Guide.rtf|RECURSE
FileKey4=%UserProfile%\Documents\Cook'n*|*.log|RECURSE

[Cook'n Backups *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n
FileKey1=%UserProfile%\Documents\Cook'n Backups|*.ckn
FileKey2=%UserProfile%\Documents\Cook'n10\Workspace\data|download;dvodb.backup
FileKey3=%UserProfile%\Documents\Cook'n10\Workspace\update|update.zip
FileKey4=%UserProfile%\Documents\Cook'n11\Download|*

[Coolmuster PDF Image Extractor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Coolmuster\Coolmuster PDF Image Extractor
FileKey1=%UserProfile%\Documents\Coolmuster files\Coolmuster PDF Image Extractor|PDF_IMAGE_EXTRACTOR_COOL.cfg

[Copernic Desktop Search *]
LangSecRef=3024
DetectFile1=%AppData%\Copernic\DesktopSearch*
DetectFile2=%LocalAppData%\Copernic\DesktopSearch*
FileKey1=%AppData%\Copernic\*\Searches|*|RECURSE
FileKey2=%AppData%\Copernic\DesktopSearch*\Logs|*|REMOVESELF
FileKey3=%LocalAppData%\Copernic\DesktopSearch*\Logs|*|REMOVESELF
RegKey1=HKCU\Software\Copernic\DesktopSearch2\Config\SearchHistory

[Copy as Path ContextMenu *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Copy Path Context Menu
FileKey1=%ProgramFiles%\Copy Path Context Menu|*.log

[CopyQ *]
LangSecRef=3021
DetectFile=%AppData%\copyq
FileKey1=%AppData%\copyq|*.bak
FileKey2=%AppData%\copyq\copyq|copyq.log

[CopyTo Synchronizer *]
LangSecRef=3024
Detect=HKCU\Software\kishDesign\CopyTo
RegKey1=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder00
RegKey2=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder01
RegKey3=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder02
RegKey4=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder03
RegKey5=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder04
RegKey6=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder05
RegKey7=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder06
RegKey8=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder07
RegKey9=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder08
RegKey10=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder09
RegKey11=HKCU\Software\kishDesign\CopyTo\settings3|scutname00
RegKey12=HKCU\Software\kishDesign\CopyTo\settings3|scutname01
RegKey13=HKCU\Software\kishDesign\CopyTo\settings3|scutname02
RegKey14=HKCU\Software\kishDesign\CopyTo\settings3|scutname03
RegKey15=HKCU\Software\kishDesign\CopyTo\settings3|scutname04
RegKey16=HKCU\Software\kishDesign\CopyTo\settings3|scutname05
RegKey17=HKCU\Software\kishDesign\CopyTo\settings3|scutname06
RegKey18=HKCU\Software\kishDesign\CopyTo\settings3|scutname07
RegKey19=HKCU\Software\kishDesign\CopyTo\settings3|scutname08
RegKey20=HKCU\Software\kishDesign\CopyTo\settings3|scutname09
RegKey21=HKCU\Software\kishDesign\CopyTo\settings3|Source00
RegKey22=HKCU\Software\kishDesign\CopyTo\settings3|Source01
RegKey23=HKCU\Software\kishDesign\CopyTo\settings3|Source02
RegKey24=HKCU\Software\kishDesign\CopyTo\settings3|Source03
RegKey25=HKCU\Software\kishDesign\CopyTo\settings3|Source04
RegKey26=HKCU\Software\kishDesign\CopyTo\settings3|Source05
RegKey27=HKCU\Software\kishDesign\CopyTo\settings3|Source06
RegKey28=HKCU\Software\kishDesign\CopyTo\settings3|Source07
RegKey29=HKCU\Software\kishDesign\CopyTo\settings3|Source08
RegKey30=HKCU\Software\kishDesign\CopyTo\settings3|Source09
RegKey31=HKCU\Software\kishDesign\CopyTo\settings3|target00
RegKey32=HKCU\Software\kishDesign\CopyTo\settings3|target01
RegKey33=HKCU\Software\kishDesign\CopyTo\settings3|target02
RegKey34=HKCU\Software\kishDesign\CopyTo\settings3|target03
RegKey35=HKCU\Software\kishDesign\CopyTo\settings3|target04
RegKey36=HKCU\Software\kishDesign\CopyTo\settings3|target05
RegKey37=HKCU\Software\kishDesign\CopyTo\settings3|target06
RegKey38=HKCU\Software\kishDesign\CopyTo\settings3|target07
RegKey39=HKCU\Software\kishDesign\CopyTo\settings3|target08
RegKey40=HKCU\Software\kishDesign\CopyTo\settings3|target09

[CopyTrans *]
LangSecRef=3023
DetectFile1=%AppData%\WindSolutions\CopyTrans*
DetectFile2=%ProgramData%\WindSolutions\CopyTrans*
FileKey1=%ProgramData%\WindSolutions|*.txt|RECURSE
FileKey2=%ProgramData%\WindSolutions\CopyTrans*\Logs|*|RECURSE

[Core Temp *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Core Temp
FileKey1=%ProgramFiles%\Core Temp|*.csv

[Corel AfterShot Pro *]
LangSecRef=3023
Detect=HKCU\Software\Corel\AfterShot Pro V3
FileKey1=%LocalAppData%\Corel\AfterShot Pro *|*.log
FileKey2=%LocalAppData%\Corel\AfterShot Pro *\Cache|*|RECURSE

[Corel Downloads *]
LangSecRef=3021
DetectFile=%ProgramData%\Corel\Downloads
FileKey1=%ProgramData%\Corel\Downloads|*|RECURSE

[Corel PaintShop Pro *]
LangSecRef=3023
Detect1=HKCU\Software\Corel\PaintShop Pro
Detect2=HKCU\Software\Corel\PhotoDownloader
FileKey1=%AppData%\Corel\PaintShop Photo Pro\13\Cache|*|RECURSE
FileKey2=%LocalAppData%\Corel|*.db;*.PspCache
FileKey3=%LocalAppData%\Corel PaintShop Pro\*\Cache|*
FileKey4=%LocalAppData%\Corel PaintShop Pro\*\Database|*.db
FileKey5=%LocalAppData%\Corel PaintShop Pro\*\Thumbs|*|RECURSE
FileKey6=%LocalAppData%\Corel\Thumbs|*|RECURSE
RegKey1=HKCU\Software\Corel\PaintShop Pro\X7\CoreMemoryManager\0
RegKey2=HKCU\Software\Corel\PaintShop Pro\X10\CoreMemoryManager\0
RegKey3=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DefaultDownloadFolder
RegKey4=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DownloadFolder

[Corel PaintShop Pro AutoPreserve *]
LangSecRef=3023
Detect=HKCU\Software\Corel\PaintShop Pro
FileKey1=%UserProfile%\Pictures\Corel Auto-Preserve|*

[Corel PhotoImpact X3 *]
LangSecRef=3023
DetectFile=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0
FileKey1=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0\Ulead.DAT\BwsCache|*
FileKey2=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0\Ulead.DAT\Recently|*.lnk

[Corel VideoStudio Pro *]
LangSecRef=3023
Detect=HKCU\Software\Ulead Systems\Corel VideoStudio Pro
FileKey1=%UserProfile%\Documents\Corel VideoStudio Pro\*.0\AudioTmp|*
FileKey2=%UserProfile%\Documents\Corel VideoStudio Pro\*.0\SmartProxy|*
RegKey1=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\14.0\Preference|Working Folder
RegKey2=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\16.0\HerRFL
RegKey3=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\17.0\HerRFL

[Corel Wordperfect *]
LangSecRef=3021
Detect=HKCU\Software\Corel\User Assistant
RegKey1=HKCU\Software\Corel\User Assistant\11\Recent Work\Presentations
RegKey2=HKCU\Software\Corel\User Assistant\12\Recent Work\Presentations
RegKey3=HKCU\Software\Corel\User Assistant\13\Recent Work\Presentations
RegKey4=HKCU\Software\Corel\User Assistant\14\Recent Work\Presentations
RegKey5=HKCU\Software\Corel\User Assistant\X3\Recent Work\Presentations
RegKey6=HKCU\Software\Corel\User Assistant\X4\Recent Work\Presentations
RegKey7=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\15.0\HerRFL

[CorelDRAW Graphics Suite X7 *]
LangSecRef=3021
Detect=HKCU\Software\Corel\CorelDRAW\17.0
FileKey1=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Config|capture.ini;corelpdf.ini
FileKey2=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Connect|Connect.config
FileKey3=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw|FindAndReplaceMRU.xml
FileKey4=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\Export|dialog.export.web.xml
FileKey5=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\Presets\HTML Export|default.pst
FileKey6=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\PreviewCache|*|RECURSE
FileKey7=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\PHOTO-PAINT\PreviewCache|*|RECURSE
FileKey8=%ProgramData%\Bitstream\Font Navigator\6.0\Cache|*|RECURSE
FileKey9=%ProgramFiles%\Corel\CorelDRAW Graphics Suite X7\Setup|*|REMOVESELF
RegKey1=HKCU\Software\Bitstream\Font Navigator\6.0\Copy|Folders
RegKey2=HKCU\Software\Bitstream\Font Navigator\6.0\Move|Folders
RegKey3=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\Directories|DrawDocsDir
RegKey4=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\Framework|RecentFiles
RegKey5=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\HTML Export|DestPath
RegKey6=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\NewFromTemplate|BrowseTemplateDir
RegKey7=HKCU\Software\Corel\CorelDRAW\17.0\PHOTO-PAINT\Application Preferences\Framework|RecentFiles

[Corsair iCue *]
LangSecRef=3024
DetectFile=%ProgramData%\Corsair\CUE\Service logs
FileKey1=%LocalAppData%\Corsair\CUE\logs|*.log
FileKey2=%ProgramData%\Corsair\CorsairLLAccessService|*.log
FileKey3=%ProgramData%\Corsair\CUE\Service logs|Service_Trace*.log

[Cortana *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\AC|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\LocalState|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\Settings|*.log*
FileKey10=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey11=%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\TempState|*|REMOVESELF
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Cortana_8wekyb3d8bbwe\LocalState\DeviceSearchCache\|SettingsCache.txt

[Counter-Strike *]
Section=Games
DetectFile=%ProgramFiles%\Counter-Strike*
FileKey1=%ProgramFiles%\Counter-Strike*|*.log
FileKey2=%ProgramFiles%\Counter-Strike*\cstrike\addons\amxmodx\logs|*.log
FileKey3=%ProgramFiles%\Counter-Strike*\cstrike\lhdoc\Demo Player\SK Player|history.txt
FileKey4=%ProgramFiles%\Counter-Strike*\valve\bin|*.log

[CrashRpt *]
LangSecRef=3024
DetectFile=%LocalAppData%\CrashRpt
FileKey1=%LocalAppData%\CrashRpt|*|RECURSE

[Crayon Physics Deluxe *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\26900
FileKey1=%AppData%\Crayon Physics Deluxe|log.txt
FileKey2=%AppData%\Crayon Physics Deluxe\data\recordings\temp|current_recording.tmp
FileKey3=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe|log.txt
FileKey4=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\cache|*
FileKey5=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\data\editor|*.tmp
FileKey6=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\data\recordings\temp|*.tmp

[Creative Installation Information *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Creative Installation Information
FileKey1=%ProgramFiles%\Creative Installation Information|*.log|RECURSE

[Creative Live! Central 3 *]
LangSecRef=3023
DetectFile=%AppData%\Creative\Live! Central 3
FileKey1=%AppData%\Creative\Live! Central 3|*.txt|RECURSE

[Creative Pro Proteus VX *]
LangSecRef=3023
Detect=HKCU\Software\Creative Professional\Proteus VX
RegKey1=HKCU\Software\Creative Professional\Proteus VX VSTi\Recent File List

[Creative Sound Blaster *]
LangSecRef=3024
DetectFile=%ProgramData%\Creative\Software Update
FileKey1=%ProgramData%\Creative\Software Update\Cache|*|RECURSE
FileKey2=%ProgramData%\Creative\Software Update\Log|*

[Cricut Design Space *]
LangSecRef=3021
DetectFile=%AppData%\Cricut Design Space
FileKey1=%AppData%\Cricut Design Space|*-journal;*.old;LOG;Network Persistent State|RECURSE
FileKey2=%AppData%\Cricut Design Space\*Cache|*|RECURSE
FileKey3=%AppData%\Cricut Design Space\blob_storage|*|RECURSE
FileKey4=%AppData%\Cricut Design Space\Native\Logs|*

[Cromite Autofill Data & Search Engine Preferences *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|*Web Data
FileKey2=%LocalAppData%\Cromite\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Cromite\User Data\AutoFill*|*|REMOVESELF

[Cromite Autoplay Preferences *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\MEIPreload|*|REMOVESELF

[Cromite Bookmark Backups *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|Bookmarks.bak

[Cromite Bookmark Favicons *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|favicons*

[Cromite Caches *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Cromite\User Data|Module Info Cache
FileKey3=%LocalAppData%\Cromite\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Cromite\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Cromite\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Cromite\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Cromite\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Cromite\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Cromite\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Cromite\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Cromite\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Cromite\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Cromite\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Cromite\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Cromite\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Cromite\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Cromite\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Cromite\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Cromite\User Data\Optimization*|*|REMOVESELF

[Cromite Default App Handlers *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|PreferredApps

[Cromite Download History *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Cromite\User Data\*\shared_proto_db|*|REMOVESELF

[Cromite DRM Data *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Cromite\User Data\WidevineCdm|*|REMOVESELF

[Cromite Extension Cookies *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|Extension Cookies

[Cromite Pinned Tabs *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
RegKey1=HKCU\Software\Cromite\PreferenceMACs\Default|pinned_tabs

[Cromite Privacy Sandbox *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Cromite\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Cromite\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Cromite\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Cromite\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Cromite\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Cromite\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Cromite\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Cromite Progressive Web Apps *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\Web Applications|*|REMOVESELF

[Cromite Saved Usernames & Passwords *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|Login Data*

[Cromite Security & Threat Detection *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|DIPS*
FileKey2=%LocalAppData%\Cromite\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Cromite\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Cromite\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Cromite\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Cromite\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Cromite\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Cromite\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Cromite\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Cromite\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Cromite\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Cromite\User Data\ZxcvbnData|*|REMOVESELF

[Cromite Shopping Insights *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Cromite\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Cromite\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Cromite\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Cromite\User Data\*\parcel_tracking_db|*|REMOVESELF

[Cromite Storage Quota Manager *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|QuotaManager

[Cromite Sync Data *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\Sync Data|*|REMOVESELF

[Cromite Telemetry *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\Application|debug.log
FileKey2=%LocalAppData%\Cromite\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Cromite\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Cromite\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Cromite\User Data\*|*.log
FileKey6=%LocalAppData%\Cromite\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Cromite\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Cromite\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Cromite\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Cromite\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Cromite\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Cromite\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Cromite\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Cromite\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Cromite\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Cromite\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Cromite\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Cromite\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Cromite\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Cromite\Application|debug.log
FileKey21=%ProgramFiles%\Cromite\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Cromite\BlBeacon|failed_count
RegKey2=HKCU\Software\Cromite\BlBeacon|state
RegKey3=HKCU\Software\Cromite\Installer|LastChecked
RegKey4=HKCU\Software\Cromite\StabilityMetrics

[Cromite Web Browsing Cookies *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\Network|Cookies*;Device Bound Sessions*

[Cromite Web Browsing History *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Cromite Web Browsing Session *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Cromite\User Data\*\Sessions|*|REMOVESELF

[Cromite Web Storage *]
Section=Cromite Web Browser
DetectFile=%LocalAppData%\Cromite\User Data
FileKey1=%LocalAppData%\Cromite\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Cromite\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Cromite\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Cromite\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Cromite\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Cromite\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Cromite\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Cromite\User Data\*\WebStorage|*|REMOVESELF

[Crusader Kings *]
Section=Games
DetectFile=%UserProfile%\Documents\Paradox Interactive\Crusader Kings *
FileKey1=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\.launcher-cache\*|*|REMOVESELF
FileKey2=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Cache|*
FileKey3=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Crashes|*|REMOVESELF
FileKey4=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Dumps|*
FileKey5=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Logs|*
FileKey6=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\oos|*.log|RECURSE
FileKey7=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\shadercache\*\*|*
FileKey8=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\TerrainCache|*.cache

[Crypt of the NecroDancer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\247080
FileKey1=%LocalAppData%\NecroDancer\replays|*|REMOVESELF
FileKey2=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\logs|*
FileKey3=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\Necrodancer*|*.log
FileKey4=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\replays|*

[CrypTool 2 *]
LangSecRef=3024
Detect=HKCU\Software\CrypTool2.0
FileKey1=%LocalAppData%\CrypTool2\Temp|*|REMOVESELF
RegKey1=HKCU\Software\CrypTool2.0|recentFileList

[Crysis *]
Section=Games
DetectFile1=%ProgramFiles%\EA Games\Crysis*
DetectFile2=%ProgramFiles%\Steam\Steamapps\common\Crysis*
FileKey1=%ProgramFiles%\EA Games\Crysis *|*.log
FileKey2=%ProgramFiles%\EA Games\Crysis *\LogBackups|*
FileKey3=%ProgramFiles%\Steam\Steamapps\common\Crysis *|*.log
FileKey4=%ProgramFiles%\Steam\Steamapps\common\Crysis *\LogBackups|*
FileKey5=%UserProfile%\Documents\My Games\Crysis*\Shaders\Cache|*|RECURSE
FileKey6=%UserProfile%\Saved Games\Crysis*\Shaders\Cache|*|RECURSE

[CrystalDiskInfo *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CrystalDiskInfo\Smart
FileKey1=%ProgramFiles%\CrystalDiskInfo\Smart|*|RECURSE

[Cult of the Lamb *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Massive Monster\Cult of the Lamb
FileKey1=%UserProfile%\AppData\LocalLow\Massive Monster\Cult of the Lamb|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Massive Monster\Cult of the Lamb\Unity|*|REMOVESELF

[Cultist Simulator *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Weather Factory\Cultist Simulator
FileKey1=%UserProfile%\AppData\LocalLow\Weather Factory\Cultist Simulator|*log
FileKey2=%UserProfile%\AppData\LocalLow\Weather Factory\Cultist Simulator\Unity|*|REMOVESELF

[CurrencyManage *]
LangSecRef=3021
Detect=HKCU\Software\Liberty Street Software\CurrencyManage
FileKey1=%ProgramFiles%\CurrencyManage|*.txt

[CurseForge *]
Section=Games
DetectFile=%LocalAppData%\Programs\CurseForge Windows
FileKey1=%AppData%\CurseForge|*-journal;*.old;LOG;QuotaManager|RECURSE
FileKey2=%AppData%\CurseForge\*Cache|*|REMOVESELF
FileKey3=%AppData%\CurseForge\agent|gamescache.json
FileKey4=%AppData%\CurseForge\agent\logs\*|*
FileKey5=%AppData%\CurseForge\agent\Thumbnails\*|*
FileKey6=%AppData%\CurseForge\blob_storage|*|RECURSE
FileKey7=%AppData%\CurseForge\Crashpad\Reports|*
FileKey8=%AppData%\CurseForge\Logs|*
FileKey9=%AppData%\CurseForge\Partitions\*\*cache*|*|REMOVESELF
FileKey10=%AppData%\CurseForge\Service Worker\*Cache*|*|RECURSE
FileKey11=%LocalAppData%\curseforge-updater|*|RECURSE

[CursorArts *]
LangSecRef=3023
Detect=HKCU\Software\CursorArts
RegKey1=HKCU\Software\CursorArts\MRU Items
RegKey2=HKCU\Software\CursorArts\MRU Library Items

[CursorFX *]
LangSecRef=3024
Detect=HKCU\Software\CursorFX Theme Editor
RegKey1=HKCU\Software\CursorFX Theme Editor\Recent File List

[CustomFolder *]
LangSecRef=3024
Detect=HKCU\Software\CustomFolder
FileKey1=%ProgramFiles%\CustomFolder|*.log

[CuteFTP *]
LangSecRef=3022
DetectFile=%AppData%\Globalscape\CuteFTP
FileKey1=%AppData%\Globalscape\CuteFTP\*|*.log
FileKey2=%AppData%\Globalscape\CuteFTP\*\Logs|*
FileKey3=%LocalAppData%\Globalscape\CuteFTP\*\Cache*|*|RECURSE

[CuteHTML 2.3 *]
LangSecRef=3024
Detect=HKCU\Software\GlobalSCAPE\CuteHTML\2.3
RegKey1=HKCU\Software\GlobalSCAPE\CuteHTML\2.3\Recent File List

[CutePDF Writer *]
LangSecRef=3023
Detect=HKCU\Software\Acro Software Inc\CPW
FileKey1=%LocalAppData%\CutePDF Writer|*.tmp
RegKey1=HKCU\Software\Acro Software Inc\CPW|Filename
RegKey2=HKCU\Software\Acro Software Inc\CPW|Title

[Cyber Privacy Suite *]
LangSecRef=3024
DetectFile=%AppData%\Cyber Privacy Suite
FileKey1=%AppData%\Cyber Privacy Suite\Cyber Privacy Suite*\install|*log.txt
FileKey2=%LocalAppData%\CyberPrivacySuite|*.log;log.rtf

[Cyberduck *]
LangSecRef=3024
Detect=HKCR\.cyberducklicense
FileKey1=%AppData%\Cyberduck|*.log

[Cyberlab *]
LangSecRef=3024
Detect=HKCU\Software\ZookaWare
DetectFile=%LocalAppData%\Cyberlab
FileKey1=%LocalAppData%\Cyberlab\ScanLogs|*.log
FileKey2=%LocalAppData%\ZookaWare\ScanLogs|*.log

[CyberLink *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink
FileKey1=%AppData%\CyberLink\MediaCache|*|RECURSE
FileKey2=%ProgramData%\CyberLink\Boomerang\*|*.dmp;*.xml
FileKey3=%ProgramData%\CyberLink\CBE\*|*|RECURSE
FileKey4=%ProgramData%\CyberLink\Downloader|*|RECURSE
FileKey5=%ProgramData%\install_backup|*|REMOVESELF
FileKey6=%ProgramData%\install_clap|*|REMOVESELF
RegKey1=HKCU\Software\CyberLink\DSSharedMediaInfo\SharedInfoCache
RegKey2=HKCU\Software\CyberLink\MediaCache\Data4
RegKey3=HKCU\Software\CyberLink\MediaCache\Thumbnail4
RegKey4=HKCU\Software\CyberLink\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\MediaCache5\Thumbnail5

[CyberLink AudioDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\AudioDirector4
Detect2=HKCU\Software\CyberLink\AudioDirector5
Detect3=HKCU\Software\CyberLink\AudioDirector6
Detect4=HKCU\Software\CyberLink\AudioDirector7
Detect5=HKCU\Software\CyberLink\AudioDirector8
Detect6=HKCU\Software\CyberLink\AudioDirector9
FileKey1=%LocalAppData%\Cyberlink\AudioDirector\*|*|RECURSE
FileKey2=%UserProfile%\Documents\Cyberlink\AudioDirector\*\SplitterIndex|*|RECURSE
RegKey1=HKCU\Software\CyberLink\AudioDirector4\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\AudioDirector4\MediaObj\MediaCache5\Thumbnail5
RegKey3=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Data5
RegKey4=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Thumbnail5
RegKey5=HKCU\Software\CyberLink\AudioDirector6\MediaObj\MediaCache5\Data5
RegKey6=HKCU\Software\CyberLink\AudioDirector6\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\AudioDirector7\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\AudioDirector7\MediaObj\MediaCache5\Thumbnail5
RegKey9=HKCU\Software\CyberLink\AudioDirector8\MediaObj\MediaCache5\Data5
RegKey10=HKCU\Software\CyberLink\AudioDirector8\MediaObj\MediaCache5\Thumbnail5
RegKey11=HKCU\Software\CyberLink\AudioDirector9\MediaObj\MediaCache5\Data5
RegKey12=HKCU\Software\CyberLink\AudioDirector9\MediaObj\MediaCache5\Thumbnail5

[CyberLink ColorDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\ColorDirector3
Detect2=HKCU\Software\CyberLink\ColorDirector4
Detect3=HKCU\Software\CyberLink\ColorDirector5
Detect4=HKCU\Software\CyberLink\ColorDirector6
Detect5=HKCU\Software\CyberLink\ColorDirector7
FileKey1=%LocalAppData%\Cyberlink\ColorDirector\*|*|RECURSE
RegKey1=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Thumbnail5
RegKey3=HKCU\Software\CyberLink\ColorDirector4\MediaObj\MediaCache5\Data5
RegKey4=HKCU\Software\CyberLink\ColorDirector4\MediaObj\MediaCache5\Thumbnail5
RegKey5=HKCU\Software\CyberLink\ColorDirector5\MediaObj\MediaCache5\Data5
RegKey6=HKCU\Software\CyberLink\ColorDirector5\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\ColorDirector6\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\ColorDirector6\MediaObj\MediaCache5\Thumbnail5
RegKey9=HKCU\Software\CyberLink\ColorDirector7\MediaObj\MediaCache5\Data5
RegKey10=HKCU\Software\CyberLink\ColorDirector7\MediaObj\MediaCache5\Thumbnail5

[CyberLink PhotoDirector *]
LangSecRef=3023
DetectFile=%UserProfile%\Pictures\PhotoDirector
FileKey1=%UserProfile%\Pictures\PhotoDirector\*\*|*|RECURSE
ExcludeKey1=PATH|%UserProfile%\Pictures\PhotoDirector\*\*\|*.phd

[CyberLink Power2Go *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\Power2Go9
Detect2=HKCU\Software\CyberLink\Power2Go10
Detect3=HKCU\Software\CyberLink\Power2Go11
Detect4=HKCU\Software\CyberLink\Power2Go12
FileKey1=%LocalAppData%\Cyberlink\Power2Go*|DLDB.db
FileKey2=%ProgramFiles%\Cyberlink\Power2Go*|*.tmp;Thumbs.db|RECURSE
FileKey3=%Public%\Documents\Cyberlink\Power2Go*|MP3Cache.log
FileKey4=%UserProfile%\Documents\PDRMUSIC.TMP|*|REMOVESELF
FileKey5=%UserProfile%\Music|*.tmp
FileKey6=%UserProfile%\Pictures|*.tmp
RegKey1=HKCU\Software\CyberLink\LabelPrint\Recent File List
RegKey2=HKCU\Software\CyberLink\Power2Go9\9.0|CDRippingPath
RegKey3=HKCU\Software\CyberLink\Power2Go9\9.0|CUEName
RegKey4=HKCU\Software\CyberLink\Power2Go9\9.0|CUEPath
RegKey5=HKCU\Software\CyberLink\Power2Go9\9.0|DestFolder
RegKey6=HKCU\Software\CyberLink\Power2Go9\9.0|DVDFolderPath
RegKey7=HKCU\Software\CyberLink\Power2Go9\9.0|ImagePath
RegKey8=HKCU\Software\CyberLink\Power2Go9\9.0|LastBrowsePath
RegKey9=HKCU\Software\CyberLink\Power2Go9\9.0|LastSaveProjPath
RegKey10=HKCU\Software\CyberLink\Power2Go9\9.0|MonitorPaths
RegKey11=HKCU\Software\CyberLink\Power2Go9\9.0|OpenPrjFilePath
RegKey12=HKCU\Software\CyberLink\Power2Go9\9.0|SelectedFolderPath
RegKey13=HKCU\Software\CyberLink\Power2Go9\9.0\MediaObj\MediaCache5\Data5
RegKey14=HKCU\Software\CyberLink\Power2Go9\9.0\MediaObj\MediaCache5\Thumbnail5
RegKey15=HKCU\Software\CyberLink\Power2Go10\10.0|CDRippingPath
RegKey16=HKCU\Software\CyberLink\Power2Go10\10.0|CUEName
RegKey17=HKCU\Software\CyberLink\Power2Go10\10.0|CUEPath
RegKey18=HKCU\Software\CyberLink\Power2Go10\10.0|DestFolder
RegKey19=HKCU\Software\CyberLink\Power2Go10\10.0|DVDFolderPath
RegKey20=HKCU\Software\CyberLink\Power2Go10\10.0|ImagePath
RegKey21=HKCU\Software\CyberLink\Power2Go10\10.0|LastBrowsePath
RegKey22=HKCU\Software\CyberLink\Power2Go10\10.0|LastSaveProjPath
RegKey23=HKCU\Software\CyberLink\Power2Go10\10.0|MonitorPaths
RegKey24=HKCU\Software\CyberLink\Power2Go10\10.0|OpenPrjFilePath
RegKey25=HKCU\Software\CyberLink\Power2Go10\10.0|SelectedFolderPath
RegKey26=HKCU\Software\CyberLink\Power2Go10\10.0\MediaObj\MediaCache5\Data5
RegKey27=HKCU\Software\CyberLink\Power2Go10\10.0\MediaObj\MediaCache5\Thumbnail5
RegKey28=HKCU\Software\CyberLink\Power2Go11\11.0|CDRippingPath
RegKey29=HKCU\Software\CyberLink\Power2Go11\11.0|CUEName
RegKey30=HKCU\Software\CyberLink\Power2Go11\11.0|CUEPath
RegKey31=HKCU\Software\CyberLink\Power2Go11\11.0|DestFolder
RegKey32=HKCU\Software\CyberLink\Power2Go11\11.0|DVDFolderPath
RegKey33=HKCU\Software\CyberLink\Power2Go11\11.0|ImagePath
RegKey34=HKCU\Software\CyberLink\Power2Go11\11.0|LastBrowsePath
RegKey35=HKCU\Software\CyberLink\Power2Go11\11.0|LastSaveProjPath
RegKey36=HKCU\Software\CyberLink\Power2Go11\11.0|MonitorPaths
RegKey37=HKCU\Software\CyberLink\Power2Go11\11.0|OpenPrjFilePath
RegKey38=HKCU\Software\CyberLink\Power2Go11\11.0|SelectedFolderPath
RegKey39=HKCU\Software\CyberLink\Power2Go11\11.0\MediaObj\MediaCache5\Data5
RegKey40=HKCU\Software\CyberLink\Power2Go11\11.0\MediaObj\MediaCache5\Thumbnail5
RegKey41=HKCU\Software\CyberLink\Power2Go12\12.0|CDRippingPath
RegKey42=HKCU\Software\CyberLink\Power2Go12\12.0|CUEName
RegKey43=HKCU\Software\CyberLink\Power2Go12\12.0|CUEPath
RegKey44=HKCU\Software\CyberLink\Power2Go12\12.0|DestFolder
RegKey45=HKCU\Software\CyberLink\Power2Go12\12.0|DVDFolderPath
RegKey46=HKCU\Software\CyberLink\Power2Go12\12.0|ImagePath
RegKey47=HKCU\Software\CyberLink\Power2Go12\12.0|LastBrowsePath
RegKey48=HKCU\Software\CyberLink\Power2Go12\12.0|LastSaveProjPath
RegKey49=HKCU\Software\CyberLink\Power2Go12\12.0|MonitorPaths
RegKey50=HKCU\Software\CyberLink\Power2Go12\12.0|OpenPrjFilePath
RegKey51=HKCU\Software\CyberLink\Power2Go12\12.0|SelectedFolderPath
RegKey52=HKCU\Software\CyberLink\Power2Go12\12.0\MediaObj\MediaCache5\Data5
RegKey53=HKCU\Software\CyberLink\Power2Go12\12.0\MediaObj\MediaCache5\Thumbnail5
RegKey54=HKCU\Software\CyberLink\WaveEditor\2.0|ImportDir
RegKey55=HKCU\Software\CyberLink\WaveEditor\2.0|TempFileDir
RegKey56=HKCU\Software\CyberLink\WaveEditor\2.0|WorkDir

[Cyberlink PowerCinema *]
LangSecRef=3023
Detect=HKCU\Software\Cyberlink\PowerCinema
DetectFile=%LocalAppData%\PowerCinema
FileKey1=%LocalAppData%\PowerCinema|trace.*
FileKey2=%ProgramData%|{*-*-*-*-*}.log

[CyberLink PowerDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PowerDirector10
Detect2=HKCU\Software\CyberLink\PowerDirector11
Detect3=HKCU\Software\CyberLink\PowerDirector12
Detect4=HKCU\Software\CyberLink\PowerDirector13
Detect5=HKCU\Software\CyberLink\PowerDirector14
Detect6=HKCU\Software\CyberLink\PowerDirector15
Detect7=HKCU\Software\CyberLink\PowerDirector16
Detect8=HKCU\Software\CyberLink\PowerDirector17
FileKey1=%AppData%\Cyberlink\PowerDirector\*|Recentfiles.ini
FileKey2=%AppData%\CyberLink\PowerDirector\*\AutoSave|*|RECURSE
FileKey3=%AppData%\CyberLink\PowerDirector\*\photoTmp|*|RECURSE
FileKey4=%AppData%\Cyberlink\PowerDirector\*\WaveForms|*|RECURSE
FileKey5=%UserProfile%\Documents\CyberLink\PowerDirector\*|Snapshot(*).jpg
FileKey6=%UserProfile%\Documents\CyberLink\PowerDirector\*\MyTitles|*|RECURSE
FileKey7=%UserProfile%\Documents\Cyberlink\PowerDirector\*\PDRMUSIC.TMP|*|REMOVESELF
FileKey8=%UserProfile%\Documents\Cyberlink\PowerDirector\*\PP.TWOPASS|*|REMOVESELF
FileKey9=%UserProfile%\Documents\CyberLink\PowerDirector\*\Preview Cache Files|*
FileKey10=%UserProfile%\Documents\CyberLink\PowerDirector\*\ShadowEditFiles|*.MPG
FileKey11=%UserProfile%\Documents\CyberLink\PowerDirector\*\SplitterIndex|*.maidx
RegKey1=HKCU\Software\CyberLink\Hanuman
RegKey2=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Data5
RegKey3=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Thumbnail5
RegKey4=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Thumbnail5
RegKey6=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Data5
RegKey7=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Thumbnail5
RegKey8=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Data5
RegKey9=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Thumbnail5
RegKey10=HKCU\Software\CyberLink\PowerDirector14\MediaObj\MediaCache5\Data5
RegKey11=HKCU\Software\CyberLink\PowerDirector14\MediaObj\MediaCache5\Thumbnail5
RegKey12=HKCU\Software\CyberLink\PowerDirector15\MediaObj\MediaCache5\Data5
RegKey13=HKCU\Software\CyberLink\PowerDirector15\MediaObj\MediaCache5\Thumbnail5
RegKey14=HKCU\Software\CyberLink\PowerDirector16\MediaObj\MediaCache5\Data5
RegKey15=HKCU\Software\CyberLink\PowerDirector16\MediaObj\MediaCache5\Thumbnail5
RegKey16=HKCU\Software\CyberLink\PowerDirector17\MediaObj\MediaCache5\Data5
RegKey17=HKCU\Software\CyberLink\PowerDirector17\MediaObj\MediaCache5\Thumbnail5
RegKey18=HKCU\Software\CyberLink\PowerDirector17\OldCacheFolder

[CyberLink PowerDVD *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PowerDVD14
Detect2=HKCU\Software\CyberLink\PowerDVD15
Detect3=HKCU\Software\CyberLink\PowerDVD16
Detect4=HKCU\Software\CyberLink\PowerDVD17
Detect5=HKCU\Software\CyberLink\PowerDVD18
Detect6=HKCU\Software\CyberLink\PowerDVD19
Detect7=HKCU\Software\CyberLink\PowerDVD20
Detect8=HKCU\Software\CyberLink\PowerDVD21
Detect9=HKCU\Software\CyberLink\PowerDVD22
FileKey1=%AppData%\CyberLink\Webview|*.old|RECURSE
FileKey2=%LocalAppData%\Cyberlink\DigitalHome|*.log|RECURSE
FileKey3=%LocalAppData%\Cyberlink\PowerDVD*|*.log|RECURSE
FileKey4=%LocalAppData%\Cyberlink\PowerDVD*\*\PowerDVDMainAP|*|RECURSE
FileKey5=%LocalAppData%\Cyberlink\PowerDVD*\cache*|*|RECURSE
FileKey6=%LocalAppData%\Cyberlink\PowerDVD*\CL_DMP_Browser|*|RECURSE
FileKey7=%LocalAppData%\Cyberlink\PowerDVD*\DB*\computer|*.db|RECURSE
FileKey8=%LocalAppData%\Cyberlink\PowerDVD*\DefaultMember|*|RECURSE
FileKey9=%ProgramData%\Cyberlink\Evoparser|*.xml
FileKey10=%ProgramData%\CyberLink\PowerDVD*\Boomerang\*|*.dmp;*.xml
FileKey11=%ProgramData%\SUPPORTDIR\*|*.log
RegKey1=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey3=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey4=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey6=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey9=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey10=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey11=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey12=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey13=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey14=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey15=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey16=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey17=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey18=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey19=HKCU\Software\CyberLink\PowerDVD20\CoarseSnapshot\MediaObj\MediaCache5\Data5
RegKey20=HKCU\Software\CyberLink\PowerDVD20\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo
RegKey21=HKCU\Software\CyberLink\PowerDVD21\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey22=HKCU\Software\CyberLink\PowerDVD21\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey23=HKCU\Software\CyberLink\PowerDVD21\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey24=HKCU\Software\CyberLink\PowerDVD21\CoarseSnapshot\MediaObj\MediaCache5\Data5
RegKey25=HKCU\Software\CyberLink\PowerDVD21\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo
RegKey26=HKCU\Software\CyberLink\PowerDVD22\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey27=HKCU\Software\CyberLink\PowerDVD22\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey28=HKCU\Software\CyberLink\PowerDVD22\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey29=HKCU\Software\CyberLink\PowerDVD22\CoarseSnapshot\MediaObj\MediaCache5\Data5
RegKey30=HKCU\Software\CyberLink\PowerDVD22\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo

[CyberLink PowerProducer *]
LangSecRef=3023
DetectFile=%ProgramFiles%\HomeCinema
FileKey1=%ProgramFiles%\HomeCinema\PowerProducer\Template\Cyberlink\frame|*tmp

[CyberLink YouCam *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\YouCam
FileKey1=%UserProfile%\Documents\YouCam|*.tmp

[CyberScrub Privacy Suite *]
LangSecRef=3024
Detect=HKCU\Software\CyberScrub\Privacy Suite
FileKey1=%AppData%\CyberScrub\Privacy Suite|cybscrub.log

[Cybertron Privacy Eraser *]
LangSecRef=3024
DetectFile=%AppData%\Cybertron\Privacy Eraser
FileKey1=%AppData%\Cybertron\Privacy Eraser\Registry Backups|*

[Cycling '74 *]
LangSecRef=3023
DetectFile=%AppData%\Cycling '74
FileKey1=%AppData%\Cycling '74\Logs|*
FileKey2=%AppData%\Cycling '74\Max*\Crash Recovery\MaxEditorLogFiles|*
FileKey3=%AppData%\Cycling '74\Max*\Database|*-journal;*.bak;*.old
FileKey4=%AppData%\Cycling '74\Max*\Settings\cef*|debug.log;Visited Links
FileKey5=%AppData%\Cycling '74\Max*\Settings\cef*\blob_storage|*|RECURSE

[CzDC *]
LangSecRef=3022
DetectFile=%AppData%\CzDC
FileKey1=%AppData%\CzDC|*.bak|RECURSE

[Daemon Tools *]
LangSecRef=3024
Detect1=HKCU\Software\Disc Soft
Detect2=HKCU\Software\DT Soft
FileKey1=%AppData%\DAEMON Tools*|ImgList.dat
FileKey2=%AppData%\DAEMON Tools*\*Cache|*|RECURSE
FileKey3=%ProgramData%\DAEMON Tools*\Temp|*|RECURSE
RegKey1=HKCU\Software\Disc Soft\DAEMON Tools Pro\GuiNamespace|MountFolder
RegKey2=HKCU\Software\DT Soft\DAEMON Tools Pro\GuiNamespace|MountFolder

[Dakota AG *]
LangSecRef=3021
DetectFile=%SystemDrive%\dakotaag
FileKey1=%SystemDrive%\dakotaag|*.log|RECURSE
FileKey2=%UserProfile%\Documents|dakotaDeinstallieren.log

[DAMN Hash Calculator *]
LangSecRef=3024
Detect=HKCU\Software\DAMN\Hash Calculator
RegKey1=HKCU\Software\DAMN\Hash Calculator\Settings|LastDir

[DAMN NFO Viewer *]
LangSecRef=3024
Detect=HKCU\Software\DAMN\DAMN NFO Viewer
RegKey1=HKCU\Software\DAMN\DAMN NFO Viewer|WorkingDirectory
RegKey2=HKCU\Software\DAMN\DAMN NFO Viewer\Recently Viewed Files

[Damned *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\251170
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Damned|*.log|RECURSE

[Danger Scavenger *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1169740
FileKey1=%UserProfile%\AppData\LocalLow\Star Drifters\Danger Scavenger|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Star Drifters\Danger Scavenger\Unity|*|REMOVESELF

[Dangerous Waters *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1600
DetectFile=%ProgramFiles%\Sonalysts Combat Simulations\Dangerous Waters
FileKey1=%ProgramFiles%\Sonalysts Combat Simulations\Dangerous Waters|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Dangerous Waters|*.log

[DARK *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225360
FileKey1=%AppData%\Kalypso Media\Dark|log.txt

[Dark Manor *]
Section=Games
DetectFile=%AppData%\DarkManor
FileKey1=%AppData%\DarkManor|*.dmp

[DarkComet RAT *]
LangSecRef=3024
DetectFile=%AppData%\DCLogs
FileKey1=%AppData%\DCLogs|*.dc|REMOVESELF

[Darksiders Genesis *]
Section=Games
DetectFile=%LocalAppData%\THQ Nordic\Darksiders Genesis
FileKey1=%LocalAppData%\THQ Nordic\Darksiders Genesis\Saved\Logs|*

[Darksiders II Deathinitive Edition Backups *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\388410
FileKey1=%ProgramFiles%\Steam\steamapps\common\Darksiders II Deathinitive Edition\Debug Saves|*

[Darksiders Warmastered Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\462780
FileKey1=%ProgramFiles%\Steam\steamapps\common\Darksiders Warmastered Edition|*.log

[Dashlane *]
LangSecRef=3022
DetectFile=%AppData%\Dashlane
FileKey1=%AppData%\Dashlane\*\background_cache|*|RECURSE

[DataNumen Disk Image *]
LangSecRef=3024
Detect=HKCU\Software\DDKI
RegKey1=HKCU\Software\DDKI\Misc|OpenDirectory

[DataNumen Outlook Password Recovery *]
LangSecRef=3024
Detect=HKCU\Software\DOPR
RegKey1=HKCU\Software\DOPR\Misc|OpenDirectory

[DataNumen Outlook Repair *]
LangSecRef=3024
Detect1=HKCU\Software\DOLKR
Detect2=HKCU\Software\DOLKR64
RegKey1=HKCU\Software\DOLKR\Misc|OpenDirectory
RegKey2=HKCU\Software\DOLKR64\Misc|OpenDirectory

[DataTron 7 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\DataTron7
FileKey1=%ProgramFiles%\DataTron7|*.BAK;*.GID

[DATEV *]
LangSecRef=3021
DetectFile=%SystemDrive%\DATEV
FileKey1=%SystemDrive%\DATEV\LOG|*.log|RECURSE

[Daum Streaming Agent Manager *]
LangSecRef=3023
DetectFile=%LocalAppData%\KakaoLiveAgent
FileKey1=%LocalAppData%\KakaoLiveAgent\Log|*
FileKey2=%LocalAppData%\KakaoLiveAgent\tmp|*

[Dawn of War *]
Section=Games
DetectFile=%ProgramFiles%\Dawn of War*
FileKey1=%ProgramFiles%\Dawn of War*|warnings.log
FileKey2=%ProgramFiles%\Dawn of War*\Playback|temp.rec

[DayZ *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\221100
FileKey1=%LocalAppData%\DayZ|DayZ.bidmp;DayZ.mdmp

[DAZ 3D Studio *]
LangSecRef=3021
DetectFile=%AppData%\DAZ 3D\Studio*
FileKey1=%AppData%\DAZ 3D\Studio*|log.txt
FileKey2=%AppData%\DAZ 3D\Studio*\Temp|*|RECURSE

[DB Browser for SQLite *]
LangSecRef=3024
Detect=HKCU\Software\sqlitebrowser\sqlitebrowser
RegKey1=HKCU\Software\sqlitebrowser\sqlitebrowser\db|lastlocation
RegKey2=HKCU\Software\sqlitebrowser\sqlitebrowser\General|recentFileList
RegKey3=HKCU\Software\sqlitebrowser\sqlitebrowser\MainWindow

[DBFView *]
LangSecRef=3021
Detect=HKCU\Software\DBFView
RegKey1=HKCU\Software\DBFView\DBFView\Recent File List

[dBpoweramp *]
LangSecRef=3023
Detect=HKCU\Software\Illustrate\dBpoweramp
FileKey1=%AppData%\dBpoweramp|*.bin
RegKey1=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder0
RegKey2=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder1
RegKey3=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder2
RegKey4=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder3
RegKey5=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder4
RegKey6=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder5
RegKey7=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder6
RegKey8=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder7
RegKey9=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder8
RegKey10=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder9
RegKey11=HKCU\Software\Illustrate\dBpoweramp|dMCLastFolder10
RegKey12=HKCU\Software\Illustrate\dBpoweramp|LastAccessedFolder
RegKey13=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\[Multi Encoder]|DMCUserFolderStr
RegKey14=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\AAC (Advanced Audio Compression)|DMCUserFolderStr
RegKey15=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\Aiff|DMCUserFolderStr
RegKey16=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\Apple Lossless|DMCUserFolderStr
RegKey17=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\FLAC|DMCUserFolderStr
RegKey18=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\mp3 (Lame)|DMCUserFolderStr
RegKey19=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\ogg vorbis|DMCUserFolderStr
RegKey20=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\Test Conversion|DMCUserFolderStr
RegKey21=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\Wave|DMCUserFolderStr
RegKey22=HKCU\Software\Illustrate\dBpoweramp\dMCCodec\Windows Media Audio 10|DMCUserFolderStr

[DC Universe Online *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\24200
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\DC Universe Online|.downloadInfo.txt;.downloadStats.txt
FileKey2=%UserProfile%\Documents\My Games\DC Universe Online\Logs|*

[DC++ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\DC++
FileKey1=%AppData%\DC++|CrashLog.txt;FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey2=%AppData%\DC++\FileLists|*
FileKey3=%AppData%\DC++\Logs|*
FileKey4=%LocalAppData%\DC++|CrashLog.txt;FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey5=%ProgramFiles%\DC++|CrashLog.txt;FinishedTransfers.xml;Queue.xml.bak;Recents.xml

[Dead Cells *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\Dead Cells
FileKey1=%ProgramFiles%\Steam\steamapps\common\Dead Cells\logs|*.log

[Dead Island *]
Section=Games
DetectFile=%UserProfile%\Documents\DeadIsland*
FileKey1=%UserProfile%\Documents\DeadIsland*\out\logs|*

[DeadHash *]
LangSecRef=3024
DetectFile=%AppData%\deadhash
FileKey1=%AppData%\deadhash\*Cache|*|RECURSE
FileKey2=%AppData%\deadhash\blob_storage|*|RECURSE
FileKey3=%AppData%\deadhash\Local Storage|*|RECURSE
FileKey4=%AppData%\deadhash\Session Storage|*
FileKey5=%LocalAppData%\deadhash-updater|*.exe

[Dear Esther *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\203810
FileKey1=%ProgramFiles%\Steam\Steamapps\common\dear esther\dearesther|*.tmp
FileKey2=%ProgramFiles%\Steam\Steamapps\common\dear esther\dearesther\resource|*.icns

[Death to Spies: Moment of Truth *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\34410
FileKey1=%UserProfile%\Documents\My Games\Smersh_MT\Cache|*

[Death Track: Resurrection *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\7840
FileKey1=%UserProfile%\Documents\Skyfallen Entertaiment\DeathTrack\Logs|*

[Debenu *]
LangSecRef=3021
Detect=HKCU\Software\Debenu
FileKey1=%ProgramData%\Debenu\PDF Tools\Reports\App Log|*
RegKey1=HKCU\Software\Debenu\Debenu PDF Maximus 2\MaximusViewerRecentDocs
RegKey2=HKCU\Software\Debenu\Debenu PDF Maximus 2\MaximusViewerRecentFolders

[DECAdry Business Card *]
LangSecRef=3021
DetectFile=%AppData%\DECAdry\BusinessCard
FileKey1=%AppData%\DECAdry\BusinessCard|LWTHUMB.DAT

[Deep Java Library *]
LangSecRef=3024
DetectFile=%UserProfile%\.djl.ai
FileKey1=%UserProfile%\.djl.ai\cache|*|REMOVESELF

[DeepBurner *]
LangSecRef=3024
Detect=HKCU\Software\Astonsoft\DeepBurner
FileKey1=%AppData%\DeepBurner|DeepBurner.log

[Deezer Desktop *]
LangSecRef=3022
DetectFile=%LocalAppData%\Programs\deezer.desktop
FileKey1=%AppData%\Deezer*|*-journal;LOG;LOG.old|RECURSE
FileKey2=%AppData%\Deezer*|log.log;Network Persistent State;Origin Bound Certs;QuotaManager
FileKey3=%AppData%\Deezer*\*Cache|*|RECURSE
FileKey4=%AppData%\Deezer*\*logs|*|RECURSE
FileKey5=%AppData%\Deezer*\blob_storage|*|RECURSE
FileKey6=%AppData%\Deezer*\Service Worker\*Cache*|*|RECURSE
FileKey7=%LocalAppData%\deezer*desktop-updater|*|RECURSE

[Default Programs Editor *]
LangSecRef=3024
DetectFile=%LocalAppData%\factormystic.net\Default Programs Editor
FileKey1=%LocalAppData%\factormystic.net\Default Programs Editor\*|crash-report.*|RECURSE

[Defense Grid: The Awakening *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\18500
FileKey1=%ProgramFiles%\Steam\steamapps\common\defensegridtheawakening\Shaders\Generated|*.cache

[Defraggler *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\Defraggler
FileKey1=%ProgramFiles%\Defraggler|*.dmp;*.log;*statistics*;Defraggler*.txt
FileKey2=%UserProfile%|Defraggler*.txt

[Delfix *]
LangSecRef=3024
DetectFile=%SystemDrive%\DelFix.txt
FileKey1=%SystemDrive%|DelFix.txt

[Dell *]
LangSecRef=3024
Detect1=HKLM\Software\Dell
Detect2=HKLM\Software\PC-Doctor
DetectFile1=%AppData%\Creative\DELL Webcam Center
DetectFile2=%LocalAppData%\Dell
DetectFile3=%LocalAppData%\SupportSoft\DellSupportCenter
DetectFile4=%ProgramData%\Dell
DetectFile5=%ProgramFiles%\Dell*
FileKey1=%AppData%\Creative\DELL Webcam Center|MO_Log.txt
FileKey2=%AppData%\PCDr\*\Logs|*
FileKey3=%LocalAppData%\Dell\*\Log|*
FileKey4=%LocalAppData%\Dell\DellMobileConnect|*.log
FileKey5=%LocalAppData%\SupportSoft\DellSupportCenter\*\state\logs|*
FileKey6=%ProgramData%\Dell\*|*.log
FileKey7=%ProgramData%\Dell\*\Log*|*|RECURSE
FileKey8=%ProgramData%\Dell\BiosVerification|*.log
FileKey9=%ProgramData%\Dell\D3\pla\*\*|*.log;*.txt|REMOVESELF
FileKey10=%ProgramData%\Dell\D3\Resources\Logs\serilog|*
FileKey11=%ProgramData%\Dell\Drivers\*|*.log;*.tmp|RECURSE
FileKey12=%ProgramData%\Dell\orca\deviceq|*
FileKey13=%ProgramData%\Dell\SupportAssist|*|RECURSE
FileKey14=%ProgramData%\Dell\TrustedDevice|*.log
FileKey15=%ProgramData%\Dell\Update|*.txt
FileKey16=%ProgramData%\Dell\UpdateService|*.log;*.txt|RECURSE
FileKey17=%ProgramData%\PCDr\*\Logs|*
FileKey18=%ProgramFiles%\Dell*|*.log|RECURSE

[Dell Customer Connect *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\DellInc.DellCustomerConnect_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellCustomerConnect_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellCustomerConnect_htrsf667h5kn2\LocalState\serilog|*.txt
FileKey3=%LocalAppData%\Packages\DellInc.DellCustomerConnect_htrsf667h5kn2\Settings|*.log*
FileKey4=%LocalAppData%\Packages\DellInc.DellCustomerConnect_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.DellCustomerConnect_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell Digital Delivery *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_htrsf667h5kn2\LocalState\serilog|*.txt
FileKey3=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_htrsf667h5kn2\Settings|*.log*
FileKey4=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell Help & Support *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\DellInc.DellHelpSupport_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellHelpSupport_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellHelpSupport_htrsf667h5kn2\LocalCache\Local\Dell\DHSC\Logs|*.log
FileKey3=%LocalAppData%\Packages\DellInc.DellHelpSupport_htrsf667h5kn2\Settings|*.log*
FileKey4=%LocalAppData%\Packages\DellInc.DellHelpSupport_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.DellHelpSupport_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell Installation Files *]
LangSecRef=3024
DetectFile=%SystemDrive%\Dell
FileKey1=%SystemDrive%\Dell|*|REMOVESELF

[Dell Mobile Connect *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2\LocalCache\Local\Dell\DellMobileConnect|*.log
FileKey3=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE
FileKey4=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2\Settings|*.log*
FileKey5=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell My Dell *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\DellInc.MyDell_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.MyDell_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.MyDell_htrsf667h5kn2\LocalState\Logs|*
FileKey3=%LocalAppData%\Packages\DellInc.MyDell_htrsf667h5kn2\Settings|*.log*
FileKey4=%LocalAppData%\Packages\DellInc.MyDell_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.MyDell_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell PC Doctor *]
LangSecRef=3024
DetectFile=%ProgramData%\PCDr
FileKey1=%ProgramData%\PCDr|*.dmp|RECURSE
FileKey2=%ProgramData%\PCDr\*\Cache|*.xml
FileKey3=%ProgramData%\PCDr\*\Cache\archives|*|RECURSE
FileKey4=%ProgramData%\PCDr\*\Cache\BUMA|*
FileKey5=%ProgramData%\PCDr\*\Cache\DriverScan|*
FileKey6=%ProgramData%\PCDr\*\Snapshots\*|*

[Dell Power Manager *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\DellInc.DellPowerManager_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellPowerManager_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellPowerManager_htrsf667h5kn2\Settings|*.log*
FileKey3=%LocalAppData%\Packages\DellInc.DellPowerManager_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\DellInc.DellPowerManager_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell PremierColor *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c
FileKey1=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c\LocalCache\Local\Microsoft\Windows\Caches|*.db
FileKey3=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c\Settings|*.log*
FileKey4=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c\TempState|*|REMOVESELF

[Dell Product Registration *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2\LocalCache\Local\Dell\Product Registration\UILog|*.htm
FileKey3=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE
FileKey4=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2\Settings|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\DellInc.DellProductRegistration_htrsf667h5kn2\TempState|*|REMOVESELF

[Dell Stage Suite *]
LangSecRef=3023
DetectFile1=%AppData%\Dell\*Stage
DetectFile2=%LocalAppData%\Dell\*Stage
FileKey1=%AppData%\Dell\Dell Stage|*.backup|RECURSE
FileKey2=%AppData%\Dell\MusicStage\*\Album_Images|*
FileKey3=%AppData%\Dell\MusicStage\*\Artist_Images|*
FileKey4=%AppData%\Dell\MusicStage\*\Cache|*
FileKey5=%AppData%\Fingertapps\AccuWeather\Cache|*
FileKey6=%LocalAppData%\Dell\VideoStage\CinemaNow\*|kthumb*.db;log.*
FileKey7=%LocalAppData%\Dell\VideoStage\Library\*|kthumb*.db;log.*

[Dell SupportAssist *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2
DetectFile2=%ProgramData%\SupportAssist
FileKey1=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2\LocalCache\Local\Microsoft\Windows\Caches|*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2\LocalState|*.txt
FileKey4=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2\Settings|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_htrsf667h5kn2\TempState|*|REMOVESELF
FileKey7=%ProgramData%\SupportAssist\Client\Agent\Downloads|*|RECURSE
FileKey8=%ProgramData%\SupportAssist\Client\Agent\Logs\*|*|REMOVESELF
FileKey9=%ProgramData%\SupportAssist\Client\SRE|*.log
FileKey10=%ProgramData%\SupportAssist\Client\SRE\ExtendedLogs|*
FileKey11=%ProgramData%\SupportAssist\Client\TechnicianToolkit\Library\Logs|*|RECURSE
FileKey12=%ProgramData%\SupportAssist\Client\TechnicianToolkit\Library\RegBackup|*
FileKey13=%ProgramData%\SupportAssist\Client\TechnicianToolkit\Library\Temp|*|RECURSE

[Dell Update *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\DellInc.DellUpdate_htrsf667h5kn2
DetectFile2=%ProgramData%\Dell\UpdateService
FileKey1=%LocalAppData%\Packages\DellInc.DellUpdate_htrsf667h5kn2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellUpdate_htrsf667h5kn2\LocalCache\Local\Microsoft\Windows\Caches|*
FileKey3=%LocalAppData%\Packages\DellInc.DellUpdate_htrsf667h5kn2\Settings|*.log*
FileKey4=%LocalAppData%\Packages\DellInc.DellUpdate_htrsf667h5kn2\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\DellInc.DellUpdate_htrsf667h5kn2\TempState|*|REMOVESELF
FileKey6=%ProgramData%\Dell\UpdateService\Downloads\*|*|REMOVESELF

[Deponia *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\214340
DetectFile=%LocalAppData%\Daedalic Entertainment\Deponia
FileKey1=%LocalAppData%\Daedalic Entertainment\Deponia|*.log

[Desk 365 *]
LangSecRef=3021
Detect1=HKCU\Software\V9\Desk 365
Detect2=HKLM\Software\V9\Desk 365 Plus
DetectFile=%ProgramFiles%\Desk 365*
FileKey1=%AppData%\Desk 365*\icons|*|RECURSE
FileKey2=%AppData%\Desk 365*\sysicons|*.ico
FileKey3=%ProgramFiles%\Desk 365|recent.xml
FileKey4=%SystemDrive%\User Data\Default|*

[Desktop Central Free Windows Admin Tools *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ManageEngine\ManageEngine Free Tools\DesktopCentral Free Windows Admin Tools
FileKey1=%ProgramFiles%\ManageEngine\ManageEngine Free Tools\DesktopCentral Free Windows Admin Tools\logs|*
FileKey2=%SystemDrive%|free-tools.log

[Desktop Dialing *]
LangSecRef=3022
DetectFile=%AppData%\Desktop Dialing
FileKey1=%AppData%\Desktop Dialing|log-*.sil

[Desktop SMS *]
LangSecRef=3021
DetectFile=%ProgramFiles%\IDM\Desktop SMS
FileKey1=%ProgramFiles%\IDM\Desktop SMS|*.log

[Deus Ex *]
Section=Games
DetectFile=%SystemDrive%\DeusEx\System
FileKey1=%SystemDrive%\DeusEx\System|*.log

[Deutsche Bank Autobahn Toolbar *]
LangSecRef=3021
DetectFile=%UserProfile%\.autobahn
FileKey1=%LocalAppData%\Deutsche Bank\Autobahn Setup\*Logs|*|RECURSE
FileKey2=%LocalAppData%\Deutsche Bank\Autobahn\*Logs|*|RECURSE
FileKey3=%LocalAppData%\Deutsche Bank\Autobahn\Temp|*|RECURSE
FileKey4=%UserProfile%\.autobahn|autobahn-log*.*

[DeviceDoctor *]
LangSecRef=3024
DetectFile=%AppData%\DeviceDoctorSoftware\DeviceDoctor
FileKey1=%AppData%\DeviceDoctorSoftware\DeviceDoctor\Logs|*

[Devolo Cockpit *]
LangSecRef=3024
Detect=HKLM\Software\devolo\dLAN
FileKey1=%ProgramFiles%\devolo\dlan|dlanhistory.*txt;dlanstats.*xml;support.html;support.zip
FileKey2=%ProgramFiles%\devolo\dlan\updates|*|RECURSE

[Devolutions Remote Desktop Manager *]
LangSecRef=3021
DetectFile=%AppData%\Devolutions\RemoteDesktopManager
FileKey1=%AppData%\Devolutions\RemoteDesktopManager|*.log*
FileKey2=%LocalAppData%\Devolutions\RemoteDesktopManager|*.log*

[Dexpot *]
LangSecRef=3024
DetectFile=%AppData%\Dexpot
FileKey1=%AppData%\Dexpot|*.log

[DFX *]
LangSecRef=3021
Detect=HKCU\Software\DFX
FileKey1=%LocalAppData%\DFX\*|dfx_skin.txt
FileKey2=%LocalAppData%\DFX\*\Tmp|*|REMOVESELF

[Diablo II/III *]
Section=Games
Detect1=HKCU\Software\Blizzard Entertainment\D3
Detect2=HKCU\Software\Blizzard Entertainment\Diablo II
FileKey1=%ProgramData%\Battle.net\Setup\diablo3_engb\Log|*
FileKey2=%ProgramFiles%\Diablo II|*.log;BnetLog.txt;D*.txt
FileKey3=%ProgramFiles%\Diablo III*\Logs|*
FileKey4=%SystemDrive%\Diablo II|*.log;BnetLog.txt;D*.txt
FileKey5=%UserProfile%\Documents\Diablo II\GameLogs|*.txt

[Diagnose Windows *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Diagnose Windows
FileKey1=%ProgramFiles%\Diagnose Windows|*.log

[Digi Net Mobile *]
LangSecRef=3021
DetectFile=%ProgramData%\Digi Net Mobile
FileKey1=%ProgramData%\Digi Net Mobile\log|*.log;*.txt

[Digital Confidence Batch Purifier *]
LangSecRef=3024
DetectFile=%AppData%\Digital Confidence\BatchPurifier
FileKey1=%AppData%\Digital Confidence\BatchPurifier|OutputFolderMRU

[Digital Janitor *]
LangSecRef=3024
Detect=HKCU\Software\Davide Vitelaru\Digital Janitor
FileKey1=%AppData%\Digital Janitor|ToSortHistory

[Dimension 4 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\D4
FileKey1=%ProgramFiles%\D4|SyncHistory*.dat

[Directory Lister *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Directory Lister*
FileKey1=%ProgramFiles%\Directory Lister*|*Setup.exe

[Directory Opus *]
LangSecRef=3024
Detect=HKLM\Software\GPSoftware\Directory Opus
FileKey1=%AppData%\GPSoftware\Directory Opus\Icon Cache Roaming|*|RECURSE
FileKey2=%AppData%\GPSoftware\Directory Opus\Logs|*
FileKey3=%LocalAppData%\GPSoftware\Directory Opus\Thumbnail Cache|*|RECURSE

[Disco Elysium *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\ZAUM Studio\Disco Elysium
FileKey1=%UserProfile%\AppData\LocalLow\ZAUM Studio\Disco Elysium|*log
FileKey2=%UserProfile%\AppData\LocalLow\ZAUM Studio\Disco Elysium\Unity|*|REMOVESELF

[Discord *]
LangSecRef=3022
Detect1=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Discord
Detect2=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiscordCanary
Detect3=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiscordPTB
FileKey1=%AppData%\BetterDiscord|*.log
FileKey2=%AppData%\BetterDiscord\temp|*|REMOVESELF
FileKey3=%AppData%\Discord*|*-journal;*.old;*.tmp;LOG;modules.log;Network Persistent State;QuotaManager|RECURSE
FileKey4=%AppData%\Discord*\*Cache|*|REMOVESELF
FileKey5=%AppData%\Discord*\blob_storage|*|RECURSE
FileKey6=%AppData%\Discord*\Crashpad\reports|*
FileKey7=%AppData%\Discord*\Logs|*
FileKey8=%AppData%\Discord*\module_data\crashlogs|*
FileKey9=%AppData%\Discord*\module_data\discord_hook|*.log
FileKey10=%AppData%\Discord*\VideoDecodeStats|*
FileKey11=%LocalAppData%\Discord*|*.log
FileKey12=%LocalAppData%\Discord*\packages|*.nupkg
FileKey13=%LocalAppData%\Discord*\packages\SquirrelTemp|*|REMOVESELF

[Dishonored *]
Section=Games
Detect=HKCU\Software\Arkane\Dishonored
DetectFile=%UserProfile%\Documents\My Games\Dishonored
FileKey1=%UserProfile%\Documents\My Games\Dishonored\DishonoredGame\Logs|*

[Disk Space Fan *]
LangSecRef=3024
Detect=HKCU\Software\Cookapp\DSF4
FileKey1=%AppData%\DiskSpaceFan|history_C.sqlite;log.txt

[DiskBoss *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskBoss Ultimate
FileKey1=%LocalAppData%\DiskBoss Ultimate\data\reports|*|REMOVESELF

[DiskMax *]
LangSecRef=3024
DetectFile=%AppData%\KoshyJohn.com\DiskMax
FileKey1=%AppData%\KoshyJohn.com\DiskMax|*Log.txt
FileKey2=%AppData%\KoshyJohn.com\DiskMax\bin|*.log

[DiskTrix Ultimate Defrag *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Disktrix\UltimateDefrag
FileKey1=%ProgramFiles%\Disktrix\UltimateDefrag|*.db;*Crash.dmp

[DisplayFusion *]
LangSecRef=3024
Detect=HKCU\Software\Binary Fortress Software\DisplayFusion
FileKey1=%AppData%\DisplayFusion|DebugInfo.*;DisplayFusion*.log;DisplayFusionSetup.exe
FileKey2=%LocalAppData%\DisplayFusion|*.log
FileKey3=%ProgramData%\Binary Fortress Software\DisplayFusion|*.log;DisplayFusionSetup.exe

[DivFix++ *]
LangSecRef=3023
Detect=HKCU\Software\Death Knight\DivFix++
RegKey1=HKCU\Software\Death Knight\DivFix++|PathLog
RegKey2=HKCU\Software\Death Knight\DivFix++|PathOut

[DivX *]
LangSecRef=3023
Detect1=HKCU\Software\DivX
Detect2=HKLM\Software\DivXNetworks
FileKey1=%AppData%\DivX|Font Cache.*|RECURSE
FileKey2=%AppData%\DivX\DivX Codec|statistics.xml
FileKey3=%AppData%\DivX\DMS\logs|*
FileKey4=%ProgramData%\DivX|*.log|RECURSE
FileKey5=%UserProfile%\Videos\DivX Movies|*|RECURSE
RegKey1=HKCU\Software\DivX\Settings\Converter|lastBrowseDir
RegKey2=HKCU\Software\DivX\Settings\Converter|outputDir
RegKey3=HKCU\Software\DivX\Settings\Player\PlayerState|LastOpenFileLocation
RegKey4=HKCU\Software\DivX\Settings\TransferWizard|LastBrwosedDir
RegKey5=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry1
RegKey6=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry2
RegKey7=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry3
RegKey8=HKCU\Software\DivXNetworks\DivX Player|CustomOpenFileFolder
RegKey9=HKCU\Software\DivXNetworks\DivX Player|file
RegKey10=HKCU\Software\DivXNetworks\DivX Player|LastOpenFileFolder
RegKey11=HKCU\Software\DivXNetworks\DivX4Windows|MP4 File Name
RegKey12=HKCU\Software\DivXNetworks\DivX4Windows|MV File Name
RegKey13=HKCU\Software\DivXNetworks\DivX4Windows|YUV Dir Name
RegKey14=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry1
RegKey15=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry2
RegKey16=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry3
RegKey17=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry4
RegKey18=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry5
RegKey19=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry6

[Dj MixStation *]
LangSecRef=3023
DetectFile=%ProgramFiles%\ejay\Dj MixStation*
FileKey1=%ProgramFiles%\ejay\Dj MixStation*\history|*.txt

[DJUCED *]
LangSecRef=3023
DetectFile=%UserProfile%\Documents\DJUCED
FileKey1=%UserProfile%\Documents\DJUCED\Cache|*|RECURSE
FileKey2=%UserProfile%\Documents\DJUCED\Logs|*

[DjVuReader *]
LangSecRef=3021
Detect=HKCU\Software\DjVuReader
RegKey1=HKCU\Software\DjVuReader\MRUList

[DLExpert *]
LangSecRef=3021
Detect=HKCU\Software\Ying3\DLExpert
RegKey1=HKCU\Software\Ying3\DLExpert|ftp
RegKey2=HKCU\Software\Ying3\DLExpert|http
RegKey3=HKCU\Software\Ying3\DLExpert\MAIN|ALLFILE
RegKey4=HKCU\Software\Ying3\DLExpert\MAIN|GOOD
RegKey5=HKCU\Software\Ying3\DLExpert\MAIN|GOODURL
RegKey6=HKCU\Software\Ying3\DLExpert\Recent File List

[DNIe *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\DNIeRemote.log
FileKey1=%UserProfile%\Documents|DNIeRemote.log

[DoctorWeb *]
LangSecRef=3024
DetectFile=%UserProfile%\DoctorWeb\Quarantine
FileKey1=%UserProfile%\DoctorWeb\Quarantine|*|RECURSE

[DocuCom PDF *]
LangSecRef=3021
DetectFile1=%AppData%\Zeon\DocuCom\PDF*
DetectFile2=%AppData%\Zeon\DocuCom\ZNSL
FileKey1=%AppData%\Zeon\DocuCom\PDF*\Log|*
FileKey2=%AppData%\Zeon\DocuCom\ZNSL|*.log;VeriHist.zli

[Document Trace Remover *]
LangSecRef=3024
Detect=HKCU\Software\Smart PC Solutions\Document Trace Remover
FileKey1=%AppData%\Smart PC Solutions\Smart Fast PC\Log|*
RegKey1=HKCU\Software\Smart PC Solutions\Document Trace Remover|LastFile
RegKey2=HKCU\Software\Smart PC Solutions\Document Trace Remover|LastFolder

[DocX Viewer *]
LangSecRef=3021
DetectFile=%SystemDrive%\epingsoft\DocXV
FileKey1=%SystemDrive%\epingsoft\DocXV|rec.lst

[Dolby Access *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\DolbyLaboratories.DolbyAccess_rz1tebttyb220
FileKey1=%LocalAppData%\Packages\DolbyLaboratories.DolbyAccess_rz1tebttyb220\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\DolbyLaboratories.DolbyAccess_rz1tebttyb220\Settings|*.log*
FileKey3=%LocalAppData%\Packages\DolbyLaboratories.DolbyAccess_rz1tebttyb220\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\DolbyLaboratories.DolbyAccess_rz1tebttyb220\TempState|*|REMOVESELF
FileKey5=%Package\LocalCache|*.log

[Dollar Dash *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\214320
FileKey1=%UserProfile%\Documents\My Games\DollarDash\PKGame\Logs|*

[Dolphin Emulator *]
Section=Games
DetectFile=%UserProfile%\Documents\Dolphin Emulator
FileKey1=%UserProfile%\Documents\Dolphin Emulator\Logs|*|RECURSE

[Dome Keeper *]
Section=Games
DetectFile=%AppData%\Godot\app_userdata\Dome Keeper
FileKey1=%AppData%\Godot\app_userdata\Dome Keeper\logs|*.log

[Donkey Kong Country *]
Section=Games
DetectFile=%ProgramFiles%\Donkey Kong Country
FileKey1=%ProgramFiles%\Donkey Kong Country|stderr.txt;stdout.txt

[Don't Starve *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219740
FileKey1=%ProgramFiles%\Steam\steamapps\common\dont_starve\bin|log.txt
FileKey2=%UserProfile%\Documents\Klei\DoNotStarve|log.txt

[Donut County *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Annapurna Interactive\Donut County
FileKey1=%UserProfile%\AppData\LocalLow\Annapurna Interactive\Donut County\Crashes|*

[Dooble *]
LangSecRef=3022
DetectFile=%SystemDrive%\Dooble
FileKey1=%SystemDrive%\Dooble\*\.dooble|cookies.db;downloads.db;favicons.fb;history.db
FileKey2=%SystemDrive%\Dooble\*\.dooble\Cache|*|REMOVESELF

[DOOM 2016 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\379720
FileKey1=%LocalAppData%\id Software\DOOM\base\generated\temp|*
FileKey2=%UserProfile%\Saved Games\id Software\DOOM\base\generated\temp|*

[Download Accelerator Plus *]
LangSecRef=3022
Detect=HKCU\Software\SpeedBit\Download Accelerator
DetectFile=%ProgramFiles%\DAP
FileKey1=%ProgramData%\SpeedBit\DAP\Plugins\Log|*

[Download Manager *]
LangSecRef=3022
DetectFile=%AppData%\Download Manager
FileKey1=%AppData%\Download Manager|DownloadManagerList.dmc

[DownTango *]
LangSecRef=3022
DetectFile=%LocalAppData%\DownTango
FileKey1=%LocalAppData%\DownTango|application.log
FileKey2=%LocalAppData%\DownTango\Logs|log.txt

[Doxygen *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Doxygen
FileKey1=%UserProfile%\Documents|doxygen_log.txt

[Dr. Despicable's Dastardly Deeds *]
Section=Games
DetectFile=%AppData%\HitPoint Studios\DrD
FileKey1=%AppData%\HitPoint Studios\DrD|logfile.txt

[Dr. Web CureIt! *]
LangSecRef=3024
DetectFile=%UserProfile%\Doctor Web
FileKey1=%UserProfile%\Doctor Web|*.log

[DraftSight *]
LangSecRef=3021
Detect1=HKCU\Software\Dassault Systemes\DraftSight
Detect2=HKLM\Software\Dassualt Systemes\DraftSight
FileKey1=%AppData%\DraftSight\*|history.txt;plot.log
FileKey2=%LocalAppData%\Dassault Systemes\DraftSight\cache|*|RECURSE

[Dragon Age: Origins *]
Section=Games
Detect1=HKCU\Software\BioWare\Dragon Age
Detect2=HKLM\Software\BioWare\Dragon Age
FileKey1=%ProgramData%\BioWare\Dragon Age\DA Updater\Logs|*
FileKey2=%UserProfile%\Documents|DAO Ultimate Addins Updater.log
FileKey3=%UserProfile%\Documents\BioWare\Dragon Age\Logs|*

[Dragon UnPACKer 5 *]
LangSecRef=3024
Detect=HKCU\Software\Dragon Software\Dragon UnPACKer 5
FileKey1=%ProgramFiles%\Dragon UnPACKer 5|*.diz;*.log
RegKey1=HKCU\Software\Dragon Software\Dragon UnPACKer 5\HyperRipper|Source
RegKey2=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|LastFilterIndex
RegKey3=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|LastFilterIndex_Hash
RegKey4=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_0
RegKey5=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_1
RegKey6=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_2
RegKey7=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_3
RegKey8=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_4
RegKey9=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_5
RegKey10=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_6
RegKey11=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_7
RegKey12=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_8
RegKey13=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_9

[Dreadnought *]
Section=Games
Detect=HKCU\Software\Grey Box\Dreadnought
FileKey1=%LocalAppData%\DreadGame\Saved\Logs|*.log

[Dream Aquarium *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Dream Aquarium
FileKey1=%ProgramFiles%\Dream Aquarium|stdout

[Drive SnapShot *]
LangSecRef=3024
Detect=HKCU\Software\SnapShot
RegKey1=HKCU\Software\SnapShot|RecentFile0
RegKey2=HKCU\Software\SnapShot|RecentFile1
RegKey3=HKCU\Software\SnapShot|RecentFile2
RegKey4=HKCU\Software\SnapShot|RecentFile3
RegKey5=HKCU\Software\SnapShot|RecentFile4
RegKey6=HKCU\Software\SnapShot|RecentFile5
RegKey7=HKCU\Software\SnapShot|RecentFile6
RegKey8=HKCU\Software\SnapShot|RecentFile7
RegKey9=HKCU\Software\SnapShot|RecentFile8
RegKey10=HKCU\Software\SnapShot|RecentFile9
RegKey11=HKCU\Software\SnapShot|RecentHashFile0
RegKey12=HKCU\Software\SnapShot|RecentHashFile1
RegKey13=HKCU\Software\SnapShot|RecentHashFile2
RegKey14=HKCU\Software\SnapShot|RecentHashFile3
RegKey15=HKCU\Software\SnapShot|RecentHashFile4
RegKey16=HKCU\Software\SnapShot|RecentHashFile5
RegKey17=HKCU\Software\SnapShot|RecentHashFile6
RegKey18=HKCU\Software\SnapShot|RecentHashFile7
RegKey19=HKCU\Software\SnapShot|RecentHashFile8
RegKey20=HKCU\Software\SnapShot|RecentHashFile9
RegKey21=HKCU\Software\SnapShot|RecentVirtualDrive

[DriveImage XML *]
LangSecRef=3021
Detect=HKLM\Software\Runtime Software\DIXML
FileKey1=%ProgramFiles%\Runtime Software\DriveImage XML|log.txt

[Driver Cleaner.NET *]
LangSecRef=3024
DetectFile=%ProgramFiles%\DriverCleanerDotNET
FileKey1=%ProgramFiles%\DriverCleanerDotNET\Backup|*|RECURSE
FileKey2=%ProgramFiles%\DriverCleanerDotNET\Log|*

[Driver Fusion *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Driver Fusion\Logs
FileKey1=%ProgramFiles%\Driver Fusion\Backup|*|RECURSE
FileKey2=%ProgramFiles%\Driver Fusion\Logs|*|RECURSE

[Driver Magician *]
LangSecRef=3021
Detect=HKCU\Software\Driver Magician
FileKey1=%AppData%\Driver Magician|HiddenUpdate.txt

[DriverEasy *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easeware\DriverEasy
FileKey1=%AppData%\Easeware\DriverEasy\drivers|*|RECURSE
FileKey2=%UserProfile%\Documents\DriverEasy|*|RECURSE

[DriverGenius *]
LangSecRef=3024
Detect=HKLM\Software\Driver-Soft\DriverGenius
DetectFile=%ProgramFiles%\Driver-Soft\DriverGenius
FileKey1=%LocalAppData%\DriverGenius|ScanLog.log
FileKey2=%ProgramData%\DriverGenius|*.log
FileKey3=%ProgramData%\DriverGenius\Downloads|*
FileKey4=%ProgramData%\DriverGenius\InstalledUpdates|*
FileKey5=%ProgramData%\DriverGenius\Temp|*

[DriverMax *]
LangSecRef=3024
Detect=HKCU\Software\Innovative Solutions\DriverMax
FileKey1=%LocalAppData%\Innovative Solutions\DriverMax\Agent|*.tmp;dmxlog.txt;lastscan*.xml;logScan.txt
FileKey2=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Downloded Drivers|*
FileKey3=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Dump|*
FileKey4=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Uploads|*|RECURSE
FileKey5=%LocalAppData%\Innovative Solutions\DriverMax\Backup|*
FileKey6=%LocalAppData%\Innovative Solutions\DriverMax\LastScan|*
FileKey7=%LocalAppData%\Innovative Solutions\DriverMax\Temp*|*
FileKey8=%ProgramFiles%\Innovative Solutions\DriverMax|*.log

[DriverPack Solution *]
LangSecRef=3024
Detect=HKCU\Software\drpsu
FileKey1=%AppData%\DriverPack Notifier\temp|*
FileKey2=%AppData%\DRPSu\Logs|*
FileKey3=%AppData%\DRPSu\snapshots|*
FileKey4=%AppData%\DRPSu\temp|*
FileKey5=%UserProfile%\Documents\DRP-Log|*
FileKey6=%WinDir%\Logs\DIALog|*.txt
FileKey7=%WinDir%\Logs\DRPLog|*.png;*.txt
FileKey8=%WinDir%\Logs\SysInfo|*

[DriverRadarPro *]
LangSecRef=3024
Detect=HKCU\Software\NoVirusThanks\DriverRadarPro
RegKey1=HKCU\Software\NoVirusThanks\DriverRadarPro|edCopyDrvTo
RegKey2=HKCU\Software\NoVirusThanks\DriverRadarPro|edSaveLogsTo

[Dropbox *]
LangSecRef=3024
Detect=HKCU\Software\Dropbox
DetectFile=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96
FileKey1=%AppData%\DropBox|Filecache.db;SigStore.db
FileKey2=%AppData%\Dropbox\*Cache*|*|RECURSE
FileKey3=%AppData%\DropBox\Bin|*.log
FileKey4=%AppData%\Dropbox\installer|*|RECURSE
FileKey5=%AppData%\Dropbox\logs|*|RECURSE
FileKey6=%AppData%\DropBoxOem\Log|*|RECURSE
FileKey7=%LocalAppData%\Dropbox\
FileKey8=%LocalAppData%\Dropbox\CrashReports|*|RECURSE
FileKey9=%LocalAppData%\Dropbox\instance*\sync|*.sqlite3-*
FileKey10=%LocalAppData%\Dropbox\instance*\sync\temp|*
FileKey11=%LocalAppData%\Dropbox\Logs|*|RECURSE
FileKey12=%LocalAppData%\Dropbox\QuitReports|*
FileKey13=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\AC|*|RECURSE
FileKey14=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Local\Dropbox\avatar_cache|*
FileKey15=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Local\Dropbox\Crashpad|*|RECURSE
FileKey16=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Local\Dropbox\instance*\sync|*.sqlite3-*
FileKey17=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Local\Dropbox\instance*\sync\temp|*
FileKey18=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Local\Dropbox\Logs|*|RECURSE
FileKey19=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Local\Dropbox\QuitReports|*
FileKey20=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\LocalCache\Roaming\Dropbox\*Cache*|*|RECURSE
FileKey21=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\Settings|*.log*
FileKey22=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\SystemAppData\Helium|*.log*
FileKey23=%LocalAppData%\Packages\DropboxInc.Dropbox_xbfy0k16fey96\TempState|*|REMOVESELF
FileKey24=%ProgramData%\Dropbox\Update\Log|*
FileKey25=%ProgramFiles%\Dropbox\Update\Download|*|REMOVESELF
FileKey26=%UserProfile%\Documents\Dropbox\.dropbox.cache|*|RECURSE
FileKey27=%UserProfile%\Dropbox\.dropbox.cache|*|RECURSE

[DS4Windows *]
Section=Games
DetectFile=%AppData%\DS4Windows
FileKey1=%AppData%\DS4Windows\Logs|*

[DSDCS InputMapper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\DSDCS
FileKey1=%ProgramFiles%\DSDCS|*.log|RECURSE

[DU Meter *]
LangSecRef=3022
Detect=HKCU\Software\Hagel\DU Meter
FileKey1=%ProgramData%\Hagel Technologies\DU Meter|*.csv;error.elf

[DuckDuckGo Autofill Data & Search Engine Preferences *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|*Web Data
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|*Web Data
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\AutoFill*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\AutoFill*|*|REMOVESELF

[DuckDuckGo Autoplay Preferences *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\MEIPreload|*|REMOVESELF

[DuckDuckGo Bookmark Backups *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|Bookmarks.bak
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|Bookmarks.bak

[DuckDuckGo Bookmark Favicons *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|favicons*
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|favicons*

[DuckDuckGo Caches *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView|*-journal|RECURSE
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView|Module Info Cache
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView|*-journal|RECURSE
FileKey21=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView|Module Info Cache
FileKey22=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey23=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\*Cache*|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\blob_storage|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\BudgetDatabase|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Download Service|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\File System|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\optimization*|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Platform Notifications|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Service Worker|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Shared Dictionary\cache|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*Cache*|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Avatars|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Optimization*|*|REMOVESELF

[DuckDuckGo Default App Handlers *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|PreferredApps
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|PreferredApps

[DuckDuckGo Download History *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|DownloadMetadata
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\shared_proto_db|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|DownloadMetadata
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\shared_proto_db|*|REMOVESELF

[DuckDuckGo DRM Data *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\WidevineCdm|*|REMOVESELF

[DuckDuckGo Extension Cookies *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|Extension Cookies
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|Extension Cookies

[DuckDuckGo Privacy Sandbox *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView|*first_party_sets*
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView|*first_party_sets*
FileKey10=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey11=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Network|Trust Tokens*
FileKey12=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF

[DuckDuckGo Progressive Web Apps *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Web Applications|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Web Applications|*|REMOVESELF

[DuckDuckGo Saved Usernames & Passwords *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|Login Data*
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|Login Data*

[DuckDuckGo Security & Threat Detection *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|DIPS*
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|DIPS*
FileKey14=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\ClientCertificates|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Network|TransportSecurity*
FileKey16=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Safe Browsing Network|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Crowd Deny|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\PKIMetadata|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Safe Browsing|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\SafetyTips|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Subresource Filter|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\ZxcvbnData|*|REMOVESELF

[DuckDuckGo Shopping Insights *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\parcel_tracking_db|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\chrome_cart_db|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\commerce_subscription_db|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\coupon_db|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\discount*_db|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\parcel_tracking_db|*|REMOVESELF

[DuckDuckGo Storage Quota Manager *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|QuotaManager
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|QuotaManager

[DuckDuckGo Sync Data *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Sync Data|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Sync Data|*|REMOVESELF

[DuckDuckGo Telemetry *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\Application|debug.log
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|*.log
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\Application|debug.log
FileKey21=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\Application\SetupMetrics|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey23=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView|*.pma;LOG;LOG.old|RECURSE
FileKey24=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|*.log
FileKey25=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\DataSharing|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey28=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\PersistentOriginTrials|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Site Characteristics Database|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\VideoDecodeStats|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\WebRTC Logs|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\WebrtcVideoStats|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Crash Reports|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Crashpad|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Local Traces|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\OriginTrials|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\Stability|*|REMOVESELF
FileKey39=%ProgramFiles%\Packages\*DuckDuckGo*Browser*\LocalState\Application|debug.log
FileKey40=%ProgramFiles%\Packages\*DuckDuckGo*Browser*\LocalState\Application\SetupMetrics|*|REMOVESELF
FileKey41=%ProgramFiles%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\Application|debug.log
FileKey42=%ProgramFiles%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\Application\SetupMetrics|*|REMOVESELF

[DuckDuckGo Web Browsing Cookies *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Network|Cookies*;Device Bound Sessions*
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Network|Cookies*;Device Bound Sessions*

[DuckDuckGo Web Browsing History *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[DuckDuckGo Web Browsing Session *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Sessions|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Extension State|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Sessions|*|REMOVESELF

[DuckDuckGo Web Storage *]
Section=DuckDuckGo Web Browser
DetectFile=%LocalAppData%\Packages\*DuckDuckGo*Browser*
FileKey1=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\EBWebView\*\WebStorage|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\IndexedDB|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Local Storage\*\IndexedDB\https*|*
FileKey11=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Local Storage\*\Session Storage|*
FileKey12=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey13=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Local Storage\*\WebStorage|*|RECURSE
FileKey14=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Local Storage\leveldb|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\Session Storage|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\*DuckDuckGo*Browser*\LocalState\internalEnvironment\EBWebView\*\WebStorage|*|REMOVESELF

[DuckieTV *]
LangSecRef=3023
DetectFile=%AppData%\DuckieTV
FileKey1=%AppData%\DuckieTV|*.log;*.txt

[Duke Nukem 3D *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225140
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Duke Nukem 3D\bin|stderr.txt;stdout.txt

[Dungeon of the Endless *]
Section=Games
DetectFile=%UserProfile%\Documents\Dungeon of the Endless
FileKey1=%UserProfile%\Documents\Dungeon of the Endless\Temporary Files|*

[Dungeon Siege *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Dungeon Siege
FileKey1=%UserProfile%\Documents\My Games\Dungeon Siege\Logs|*

[Dungeon Siege 2 *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Dungeon Siege 2
FileKey1=%UserProfile%\Documents\My Games\Dungeon Siege 2\Logs|*

[Dungeons - The Dark Lord *]
Section=Games
DetectFile=%AppData%\Kalypso Media\Dungeons - The Dark Lord
FileKey1=%AppData%\Kalypso Media\Dungeons - The Dark Lord|log.txt

[Dungreed *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\TeamHoray\Dungreed
FileKey1=%UserProfile%\AppData\LocalLow\TeamHoray\Dungreed\Unity|*|REMOVESELF

[Dup Detector *]
LangSecRef=3023
Detect=HKCU\Software\Prismatic Software\PhotoBatch
RegKey1=HKCU\Software\Prismatic Software\PhotoBatch\Dialogs|LastBatchFile
RegKey2=HKCU\Software\Prismatic Software\PhotoBatch\Dialogs|LastBatchFolder
RegKey3=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastBatFile
RegKey4=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastFold
RegKey5=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastSecFold
RegKey6=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastSingleFold
RegKey7=HKCU\Software\Prismatic Software\PhotoBatch\MRU

[dupeGuru *]
LangSecRef=3024
DetectFile=%AppData%\Hardcoded Software\dupeGuru
FileKey1=%AppData%\Hardcoded Software\dupeGuru|*.log

[DupKiller *]
LangSecRef=3024
DetectFile=%ProgramFiles%\DupKilIer
FileKey1=%ProgramFiles%\DupKilIer|DupKiller.log

[Duplicate Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\DigitalVolcano
FileKey1=%AppData%\DigitalVolcano\DuplicateCleaner|*.data
FileKey2=%UserProfile%\Documents|Duplicate Cleaner log.txt

[Duplicate Photo Finder *]
LangSecRef=3024
Detect=HKCU\Software\Duplicate Photo Finder
RegKey1=HKCU\Software\Duplicate Photo Finder|AddFolderWiz
RegKey2=HKCU\Software\Duplicate Photo Finder|last1
RegKey3=HKCU\Software\Duplicate Photo Finder|lastR1

[DUSK *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\519860
FileKey1=%UserProfile%\AppData\LocalLow\David Szymanski\Dusk|output_log.txt

[DVBDream *]
LangSecRef=3024
Detect=HKLM\Software\DVBDream
FileKey1=%ProgramFiles%\dvbdream|*.bak;*.log;*levellog*|RECURSE
FileKey2=%ProgramFiles%\dvbdream\Logs|*
FileKey3=%SystemDrive%\dvbdream|*.bak;*.log;*levellog*|RECURSE
FileKey4=%SystemDrive%\dvbdream\Logs|*

[DVBViewer *]
LangSecRef=3023
Detect=HKLM\Software\CM&V\DVBViewer
FileKey1=%AppData%\CMUV\DVBViewer*|*.bak;*.log
FileKey2=%ProgramData%\CMUV\DVBViewer*|*.bak;*.log
FileKey3=%ProgramData%\CMUV\DVBViewer\backup|*|REMOVESELF
FileKey4=%ProgramFiles%\DVBViewer\backup|*|REMOVESELF
FileKey5=%ProgramFiles%\DVBViewer\GraphPresets|*.fgp
FileKey6=%ProgramFiles%\DVBViewer\Remotes|*
FileKey7=%ProgramFiles%\DVBViewer\setup|*
FileKey8=%ProgramFiles%\DVBViewer\Transponders|*

[DVD-Cloner *]
LangSecRef=3023
Detect1=HKCU\Software\Dvd-cloner
Detect2=HKCU\Software\DVD-Cloner Gold
FileKey1=%AppData%\DVD-Cloner*|*.log
FileKey2=%ProgramData%\DVD-Cloner*|*.log
FileKey3=%ProgramFiles%\DVD-Cloner Platinum\*\readcache|*
FileKey4=%ProgramFiles%\DVD-Cloner*|*.log|RECURSE
FileKey5=%SystemDrive%|dtdlog.txt
FileKey6=%UserProfile%\Documents|Smart.log;Smart_result.log
FileKey7=%WinDir%\System32|dvdtest10024.dat

[DVD-Ranger *]
LangSecRef=3021
Detect=HKLM\Software\DVD-Ranger
FileKey1=%ProgramData%\DVDRanger\DDF626ADdvdcss|*
FileKey2=%ProgramData%\DVDRanger\Logs|*
FileKey3=%SystemDrive%\DVDRanger|*|REMOVESELF
FileKey4=%UserProfile%\Documents\DVDRanger\Screenshots|*|RECURSE
FileKey5=%UserProfile%\Documents\DVDRanger\Temp|*|REMOVESELF

[DVD Flick *]
LangSecRef=3023
DetectFile=%ProgramFiles%\DVD Flick
FileKey1=%AppData%\DVD Flick|dvdflick.log;report.txt

[DVD Shrink *]
LangSecRef=3023
Detect=HKCU\Software\DVD Shrink
FileKey1=%ProgramData%\DVD Shrink|*

[dvdcss *]
LangSecRef=3023
DetectFile1=%AppData%\.dvdcss
DetectFile2=%AppData%\dvdcss*
DetectFile3=%UserProfile%\.dvdcss
FileKey1=%AppData%\.dvdcss|*|REMOVESELF
FileKey2=%AppData%\dvdcss*|*|REMOVESELF
FileKey3=%UserProfile%\.dvdcss|*|REMOVESELF

[DVDFab *]
LangSecRef=3023
Detect1=HKCU\Software\DVDFab
Detect2=HKCU\Software\DVDFab Passkey
Detect3=HKCU\Software\FabPlayer
FileKey1=%AppData%\DVDFab Player*\Advertis*|*|RECURSE
FileKey2=%AppData%\DVDFab\DVDFab*\regRecord|*.rec
FileKey3=%AppData%\DVDFab\DVDFab*\SceneData|*|RECURSE
FileKey4=%AppData%\DVDFab\DVDFabCommon|*.bin
FileKey5=%AppData%\LiveUpdate|*.log
FileKey6=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*|RECURSE
FileKey7=%LocalAppData%\DVDFab*\cache\QtWebEngine\Default\Cache|*
FileKey8=%LocalAppData%\DVDFab*\QtWebEngine\Default\GPUCache|*|REMOVESELF
FileKey9=%LocalAppData%\DVDFab*\QtWebEngine\Default\Service Worker\Database|LOG;LOG.old
FileKey10=%UserProfile%\Documents\DVDFab*|*.log
FileKey11=%UserProfile%\Documents\DVDFab*\Log|*|RECURSE
FileKey12=%UserProfile%\Documents\DVDFab*\SceneData|*|RECURSE
FileKey13=%UserProfile%\Documents\DVDFab*\Temp|*|RECURSE
FileKey14=%UserProfile%\Documents\DVDFab\DVDFab*\Cinavia|*|RECURSE
FileKey15=%UserProfile%\Documents\DVDFab\DVDFab*\Log|*|RECURSE
FileKey16=%UserProfile%\Documents\DVDFab\DVDFab*\Temp|*|RECURSE
FileKey17=%UserProfile%\Documents\DVDFab\updateLog|*|REMOVESELF
FileKey18=%UserProfile%\Documents\LiveUpdate|*|REMOVESELF
FileKey19=%UserProfile%\Documents\PcSetup|*|RECURSE
RegKey1=HKCU\Software\FabPlayer|DefaultDir
RegKey2=HKCU\Software\FabPlayer|DefaultFile

[DVDSmith *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DVDSmith Movie Backup_is1
FileKey1=%UserProfile%\Documents\dvdsmith|*.log

[DVDVideoSoft *]
LangSecRef=3023
Detect1=HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Detect2=HKCU\Software\DVDVideoSoft
FileKey1=%AppData%\DVDVideoSoft\*\History|*|RECURSE
FileKey2=%AppData%\DVDVideoSoft\*Logs|*|RECURSE
FileKey3=%AppData%\DVDVideoSoft\Backup|*|RECURSE
FileKey4=%LocalAppData%\DVDVideoSoftTB\Logs|*|RECURSE
FileKey5=%UserProfile%\Documents\DVDVideoSoft|*log.txt|RECURSE

[DVDx *]
LangSecRef=3023
Detect=HKCU\Software\DVDx
FileKey1=%ProgramFiles%\DVDx|*.tmp
RegKey1=HKCU\Software\DVDx\LastDir
RegKey2=HKCU\Software\DVDx\LastOutput

[DVIPS Shell *]
LangSecRef=3021
Detect=HKCU\Software\Juan M. Aguirregabiria\DVIPSsh\Version 1.00
RegKey1=HKCU\Software\Juan M. Aguirregabiria\DVIPSsh\Version 1.00|Options

[DxO Photo Suite *]
LangSecRef=3021
DetectFile1=%LocalAppData%\DxO*
DetectFile2=%UserProfile%\Documents\DxO*
FileKey1=%LocalAppData%\DxO*\DataCache|*|RECURSE
FileKey2=%LocalAppData%\DxO*\DxO*\*Cache|*|RECURSE
FileKey3=%LocalAppData%\DxO*\DxO*\CrashReports|*|RECURSE
FileKey4=%LocalAppData%\DxO*\DxO*\Logs|*
FileKey5=%LocalAppData%\DxO*\Logs|*
FileKey6=%UserProfile%\Documents\DxO * crash*s|*
FileKey7=%UserProfile%\Documents\DxO * logs|*
FileKey8=%UserProfile%\Documents\DxO*\CrashReports|*|RECURSE
FileKey9=%UserProfile%\Documents\DxO*\log|*

[Dying Light *]
Section=Games
DetectFile=%UserProfile%\Documents\DyingLight
FileKey1=%UserProfile%\Documents\DyingLight\Out\Logs|*
FileKey2=%UserProfile%\Documents\DyingLight\Out\Screenshots|screen_*.tga

[Dyn Updater *]
LangSecRef=3022
Detect=HKCU\Software\Dyn\Dyn Updater
FileKey1=%ProgramData%\Dyn\Updater|*.log;*.msi

[Dynalist Obsidian *]
LangSecRef=3021
DetectFile=%AppData%\Obsidian
FileKey1=%AppData%\Obsidian|*.log;DIPS*
FileKey2=%AppData%\Obsidian\*cache|*|RECURSE
FileKey3=%LocalAppData%\obsidian-updater|*

[Dynamo *]
LangSecRef=3021
DetectFile=%AppData%\Dynamo
FileKey1=%AppData%\Dynamo\*\Logs|*Log_*.txt

[EA App *]
Section=Games
Detect1=HKCU\Software\EA Games\EA Core
Detect2=HKLM\Software\EA Games\EA Core
Detect3=HKLM\SOFTWARE\Electronic Arts\EA Desktop
Detect4=HKLM\Software\Electronic Arts\EADM
FileKey1=%LocalAppData%\EA Core\Cache|*|REMOVESELF
FileKey2=%LocalAppData%\EADesktop\cache|*|REMOVESELF
FileKey3=%LocalAppData%\EADesktop\QtWebEngine\Default|*state;quota*;visited*
FileKey4=%LocalAppData%\EADesktop\QtWebEngine\Default\*cache|*|RECURSE
FileKey5=%LocalAppData%\EADesktop\QtWebEngine\Default\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\EALaunchHelper\cache\qmlcache|*|RECURSE
FileKey7=%LocalAppData%\Electronic Arts\EA Desktop\*Cache|*|RECURSE
FileKey8=%LocalAppData%\Electronic Arts\EA Desktop\Logs|*
FileKey9=%LocalAppData%\Electronic Arts\EA Desktop\OfflineTelemetry|*
FileKey10=%LocalAppData%\Electronic Arts\EADMUI\Web Cache|*|RECURSE
FileKey11=%ProgramData%\EA Core\Cache|*|REMOVESELF
FileKey12=%ProgramData%\EA Desktop\Logs|*
FileKey13=%ProgramData%\EA Logs|*
FileKey14=%ProgramData%\Electronic Arts\EA Core\logs|*
FileKey15=%ProgramData%\Origin\Logs|*
FileKey16=%WinDir%\System32\config\systemprofile\AppData\Local\Electronic Arts\EA Desktop|*|REMOVESELF
FileKey17=%WinDir%\System32\config\systemprofile\AppData\Local\Origin\Web Cache\*|*|REMOVESELF

[EA App Game Installers *]
Section=Games
Detect=HKLM\SOFTWARE\Electronic Arts\EA Desktop
FileKey1=%ProgramFiles%\EA Games\*\__Installer|InstallLog.txt
FileKey2=%ProgramFiles%\EA Games\*\__Installer\directx|*|REMOVESELF
FileKey3=%ProgramFiles%\EA Games\*\__Installer\vc|*|REMOVESELF

[EA Games Battlefield 5 *]
Section=Games
DetectFile=%UserProfile%\Documents\Battlefield V
FileKey1=%LocalAppData%\Battlefield V\shaders|*.cache
FileKey2=%UserProfile%\Documents\Battlefield V\twinkle\temp\*http*|*|RECURSE

[EA Games Battlefield 2042 *]
Section=Games
DetectFile=%UserProfile%\Documents\Battlefield 2042
FileKey1=%UserProfile%\Documents\Battlefield 2042\Cache|*|RECURSE
FileKey2=%UserProfile%\Documents\Battlefield 2042\CrashDumps|*|RECURSE

[EA Games Battlefield 2042 Screenshots *]
Section=Games
DetectFile=%UserProfile%\Documents\Battlefield 2042
FileKey1=%UserProfile%\Documents\Battlefield 2042\Screenshots|*|RECURSE

[Earth 2160 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\19000
FileKey1=%UserProfile%\Documents\Earth 2160\FontsCache|*

[Earth Alerts *]
LangSecRef=3022
Detect=HKCU\Software\South Wind Technologies\Earth Alerts
FileKey1=%AppData%\Earth Alerts\Images|*|RECURSE
FileKey2=%AppData%\Earth Alerts\Messages|*|RECURSE

[EaseUS Data Recovery Wizard *]
LangSecRef=3024
DetectFile=%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard
FileKey1=%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard|*.log
ExcludeKey1=FILE|%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard\|install.log

[EaseUS KeyFinder *]
LangSecRef=3024
DetectFile=%LocalAppData%\EaseUS\KeyFinder
FileKey1=%LocalAppData%\EaseUS\KeyFinder\Cache\qmlcache|*

[EaseUS MobiSaver *]
LangSecRef=3021
Detect1=HKLM\Software\EASEUS\EASEUS IPhone Wizard
Detect2=HKLM\Software\EaseUS\Mobisaver for Android
FileKey1=%ProgramFiles%\EaseUS\EaseUS MobiSaver*\bin|*.log;CommDbg.txt;Eaolog;mbs
FileKey2=%SystemDrive%\EaseUS MobiSaver * Temp Backup|*|RECURSE

[EaseUS Partition Master *]
LangSecRef=3024
Detect=HKCU\Software\EASEUS\EASEUS Partition Manager
FileKey1=%ProgramFiles%\EASEUS\EASEUS Partition Master*\bin|*.log|RECURSE
FileKey2=%WinDir%|EPMBatch.ept;OutLog.txt

[EaseUS ToDo Backup *]
LangSecRef=3024
Detect=HKCU\Software\EaseUS\EaseUS Todo Backup
FileKey1=%ProgramFiles%\EaseUS\Todo Backup\bin|easeus.log;TbLogsysClient.tblog

[East-Tec Eraser *]
LangSecRef=3024
Detect=HKLM\Software\East-Tec\east-tec Eraser
FileKey1=%ProgramData%\East-Tec\east-tec Eraser\Updates|*|RECURSE
FileKey2=%ProgramFiles%\east-tec Eraser|except.log

[Easy Anti-Cheat *]
Section=Games
DetectFile=%AppData%\EasyAntiCheat
FileKey1=%AppData%\EasyAntiCheat|*.log|REMOVESELF
FileKey2=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\EasyAntiCheat|*.log

[Easy CD-DA Extractor *]
LangSecRef=3024
Detect=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8
RegKey1=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k8c
RegKey2=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k80
RegKey3=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k81
RegKey4=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k91
RegKey5=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k92

[Easy Duplicate Finder *]
LangSecRef=3024
Detect=HKCU\Software\Easy Duplicate Finder
DetectFile=%ProgramFiles%\Easy Duplicate Finder 4
FileKey1=%AppData%\EasyDuplicateFinder\Logs|*.log

[EasyGPS *]
LangSecRef=3024
Detect=HKCU\Software\TopoGrafix\EasyGPS
FileKey1=%LocalAppData%\TopoGrafix\Error Logs|*.txt
RegKey1=HKCU\Software\TopoGrafix\EasyGPS\Error Log
RegKey2=HKCU\Software\TopoGrafix\EasyGPS\Recent File List

[EC XTRA Timer *]
LangSecRef=3021
DetectFile=%AppData%\The Toro Company
FileKey1=%AppData%\The Toro Company|ECXTRAoutput.txt

[Eclipse Project *]
LangSecRef=3021
DetectFile=%UserProfile%\desenvolvimento\Eclipse
FileKey1=%UserProfile%\desenvolvimento\Eclipse\configuration|*.log
FileKey2=%UserProfile%\desenvolvimento\Eclipse\configuration\org.eclipse.update\history|*.xml
FileKey3=%UserProfile%\desenvolvimento\Eclipse\p2\org.eclipse.equinox.p2.repository\Cache|*

[Ecobyte Replace Text *]
LangSecRef=3024
Detect=HKLM\Software\BK\BK ReplaceEm
RegKey1=HKLM\Software\BK\BK ReplaceEm|destPath
RegKey2=HKLM\Software\BK\BK ReplaceEm|sourceExcludeFilter
RegKey3=HKLM\Software\BK\BK ReplaceEm|sourcePath

[Ecosia Browser Autofill Data & Search Engine Preferences *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|*Web Data
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\EcosiaBrowser\User Data\AutoFill*|*|REMOVESELF

[Ecosia Browser Autoplay Preferences *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\MEIPreload|*|REMOVESELF

[Ecosia Browser Bookmark Backups *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|Bookmarks.bak

[Ecosia Browser Bookmark Favicons *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|favicons*

[Ecosia Browser Caches *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\EcosiaBrowser\User Data|Module Info Cache
FileKey3=%LocalAppData%\EcosiaBrowser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\EcosiaBrowser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\EcosiaBrowser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\EcosiaBrowser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\EcosiaBrowser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\EcosiaBrowser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\EcosiaBrowser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\EcosiaBrowser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\EcosiaBrowser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\EcosiaBrowser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\EcosiaBrowser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\EcosiaBrowser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\EcosiaBrowser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\EcosiaBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\EcosiaBrowser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\EcosiaBrowser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\EcosiaBrowser\User Data\Optimization*|*|REMOVESELF

[Ecosia Browser Default App Handlers *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|PreferredApps

[Ecosia Browser Download History *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*\shared_proto_db|*|REMOVESELF

[Ecosia Browser DRM Data *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\WidevineCdm|*|REMOVESELF

[Ecosia Browser Extension Cookies *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|Extension Cookies

[Ecosia Browser Pinned Tabs *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
RegKey1=HKCU\Software\EcosiaBrowser\PreferenceMACs\Default|pinned_tabs

[Ecosia Browser Privacy Sandbox *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\EcosiaBrowser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\EcosiaBrowser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\EcosiaBrowser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\EcosiaBrowser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\EcosiaBrowser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\EcosiaBrowser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Ecosia Browser Progressive Web Apps *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\Web Applications|*|REMOVESELF

[Ecosia Browser Saved Usernames & Passwords *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|Login Data*

[Ecosia Browser Security & Threat Detection *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|DIPS*
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\EcosiaBrowser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\EcosiaBrowser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\EcosiaBrowser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\EcosiaBrowser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\EcosiaBrowser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\EcosiaBrowser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\EcosiaBrowser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\EcosiaBrowser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\EcosiaBrowser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\EcosiaBrowser\User Data\ZxcvbnData|*|REMOVESELF

[Ecosia Browser Shopping Insights *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\EcosiaBrowser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\EcosiaBrowser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\EcosiaBrowser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Ecosia Browser Storage Quota Manager *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|QuotaManager

[Ecosia Browser Sync Data *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\Sync Data|*|REMOVESELF

[Ecosia Browser Telemetry *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\Application|debug.log
FileKey2=%LocalAppData%\EcosiaBrowser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\EcosiaBrowser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\EcosiaBrowser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\EcosiaBrowser\User Data\*|*.log
FileKey6=%LocalAppData%\EcosiaBrowser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\EcosiaBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\EcosiaBrowser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\EcosiaBrowser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\EcosiaBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\EcosiaBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\EcosiaBrowser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\EcosiaBrowser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\EcosiaBrowser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\EcosiaBrowser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\EcosiaBrowser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\EcosiaBrowser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\EcosiaBrowser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\EcosiaBrowser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\EcosiaBrowser\Application|debug.log
FileKey21=%ProgramFiles%\EcosiaBrowser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\EcosiaBrowser\BlBeacon|failed_count
RegKey2=HKCU\Software\EcosiaBrowser\BlBeacon|state
RegKey3=HKCU\Software\EcosiaBrowser\Installer|LastChecked
RegKey4=HKCU\Software\EcosiaBrowser\StabilityMetrics

[Ecosia Browser Web Browsing Cookies *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Ecosia Browser Web Browsing History *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Ecosia Browser Web Browsing Session *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*\Sessions|*|REMOVESELF

[Ecosia Browser Web Storage *]
Section=Ecosia Web Browser
DetectFile=%LocalAppData%\EcosiaBrowser\User Data
FileKey1=%LocalAppData%\EcosiaBrowser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\EcosiaBrowser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\EcosiaBrowser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\EcosiaBrowser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\EcosiaBrowser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\EcosiaBrowser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\EcosiaBrowser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\EcosiaBrowser\User Data\*\WebStorage|*|REMOVESELF

[Edna & Harvey: Harvey's New Eyes *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219910
DetectFile=%LocalAppData%\Daedalic Entertainment\Harvey
FileKey1=%LocalAppData%\Daedalic Entertainment\Harvey|*.log
FileKey2=%ProgramFiles%\Steam\Steamapps\common\Edna and Harvey Harvey's New Eyes|stderr.txt

[Effective File Search *]
LangSecRef=3024
Detect=HKCU\Software\SOW\EFS
FileKey1=%ProgramFiles%\efs|cblist*.dat

[EffeTech HTTP Sniffer *]
LangSecRef=3024
Detect=HKCU\Software\EffeTech\EffeTech HTTP Sniffer
RegKey1=HKCU\Software\EffeTech\EffeTech HTTP Sniffer\Recent File List

[Efficient Calendar *]
LangSecRef=3021
DetectFile=%AppData%\Efficient Calendar
FileKey1=%AppData%\Efficient Calendar\MRUItems|*|RECURSE

[EFSoftware  *]
LangSecRef=3024
DetectFile=%AppData%\EFSoftware
FileKey1=%AppData%\EFSoftware|*Cache

[EH Reminder *]
LangSecRef=3021
Detect=HKCU\Software\Juan M. Aguirregabiria\Eh Reminder
RegKey1=HKCU\Software\Juan M. Aguirregabiria\Eh Reminder\Previous

[Elcomsoft Advanced EFS Data Recovery *]
LangSecRef=3021
Detect=HKCU\Software\ElcomSoft\Advanced EFS Data Recovery
FileKey1=%SystemDrive%|aefsdr.log

[Elcomsoft Advanced Registry Tracer *]
LangSecRef=3024
Detect=HKCU\Software\Elcom\ART
RegKey1=HKCU\Software\Elcom\ART\Recent File List

[Elcomsoft Password Digger *]
LangSecRef=3021
Detect=HKCU\Software\ElcomSoft\Elcomsoft Password Digger
FileKey1=%AppData%\Elcomsoft\*Password Digger|journal.sqlite

[Elcomsoft Password Recovery *]
LangSecRef=3021
Detect1=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery
Detect2=HKCU\Software\ElcomSoft\Advanced Office Password Recovery
Detect3=HKCU\Software\ElcomSoft\Advanced PDF Password Recovery
Detect4=HKCU\Software\ElcomSoft\Distributed Password Recovery
Detect5=HKCU\Software\ElcomSoft\Elcomsoft Internet Password Breaker
Detect6=HKCU\Software\ElcomSoft\Elcomsoft Phone Password Breaker
Detect7=HKCU\Software\ElcomSoft\Elcomsoft Proactive Password Auditor
Detect8=HKCU\Software\ElcomSoft\Elcomsoft Wireless Security Auditor
FileKey1=%AppData%\Elcomsoft\Elcomsoft Phone Password Breaker|*.log
FileKey2=%ProgramData%\Elcomsoft Password Recovery\Distributed Password Recovery\Logs|*
FileKey3=%ProgramFiles%\Elcomsoft Password Recovery\*|*.log;*log.txt
RegKey1=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery\Paths
RegKey2=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery\Recent Files
RegKey3=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 1
RegKey4=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 2
RegKey5=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 3
RegKey6=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 4
RegKey7=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 5
RegKey8=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 6
RegKey9=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 7
RegKey10=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 8
RegKey11=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 9
RegKey12=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 10
RegKey13=HKCU\Software\ElcomSoft\Advanced PDF Password Recovery\Recent Files

[Electric Sheep *]
LangSecRef=3021
DetectFile=%ProgramData%\ElectricSheep
FileKey1=%ProgramData%\ElectricSheep\Logs|*

[ElsterFormular *]
LangSecRef=3021
DetectFile=%AppData%\elsterformular
FileKey1=%AppData%\elsterformular\*\log|*.log*
FileKey2=%AppData%\elsterformular\*\tmp|*|RECURSE
FileKey3=%AppData%\elsterformular\pluginmanager\data|*_cpy.zip
FileKey4=%LocalAppData%\.elfohilfe|*|REMOVESELF
FileKey5=%LocalAppData%\elfopatch|*|REMOVESELF
FileKey6=%ProgramData%\elsterformular\log|*.log

[Eltima SWF Player *]
LangSecRef=3023
DetectFile=%AppData%\Eltima Software\SWF Player
FileKey1=%AppData%\Eltima Software\SWF Player|last_playlist;recent

[Eluktronics Bluetooth Device Firmware Update Tool *]
LangSecRef=3024
DetectFile=%ProgramData%\BT_DFU_Tool
FileKey1=%ProgramData%\BT_DFU_Tool\DFU*.exe.WebView2\EBWebView|*.pma
FileKey2=%ProgramData%\BT_DFU_Tool\DFU*.exe.WebView2\EBWebView\*Cache|*|RECURSE
FileKey3=%ProgramData%\BT_DFU_Tool\DFU*.exe.WebView2\EBWebView\BrowserMetrics|*
FileKey4=%ProgramData%\BT_DFU_Tool\DFU*.exe.WebView2\EBWebView\Default\*Cache|*|RECURSE

[Eluktronics Control Center *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\ControlCenter3_wrbgcf7aesyd8
DetectFile2=%ProgramFiles%\OEM\Eluktronics Control Center
FileKey1=%LocalAppData%\Packages\ControlCenter3_wrbgcf7aesyd8\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\ControlCenter3_wrbgcf7aesyd8\Settings|*.log*
FileKey3=%LocalAppData%\Packages\ControlCenter3_wrbgcf7aesyd8\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\ControlCenter3_wrbgcf7aesyd8\TempState|*|REMOVESELF
FileKey5=%ProgramData%\ControlCenter|*.log
FileKey6=%UserProfile%\Logs|SystrayComponent.json

[eM Client *]
LangSecRef=3022
Detect=HKCU\Software\eM Client
FileKey1=%AppData%\eM Client\Logs|*

[Email Address Collector *]
LangSecRef=3022
DetectFile=%AppData%\DS Development\EAC
FileKey1=%AppData%\DS Development\EAC|*.log

[EmailTray *]
LangSecRef=3024
Detect=HKCU\Software\EmailTray
FileKey1=%UserProfile%\AppData\LocalLow\EmailTray|*.log|RECURSE

[EMCO Software *]
LangSecRef=3024
DetectFile=%ProgramData%\EMCO
FileKey1=%ProgramData%\EMCO\Setup|*|REMOVESELF

[EmEditor *]
LangSecRef=3024
Detect=HKCU\Software\EmSoft\EmEditor v3
RegKey1=HKCU\Software\EmSoft\EmEditor v3\Recent File List
RegKey2=HKCU\Software\EmSoft\EmEditor v3\Recent Folder List
RegKey3=HKCU\Software\EmSoft\EmEditor v3\Recent Font List

[Empire Earth *]
Section=Games
DetectFile=%ProgramFiles%\Empire Earth
FileKey1=%ProgramFiles%\Empire Earth|*Error.log

[Emsisoft Emergency Kit *]
LangSecRef=3024
DetectFile=%SystemDrive%\EEK
FileKey1=%SystemDrive%\EEK\Logs|*

[Emsisoft HiJackFree *]
LangSecRef=3024
Detect=HKLM\Software\Emsi Software GmbH\a-squared HiJackFree
FileKey1=%ProgramFiles%\Emsisoft HiJackFree|*.old
FileKey2=%ProgramFiles%\Emsisoft HiJackFree\Logs|*

[eMule *]
LangSecRef=3022
Detect=HKCU\Software\eMule
FileKey1=%LocalAppData%\eMule\config|*.bak;*.old
FileKey2=%LocalAppData%\eMule\logs|*
FileKey3=%ProgramData%\eMule\config|*.bak;*.old
FileKey4=%ProgramData%\eMule\logs|*
FileKey5=%ProgramFiles%\eMule\config|*.bak;*.old
FileKey6=%ProgramFiles%\eMule\logs|*

[Encryption Xpert *]
LangSecRef=3024
Detect=HKCU\Software\Enplase Research\Encryption Xpert
RegKey1=HKCU\Software\Enplase Research\Encryption Xpert\Settings|LastFile

[Endless Legend *]
Section=Games
DetectFile=%UserProfile%\Documents\Endless Legend
FileKey1=%UserProfile%\Documents\Endless Legend\Temporary Files|*|RECURSE

[Endless Space *]
Section=Games
DetectFile=%UserProfile%\Documents\Endless Space*
FileKey1=%UserProfile%\Documents\Endless Space*\Temporary Files|*.html

[EndNote X6 *]
LangSecRef=3021
Detect=HKLM\Software\ISI ResearchSoft\EndNote
FileKey1=%AppData%\EndNote|*.16;*.log
FileKey2=%CommonProgramFiles%\Risxtd|*.LOG;*.txt
FileKey3=%ProgramData%\Thomson.ResearchSoft.Installers|*|REMOVESELF
FileKey4=%ProgramFiles%\EndNote X6\Product-Support\ThirdParty\Apache2|NOTICE
FileKey5=%ProgramFiles%\EndNote*|*.txt
FileKey6=%UserProfile%\Documents\My EndNote Library.Data\Trash|*|RECURSE

[EnhanceMy XP/Vista/Se7en/8 *]
LangSecRef=3024
DetectFile=%AppData%\SeriousBit\EnhanceMy*
FileKey1=%AppData%\SeriousBit\EnhanceMy*|Logs.txt
FileKey2=%AppData%\SeriousBit\EnhanceMy*\Backups|*|RECURSE

[Enhanso *]
LangSecRef=3024
DetectFile=%AppData%\SeriousBit\Enhanso
FileKey1=%AppData%\SeriousBit\Enhanso|Logs.txt
FileKey2=%AppData%\SeriousBit\Enhanso\Backups|*|RECURSE

[Enpass *]
LangSecRef=3024
DetectFile=%LocalAppData%\Sinew Software Systems Pvt Ltd\Enpass
FileKey1=%AppData%\Sinew Software Systems Pvt Ltd\Enpass\Crashes|*
FileKey2=%LocalAppData%\Sinew Software Systems Pvt Ltd\Enpass\cache|*|RECURSE

[Epic Games Launcher *]
Section=Games
Detect=HKCU\Software\Epic Games\EpicGamesLauncher
FileKey1=%LocalAppData%\CrashReportClient\Saved\Logs|*|REMOVESELF
FileKey2=%LocalAppData%\Epic Games\Epic Online Services\EOSInstaller\Logs|*
FileKey3=%LocalAppData%\EpicGames\eosoverlay|*.log
FileKey4=%LocalAppData%\EpicGames\eosoverlay\BrowserCache|*|RECURSE
FileKey5=%LocalAppData%\EpicGamesLauncher\Saved\Crashes|*|REMOVESELF
FileKey6=%LocalAppData%\EpicGamesLauncher\Saved\Logs|*|REMOVESELF
FileKey7=%LocalAppData%\EpicGamesLauncher\Saved\WebCache*|*|REMOVESELF
FileKey8=%ProgramData%\Epic\EpicOnlineServices\EpicOnlineServicesHost\Logs|*
FileKey9=%ProgramData%\Epic\EpicOnlineServices\InstallHelper\*Logs|*|RECURSE
FileKey10=%ProgramData%\Epic\EpicOnlineServices\MainService\Logs|*
FileKey11=%UserProfile%\AppData\LocalLow\EpicGamesLauncher\Logs|*

[Epic Privacy Browser Autofill Data & Search Engine Preferences *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Epic Privacy Browser\User Data\AutoFill*|*|REMOVESELF

[Epic Privacy Browser Autoplay Preferences *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\MEIPreload|*|REMOVESELF

[Epic Privacy Browser Bookmark Backups *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|Bookmarks.bak

[Epic Privacy Browser Bookmark Favicons *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|favicons*

[Epic Privacy Browser Caches *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\Epic Privacy Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Epic Privacy Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Epic Privacy Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Epic Privacy Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Epic Privacy Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Epic Privacy Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Epic Privacy Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Epic Privacy Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Epic Privacy Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Epic Privacy Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Epic Privacy Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Epic Privacy Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Epic Privacy Browser\User Data\Optimization*|*|REMOVESELF

[Epic Privacy Browser Default App Handlers *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|PreferredApps

[Epic Privacy Browser Download History *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*\shared_proto_db|*|REMOVESELF

[Epic Privacy Browser DRM Data *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\WidevineCdm|*|REMOVESELF

[Epic Privacy Browser Extension Cookies *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|Extension Cookies

[Epic Privacy Browser Pinned Tabs *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
RegKey1=HKCU\Software\Epic Privacy Browser\PreferenceMACs\Default|pinned_tabs

[Epic Privacy Browser Privacy Sandbox *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Epic Privacy Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Epic Privacy Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Epic Privacy Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Epic Privacy Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Epic Privacy Browser Progressive Web Apps *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\Web Applications|*|REMOVESELF

[Epic Privacy Browser Saved Usernames & Passwords *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|Login Data*

[Epic Privacy Browser Security & Threat Detection *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Epic Privacy Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Epic Privacy Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Epic Privacy Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Epic Privacy Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Epic Privacy Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Epic Privacy Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\ZxcvbnData|*|REMOVESELF

[Epic Privacy Browser Shopping Insights *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Epic Privacy Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Epic Privacy Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Epic Privacy Browser Storage Quota Manager *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|QuotaManager

[Epic Privacy Browser Sync Data *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\Sync Data|*|REMOVESELF

[Epic Privacy Browser Telemetry *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\Application|debug.log
FileKey2=%LocalAppData%\Epic Privacy Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Epic Privacy Browser\CrashReports|*|REMOVESELF
FileKey4=%LocalAppData%\Epic Privacy Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey5=%LocalAppData%\Epic Privacy Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Epic Privacy Browser\User Data\*|*.log
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey8=%LocalAppData%\Epic Privacy Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey10=%LocalAppData%\Epic Privacy Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey11=%LocalAppData%\Epic Privacy Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey13=%LocalAppData%\Epic Privacy Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey14=%LocalAppData%\Epic Privacy Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey15=%LocalAppData%\Epic Privacy Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey16=%LocalAppData%\Epic Privacy Browser\User Data\Crash Reports|*|REMOVESELF
FileKey17=%LocalAppData%\Epic Privacy Browser\User Data\Crashpad|*|REMOVESELF
FileKey18=%LocalAppData%\Epic Privacy Browser\User Data\Local Traces|*|REMOVESELF
FileKey19=%LocalAppData%\Epic Privacy Browser\User Data\OriginTrials|*|REMOVESELF
FileKey20=%LocalAppData%\Epic Privacy Browser\User Data\Stability|*|REMOVESELF
FileKey21=%ProgramFiles%\Epic Privacy Browser\Application|debug.log
FileKey22=%ProgramFiles%\Epic Privacy Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Epic Privacy Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\Epic Privacy Browser\BlBeacon|state
RegKey3=HKCU\Software\Epic Privacy Browser\Installer|LastChecked
RegKey4=HKCU\Software\Epic Privacy Browser\StabilityMetrics

[Epic Privacy Browser Web Browsing Cookies *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Epic Privacy Browser Web Browsing History *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Epic Privacy Browser Web Browsing Session *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*\Sessions|*|REMOVESELF

[Epic Privacy Browser Web Storage *]
Section=Epic Privacy Web Browser
DetectFile=%LocalAppData%\Epic Privacy Browser\User Data
FileKey1=%LocalAppData%\Epic Privacy Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Epic Privacy Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Epic Privacy Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Epic Privacy Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Epic Privacy Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Epic Privacy Browser\User Data\*\WebStorage|*|REMOVESELF

[Epson *]
LangSecRef=3021
Detect=HKCU\Software\EPSON
DetectFile=%AppData%\com.epson.printlayout
FileKey1=%AppData%\com.epson.printlayout\Local Store\#SharedObjects|*|RECURSE
FileKey2=%AppData%\com.epson.printlayout\Local Store\tmpImageFolder|*
FileKey3=%AppData%\com.epson.printlayout\Local Store\tmpPageFolder|*
FileKey4=%AppData%\EPSON\Epson_Windows_Installer\EPSON*|*.log
FileKey5=%AppData%\Epson\FAX Utility\FAXLOG|*

[Eraser *]
LangSecRef=3024
Detect=HKCU\Software\Heidi Computers Ltd\Eraser\5.5
FileKey1=%ProgramFiles%\Eraser*|schedlog.txt

[Erosion *]
Section=Games
DetectFile=%LocalAppData%\Erosion\Saved
FileKey1=%LocalAppData%\Erosion\Saved|Erosion_PCD3D_SM6.upipelinecache
FileKey2=%LocalAppData%\Erosion\Saved\Logs|*

[ESET *]
LangSecRef=3021
Detect=HKLM\Software\ESET\ESET Security
FileKey1=%ProgramData%\ESET\ESET*\Logs|*|RECURSE
FileKey2=%ProgramData%\ESET\ESET*\Oldfiles|*|RECURSE
FileKey3=%ProgramData%\ESET\ESET*\Updfiles|*|REMOVESELF
FileKey4=%ProgramFiles%\ESET\ESET Online Scanner|log.txt
FileKey5=%ProgramFiles%\ESET\ESET Online Scanner\Modules\data\updfiles\temp|*
FileKey6=%ProgramFiles%\ESET\ESET Online Scanner\Quarantine|*

[eSignaDesktop *]
LangSecRef=3024
DetectFile=%AppData%\Indenova\eSigna Desktop
FileKey1=%AppData%\Indenova\eSigna Desktop\log|*

[eSobi *]
LangSecRef=3022
DetectFile=%AppData%\eSobi
FileKey1=%AppData%\eSobi\*\temp|*|RECURSE

[Essential NetTools 3 *]
LangSecRef=3022
Detect=HKCU\Software\ENT3
DetectFile=%ProgramFiles%\Essential NetTools
FileKey1=%ProgramFiles%\Essential NetTools\LOGS|*
FileKey2=%UserProfile%\Documents\EssNetTools\LOGS|*.csv
RegKey1=HKCU\Software\ENT3\Recent

[EssentialPIM *]
LangSecRef=3021
Detect=HKLM\Software\clients\mail\essentialpim pro
DetectFile=%AppData%\EssentialPIM
FileKey1=%AppData%\EssentialPIM*\Logs|*

[Esumsoft POP Peeper *]
LangSecRef=3022
DetectFile=%AppData%\POP Peeper
FileKey1=%AppData%\POP Peeper|*.bak;Search.db
FileKey2=%AppData%\POP Peeper\PluginData\Profile\Cache|*.png

[Etherscan Password Sniffer *]
LangSecRef=3022
Detect=HKCU\Software\Win Sniffer\Etherscan Password Sniffer
RegKey1=HKCU\Software\Win Sniffer\Etherscan Password Sniffer\Recent File List
RegKey2=HKCU\Software\Win Sniffer\Etherscan Password Sniffer\Recent Item List

[Etwok NetSpot *]
LangSecRef=3024
DetectFile=%AppData%\Etwok\NetSpot
FileKey1=%AppData%\Etwok\NetSpot Installer\Logs|*
FileKey2=%AppData%\Etwok\NetSpot\Logs|*

[EurekaLog *]
LangSecRef=3024
DetectFile=%AppData%\Neos Eureka S.r.l\EurekaLog
FileKey1=%AppData%\Neos Eureka S.r.l\EurekaLog|*|RECURSE
RegKey1=HKCU\Software\EurekaLab\EurekaLog

[Euro Truck Simulator *]
Section=Games
DetectFile1=%UserProfile%\Documents\ETS2MP
DetectFile2=%UserProfile%\Documents\Euro Truck Simulator*
FileKey1=%UserProfile%\Documents\ETS2MP\logs|*.log
FileKey2=%UserProfile%\Documents\Euro Truck Simulator*|*.crash;*.log;*log.txt
FileKey3=%UserProfile%\Documents\Euro Truck Simulator*\cache|*.navcache
FileKey4=%UserProfile%\Documents\Euro Truck Simulator*\online\lscr_cache|*.jpg

[Euro Truck Simulator Profile Backups *]
Section=Games
DetectFile1=%UserProfile%\Documents\ETS2MP
DetectFile2=%UserProfile%\Documents\Euro Truck Simulator*
FileKey1=%UserProfile%\Documents\Euro Truck Simulator*|backups.txt
FileKey2=%UserProfile%\Documents\Euro Truck Simulator*\profiles*.bak|*|REMOVESELF

[EuroSYSTEMS CoCut Professional 2011 *]
LangSecRef=3021
Detect=HKCU\Software\EuroSYSTEMS\CoCut Professional 2011
FileKey1=%AppData%\EUROSYSTEMS\CoCut Professional 2011 15|*.bak
FileKey2=%ProgramFiles%\EUROSYSTEMS\CoCut Professional 2011|*.bak;*.log;*.tmp
FileKey3=%ProgramFiles%\EUROSYSTEMS\CoCut Professional 2011\log|*

[EuroSYSTEMS SmartCut Pro *]
LangSecRef=3021
Detect=HKCU\Software\EuroSYSTEMS
FileKey1=%ProgramFiles%\EUROSYSTEMS\SmartCut Pro|*.bak;*.tmp
FileKey2=%ProgramFiles%\EUROSYSTEMS\SmartCut Pro\Temp|*|RECURSE

[Eusing Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\Eusing\Eusing Cleaner
FileKey1=%AppData%\Eusing\Eusing Cleaner\Backup|*.reg

[Eusing Free Registry Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\Eusing\Free Registry Cleaner
FileKey1=%AppData%\Eusing\Free Registry Cleaner\Backup|*.reg

[Eusing Launcher *]
LangSecRef=3024
DetectFile=%AppData%\Eusing\Eusing Launcher
FileKey1=%AppData%\Eusing\Eusing Launcher|*.bak

[EVE Online *]
Section=Games
Detect=HKCU\Software\CCP
FileKey1=%AppData%\EVEMon|*.bak
FileKey2=%LocalAppData%\CCP\EVE|history.txt
FileKey3=%UserProfile%\Documents\EVE\Logs|*|RECURSE

[Evernote *]
LangSecRef=3021
DetectFile=%UserProfile%\AppData\LocalLow\Evernote
FileKey1=%LocalAppData%\Evernote\Evernote\AutoUpdate|*.exe
FileKey2=%LocalAppData%\Evernote\Evernote\Updates|*
FileKey3=%UserProfile%\AppData\LocalLow\Evernote\Evernote\Logs|*

[Everyday Genius: SquareLogic *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\32150
DetectFile=%AppData%\SquareLogic
FileKey1=%AppData%\SquareLogic|*.log

[Everything *]
LangSecRef=3024
DetectFile1=%AppData%\Everything
DetectFile2=%ProgramFiles%\Everything
FileKey1=%AppData%\Everything|*.csv;*.tmp;*.txt
FileKey2=%LocalAppData%\EverythingToolbar|history.xml
FileKey3=%ProgramFiles%\Everything|*.csv;*.tmp;*.txt
ExcludeKey1=FILE|%AppData%\Everything\|Filters.csv
ExcludeKey2=FILE|%ProgramFiles%\Everything\|Filters.csv

[Evince Document Viewer *]
LangSecRef=3021
DetectFile=%LocalAppData%\Apps\Evince-*
FileKey1=%UserProfile%\.gnome*\evince|ev-metadata.xml

[ExactFile *]
LangSecRef=3024
Detect=HKCU\Software\ExactFile
RegKey1=HKCU\Software\ExactFile|CDLastFolderSelected
RegKey2=HKCU\Software\ExactFile\FormMain_Properties|EditCDFolderOutputFileName.Text
RegKey3=HKCU\Software\ExactFile\FormMain_Properties|EditCDFolderPath.Text
RegKey4=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditsfcFile.Text
RegKey5=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTDBaseFolder.Text
RegKey6=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTestDigestFile.Text
RegKey7=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTFPath.Text

[ExamDiff Pro *]
LangSecRef=3024
Detect=HKCU\Software\PrestoSoft\ExamDiff Pro
RegKey1=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Binary Find Strings
RegKey2=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Center Merged Files
RegKey3=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Left Merged Files
RegKey4=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Sessions

[ExeIco *]
LangSecRef=3024
Detect=HKCU\Software\XTZY\ExeIcon
FileKey1=%ProgramFiles%\ExeIco|*.log

[Exif Tag Remover *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover
RegKey1=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover|sLastAddDir
RegKey2=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover|sLastDir

[Exifer *]
LangSecRef=3024
Detect=HKCU\Software\Exifer
RegKey1=HKCU\Software\Exifer\Browse\History

[ExifPro *]
LangSecRef=3024
Detect=HKCU\Software\MKowalski\ExifPro
FileKey1=%ProgramData%\MiK\ExifPro|Cache*
RegKey1=HKCU\Software\MKowalski\ExifPro\1.0\Browser\View 0|LastPath
RegKey2=HKCU\Software\MKowalski\ExifPro\1.0\HTMLAlbumGen\RecentDestPaths
RegKey3=HKCU\Software\MKowalski\ExifPro\1.0\RecentPaths
RegKey4=HKCU\Software\MKowalski\ExifPro\1.0\ResizeDlg\RecentDestPaths

[Exodus *]
LangSecRef=3022
Detect=HKCU\Software\Jabber\Exodus
FileKey1=%AppData%\Exodus\avatars|cache.xml

[Exodus Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Jabber\Exodus
FileKey1=%UserProfile%\Documents\Exodus-Logs|*|RECURSE

[ExpertGHID *]
LangSecRef=3021
Detect1=HKCU\Software\ExpertGHID
Detect2=HKCU\Software\Local AppWizard-Generated Applications\ExpertGHID
RegKey1=HKCU\Software\ExpertGHID\Recent File List
RegKey2=HKCU\Software\Local AppWizard-Generated Applications\ExpertGHID\Recent File List

[ExplorerXP *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ExplorerXP
FileKey1=%ProgramFiles%\ExplorerXP|DirSizeCache.dat

[Exportizer *]
LangSecRef=3024
Detect=HKCU\Software\Vitaliy Levchenko\Exportizer 5
RegKey1=HKCU\Software\Vitaliy Levchenko\Exportizer 5\Settings|LastExt
RegKey2=HKLM\Software\ODBC\Temporary (volatile) Jet DSN for process 0x5ac Thread 0x3d8 DBC 0x2bd1e84 Xbase|DefaultDir
RegKey3=HKLM\Software\ODBC\Temporary (volatile) Jet DSN for process 0x858 Thread 0xfb0 DBC 0x2ca3a74 Paradox|DefaultDir

[Express Photo Digital *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Express Digital\ExpressPhoto*
FileKey1=%ProgramFiles%\Express Digital\ExpressPhoto*|*.log

[EZ Backup Ultimate *]
LangSecRef=3024
Detect=HKCU\Software\Perception\EZ Backup Ultimate
FileKey1=%AppData%\EZ Backup Ultimate|lastlog.html

[F-Secure *]
LangSecRef=3024
DetectFile=%LocalAppData%\F-Secure
FileKey1=%LocalAppData%\F-Secure\Antivirus\ScanningReports|scan_report*.html
FileKey2=%LocalAppData%\F-Secure\Log|*|RECURSE
FileKey3=%UserProfile%\AppData\LocalLow\F-Secure\Log|*|RECURSE

[F-Secure Password Manager *]
LangSecRef=3021
Detect=HKCU\Software\F-Secure
FileKey1=%LocalAppData%\F-Secure\Pwmgr|*.log
FileKey2=%LocalAppData%\F-Secure\Pwmgr\LocalStorage|*|RECURSE

[Facebook *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\FACEBOOK.FACEBOOK_8xx8rvfyw5nnt
FileKey1=%LocalAppData%\Packages\FACEBOOK.FACEBOOK_8xx8rvfyw5nnt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\FACEBOOK.FACEBOOK_8xx8rvfyw5nnt\Settings|*.log*
FileKey3=%LocalAppData%\Packages\FACEBOOK.FACEBOOK_8xx8rvfyw5nnt\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\FACEBOOK.FACEBOOK_8xx8rvfyw5nnt\TempState|*|REMOVESELF

[Facebook Messenger *]
LangSecRef=3022
DetectFile=%LocalAppData%\Facebook\Messenger
FileKey1=%LocalAppData%\Facebook\Messenger|*.log|RECURSE
FileKey2=%LocalAppData%\Facebook\Messenger\fbmessenger.cache|data_*;index

[FACEIT Client *]
Section=Games
DetectFile=%AppData%\FACEIT
FileKey1=%AppData%\FACEIT\*Cache|*
FileKey2=%AppData%\FACEIT\FACEIT Client|debug.log

[Faceprov *]
LangSecRef=3023
Detect=HKCU\Software\Lenovo
FileKey1=%SystemDrive%|Faceprov.*

[Factorio *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\427520
FileKey1=%AppData%\Factorio|*log

[Fallout Shelter *]
Section=Games
DetectFile=%LocalAppData%\FalloutShelter
FileKey1=%LocalAppData%\FalloutShelter|*.bkp;*.log

[Famatech Advanced IP Scanner *]
LangSecRef=3024
Detect1=HKCU\Software\famatech\Advanced IP Scanner
Detect2=HKCU\Software\famatech\advanced_ip_scanner
DetectFile=%ProgramFiles%\Advanced IP Scanner*
FileKey1=%ProgramFiles%\Advanced IP Scanner*|*.cnt;*.GID;*.msi
FileKey2=%UserProfile%|advanced_ip_scanner_*.bin
RegKey1=HKCU\Software\famatech\Advanced IP Scanner\LastLoadedListName
RegKey2=HKCU\Software\famatech\advanced_ip_scanner\State|IpRangesMruList
RegKey3=HKCU\Software\famatech\advanced_ip_scanner\State|LastRangeUsed
RegKey4=HKCU\Software\famatech\advanced_ip_scanner\State|SearchMruList
RegKey5=HKLM\Software\famatech\advanced_ip_scanner|locale_timestamp

[Famatech Advanced Port Scanner *]
LangSecRef=3024
Detect1=HKCU\Software\famatech\Advanced Port Scanner
Detect2=HKCU\Software\famatech\advanced_port_scanner
FileKey1=%ProgramFiles%\Advanced Port Scanner|*.cnt;*.GID;*.msi
FileKey2=%UserProfile%|advanced_port_scanner_*.bin
RegKey1=HKCU\Software\famatech\Advanced Port Scanner\LastUsedIPsListPath
RegKey2=HKCU\Software\famatech\Advanced Port Scanner\LastUsedPortsListPath
RegKey3=HKCU\Software\famatech\advanced_port_scanner\State|details_save_path
RegKey4=HKCU\Software\famatech\advanced_port_scanner\State|IpRangesMruList
RegKey5=HKCU\Software\famatech\advanced_port_scanner\State|LastPortsUsed
RegKey6=HKCU\Software\famatech\advanced_port_scanner\State|LastRangeUsed
RegKey7=HKCU\Software\famatech\advanced_port_scanner\State|PortsMruList
RegKey8=HKCU\Software\famatech\advanced_port_scanner\State|SearchMruList
RegKey9=HKLM\Software\famatech\advanced_port_scanner|locale_timestamp

[Fantasy Wars *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\63900
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Fantasy Wars|gui_log.txt

[FAR Manager *]
LangSecRef=3021
Detect1=HKCU\Software\Far
Detect2=HKCU\Software\Far2
Detect3=HKCU\Software\Far18
RegKey1=HKCU\Software\Far\Editor\LastPositions
RegKey2=HKCU\Software\Far\SavedDialogHistory
RegKey3=HKCU\Software\Far\SavedDialogHistory\PersPath
RegKey4=HKCU\Software\Far\SavedFolderHistory
RegKey5=HKCU\Software\Far\SavedHistory
RegKey6=HKCU\Software\Far\SavedViewHistory
RegKey7=HKCU\Software\Far\Viewer\LastPositions
RegKey8=HKCU\Software\Far2\Editor\LastPositions
RegKey9=HKCU\Software\Far2\SavedDialogHistory
RegKey10=HKCU\Software\Far2\SavedDialogHistory\PersPath
RegKey11=HKCU\Software\Far2\SavedFolderHistory
RegKey12=HKCU\Software\Far2\SavedHistory
RegKey13=HKCU\Software\Far2\SavedViewHistory
RegKey14=HKCU\Software\Far2\Viewer\LastPositions
RegKey15=HKCU\Software\Far18\Editor\LastPositions
RegKey16=HKCU\Software\Far18\SavedDialogHistory
RegKey17=HKCU\Software\Far18\SavedDialogHistory\PersPath
RegKey18=HKCU\Software\Far18\SavedFolderHistory
RegKey19=HKCU\Software\Far18\SavedHistory
RegKey20=HKCU\Software\Far18\SavedViewHistory
RegKey21=HKCU\Software\Far18\Viewer\LastPositions

[Farming Simulator *]
Section=Games
Detect=HKLM\Software\SCS Software
FileKey1=%UserProfile%\Documents\My Games\FarmingSimulator*|*.txt
FileKey2=%UserProfile%\Documents\My Games\FarmingSimulator*\pdlc*|*.dlc|REMOVESELF
FileKey3=%UserProfile%\Documents\My Games\FarmingSimulator*\shader_cache|*.shc;*.xml|REMOVESELF

[Farming Simulator Old AutoSaves *]
Section=Games
Detect=HKLM\Software\SCS Software
FileKey1=%UserProfile%\Documents\My Games\FarmingSimulator*\savegame*|*|REMOVESELF
ExcludeKey1=PATH|%UserProfile%\Documents\My Games\FarmingSimulator*\savegame1\|*
ExcludeKey2=PATH|%UserProfile%\Documents\My Games\FarmingSimulator*\savegameBackup\|*

[Fast Clean Pro *]
LangSecRef=3024
DetectFile=%LocalAppData%\Fastcleanpro
FileKey1=%LocalAppData%\Fastcleanpro\logs|*

[FastCopy *]
LangSecRef=3024
DetectFile=%AppData%\FastCopy
FileKey1=%AppData%\FastCopy|*.log

[FastStone Capture *]
LangSecRef=3024
Detect=HKCU\Software\FastStone Capture
DetectFile=%AppData%\FastStone\FSC
FileKey1=%AppData%\FastStone\FSC|*.bak;fsc.db
FileKey2=%LocalAppData%\FastStone\FSC|fsc.db
FileKey3=%LocalAppData%\FastStone\FSC\EditWith|*
FileKey4=%LocalAppData%\FastStone\FSC\Email|*
FileKey5=%LocalAppData%\FastStone\FSC\FTP|*
RegKey1=HKCU\Software\FastStone|_GrbId
RegKey2=HKCU\Software\FastStone|_LastClipPlayed
RegKey3=HKCU\Software\FastStone|_LastRecordingFileName
RegKey4=HKCU\Software\FastStone\APP.FSRecorder\Global|_GrbId
RegKey5=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastClipPlayed
RegKey6=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastRecordingFileName

[FastStone Image Viewer *]
LangSecRef=3023
Detect=HKLM\Software\FastStone Image Viewer
FileKey1=%AppData%\FastStone\FSIV|FSViewer.db

[FatBatt *]
LangSecRef=3024
Detect=HKCU\Software\MiserWare, Inc.\FatBatt
FileKey1=%ProgramData%\MiserWare\FatBatt\logs|*.log

[FBReader *]
LangSecRef=3021
Detect=HKCU\Software\FBReader
DetectFile=%ProgramFiles%\FBReader
FileKey1=%UserProfile%\.FBReader|books.db;network.db;state.db

[FCleaner *]
LangSecRef=3024
Detect=HKCU\Software\FTweak\FCleaner
RegKey1=HKCU\Software\FTweak\FCleaner|programfile

[FEZ *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\224760
FileKey1=%AppData%\FEZ|Debug Log.txt

[FFsplit *]
LangSecRef=3023
DetectFile=%ProgramFiles%\FFsplit
FileKey1=%AppData%\FFsplit|FFsourceLog.txt
FileKey2=%AppData%\FFsplit\logs|*

[FIGHTERStools *]
LangSecRef=3024
Detect=HKCU\Software\Fighters
FileKey1=%AppData%\Fighters\*\Logs|*.log;*log.txt
FileKey2=%ProgramData%\Common Toolkit Suite\Tools\Logs|*.log
FileKey3=%ProgramData%\Fighters\*\Logs|*.log

[File Renamer Basic *]
LangSecRef=3024
DetectFile=%LocalAppData%\File Renamer Basic
FileKey1=%LocalAppData%\File Renamer Basic|*log*.txt

[File Shredder *]
LangSecRef=3024
Detect=HKCU\Software\Shredder
RegKey1=HKCU\Software\Shredder\{FF14D9EE-48EB-4873-80AC-8E224BEE5823}

[File Type Doctor *]
LangSecRef=3024
Detect=HKCU\Software\Creative Element\File Type Doctor
RegKey1=HKCU\Software\Creative Element\File Type Doctor|LastSelected

[FileCleaner *]
LangSecRef=3024
Detect=HKCU\Software\WebMinds, Inc\FileCleaner
FileKey1=%AppData%\FileCleaner|log.txt

[FileLocator Pro *]
LangSecRef=3024
Detect=HKCU\Software\Mythicsoft\FileLocatorPro
RegKey1=HKCU\Software\Mythicsoft\FileLocatorPro\RecentContains
RegKey2=HKCU\Software\Mythicsoft\FileLocatorPro\RecentFileName
RegKey3=HKCU\Software\Mythicsoft\FileLocatorPro\RecentFolders

[FileMind QuickFix *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92789900-80D0-4B61-B742-7897964A69AB}_is1
FileKey1=%ProgramFiles%\Metability Software\FileMindQuickFix|*.log|RECURSE

[FileSearchEX *]
LangSecRef=3024
Detect=HKCU\Software\GOFF Concepts\FileSearchEX
RegKey1=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_ContainingTextHistory
RegKey2=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_LookinHistory
RegKey3=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_SearchHistory

[FileZilla *]
LangSecRef=3022
Detect=HKLM\Software\FileZilla Client
FileKey1=%ProgramFiles%\FileZilla FTP Client|*.tmp

[Final Factory *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Never Games\FinalFactory
FileKey1=%UserProfile%\AppData\LocalLow\Never Games\FinalFactory|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Never Games\FinalFactory\backtrace|*|RECURSE
FileKey3=%UserProfile%\AppData\LocalLow\Never Games\FinalFactory\Unity|*|REMOVESELF

[FINAM Forex Terminal *]
LangSecRef=3021
DetectFile=%ProgramFiles%\FINAM Forex Terminal
FileKey1=%ProgramFiles%\FINAM Forex Terminal\logs|*
FileKey2=%ProgramFiles%\FINAM Forex Terminal\MQL*\Logs|*
FileKey3=%ProgramFiles%\FINAM Forex Terminal\tester\logs|*

[Find Junk Files *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Find Junk Files
FileKey1=%ProgramFiles%\Find Junk Files\System\logs|*|RECURSE

[Finders Keepers *]
LangSecRef=3021
Detect=HKCU\Software\Yadu Digital\Finders Keepers
RegKey1=HKCU\Software\Yadu Digital\Finders Keepers\Options\General|Last file

[Finetuneapps AI Text Scanner *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\7549finetuneapps.DocumentScannerOCRPDFImagetoText_6a8h0qfxmjx9c
FileKey1=%LocalAppData%\Packages\7549finetuneapps.DocumentScannerOCRPDFImagetoText_6a8h0qfxmjx9c\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\7549finetuneapps.DocumentScannerOCRPDFImagetoText_6a8h0qfxmjx9c\LocalState\OcrScannerApp\RecentDocuments|*|RECURSE
FileKey3=%LocalAppData%\Packages\7549finetuneapps.DocumentScannerOCRPDFImagetoText_6a8h0qfxmjx9c\Settings|*.log*
FileKey4=%LocalAppData%\Packages\7549finetuneapps.DocumentScannerOCRPDFImagetoText_6a8h0qfxmjx9c\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\7549finetuneapps.DocumentScannerOCRPDFImagetoText_6a8h0qfxmjx9c\TempState|*|REMOVESELF

[Firebird Project *]
LangSecRef=3023
Detect=HKLM\Software\Firebird Project
FileKey1=%ProgramFiles%\Firebird\Firebird_2_1|*.log

[Fishdom H2O *]
Section=Games
DetectFile=%AppData%\Playrix Entertainment\Fishdom H2O Final
FileKey1=%AppData%\Playrix Entertainment\Fishdom H2O Final|log.html

[FixCleaner *]
LangSecRef=3024
DetectFile=%AppData%\FixCleaner
FileKey1=%AppData%\FixCleaner\Logs|*

[FL Studio *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Image-Line\FL Studio*
FileKey1=%ProgramFiles%\Image-Line\Downloader|*.log

[Flame Keeper *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Untold Tales\Flame Keeper
FileKey1=%UserProfile%\AppData\LocalLow\Untold Tales\Flame Keeper|*.log

[FlashFXP *]
LangSecRef=3022
Detect=HKLM\Software\FlashFXP
FileKey1=%ProgramFiles%\FlashFXP|quick.dat

[FlashIntegro *]
LangSecRef=3023
DetectFile=%ProgramFiles%\FlashIntegro
FileKey1=%AppData%\FlashIntegro\filecache|*.cache
FileKey2=%AppData%\ScreenRecorder|*.log
FileKey3=%AppData%\VideoCapture|*.log
FileKey4=%AppData%\VideoEditor|*.log

[FlashPeak SlimJet Autofill Data & Search Engine Preferences *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|*Web Data
FileKey2=%LocalAppData%\Slimjet\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Slimjet\User Data\AutoFill*|*|REMOVESELF

[FlashPeak SlimJet Autoplay Preferences *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\MEIPreload|*|REMOVESELF

[FlashPeak SlimJet Bookmark Backups *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|Bookmarks.bak

[FlashPeak SlimJet Bookmark Favicons *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|favicons*

[FlashPeak SlimJet Caches *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Slimjet\User Data|Module Info Cache
FileKey3=%LocalAppData%\Slimjet\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Slimjet\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Slimjet\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Slimjet\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Slimjet\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Slimjet\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Slimjet\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Slimjet\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Slimjet\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Slimjet\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Slimjet\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Slimjet\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Slimjet\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Slimjet\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Slimjet\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Slimjet\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Slimjet\User Data\Default\newtab\thumbnails|*|REMOVESELF
FileKey20=%LocalAppData%\Slimjet\User Data\Optimization*|*|REMOVESELF

[FlashPeak SlimJet Default App Handlers *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|PreferredApps

[FlashPeak SlimJet Download History *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Slimjet\User Data\*\shared_proto_db|*|REMOVESELF

[FlashPeak SlimJet DRM Data *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Slimjet\User Data\WidevineCdm|*|REMOVESELF

[FlashPeak SlimJet Extension Cookies *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|Extension Cookies

[FlashPeak SlimJet Pinned Tabs *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
RegKey1=HKCU\Software\Slimjet\PreferenceMACs\Default|pinned_tabs

[FlashPeak SlimJet Privacy Sandbox *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Slimjet\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Slimjet\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Slimjet\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Slimjet\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Slimjet\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Slimjet\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Slimjet\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[FlashPeak SlimJet Progressive Web Apps *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\Web Applications|*|REMOVESELF

[FlashPeak SlimJet Saved Usernames & Passwords *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|Login Data*

[FlashPeak SlimJet Security & Threat Detection *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|DIPS*
FileKey2=%LocalAppData%\Slimjet\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Slimjet\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Slimjet\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Slimjet\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Slimjet\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Slimjet\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Slimjet\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Slimjet\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Slimjet\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Slimjet\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Slimjet\User Data\ZxcvbnData|*|REMOVESELF

[FlashPeak SlimJet Shopping Insights *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Slimjet\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Slimjet\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Slimjet\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Slimjet\User Data\*\parcel_tracking_db|*|REMOVESELF

[FlashPeak SlimJet Storage Quota Manager *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|QuotaManager

[FlashPeak SlimJet Sync Data *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\Sync Data|*|REMOVESELF

[FlashPeak SlimJet Telemetry *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\Application|debug.log
FileKey2=%LocalAppData%\Slimjet\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Slimjet\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Slimjet\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Slimjet\User Data\*|*.log
FileKey6=%LocalAppData%\Slimjet\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Slimjet\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Slimjet\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Slimjet\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Slimjet\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Slimjet\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Slimjet\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Slimjet\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Slimjet\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Slimjet\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Slimjet\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Slimjet\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Slimjet\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Slimjet\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Slimjet\Application|debug.log
FileKey21=%ProgramFiles%\Slimjet\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Slimjet\BlBeacon|failed_count
RegKey2=HKCU\Software\Slimjet\BlBeacon|state
RegKey3=HKCU\Software\Slimjet\Installer|LastChecked
RegKey4=HKCU\Software\Slimjet\StabilityMetrics

[FlashPeak SlimJet Web Browsing Cookies *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\Network|Cookies*;Device Bound Sessions*

[FlashPeak SlimJet Web Browsing History *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[FlashPeak SlimJet Web Browsing Session *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Slimjet\User Data\*\Sessions|*|REMOVESELF

[FlashPeak SlimJet Web Storage *]
Section=FlashPeak SlimJet Web Browser
DetectFile=%LocalAppData%\Slimjet\User Data
FileKey1=%LocalAppData%\Slimjet\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Slimjet\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Slimjet\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Slimjet\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Slimjet\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Slimjet\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Slimjet\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Slimjet\User Data\*\WebStorage|*|REMOVESELF

[Flashpoint Launcher *]
Section=Games
DetectFile=%AppData%\Flashpoint-Launcher
FileKey1=%AppData%\Flashpoint-Launcher|*.old;LOG;Network Persistent State|RECURSE
FileKey2=%AppData%\Flashpoint-Launcher\*Cache|*|RECURSE
FileKey3=%AppData%\Flashpoint-Launcher\blob_storage|*|RECURSE

[Flexibits Fantastical *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\FlexibitsInc.Fantastical_xhwyj10g4qjsr
FileKey1=%LocalAppData%\Fantastical\Cache\WebView\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey2=%LocalAppData%\Fantastical\Cache\WebView\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey3=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey4=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\AutoFill*|*|REMOVESELF
FileKey6=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Avatars|*|REMOVESELF
FileKey7=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey8=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey9=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Crash Reports|*|REMOVESELF
FileKey10=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Crashpad|*|REMOVESELF
FileKey11=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Crowd Deny|*|REMOVESELF
FileKey12=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey13=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey14=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey15=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey16=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey17=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey18=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey19=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey20=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey21=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey22=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey23=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Download Service|*|REMOVESELF
FileKey24=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Extension State|*|REMOVESELF
FileKey25=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey26=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\File System|*|REMOVESELF
FileKey27=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey28=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey29=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey30=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey31=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\optimization*|*|REMOVESELF
FileKey32=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey33=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey34=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey35=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey36=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey37=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Sessions|*|REMOVESELF
FileKey38=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey39=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey40=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey41=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey42=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey43=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey44=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey45=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey46=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey47=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey48=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey49=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Local Traces|*|REMOVESELF
FileKey50=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\MEIPreload|*|REMOVESELF
FileKey51=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Optimization*|*|REMOVESELF
FileKey52=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\OriginTrials|*|REMOVESELF
FileKey53=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\PKIMetadata|*|REMOVESELF
FileKey54=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey55=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey56=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Safe Browsing|*|REMOVESELF
FileKey57=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\SafetyTips|*|REMOVESELF
FileKey58=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\SmartScreen|*|REMOVESELF
FileKey59=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey60=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Stability|*|REMOVESELF
FileKey61=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\Subresource Filter|*|REMOVESELF
FileKey62=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey63=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\WidevineCdm|*|REMOVESELF
FileKey64=%LocalAppData%\Fantastical\Cache\WebView\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey65=%LocalAppData%\Fantastical\Logs|*
FileKey66=%LocalAppData%\Packages\FlexibitsInc.Fantastical_xhwyj10g4qjsr\AC|*|RECURSE
FileKey67=%LocalAppData%\Packages\FlexibitsInc.Fantastical_xhwyj10g4qjsr\Settings|*.log*
FileKey68=%LocalAppData%\Packages\FlexibitsInc.Fantastical_xhwyj10g4qjsr\SystemAppData\Helium|*.log*
FileKey69=%LocalAppData%\Packages\FlexibitsInc.Fantastical_xhwyj10g4qjsr\TempState|*|REMOVESELF

[FLEXnet *]
LangSecRef=3021
Detect1=HKCU\Software\FlexNet
Detect2=HKLM\System\CurrentControlSet\services\FLEXnet Licensing Service
FileKey1=%ProgramData%\FLEXnet|*.data_backup.*;*.log

[FlipBooks *]
LangSecRef=3021
Detect=HKCU\Software\EBooksys\FlipBook CD 1
RegKey1=HKCU\Software\EBooksys\FlipBook CD 1\Typed URLs

[Floorp Autocomplete History *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|formhistory*

[Floorp Autofill Data *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|autofill-profiles.json

[Floorp Bookmark Backups *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*\bookmarkbackups|*

[Floorp Bookmark Favicons *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|favicons*

[Floorp Caches *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Floorp\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Floorp\Profiles\*\notificationstore|*
FileKey4=%AppData%\Floorp\Profiles\*\security_state|*
FileKey5=%AppData%\Floorp\Profiles\*\shader-cache|*
FileKey6=%AppData%\Floorp\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Floorp\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Floorp\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Floorp\Profiles\*\thumbnails|*|REMOVESELF

[Floorp Privacy Sandbox *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|credentialstate.sqlite

[Floorp Saved Usernames & Passwords *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|key4.db;logins.json

[Floorp Synced Tabs *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|synced-tabs.db*

[Floorp Telemetry *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp|*.log|RECURSE
FileKey2=%AppData%\Floorp\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Floorp\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Floorp\Profiles\*\crashes|*
FileKey5=%AppData%\Floorp\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Floorp\Profiles\*\minidumps|*
FileKey7=%AppData%\Floorp\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Floorp\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Floorp\Profiles\*\weave\logs|*

[Floorp Web Browsing Cookies *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|cookies*

[Floorp Web Browsing Session *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|session*.json*

[Floorp Web Browsing Session Backups *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*\sessionstore-backups|*

[Floorp Web Storage *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Floorp\Profiles\*\storage\default\http*|*|REMOVESELF

[Floorp Website Permissions *]
Section=Floorp Web Browser
DetectFile=%AppData%\Floorp\Profiles
FileKey1=%AppData%\Floorp\Profiles\*|content-prefs.sqlite;permissions.sqlite

[FocusOn Image Viewer *]
LangSecRef=3023
Detect=HKLM\Software\Pintosoft\FocusOn Image Viewer
FileKey1=%LocalAppData%\Pintosoft\FocusOn Image Viewer|Images.fds
FileKey2=%ProgramFiles%\Pintosoft\FocusOn Image Viewer|ImageMagick_*.txt

[FocusOn Renamer *]
LangSecRef=3024
Detect=HKCU\Software\Pintosoft\FocusOn Renamer
RegKey1=HKCU\Software\Pintosoft\FocusOn Renamer|BRMRN1
RegKey2=HKCU\Software\Pintosoft\FocusOn Renamer|BRReplaceFrom
RegKey3=HKCU\Software\Pintosoft\FocusOn Renamer|BRReplaceWith

[FolderSecurityViewer *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\FolderSecurityViewer
FileKey1=%UserProfile%\Documents\FolderSecurityViewer\Logs|*

[FonePaw Data Recovery *]
LangSecRef=3024
DetectFile=%LocalAppData%\FonePaw\FonePaw*Data Recovery
FileKey1=%LocalAppData%\FonePaw\FonePaw*Data Recovery|*.log
FileKey2=%LocalAppData%\FonePaw\FonePaw*Data Recovery\Log|*

[FontBase *]
LangSecRef=3021
DetectFile=%AppData%\FontBase
FileKey1=%AppData%\FontBase|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE
FileKey2=%AppData%\FontBase\*Cache|*|RECURSE
FileKey3=%AppData%\FontBase\blob_storage|*|RECURSE

[Foobar2000 *]
LangSecRef=3023
Detect=HKLM\Software\foobar2000
DetectFile=%ProgramFiles%\foobar2000
FileKey1=%AppData%\foobar2000|*.log;failure.txt;history.flg;library-error-log.txt;PlayCount.sdf;wavecache.db
FileKey2=%AppData%\foobar2000\autobackup|autobackup*.zip
FileKey3=%AppData%\foobar2000\component-updates|*.zip
FileKey4=%AppData%\foobar2000\crash reports|failure*.dmp;failure*.txt
FileKey5=%AppData%\foobar2000\foo_youtube\cache|*|RECURSE
FileKey6=%AppData%\foobar2000\index-data|*|RECURSE
FileKey7=%ProgramFiles%\foobar2000|*.log;failure.txt;history.flg;library-error-log.txt;PlayCount.sdf;wavecache.db
FileKey8=%ProgramFiles%\foobar2000\crash reports|failure*.dmp;failure*.txt
FileKey9=%ProgramFiles%\foobar2000\index-data|*|RECURSE

[fopnu *]
LangSecRef=3022
DetectFile=%AppData%\fopnu
FileKey1=%AppData%\fopnu|*.lastloadok.dat;chat.dat;downloads.dat
FileKey2=%UserProfile%\Desktop|Fopnu_*_log_*.txt

[Ford Sync My iTunes *]
LangSecRef=3023
DetectFile=%AppData%\Ford Motor Company
FileKey1=%AppData%\Ford Motor Company\logs|*

[ForgetBox *]
LangSecRef=3022
Detect=HKCU\Software\ForgetBox SAS
FileKey1=%AppData%\ForgetBox\cache|*|RECURSE

[Form Pilot Office *]
LangSecRef=3021
Detect=HKCU\Software\Two Pilots\Form Pilot
FileKey1=%AppData%\Two Pilots\PDF Library|Log.txt
FileKey2=%UserProfile%\Documents\Form Pilot|error.log
RegKey1=HKCU\Software\Two Pilots\Form Pilot\Settings|GraphicInitialDir
RegKey2=HKCU\Software\Two Pilots\Form Pilot\Settings|InitialDir

[Format Factory *]
LangSecRef=3023
DetectFile=%ProgramFiles%\FormatFactory
FileKey1=%ProgramFiles%\FormatFactory|*log.txt

[Fort Firewall *]
LangSecRef=3022
DetectFile=%LocalAppData%\Fort Firewall
FileKey1=%LocalAppData%\Fort Firewall\Logs|*

[Forte Agent *]
LangSecRef=3022
Detect=HKLM\Software\Forte
FileKey1=%AppData%\Forte\Agent|*.log;errorlog.xml|RECURSE
FileKey2=%SystemDrive%\My Data\ForteAgent|*.bak;*.log

[Fortnite *]
Section=Games
DetectFile=%LocalAppData%\FortniteGame*
FileKey1=%LocalAppData%\FortniteGame*\Saved\Crashes|*|REMOVESELF
FileKey2=%LocalAppData%\FortniteGame*\Saved\Demos|UnsavedReplay*.replay|REMOVESELF
FileKey3=%LocalAppData%\FortniteGame*\Saved\Logs|*|REMOVESELF
FileKey4=%LocalAppData%\FortniteGame*\Saved\WebCache*|*|REMOVESELF

[Forward Observer *]
LangSecRef=3021
DetectFile=%ProgramFiles%\AAForwardObserver
FileKey1=%ProgramFiles%\AAForwardObserver|FO.log

[Fotoboeken *]
LangSecRef=3023
DetectFile=%LocalAppData%\Albelli.be Fotoboeken
FileKey1=%LocalAppData%\Albelli.be Fotoboeken\Config|List.mru

[Fotoworks XL *]
LangSecRef=3023
DetectFile=%ProgramFiles%\FotoWorksXL*
FileKey1=%ProgramFiles%\FotoWorksXL*|*.log

[Found: Free to Play *]
Section=Games
DetectFile=%AppData%\Elephant Games\Found - Free to Play
FileKey1=%AppData%\Elephant Games\Found - Free to Play|logfile.txt

[Fox Digital Copy *]
LangSecRef=3023
DetectFile=%AppData%\Fox Digital Copy
FileKey1=%AppData%\Fox Digital Copy|data_*;f_*;index

[Foxit PDF Editor *]
LangSecRef=3021
DetectFile=%AppData%\Foxit Software\Foxit PDF Editor*
FileKey1=%AppData%\Foxit Software\Addon\Foxit PDF Editor\Install|*|RECURSE
FileKey2=%AppData%\Foxit Software\Foxit PDF Editor\Cache|*|RECURSE
FileKey3=%AppData%\Foxit Software\Foxit PDF Editor\cacheData|*.dat
FileKey4=%AppData%\Foxit Software\Foxit PDF Editor\FormFiller|AutoComplete.ds
FileKey5=%AppData%\Foxit Software\Foxit PDF Editor\StartPage\*\Start\en-US|index.html
FileKey6=%AppData%\Foxit Software\RMS|FXRMS_Log.txt
FileKey7=%ProgramData%\Foxit Software\Foxit PDF Editor\Foxit*\Log|*|RECURSE
FileKey8=%UserProfile%\AppData\LocalLow\Foxit\Search|*|RECURSE
RegKey1=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\CommentPanel\Filter
RegKey2=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\MRU\File MRU
RegKey3=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\MRU\Place MRU
RegKey4=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\plugins\JSPlugins
RegKey5=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\Preferences\History

[Foxit PhantomPDF *]
LangSecRef=3021
Detect1=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0
Detect2=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0
Detect3=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0
Detect4=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0
FileKey1=%AppData%\Foxit Software\Foxit PDF Creator|*_foxittemp.xml|RECURSE
FileKey2=%AppData%\Foxit Software\Foxit PDF Creator\Creator-Log|*|RECURSE
FileKey3=%AppData%\Foxit Software\Foxit PhantomPDF\FormFiller|AutoComplete.ds
FileKey4=%AppData%\Foxit Software\Foxit PhantomPDF\StartPage\*\Start\en-US|index.html
FileKey5=%AppData%\Foxit Software\RMS|FXRMS_Log.txt
FileKey6=%LocalAppData%\Foxit PhantomPDF|*.log
FileKey7=%LocalAppData%\Foxit PhantomPDF\msilog|*.log
FileKey8=%ProgramFiles%\Foxit Software\Foxit PhantomPDF\Foxit PDF IFilter\log|*
FileKey9=%ProgramFiles%\Foxit Software\Foxit PhantomPDF\plugins\OCR\FX_Abbyy_OCR\Resource\CMap|*.lst
FileKey10=%WinDir%\System32\config\systemprofile\AppData\Roaming\Foxit Software\Foxit PDF Creator|*_foxittemp.xml|RECURSE
RegKey1=HKCU\Software\Foxit Software Company\Foxit PDF Editor|Recent File List
RegKey2=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\History
RegKey3=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\Others|csFileSavePLGEXT
RegKey4=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\Others|csInitialOpenDir
RegKey5=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\RecentFiles
RegKey6=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\File MRU
RegKey7=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\Place MRU
RegKey8=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\plugins\JSPlugins
RegKey9=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Preferences\History
RegKey10=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Recent File List
RegKey11=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\CommentPanel\Filter
RegKey12=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey13=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\File MRU
RegKey14=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\Place MRU
RegKey15=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\plugins\JSPlugins
RegKey16=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Preferences\History
RegKey17=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Recent File List
RegKey18=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\CommentPanel\Filter
RegKey19=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey20=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\File MRU
RegKey21=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\Place MRU
RegKey22=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\plugins\JSPlugins
RegKey23=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Preferences\History
RegKey24=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Recent File List

[Foxit Reader *]
LangSecRef=3021
Detect1=HKCU\Software\Foxit Software\Foxit Reader 6.0
Detect2=HKCU\Software\Foxit Software\Foxit Reader 7.0
DetectFile=%AppData%\Foxit Software\Foxit Reader
FileKey1=%AppData%\Foxit Software\Foxit PDF Creator\Foxit Reader PDF Printer|*_foxittemp.xml
FileKey2=%AppData%\Foxit Software\Foxit Reader\Foxit Cloud|foxitcloud.log
FileKey3=%AppData%\Foxit Software\Foxit Reader\Foxit Cloud\DownloadCache|*.cache
FileKey4=%AppData%\Foxit Software\Foxit Reader\Foxit Cloud\FileIDCache|*.fcd
FileKey5=%AppData%\Foxit Software\Foxit Reader\StartPage*\Advertisement|*|REMOVESELF
FileKey6=%AppData%\Foxit Software\Foxit Reader\StartPage*\Start|history.txt
FileKey7=%LocalAppData%\Foxit Reader|*.reg;*.TXT;*.zip;*_old.DMP
FileKey8=%ProgramData%\Foxit Software|*.log|RECURSE
FileKey9=%ProgramData%\Foxit Software\Foxit PDF Reader\FoxitSensor\Log|*
FileKey10=%ProgramData%\Foxit Software\Foxit*Reader\Foxit Service\Log|*
FileKey11=%ProgramFiles%\Foxit Software\Foxit Reader\Release Note|*|REMOVESELF
FileKey12=%SystemDrive%\Documents and Settings\NetworkService*\Application Data\Foxit Software\Foxit Cloud|*log.txt
RegKey1=HKCU\Software\Foxit Software\Foxit Reader 6.0\Preferences\History\Options
RegKey2=HKCU\Software\Foxit Software\Foxit Reader 6.0\Preferences\Others|csFileSavePLGEXT
RegKey3=HKCU\Software\Foxit Software\Foxit Reader 7.0\MRU
RegKey4=HKCU\Software\Foxit Software\Foxit Reader 8.0\MRU\File MRU
RegKey5=HKCU\Software\Foxit Software\Foxit Reader 8.0\MRU\Place MRU
RegKey6=HKCU\Software\Foxit Software\Foxit Reader 8.0\Preferences\History\LastOpen
RegKey7=HKCU\Software\Foxit Software\Foxit Reader 8.0\Preferences\History\LastSession
RegKey8=HKCU\Software\Foxit Software\Foxit Reader 8.0\Preferences\Others|csInitialOpenDir

[Fractal: Make Blooms Not War *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\61310
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Fractal\fractal_data|output_log.txt

[Franzis CutOut *]
LangSecRef=3023
Detect=HKCU\Software\Stepok\Light Developer
RegKey1=HKCU\Software\Stepok\Light Developer\Last Path

[Fre:ac *]
LangSecRef=3024
DetectFile=%AppData%\freac
FileKey1=%AppData%\Freac\cddb|*|REMOVESELF

[Free Blu-ray Ripper *]
LangSecRef=3023
DetectFile=%LocalAppData%\Blu-ray Master\Free Blu-ray Ripper
FileKey1=%LocalAppData%\Blu-ray Master\Free Blu-ray Ripper|*.log;*log.txt

[Free Download Manager *]
LangSecRef=3022
Detect=HKCU\Software\FreeDownloadManager.ORG\Free Download Manager
FileKey1=%AppData%\Free Download Manager|downloads.del.sav

[Free Editor *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Free Editor
FileKey1=%ProgramFiles%\Free Editor|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Free Editor\NGEN\x64|ngen.log
FileKey3=%ProgramFiles%\Free Editor\NGEN\x86|ngen.log

[Free Hex Editor *]
LangSecRef=3024
Detect=HKCU\Software\Frhed
RegKey1=HKCU\Software\Frhed\Settings\0|MRU_File1
RegKey2=HKCU\Software\Frhed\Settings\0|MRU_File2
RegKey3=HKCU\Software\Frhed\Settings\0|MRU_File3
RegKey4=HKCU\Software\Frhed\Settings\0|MRU_File4
RegKey5=HKCU\Software\Frhed\Settings\0|MRU_File5
RegKey6=HKCU\Software\Frhed\Settings\0|MRU_File6
RegKey7=HKCU\Software\Frhed\Settings\0|MRU_File7
RegKey8=HKCU\Software\Frhed\Settings\0|MRU_File8
RegKey9=HKCU\Software\Frhed\Settings\0|MRU_File9

[Free Image Editor *]
LangSecRef=3023
Detect=HKCU\Software\RasterVect Software\Free Image Editor
RegKey1=HKCU\Software\RasterVect Software\Free Image Editor\Options|CurrDir
RegKey2=HKCU\Software\RasterVect Software\Free Image Editor\Recent File List

[Free Opener *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Free Opener
FileKey1=%ProgramFiles%\Free Opener|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Free Opener\NGEN\x64|ngen.log
FileKey3=%ProgramFiles%\Free Opener\NGEN\x86|ngen.log

[Free PDF XP *]
LangSecRef=3024
Detect=HKCU\Software\shbox\FreePdfXP
FileKey1=%SystemDrive%|IfpRedmon.log

[Free Snipping Tool *]
LangSecRef=3023
DetectFile=%AppData%\Free Snipping Tool
FileKey1=%AppData%\Free Snipping Tool\Free Snipping Tool\updates\updates|*.msi

[Free Viewer *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Free Viewer
FileKey1=%ProgramFiles%\Free Viewer|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Free Viewer\NGEN\x64|ngen.log
FileKey3=%ProgramFiles%\Free Viewer\NGEN\x86|ngen.log

[FreeCommander XE *]
LangSecRef=3021
DetectFile=%LocalAppData%\FreeCommanderXE
FileKey1=%LocalAppData%\FreeCommanderXE\Settings\Bkp_Settings_*|*|REMOVESELF
FileKey2=%ProgramFiles%\FreeCommander XE\backup|*|REMOVESELF

[FreeFileSync *]
LangSecRef=3024
DetectFile=%AppData%\FreeFileSync
FileKey1=%AppData%\FreeFileSync\Logs|*
FileKey2=%ProgramFiles%\FreeFileSync|*log.txt

[FreeFixer *]
LangSecRef=3024
DetectFile=%LocalAppData%\FreeFixer
FileKey1=%LocalAppData%\FreeFixer|itemtracking.txt
FileKey2=%LocalAppData%\FreeFixer\icons|*.ico|RECURSE
FileKey3=%LocalAppData%\FreeFixer\Logs|*|RECURSE

[Freemake Video Converter *]
LangSecRef=3023
DetectFile=%ProgramData%\Freemake\FreemakeVideoConverter
FileKey1=%ProgramData%\Freemake\FreemakeUtilsService\ErrorReports\Logs|*
FileKey2=%ProgramData%\Freemake\FreemakeUtilsService\Statistics\Targets|FVC_Statistics.ini
FileKey3=%ProgramFiles%\Freemake|DotNet*.exe

[Freemake Video Downloader *]
LangSecRef=3022
Detect=HKCU\Software\Freemake\FreemakeVideoDownloader
FileKey1=%ProgramFiles%\Freemake|*.txt
FileKey2=%UserProfile%\Documents\Freemake\FreemakeVideoDownloader|fvd.bin

[Freenet *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Freenet
DetectFile=%LocalAppData%\Freenet
FileKey1=%LocalAppData%\Freenet|*.bak
FileKey2=%LocalAppData%\Freenet\logs|*.gz;*.log
FileKey3=%LocalAppData%\Freenet\persistent-temp|*.tmp
FileKey4=%LocalAppData%\Freenet\temp|*
FileKey5=%LocalAppData%\Freenet\wrapper|*.log

[Freeplane *]
LangSecRef=3021
DetectFile=%AppData%\Freeplane
FileKey1=%AppData%\Freeplane\*\logs|*

[Frigate3 *]
LangSecRef=3024
DetectFile=%AppData%\Frigate3
FileKey1=%AppData%\Frigate3|History.XML

[FrostWire *]
LangSecRef=3022
Detect=HKLM\Software\FrostWire
FileKey1=%AppData%\FrostWire\.AppSpecialShare|*|RECURSE
FileKey2=%AppData%\FrostWire\azureus|*|RECURSE
FileKey3=%UserProfile%\Documents\FrostWire\Incomplete|*|RECURSE

[Frozen Synapse *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\98200
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Frozen Synapse|*.log

[FRSFileMgr *]
LangSecRef=3024
Detect=HKCU\Software\FourthRaySoftware\FRSFileMgr
FileKey1=%SystemDrive%\FRS\FRSFileMgr|FRSFileMgr.ffm

[FTL: Faster Than Light *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\212680
DetectFile=%UserProfile%\Documents\My Games\FasterThanLight
FileKey1=%ProgramFiles%\Steam\steamapps\common\FTL Faster Than Light\crashlogs|*

[Full Bore *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\264060
FileKey1=%UserProfile%\Documents\Full Bore|log.txt

[G-Data *]
LangSecRef=3023
Detect=HKCU\Software\G Data
FileKey1=%CommonProgramFiles%\G Data\AVKScanP\G Data|*.log;*old
FileKey2=%ProgramData%\G Data\AVK\Log|*|RECURSE
FileKey3=%ProgramFiles%\G Data\AntiVirus\AVK\UpdatePGM|*.log

[Gadu-Gadu *]
LangSecRef=3022
Detect=HKCU\Software\Gadu-Gadu
FileKey1=%WinDir%|TEMP*.htm*

[Gainedge Better Explorer *]
LangSecRef=3024
DetectFile1=%AppData%\BExplorer
DetectFile2=%ProgramFiles%\Better Explorer
FileKey1=%AppData%\BExplorer|log.txt
FileKey2=%ProgramFiles%\Better Explorer|log.txt

[Gainedge Better Explorer Open Tabs *]
LangSecRef=3024
DetectFile=%AppData%\BExplorer
RegKey1=HKCU\Software\BExplorer\OpenedTabs

[Gainedge Better Explorer Saved Tabs *]
LangSecRef=3024
DetectFile=%AppData%\BExplorer
FileKey1=%LocalAppData%\BExplorer_SavedTabs|*

[Gajim *]
LangSecRef=3022
DetectFile=%AppData%\Gajim
FileKey1=%AppData%\Gajim|cache.db;gajim.log;Logs.db
FileKey2=%AppData%\Gajim\Avatars|*

[Game-Cloner *]
Section=Games
DetectFile=%AppData%\Game-Cloner
FileKey1=%AppData%\Game-Cloner|*.log

[Game Maker *]
LangSecRef=3021
Detect1=HKCU\Software\Game Maker 4
Detect2=HKCU\Software\Game Maker\Version 5
Detect3=HKCU\Software\Game Maker\Version 6
Detect4=HKCU\Software\Game Maker\Version 7
Detect5=HKCU\Software\Game Maker\Version 8
RegKey1=HKCU\Software\Game Maker 4\Preferences|GameDir
RegKey2=HKCU\Software\Game Maker 4\Preferences|Recent0
RegKey3=HKCU\Software\Game Maker 4\Preferences|Recent1
RegKey4=HKCU\Software\Game Maker 4\Preferences|Recent2
RegKey5=HKCU\Software\Game Maker 4\Preferences|Recent3
RegKey6=HKCU\Software\Game Maker\Version 5\Preferences|GameDir
RegKey7=HKCU\Software\Game Maker\Version 5\Preferences|Recent0
RegKey8=HKCU\Software\Game Maker\Version 5\Preferences|Recent1
RegKey9=HKCU\Software\Game Maker\Version 5\Preferences|Recent2
RegKey10=HKCU\Software\Game Maker\Version 5\Preferences|Recent3
RegKey11=HKCU\Software\Game Maker\Version 5\Preferences|Recent4
RegKey12=HKCU\Software\Game Maker\Version 5\Preferences|Recent5
RegKey13=HKCU\Software\Game Maker\Version 5\Preferences|Recent6
RegKey14=HKCU\Software\Game Maker\Version 5\Preferences|Recent7
RegKey15=HKCU\Software\Game Maker\Version 6\Preferences|GameDir
RegKey16=HKCU\Software\Game Maker\Version 6\Preferences|Recent0
RegKey17=HKCU\Software\Game Maker\Version 6\Preferences|Recent1
RegKey18=HKCU\Software\Game Maker\Version 6\Preferences|Recent2
RegKey19=HKCU\Software\Game Maker\Version 6\Preferences|Recent3
RegKey20=HKCU\Software\Game Maker\Version 6\Preferences|Recent4
RegKey21=HKCU\Software\Game Maker\Version 6\Preferences|Recent5
RegKey22=HKCU\Software\Game Maker\Version 6\Preferences|Recent6
RegKey23=HKCU\Software\Game Maker\Version 6\Preferences|Recent7
RegKey24=HKCU\Software\Game Maker\Version 7\Preferences|GameDir
RegKey25=HKCU\Software\Game Maker\Version 7\Preferences|Recent0
RegKey26=HKCU\Software\Game Maker\Version 7\Preferences|Recent1
RegKey27=HKCU\Software\Game Maker\Version 7\Preferences|Recent2
RegKey28=HKCU\Software\Game Maker\Version 7\Preferences|Recent3
RegKey29=HKCU\Software\Game Maker\Version 7\Preferences|Recent4
RegKey30=HKCU\Software\Game Maker\Version 7\Preferences|Recent5
RegKey31=HKCU\Software\Game Maker\Version 7\Preferences|Recent6
RegKey32=HKCU\Software\Game Maker\Version 7\Preferences|Recent7
RegKey33=HKCU\Software\Game Maker\Version 8\Preferences|GameDir
RegKey34=HKCU\Software\Game Maker\Version 8\Preferences|Recent0
RegKey35=HKCU\Software\Game Maker\Version 8\Preferences|Recent1
RegKey36=HKCU\Software\Game Maker\Version 8\Preferences|Recent2
RegKey37=HKCU\Software\Game Maker\Version 8\Preferences|Recent3
RegKey38=HKCU\Software\Game Maker\Version 8\Preferences|Recent4
RegKey39=HKCU\Software\Game Maker\Version 8\Preferences|Recent5
RegKey40=HKCU\Software\Game Maker\Version 8\Preferences|Recent6
RegKey41=HKCU\Software\Game Maker\Version 8\Preferences|Recent7

[GameAnalyics *]
Section=Games
DetectFile=%LocalAppData%\GameAnalyics
FileKey1=%LocalAppData%\GameAnalyics|ga_log.txt

[GameRanger *]
Section=Games
DetectFile=%AppData%\GameRanger\GameRanger
FileKey1=%AppData%\GameRanger\GameRanger Prefs|Icon Cache;Image Cache
FileKey2=%AppData%\GameRanger\GameRanger Prefs\WCache|*-journal;*.old;ChromeDWriteFontCache;data_*;f_*;index;LOG;Visited Links|RECURSE
FileKey3=%AppData%\GameRanger\GameRanger Prefs\WCache\*Cache|*
FileKey4=%AppData%\GameRanger\GameRanger Prefs\WCache\blob_storage|*|RECURSE

[GameSave Manager *]
LangSecRef=3021
Detect1=HKCR\GSM_gsba
Detect2=HKCR\GSM_gsdu
Detect3=HKCR\GSM_gsms
FileKey1=%AppData%\GameSave Manager*\*Cache*|*
FileKey2=%AppData%\GameSave Manager*\TaskLogs|*
FileKey3=%ProgramFiles%\GameSave Manager*\settings|*.log;ScanResults.txt|RECURSE

[Gardens Inc. 2: The Road to Fame *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBB8E5A9-EE43-491D-9A2D-84172C3C9384}_is1
FileKey1=%ProgramFiles%\*\Gardens Inc. 2*|*.html;*.ico;*.nfo;*.txt;*.url;*msi|RECURSE

[Gardenscapes *]
Section=Games
DetectFile=%AppData%\Playrix Entertainment\Gardenscapes
FileKey1=%AppData%\Playrix Entertainment\Gardenscapes|log.html

[Garena *]
Section=Games
DetectFile=%ProgramData%\Garena
FileKey1=%ProgramData%\Garena\gxx\cache|*|RECURSE
FileKey2=%ProgramData%\Garena\gxx\dmp|*
FileKey3=%ProgramData%\Garena\gxx\log|*

[Garmin Express *]
LangSecRef=3024
Detect=HKCU\Software\Garmin\Express
FileKey1=%ProgramData%\Garmin\Logs|*.log;*.txt|RECURSE
FileKey2=%UserProfile%\Documents\Garmin\Backups\*|*|RECURSE

[Garmin MapSource *]
LangSecRef=3024
Detect=HKCU\Software\Garmin\MapSource
FileKey1=%AppData%\GARMIN\MapSource\TileCache|*|REMOVESELF

[GarrysMod *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\GarrysMod
FileKey1=%ProgramFiles%\Steam\steamapps\common\GarrysMod|*.cache|RECURSE

[Gatewatch *]
Section=Games
DetectFile=%UserProfile%\Documents\Gatewatch_Logs
FileKey1=%UserProfile%\Documents\Gatewatch_Logs\DownloadLog|*.log

[gBurner *]
LangSecRef=3021
Detect=HKCU\Software\gBurner
RegKey1=HKCU\Software\gBurner|Reopen0
RegKey2=HKCU\Software\gBurner|Reopen1
RegKey3=HKCU\Software\gBurner|Reopen2
RegKey4=HKCU\Software\gBurner|Reopen3

[GEAR DIFx *]
LangSecRef=3024
Detect1=HKCR\Installer\Products\CACFC38969C58104B8CE6D8561446C45
Detect2=HKLM\Software\GEAR Software\DIFx
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EC13FCAF38E85F44B0F1137C7FB5037
FileKey1=%AppData%\34BE82C4-E596-4e99-A191-52C6199EBF69|*|REMOVESELF
FileKey2=%AppData%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*|REMOVESELF
FileKey3=%AppData%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*|REMOVESELF
FileKey4=%AppData%\Downloaded Installations|*|REMOVESELF
FileKey5=%LocalAppData%\Downloaded Installations|*|REMOVESELF
FileKey6=%ProgramData%\{755AC846-7372-4AC8-8550-C52491DAA8BD}|*|REMOVESELF
FileKey7=%ProgramData%\34BE82C4-E596-4e99-A191-52C6199EBF69|*|REMOVESELF
FileKey8=%ProgramData%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*|REMOVESELF
FileKey9=%ProgramData%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*|REMOVESELF
FileKey10=%ProgramData%\9727E41D-AD6A-47cd-B9BC-CF630B6013FD|*|REMOVESELF
FileKey11=%ProgramData%\A73B37F8-7A4D-41f4-98A8-7F608CE8B98F|*|REMOVESELF
FileKey12=%ProgramData%\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB|*.log|RECURSE
FileKey13=%ProgramData%\E1864A66-75E3-486a-BD95-D1B7D99A84A7|*|REMOVESELF
FileKey14=%ProgramFiles%\34BE82C4-E596-4e99-A191-52C6199EBF69|*|REMOVESELF
FileKey15=%ProgramFiles%\38FDB89C-1EBD-4366-84B2-336D12CC3209|*|REMOVESELF
FileKey16=%ProgramFiles%\93E26451-CD9A-43A5-A2FA-C42392EA4001|*|REMOVESELF
FileKey17=%ProgramFiles%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*|REMOVESELF
FileKey18=%ProgramFiles%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*|REMOVESELF
FileKey19=%ProgramFiles%\9727E41D-AD6A-47cd-B9BC-CF630B6013FD|*|REMOVESELF

[Geek Uninstaller *]
LangSecRef=3024
Detect=HKCU\Software\Geek Uninstaller
FileKey1=%AppData%\Geek Uninstaller|*.log;*cache.dat

[GeekSquad *]
LangSecRef=3024
DetectFile=%ProgramData%\Geek Squad
FileKey1=%ProgramData%\Geek Squad\MRI|EventLog.gsl|RECURSE
FileKey2=%ProgramData%\Geek Squad\MRI\Automation Reports|*|REMOVESELF
FileKey3=%ProgramData%\Geek Squad\MRI\Downloads|*|REMOVESELF

[Genie-Soft *]
LangSecRef=3024
Detect=HKCU\Software\Genie-Soft
FileKey1=%AppData%\Genie-soft\*\logs|*

[Genspark Browser Autofill Data & Search Engine Preferences *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\AutoFill*|*|REMOVESELF

[Genspark Browser Autoplay Preferences *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\MEIPreload|*|REMOVESELF

[Genspark Browser Bookmark Backups *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|Bookmarks.bak

[Genspark Browser Bookmark Favicons *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|favicons*

[Genspark Browser Caches *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Optimization*|*|REMOVESELF

[Genspark Browser Default App Handlers *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|PreferredApps

[Genspark Browser Download History *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\shared_proto_db|*|REMOVESELF

[Genspark Browser DRM Data *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\WidevineCdm|*|REMOVESELF

[Genspark Browser Extension Cookies *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|Extension Cookies

[Genspark Browser Pinned Tabs *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
RegKey1=HKCU\Software\GensparkSoftware\Genspark-Browser\PreferenceMACs\Default|pinned_tabs

[Genspark Browser Privacy Sandbox *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Genspark Browser Progressive Web Apps *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Web Applications|*|REMOVESELF

[Genspark Browser Saved Usernames & Passwords *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|Login Data*

[Genspark Browser Security & Threat Detection *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\ZxcvbnData|*|REMOVESELF

[Genspark Browser Shopping Insights *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Genspark Browser Storage Quota Manager *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|QuotaManager

[Genspark Browser Sync Data *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Sync Data|*|REMOVESELF

[Genspark Browser Telemetry *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\Application|debug.log
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|*.log
FileKey6=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\GensparkSoftware\Genspark-Browser\Application|debug.log
FileKey21=%ProgramFiles%\GensparkSoftware\Genspark-Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\GensparkSoftware\Genspark-Browser\BlBeacon|failed_count
RegKey2=HKCU\Software\GensparkSoftware\Genspark-Browser\BlBeacon|state
RegKey3=HKCU\Software\GensparkSoftware\Genspark-Browser\Installer|LastChecked
RegKey4=HKCU\Software\GensparkSoftware\Genspark-Browser\StabilityMetrics

[Genspark Browser Web Browsing Cookies *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Genspark Browser Web Browsing History *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Genspark Browser Web Browsing Session *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Sessions|*|REMOVESELF

[Genspark Browser Web Storage *]
Section=Genspark Web browser
DetectFile=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data
FileKey1=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\GensparkSoftware\Genspark-Browser\User Data\*\WebStorage|*|REMOVESELF

[Genymobile *]
LangSecRef=3024
Detect=HKCU\Software\Genymobile
FileKey1=%LocalAppData%\Genymobile|*.log
FileKey2=%UserProfile%\VirtualBox VMs\*|genymotion-player*.log;logcat*.txt

[GeoVid Video Avatar *]
LangSecRef=3023
DetectFile1=%AppData%\GeoVid\Video To Avatar
DetectFile2=%ProgramFiles%\GeoVid\Video Avatar
FileKey1=%AppData%\GeoVid\Video To Avatar|log.txt
FileKey2=%ProgramFiles%\GeoVid\Video Avatar|vcredist_*.exe

[GetDiz *]
LangSecRef=3021
Detect=HKCU\Software\Outertech\GetDiz
RegKey1=HKCU\Software\Outertech\GetDiz|Recent Files_1
RegKey2=HKCU\Software\Outertech\GetDiz|Recent Files_2
RegKey3=HKCU\Software\Outertech\GetDiz|Recent Files_3
RegKey4=HKCU\Software\Outertech\GetDiz|Recent Files_4
RegKey5=HKCU\Software\Outertech\GetDiz|Recent Files_5
RegKey6=HKCU\Software\Outertech\GetDiz|Recent Files_6
RegKey7=HKCU\Software\Outertech\GetDiz|Recent Files_7
RegKey8=HKCU\Software\Outertech\GetDiz|Recent Files_8
RegKey9=HKCU\Software\Outertech\GetDiz|Recent Files_9
RegKey10=HKCU\Software\Outertech\GetDiz|Recent Files_10

[GetFLV *]
LangSecRef=3023
Detect=HKCU\Software\GetFLV
DetectFile=%ProgramFiles%\GetFLV
FileKey1=%ProgramFiles%\GetFLV|history.xml;setting.ini;URLHistory.dat
FileKey2=%ProgramFiles%\GetFLV\cache|Visited Links
FileKey3=%ProgramFiles%\GetFLV\cache\*Cache|*
FileKey4=%ProgramFiles%\GetFLV\libav\cache\*Cache|*
FileKey5=%ProgramFiles%\GetFLV\site_files|*.tmp
FileKey6=%ProgramFiles%\GetFLV\temp|*
FileKey7=%ProgramFiles%\GetFLV\thumb|*
FileKey8=%ProgramFiles%\GetFLV\tmp|*
FileKey9=%ProgramFiles%\GetFLV\Youtube Zilla\libav\cache\*Cache|*
RegKey1=HKCU\Software\GetFLV|AutoCaptureURL
RegKey2=HKCU\Software\GetFLV|DownloadDir
RegKey3=HKCU\Software\GetFLV|FLVTitle
RegKey4=HKCU\Software\GetFLV|FLVURL

[GetMyIP *]
LangSecRef=3024
Detect=HKCU\Software\CubicDesign\GetMyIP
RegKey1=HKCU\Software\CubicDesign\GetMyIP

[GetRight *]
LangSecRef=3022
Detect=HKCU\Software\Headlight\GetRight
FileKey1=%AppData%\GetRight*|*.data;GetRight.lst|RECURSE
RegKey1=HKCU\Software\Headlight\GetRight\FileQueue
RegKey2=HKCU\Software\Headlight\GetRight\ResumeServers
RegKey3=HKCU\Software\Headlight\GetRight\Stats
RegKey4=HKCU\Software\Headlight\GetRight\UserAgent

[Getting Over It with Bennett Foddy *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Bennett Foddy\Getting Over It
FileKey1=%UserProfile%\AppData\LocalLow\Bennett Foddy\Getting Over It|output_log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Bennett Foddy\Getting Over It\Crashes|*

[GFI LanGuard *]
LangSecRef=3022
DetectFile1=%ProgramData%\GFI Software\LanGuard*
DetectFile2=%ProgramFiles%\GFI\LANguard*
FileKey1=%ProgramData%\GFI Software\LanGuard*|newfileslog.*
FileKey2=%ProgramData%\GFI Software\LanGuard*\*Logs|*|RECURSE
FileKey3=%ProgramData%\GFI Software\LanGuard*\Cache|*|REMOVESELF
FileKey4=%ProgramFiles%\GFI\LANguard*\DebugLogs|*
FileKey5=%WinDir%\Patches|*.log;*.log.txt

[GG *]
LangSecRef=3022
DetectFile=%AppData%\GG
FileKey1=%AppData%\GG\*\*cache*|*|RECURSE
FileKey2=%AppData%\GG\*\crashes|*|RECURSE
FileKey3=%AppData%\GG\*\minidumps|*|RECURSE
FileKey4=%AppData%\GG\Crash Reports|*|RECURSE
FileKey5=%AppData%\GG\logs|*

[Ghost Browser Autofill Data & Search Engine Preferences *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|*Web Data
FileKey2=%LocalAppData%\GhostBrowser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\GhostBrowser\User Data\AutoFill*|*|REMOVESELF

[Ghost Browser Autoplay Preferences *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\MEIPreload|*|REMOVESELF

[Ghost Browser Bookmark Backups *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|Bookmarks.bak

[Ghost Browser Bookmark Favicons *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|favicons*

[Ghost Browser Caches *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\GhostBrowser\User Data|Module Info Cache
FileKey3=%LocalAppData%\GhostBrowser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\GhostBrowser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\GhostBrowser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\GhostBrowser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\GhostBrowser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\GhostBrowser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\GhostBrowser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\GhostBrowser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\GhostBrowser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\GhostBrowser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\GhostBrowser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\GhostBrowser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\GhostBrowser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\GhostBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\GhostBrowser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\GhostBrowser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\GhostBrowser\User Data\Optimization*|*|REMOVESELF

[Ghost Browser Default App Handlers *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|PreferredApps

[Ghost Browser Download History *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\GhostBrowser\User Data\*\shared_proto_db|*|REMOVESELF

[Ghost Browser DRM Data *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\GhostBrowser\User Data\WidevineCdm|*|REMOVESELF

[Ghost Browser Extension Cookies *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|Extension Cookies

[Ghost Browser Pinned Tabs *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
RegKey1=HKCU\Software\GhostBrowser\PreferenceMACs\Default|pinned_tabs

[Ghost Browser Privacy Sandbox *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\GhostBrowser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\GhostBrowser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\GhostBrowser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\GhostBrowser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\GhostBrowser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\GhostBrowser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\GhostBrowser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Ghost Browser Progressive Web Apps *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\Web Applications|*|REMOVESELF

[Ghost Browser Saved Usernames & Passwords *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|Login Data*

[Ghost Browser Security & Threat Detection *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|DIPS*
FileKey2=%LocalAppData%\GhostBrowser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\GhostBrowser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\GhostBrowser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\GhostBrowser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\GhostBrowser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\GhostBrowser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\GhostBrowser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\GhostBrowser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\GhostBrowser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\GhostBrowser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\GhostBrowser\User Data\ZxcvbnData|*|REMOVESELF

[Ghost Browser Shopping Insights *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\GhostBrowser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\GhostBrowser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\GhostBrowser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\GhostBrowser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Ghost Browser Storage Quota Manager *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|QuotaManager

[Ghost Browser Sync Data *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\Sync Data|*|REMOVESELF

[Ghost Browser Telemetry *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\Application|debug.log
FileKey2=%LocalAppData%\GhostBrowser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\GhostBrowser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\GhostBrowser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\GhostBrowser\User Data\*|*.log
FileKey6=%LocalAppData%\GhostBrowser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\GhostBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\GhostBrowser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\GhostBrowser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\GhostBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\GhostBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\GhostBrowser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\GhostBrowser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\GhostBrowser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\GhostBrowser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\GhostBrowser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\GhostBrowser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\GhostBrowser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\GhostBrowser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\GhostBrowser\Application|debug.log
FileKey21=%ProgramFiles%\GhostBrowser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\GhostBrowser\BlBeacon|failed_count
RegKey2=HKCU\Software\GhostBrowser\BlBeacon|state
RegKey3=HKCU\Software\GhostBrowser\Installer|LastChecked
RegKey4=HKCU\Software\GhostBrowser\StabilityMetrics

[Ghost Browser Web Browsing Cookies *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Ghost Browser Web Browsing History *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Ghost Browser Web Browsing Session *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\GhostBrowser\User Data\*\Sessions|*|REMOVESELF

[Ghost Browser Web Storage *]
Section=Ghost Web Browser
DetectFile=%LocalAppData%\GhostBrowser\User Data
FileKey1=%LocalAppData%\GhostBrowser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\GhostBrowser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\GhostBrowser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\GhostBrowser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\GhostBrowser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\GhostBrowser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\GhostBrowser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\GhostBrowser\User Data\*\WebStorage|*|REMOVESELF

[Ghostbuster *]
LangSecRef=3021
DetectFile=%AppData%\Ghostbuster
FileKey1=%AppData%\Ghostbuster|*|REMOVESELF

[GhostMouse *]
LangSecRef=3024
DetectFile=%ProgramFiles%\GhostMouse
FileKey1=%UserProfile%\Documents\AutomaticSolution Software\GhostMouse\conf\temp|*.tmp

[GIGABYTE *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\GIGABYTE\EasyTuneEngineService
DetectFile2=%ProgramFiles%\GIGABYTE\RGBFusion
FileKey1=%ProgramFiles%\GIGABYTE\EasyTuneEngineService|logFile.txt
FileKey2=%ProgramFiles%\GIGABYTE\RGBFusion\AtiTool|*.log

[GIGABYTE ControlCenter *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\ControlCenter
DetectFile2=%ProgramFiles%\GIGABYTE\Control Center
FileKey1=%AppData%\GCC\EBWebView|*.pma
FileKey2=%AppData%\GCC\EBWebView\*Cache*|*|REMOVESELF
FileKey3=%AppData%\GCC\EBWebView\BrowserMetrics|*|REMOVESELF
FileKey4=%AppData%\GCC\EBWebView\Crashpad\reports|*
FileKey5=%AppData%\GCC\EBWebView\Default*|*|REMOVESELF
FileKey6=%AppData%\GCC\EBWebView\SmartScreen|*|RECURSE
FileKey7=%ProgramFiles%\ControlCenter|erLog.txt
FileKey8=%ProgramFiles%\GIGABYTE\Control Center|*Eventlog*.txt
FileKey9=%ProgramFiles%\GIGABYTE\Control Center\logs|*

[GIGABYTE EasyTune6 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\A58-Easytune6
FileKey1=%ProgramFiles%\A58-Easytune6|*.log

[Gigantic *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Gigantic
FileKey1=%UserProfile%\Documents\My Games\Gigantic\RxGame\Logs|*.dmg;*.log|RECURSE

[GigaTribe *]
LangSecRef=3022
Detect=HKCU\Software\ShalSoft\GigaTribe
FileKey1=%LocalAppData%\Shalsoft\Gigatribe\*\re*sources|*|RECURSE

[GIMP *]
LangSecRef=3021
DetectFile1=%LocalAppData%\GIMP
DetectFile2=%UserProfile%\.gimp-*
FileKey1=%LocalAppData%|recently-used.xbel
FileKey2=%LocalAppData%\GIMP\*\CrashLog|*|RECURSE
FileKey3=%LocalAppData%\GIMP\*\tmp|*|RECURSE
FileKey4=%LocalAppData%\webkit|*|REMOVESELF
FileKey5=%UserProfile%\.gegl-*|documents
FileKey6=%UserProfile%\.gimp-*|documents
FileKey7=%UserProfile%\.gimp-*\tmp|*|RECURSE
FileKey8=%UserProfile%\.thumbnails\normal|*|RECURSE

[Ginger *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Ginger
FileKey1=%ProgramFiles%\Ginger|*.log;*.tmp|RECURSE
FileKey2=%SystemDrive%|GingerSetup.log

[GitHub Desktop *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\GitHubDesktop
DetectFile=%LocalAppData%\GitHub
FileKey1=%AppData%\GitHub*Desktop\*Cache|*|REMOVESELF
FileKey2=%AppData%\GitHub*Desktop\logs|*|REMOVESELF
FileKey3=%LocalAppData%\GitHub|*.log;*log.txt|RECURSE
FileKey4=%LocalAppData%\GitHubDesktop|*.log
FileKey5=%LocalAppData%\GitHubDesktop\packages\SquirrelTemp|*|REMOVESELF

[Gizmo *]
LangSecRef=3021
DetectFile=%AppData%\Gizmo
FileKey1=%AppData%\Gizmo|mru.xml

[Glary Utilities *]
LangSecRef=3024
Detect=HKCU\Software\GlarySoft\Glary Utilities 5
FileKey1=%AppData%\GlarySoft\Glary Utilities\Backups|*
FileKey2=%CommonProgramFiles%\Glarysoft\StartupManager\1.0\Log|*
RegKey1=HKCU\Software\GlarySoft\Glary Utilities 5\RegistryRepair|History

[Global Delight Technologies Boom 3D *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\GlobalDelightTechnologies.Boom3D_b7pwcagxvespy
FileKey1=%LocalAppData%\Packages\GlobalDelightTechnologies.Boom3D_b7pwcagxvespy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\GlobalDelightTechnologies.Boom3D_b7pwcagxvespy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\GlobalDelightTechnologies.Boom3D_b7pwcagxvespy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\GlobalDelightTechnologies.Boom3D_b7pwcagxvespy\TempState|*|REMOVESELF
FileKey5=%ProgramData%\BoomLogs|*

[Globus Privacy *]
LangSecRef=3022
DetectFile=%ProgramData%\Globus Privacy
FileKey1=%ProgramData%\Globus Privacy\install_log|*.log

[GMote *]
LangSecRef=3024
DetectFile=%AppData%\Gmote
FileKey1=%AppData%\Gmote|*.log

[GNU *]
LangSecRef=3021
Detect=HKCU\Software\GNU
FileKey1=%LocalAppData%\GNU\Cache\*|*|RECURSE
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Gnu\Cache|*|RECURSE
FileKey3=%WinDir%\System32\config\systemprofile\local settings\application data\gnu\cache|*|RECURSE
FileKey4=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\GNU\Cache|*|RECURSE

[GnuCash *]
LangSecRef=3021
Detect=HKCU\Software\GSettings\org\gnucash
FileKey1=%UserProfile%\*|*.gnucash.*.gnucash;*.gnucash.*.log;translog.*.log|RECURSE
RegKey1=HKCU\Software\GSettings\org\gnucash\history

[Goalscape *]
LangSecRef=3021
DetectFile=%ProgramFiles%\GoalScape
FileKey1=%AppData%\com.goalscape.app.*\Logging|*|RECURSE

[Goat Simulator *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\265930
FileKey1=%UserProfile%\Documents\my games\GoatSim\GoatGame\Logs|*

[GOG Galaxy *]
Section=Games
Detect=HKCU\Software\GOG.com\Galaxy
FileKey1=%ProgramData%\GOG.com\Galaxy\crashdumps|*|REMOVESELF
FileKey2=%ProgramData%\GOG.com\Galaxy\jump-list-cache|*|REMOVESELF
FileKey3=%ProgramData%\GOG.com\Galaxy\logs|*
FileKey4=%ProgramData%\GOG.com\Galaxy\temp\desktop-galaxy-updater|*|REMOVESELF
FileKey5=%ProgramData%\GOG.com\Galaxy\webcache\*\epic|*|RECURSE
FileKey6=%ProgramData%\GOG.com\Galaxy\webcache\*\gog|*|RECURSE
FileKey7=%ProgramData%\GOG.com\Galaxy\webcache\*\steam|*|RECURSE
FileKey8=%ProgramData%\GOG.com\Galaxy\webcache\*\user|*|REMOVESELF
FileKey9=%ProgramData%\GOG.com\Galaxy\webcache\*\xboxone|*|RECURSE
FileKey10=%ProgramData%\GOG.com\Galaxy\webcache\common|Cookies*QuotaManager;Visited Links
FileKey11=%ProgramData%\GOG.com\Galaxy\webcache\common\*cache*|REMOVESELF
FileKey12=%ProgramData%\GOG.com\Galaxy\webcache\common\Service Worker|REMOVESELF

[Going Under *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1154810
FileKey1=%UserProfile%\AppData\LocalLow\Aggro Crab\Going Under|output_log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Aggro Crab\Going Under\Unity|*|REMOVESELF

[GoldenCheetah *]
LangSecRef=3021
DetectFile=%LocalAppData%\GoldenCheetah
FileKey1=%LocalAppData%\GoldenCheetah\*\Logs|*

[GoldKey Acellus *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry
FileKey1=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey3=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey32=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\Settings|*.log*
FileKey67=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\SystemAppData\Helium|*.log*
FileKey68=%LocalAppData%\Packages\GoldKeyCorporation.Acellus_v2rn50m687qry\TempState|*|REMOVESELF

[Gom Player *]
LangSecRef=3023
Detect=HKCU\Software\GRETECH\GomPlayer
FileKey1=%AppData%\GRETECH\GomPlayer|*.bmk
FileKey2=%SystemDrive%|nsispromotion_log.txt
RegKey1=HKCU\Software\GRETECH\GomPlayer\OPTION|sRecentPLFolder

[Goodix Fingerprint Driver *]
LangSecRef=3024
DetectFile=%ProgramData%\Goodix
FileKey1=%ProgramData%\Goodix|*.bak;*.log

[GoodSync *]
LangSecRef=3024
Detect=HKCU\Software\Siber Systems\GoodSync
FileKey1=%AppData%\GoodSync|*.log|RECURSE
FileKey2=%UserProfile%\Documents\_gsdata_|*.log|RECURSE

[Google App *]
LangSecRef=3022
DetectFile=%LocalAppData%\Google\Google
FileKey1=%LocalAppData%\Google\Google|*.log
FileKey2=%LocalAppData%\Google\Google\Crashpad|*|RECURSE
FileKey3=%LocalAppData%\Google\Google\previous_for_*|*|REMOVESELF
FileKey4=%LocalAppData%\Google\Google\WebView2|*|REMOVESELF

[Google Apps Sync *]
LangSecRef=3022
DetectFile=%LocalAppData%\Google\Google Apps*
FileKey1=%AppData%\Google\Google Apps*|*.log|RECURSE
FileKey2=%AppData%\Google\Identity|*.txt
FileKey3=%LocalAppData%\Google\Google Apps*|*.log|RECURSE

[Google Drive *]
LangSecRef=3024
Detect=HKCU\Software\Google\Drive
DetectFile=%ProgramFiles%\Google\Drive
FileKey1=%LocalAppData%\Google\Drive|*.log
FileKey2=%LocalAppData%\Google\Drive Plugin for Office|*.log
FileKey3=%LocalAppData%\Google\Drive Plugin for Office\Logs|*.log*
FileKey4=%LocalAppData%\Google\Drive\CrashReports|*|RECURSE
FileKey5=%LocalAppData%\Google\Drive\User_Default|*.log
FileKey6=%LocalAppData%\Google\Drive\User_Default\TempData|*|RECURSE
FileKey7=%LocalAppData%\Google\Drive\User_Default\UsageStatistics|*
FileKey8=%LocalAppData%\Google\drivefs\*\Content_Cache|*|RECURSE
FileKey9=%LocalAppData%\Google\drivefs\*\Thumbnails_Cache|*|RECURSE
FileKey10=%LocalAppData%\Google\drivefs\Cef_Cache|*.old;LOG|RECURSE
FileKey11=%LocalAppData%\Google\drivefs\Cef_Cache\*cache|*|RECURSE
FileKey12=%LocalAppData%\Google\drivefs\Crashpad\Reports|*.dmp
FileKey13=%LocalAppData%\Google\drivefs\Logs|*
FileKey14=%LocalAppData%\Google\Identity|ClientMigration*.txt
FileKey15=%ProgramFiles%\Google\Drive|*.log

[Google Earth *]
LangSecRef=3021
DetectFile=%UserProfile%\AppData\LocalLow\Google\GoogleEarth
FileKey1=%LocalLowAppData%\Google\GoogleEarth\unified_cache_leveldb_*|*|REMOVESELF
FileKey2=%ProgramFiles%\Google\GoogleEarth\client|*.log
FileKey3=%UserProfile%\AppData\LocalLow\Google\GoogleEarth|*.log;*.tmp|RECURSE
FileKey4=%UserProfile%\AppData\LocalLow\Google\GoogleEarth\Cache|*|RECURSE

[Google Quick Share *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\NearbyShare_21hpf16v5xp10
FileKey1=%LocalAppData%\Google\Nearby\Sharing\*log*|*|REMOVESELF
FileKey2=%LocalAppData%\Google\Nearby\Sharing\CrashDumps|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\NearbyShare_21hpf16v5xp10\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\NearbyShare_21hpf16v5xp10\Settings|*.log*
FileKey5=%LocalAppData%\Packages\NearbyShare_21hpf16v5xp10\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\NearbyShare_21hpf16v5xp10\TempState|*|REMOVESELF
FileKey7=%ProgramData%\Google\Nearby\Sharing\CrashDumps|*
FileKey8=%SystemDrive%\Users\Default\AppData\Local\Google\Nearby\Sharing\Logs|*.log
FileKey9=%WinDir%\System32\config\systemprofile\AppData\Local\Google\Nearby\Sharing\Logs|*

[Google Updater *]
LangSecRef=3022
DetectFile1=%LocalAppData%\Google\GoogleUpdater
DetectFile2=%ProgramFiles%\Google\GoogleUpdater
FileKey1=%LocalAppData%\Google\GoogleUpdater|*.log*
FileKey2=%ProgramFiles%\Google\GoogleUpdater|updater.log*
FileKey3=%ProgramFiles%\Google\GoogleUpdater\*\Crashpad|*|RECURSE
FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Google\GoogleUpdater|*.log
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Google\GoogleUpdater\*\Crashpad|*|RECURSE
FileKey6=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Google\GoogleUpdater|updater.log
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Google\GoogleUpdater\*\Crashpad|*|RECURSE

[GoPlayer *]
LangSecRef=3023
DetectFile=%ProgramFiles%\GoPlayer
FileKey1=%ProgramFiles%\GoPlayer|*.log

[Gothic 3 *]
Section=Games
Detect=HKCU\Software\JoWooD Productions Software AG\Gothic III
FileKey1=%ProgramFiles%\Gothic III|setup*.txt

[GradeKeeper *]
LangSecRef=3021
Detect=HKCU\Software\Gradekeeper
FileKey1=%AppData%\Gradekeeper|*

[Grammarly *]
LangSecRef=3024
DetectFile=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView
FileKey1=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey2=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey3=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey4=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\*Cache*|*|REMOVESELF
FileKey5=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\AutoFill*|*|REMOVESELF
FileKey6=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Avatars|*|REMOVESELF
FileKey7=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey8=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey9=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Crash Reports|*|REMOVESELF
FileKey10=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Crashpad|*|REMOVESELF
FileKey11=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Crowd Deny|*|REMOVESELF
FileKey12=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey13=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey14=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey15=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey16=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey17=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey18=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey19=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey20=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey21=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey22=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey23=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Download Service|*|REMOVESELF
FileKey24=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Extension State|*|REMOVESELF
FileKey25=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey26=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\File System|*|REMOVESELF
FileKey27=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey28=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey29=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey30=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey31=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\optimization*|*|REMOVESELF
FileKey32=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey33=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey34=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey35=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey36=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey37=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Sessions|*|REMOVESELF
FileKey38=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey39=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey40=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey41=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey42=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey43=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey44=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey45=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey46=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey47=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey48=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey49=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Local Traces|*|REMOVESELF
FileKey50=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\MEIPreload|*|REMOVESELF
FileKey51=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Optimization*|*|REMOVESELF
FileKey52=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\OriginTrials|*|REMOVESELF
FileKey53=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\PKIMetadata|*|REMOVESELF
FileKey54=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey55=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey56=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Safe Browsing|*|REMOVESELF
FileKey57=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\SafetyTips|*|REMOVESELF
FileKey58=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\SmartScreen|*|REMOVESELF
FileKey59=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey60=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Stability|*|REMOVESELF
FileKey61=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Subresource Filter|*|REMOVESELF
FileKey62=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey63=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\WidevineCdm|*|REMOVESELF
FileKey64=%AppData%\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\ZxcvbnData|*|REMOVESELF

[Grand Theft Auto *]
Section=Games
DetectFile=%ProgramFiles%\GTA*
FileKey1=%ProgramFiles%\GTA*\Test|*.log

[Graphisoft BIMx *]
LangSecRef=3021
DetectFile1=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt
DetectFile2=%UserProfile%\Documents\BIMx
FileKey1=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt\LocalCache\Local\GRAPHISOFT\BIMx Desktop Viewer|open_recent.list
FileKey3=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt\LocalCache\Roaming\BIMx\*Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt\Settings|*.log*
FileKey5=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\GraphisoftSE.21795B871412D_ry7td4y6vfzjt\TempState|*|REMOVESELF
FileKey7=%UserProfile%\Documents\BIMx|*_Log.txt

[Gratuitous Space Battles *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\41800
FileKey1=%ProgramFiles%\Steam\Steamapps\common\gratuitous space battles\data\temp|*|RECURSE
FileKey2=%UserProfile%\Documents\My Games\GratuitousSpaceBattles\debug|*

[Green Ranch *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Green RanchFINAL
FileKey1=%AppData%\Palaplay\GreenRanch_Survey|*.txt

[Greenfish Icon Editor Pro *]
LangSecRef=3021
DetectFile=%LocalAppData%\gfie
FileKey1=%LocalAppData%\gfie|recent.txt

[Greenshot *]
LangSecRef=3024
DetectFile=%LocalAppData%\Greenshot
FileKey1=%LocalAppData%\Greenshot|*.log*

[grepWin *]
LangSecRef=3024
Detect=HKCU\Software\grepWin
RegKey1=HKCU\Software\grepWin|searchpath
RegKey2=HKCU\Software\grepWin\History

[GridinSoft Notepad *]
LangSecRef=3021
Detect=HKCU\Software\GridinSoft\Notepad3
RegKey1=HKCU\Software\GridinSoft\Notepad3\Files
RegKey2=HKCU\Software\GridinSoft\Notepad3\Search|ReplaceTextHistory
RegKey3=HKCU\Software\GridinSoft\Notepad3\Search|TextHistory

[Grim Tales: The Wishes CE *]
Section=Games
DetectFile=%AppData%\Elephant Games\Grim Tales The Wishes CE
FileKey1=%AppData%\Elephant Games\Grim Tales The Wishes CE|logfile.txt

[GRIME *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Clover Bite\GRIME
FileKey1=%UserProfile%\AppData\LocalLow\Clover Bite\GRIME|*.log

[GroupWise Messenger *]
LangSecRef=3021
Detect=HKCU\Software\Novell\Messenger
FileKey1=%LocalAppData%\Novell\GroupWise Messenger\history\%UserName%|*

[Growl *]
LangSecRef=3024
Detect=HKCU\Software\Growl
FileKey1=%LocalAppData%\Growl\*\History|*|RECURSE
FileKey2=%LocalAppData%\Growl\*\ImageCache|*|RECURSE
FileKey3=%LocalAppData%\Growl\*\Log|*|RECURSE

[GS RichCopy 360 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\GuruSquad\GS RichCopy 360
FileKey1=%ProgramData%|Microsoft.SqlServer.Compact.400.*.bc
FileKey2=%ProgramFiles%\GuruSquad\GS RichCopy 360\Log|*
FileKey3=%SystemDrive%\GSRichCopy360Log|*|RECURSE

[GSpot *]
LangSecRef=3024
Detect=HKCU\Software\GSpot Appliance Corp
RegKey1=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|ExportFile
RegKey2=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|ExportNameOfFileForFormat
RegKey3=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|ExportPath
RegKey4=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|LastMediaFile

[gSyncit *]
LangSecRef=3022
DetectFile=%AppData%\gSyncit
FileKey1=%AppData%\gSyncit|gsyncit*.*

[GT Interactive Driver *]
Section=Games
DetectFile=%ProgramFiles%\GT Interactive\Driver
FileKey1=%ProgramFiles%\GT Interactive\Driver|debug.log

[Guild Wars *]
Section=Games
DetectFile=%ProgramFiles%\Guild Wars*
FileKey1=%AppData%\Guild Wars*\Coherent Dumps|*
FileKey2=%ProgramFiles%\Guild Wars*|*.tmp

[Gwent - The Witcher Card Game *]
Section=Games
Detect=HKCU\Software\CDProjektRED\Gwent
DetectFile=%UserProfile%\AppData\LocalLow\CDProjektRED\Gwent
FileKey1=%ProgramData%\CDProjekt RED\Gwent\Logs|*.log
FileKey2=%UserProfile%\AppData\LocalLow\CDProjektRED\Gwent|*_log.txt

[Hacknet *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\365450
FileKey1=%UserProfile%\Documents\My Games\Hacknet\Reports|*.txt

[Halite *]
LangSecRef=3021
DetectFile=%LocalAppData%\Halite
FileKey1=%LocalAppData%\Halite|Halite.xml.*;HaliteLog.txt|RECURSE

[Halls of Torment *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\2218750
FileKey1=%AppData%\HallsOfTorment\crashes|*
FileKey2=%AppData%\HallsOfTorment\logs|*

[Halo: Spartan Assault *]
Section=Games
DetectFile=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Hancom Office *]
LangSecRef=3021
DetectFile=%AppData%\HNC\Office
FileKey1=%AppData%\HNC\Office\Recent|*.lnk

[HandBrake *]
LangSecRef=3021
DetectFile=%ProgramFiles%\HandBrake
FileKey1=%AppData%\HandBrake\HandBrake\*|*.tmp
FileKey2=%AppData%\HandBrake\logs|*|REMOVESELF
FileKey3=%ProgramFiles%\HandBrake|*.stackdump

[Handle Regshot *]
LangSecRef=3024
DetectFile=%SystemDrive%\Hive
FileKey1=%SystemDrive%\Hive|*.css;*.hive;*.html;*.reg

[Handy Backup *]
LangSecRef=3024
Detect=HKCU\Software\Novosoft\Handy Backup
FileKey1=%AppData%\Novosoft\Handy Backup\logs|*

[Happy Cloud *]
Section=Games
Detect=HKCU\Software\HappyCloud
FileKey1=%ProgramData%\HappyCloud|*.log
FileKey2=%ProgramData%\HappyCloud\cache|*

[Hard Disk Sentinel *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Hard Disk Sentinel
FileKey1=%ProgramFiles%\Hard Disk Sentinel|*.bak;*Log.txt

[Hard Drive Inspector *]
LangSecRef=3024
DetectFile=%ProgramData%\AltrixSoft\Hard Drive Inspector
FileKey1=%ProgramData%\AltrixSoft\Hard Drive Inspector|log.err

[Hauppauge WinTV *]
LangSecRef=3024
Detect=HKLM\Software\Hauppauge
FileKey1=%Public%\WinTV|Settings-old.xml
FileKey2=%Public%\WinTV\Channel Database|hcwChanDB_5-lastgood.mdb
FileKey3=%Public%\WinTV\Installation Log|*|RECURSE
FileKey4=%Public%\WinTV\Logs|*.log;*.txt
FileKey5=%Public%\WinTV\Logs\minidump|*|RECURSE
FileKey6=%SystemDrive%|hcwDriverInstall.txt

[HDCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HDCleaner
FileKey1=%ProgramFiles%\HDCleaner\Settings\Stats|*.ini

[HDD Health *]
LangSecRef=3022
Detect=HKLM\System\CurrentControlSet\services\HDDHealth
FileKey1=%ProgramFiles%\HDD Health|*.tmp

[HDD Regenerator *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HDD Regenerator
FileKey1=%ProgramFiles%\HDD Regenerator|*.log|RECURSE

[HDD Thermometer *]
LangSecRef=3024
Detect=HKCU\Software\RSD Software, Inc.\HDD Thermometer
FileKey1=%ProgramData%\HDD Thermometer|*.log|RECURSE

[Hearthstone *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Hearthstone
FileKey1=%LocalAppData%\Blizzard\Hearthstone\Cache|*|RECURSE
FileKey2=%LocalAppData%\Blizzard\Hearthstone\Logs|*
FileKey3=%ProgramFiles%\Hearthstone|*.dmp;*.log;*log.txt|RECURSE

[Hearts of Iron IV *]
Section=Games
DetectFile=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV
FileKey1=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\_backup_*|*|REMOVESELF
FileKey2=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Cache|*
FileKey3=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Crashes|*|REMOVESELF
FileKey4=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Dumps|*
FileKey5=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\History_Dumps|*
FileKey6=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Logs|*
FileKey7=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\ShaderCache|*|RECURSE

[Heatsoft Handy File Tool *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\HFT
FileKey1=%UserProfile%\Documents\HFT\Logs|*

[Hedgewars *]
Section=Games
Detect=HKLM\Software\Hedgewars
FileKey1=%UserProfile%\Documents\Hedgewars\Logs|*
FileKey2=%UserProfile%\Documents\Hedgewars\VideoTemp|*

[Helium Autofill Data & Search Engine Preferences *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|*Web Data
FileKey2=%LocalAppData%\imput\Helium\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\imput\Helium\User Data\AutoFill*|*|REMOVESELF

[Helium Autoplay Preferences *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\MEIPreload|*|REMOVESELF

[Helium Bookmark Backups *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|Bookmarks.bak

[Helium Bookmark Favicons *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|favicons*

[Helium Caches *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\imput\Helium\User Data|Module Info Cache
FileKey3=%LocalAppData%\imput\Helium\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\imput\Helium\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\imput\Helium\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\imput\Helium\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\imput\Helium\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\imput\Helium\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\imput\Helium\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\imput\Helium\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\imput\Helium\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\imput\Helium\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\imput\Helium\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\imput\Helium\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\imput\Helium\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\imput\Helium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\imput\Helium\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\imput\Helium\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\imput\Helium\User Data\Optimization*|*|REMOVESELF

[Helium Default App Handlers *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|PreferredApps

[Helium Download History *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\imput\Helium\User Data\*\shared_proto_db|*|REMOVESELF

[Helium DRM Data *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\imput\Helium\User Data\WidevineCdm|*|REMOVESELF

[Helium Extension Cookies *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|Extension Cookies

[Helium Music Manager *]
LangSecRef=3023
DetectFile=%AppData%\Intermedia Software\Helium *
FileKey1=%AppData%\Intermedia Software\Helium *\Logs|*

[Helium Privacy Sandbox *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data|*first_party_sets*
FileKey2=%LocalAppData%\imput\Helium\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\imput\Helium\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\imput\Helium\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\imput\Helium\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\imput\Helium\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\imput\Helium\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\imput\Helium\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Helium Progressive Web Apps *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\Web Applications|*|REMOVESELF

[Helium Saved Usernames & Passwords *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|Login Data*

[Helium Security & Threat Detection *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|DIPS*
FileKey2=%LocalAppData%\imput\Helium\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\imput\Helium\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\imput\Helium\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\imput\Helium\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\imput\Helium\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\imput\Helium\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\imput\Helium\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\imput\Helium\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\imput\Helium\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\imput\Helium\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\imput\Helium\User Data\ZxcvbnData|*|REMOVESELF

[Helium Shopping Insights *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\imput\Helium\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\imput\Helium\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\imput\Helium\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\imput\Helium\User Data\*\parcel_tracking_db|*|REMOVESELF

[Helium Storage Quota Manager *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|QuotaManager

[Helium Sync Data *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\Sync Data|*|REMOVESELF

[Helium Telemetry *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\Application|debug.log
FileKey2=%LocalAppData%\imput\Helium\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\imput\Helium\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\imput\Helium\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\imput\Helium\User Data\*|*.log
FileKey6=%LocalAppData%\imput\Helium\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\imput\Helium\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\imput\Helium\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\imput\Helium\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\imput\Helium\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\imput\Helium\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\imput\Helium\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\imput\Helium\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\imput\Helium\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\imput\Helium\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\imput\Helium\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\imput\Helium\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\imput\Helium\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\imput\Helium\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\imput\Helium\Application|debug.log
FileKey21=%ProgramFiles%\imput\Helium\Application\SetupMetrics|*|REMOVESELF

[Helium Web Browsing Cookies *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\Network|Cookies*;Device Bound Sessions*

[Helium Web Browsing History *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Helium Web Browsing Session *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\imput\Helium\User Data\*\Sessions|*|REMOVESELF

[Helium Web Storage *]
Section=Helium Web Browser
DetectFile=%LocalAppData%\imput\Helium\User Data
FileKey1=%LocalAppData%\imput\Helium\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\imput\Helium\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\imput\Helium\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\imput\Helium\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\imput\Helium\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\imput\Helium\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\imput\Helium\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\imput\Helium\User Data\*\WebStorage|*|REMOVESELF

[herdProtect Anti-Malware Scanner *]
LangSecRef=3024
Detect=HKCU\Software\Reason\herdProtect
DetectFile=%ProgramFiles%\Reason\herdProtect\Scanner
FileKey1=%ProgramFiles%\Reason\herdProtect\Scanner*|Errors.dat
FileKey2=%ProgramFiles%\Reason\herdProtect\Scanner*\Cache|*|RECURSE
FileKey3=%ProgramFiles%\Reason\herdProtect\Scanner*\Logs|*

[Heroes of a Broken Land *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\314470
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Heroes of a Broken Land\hobl_data|output_log.txt

[Heroes of Hammerwatch *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\677120
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Heroes of Hammerwatch|*.log|RECURSE

[Heroes of the Storm *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Heroes of the Storm
FileKey1=%LocalAppData%\Blizzard Entertainment\Heroes of the Storm\BrowserCookies|*|RECURSE
FileKey2=%UserProfile%\Documents\Heroes of the Storm\GameLogs|*

[Heroic Games Launcher *]
Section=Games
DetectFile=%AppData%\Heroic
FileKey1=%AppData%\Heroic\*Cache*|REMOVESELF
FileKey2=%AppData%\Heroic\icons|*
FileKey3=%AppData%\Heroic\logs|*
FileKey4=%AppData%\Heroic\Network|*
FileKey5=%LocalAppData%\heroic-updater|*|RECURSE

[Hex Editor Neo *]
LangSecRef=3024
Detect=HKCU\Software\HHD Software\Hex Editor 6.sm
RegKey1=HKCU\Software\HHD Software\Hex Editor 6.sm\MRU
RegKey2=HKCU\Software\HHD Software\Hex Editor 6.sm\Structure Editor|Recent
RegKey3=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Diff|DiffFirstSelectedDoc
RegKey4=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Diff|DiffSecondSelectedDoc
RegKey5=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Disasm\Disasm|SelectedFiles
RegKey6=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Disasm\Find|History
RegKey7=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Disasm\Find|Patterns
RegKey8=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\ExtEditor\Find|Recent
RegKey9=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\ExtEditor\Replace|Recent
RegKey10=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\ExtEditor\Replace|Recent2
RegKey11=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Find|History
RegKey12=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Find|Patterns
RegKey13=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Replace|History
RegKey14=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Replace|Patterns
RegKey15=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Settings|RecentMasks
RegKey16=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Settings|RecentPaths
RegKey17=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Arith|Recent
RegKey18=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Bitwise|History
RegKey19=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Bitwise|Patterns
RegKey20=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Fill|History
RegKey21=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Fill|Patterns
RegKey22=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Find|History
RegKey23=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Find|Patterns
RegKey24=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Goto|Recent
RegKey25=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Insert|History
RegKey26=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Insert|Patterns
RegKey27=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Insert|Recent
RegKey28=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceFind|History
RegKey29=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceFind|Patterns
RegKey30=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceReplace|History
RegKey31=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceReplace|Patterns
RegKey32=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\SetSize|Recent
RegKey33=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\OpenDevice|Recent
RegKey34=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\Pattern|History
RegKey35=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\Pattern|Patterns
RegKey36=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\RuleEdit|History
RegKey37=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\RuleEdit|Patterns
RegKey38=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Streams\Locate|Exclude
RegKey39=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Streams\Locate|Masks
RegKey40=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Streams\Locate|Paths

[Hex Workshop Hex Editor *]
LangSecRef=3024
Detect1=HKCU\Software\BreakPoint\Hex Workshop 3.1
Detect2=HKCU\Software\BreakPoint\Hex Workshop v5
Detect3=HKCU\Software\BreakPoint\Hex Workshop v6.7
Detect4=HKCU\Software\BreakPoint\Hex Workshop v6.8
RegKey1=HKCU\Software\BreakPoint\Hex Workshop 3.1\Recent File List
RegKey2=HKCU\Software\BreakPoint\Hex Workshop v5\FileGoto|lastStr
RegKey3=HKCU\Software\BreakPoint\Hex Workshop v5\Paths
RegKey4=HKCU\Software\BreakPoint\Hex Workshop v5\SectorGoto|lastStr
RegKey5=HKCU\Software\BreakPoint\Hex Workshop v5\SelectBlock|last
RegKey6=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0sourceFile
RegKey7=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0sourceLength
RegKey8=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0sourceOffset
RegKey9=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0targetFile
RegKey10=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0targetLength
RegKey11=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0targetOffset
RegKey12=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_count
RegKey13=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|Source File
RegKey14=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|Target File
RegKey15=HKCU\Software\BreakPoint\Hex Workshop v6.7\Expression Calc|LastExpression
RegKey16=HKCU\Software\BreakPoint\Hex Workshop v6.7\FileGoto|goto_MRU_0
RegKey17=HKCU\Software\BreakPoint\Hex Workshop v6.7\FileGoto|goto_MRU_count
RegKey18=HKCU\Software\BreakPoint\Hex Workshop v6.7\FileGoto|lastStr
RegKey19=HKCU\Software\BreakPoint\Hex Workshop v6.7\Find|Value0
RegKey20=HKCU\Software\BreakPoint\Hex Workshop v6.7\Find|Value1
RegKey21=HKCU\Software\BreakPoint\Hex Workshop v6.7\LastPaths
RegKey22=HKCU\Software\BreakPoint\Hex Workshop v6.7\Replace|FindString
RegKey23=HKCU\Software\BreakPoint\Hex Workshop v6.7\Replace|ReplaceString
RegKey24=HKCU\Software\BreakPoint\Hex Workshop v6.7\SectorGoto|goto_MRU_count
RegKey25=HKCU\Software\BreakPoint\Hex Workshop v6.7\SectorGoto|lastStr
RegKey26=HKCU\Software\BreakPoint\Hex Workshop v6.7\SelectBlock|last
RegKey27=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0sourceFile
RegKey28=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0sourceLength
RegKey29=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0sourceOffset
RegKey30=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0targetFile
RegKey31=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0targetLength
RegKey32=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0targetOffset
RegKey33=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_count
RegKey34=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|Source File
RegKey35=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|Target File
RegKey36=HKCU\Software\BreakPoint\Hex Workshop v6.8\Expression Calc|LastExpression
RegKey37=HKCU\Software\BreakPoint\Hex Workshop v6.8\FileGoto|goto_MRU_0
RegKey38=HKCU\Software\BreakPoint\Hex Workshop v6.8\FileGoto|goto_MRU_count
RegKey39=HKCU\Software\BreakPoint\Hex Workshop v6.8\FileGoto|lastStr
RegKey40=HKCU\Software\BreakPoint\Hex Workshop v6.8\Find|Value0
RegKey41=HKCU\Software\BreakPoint\Hex Workshop v6.8\Find|Value1
RegKey42=HKCU\Software\BreakPoint\Hex Workshop v6.8\LastPaths
RegKey43=HKCU\Software\BreakPoint\Hex Workshop v6.8\Replace|FindString
RegKey44=HKCU\Software\BreakPoint\Hex Workshop v6.8\Replace|ReplaceString
RegKey45=HKCU\Software\BreakPoint\Hex Workshop v6.8\SectorGoto|goto_MRU_count
RegKey46=HKCU\Software\BreakPoint\Hex Workshop v6.8\SectorGoto|lastStr
RegKey47=HKCU\Software\BreakPoint\Hex Workshop v6.8\SelectBlock|last

[HexChat *]
LangSecRef=3022
DetectFile=%AppData%\HexChat
FileKey1=%AppData%\HexChat\logs|*|REMOVESELF
FileKey2=%AppData%\HexChat\scrollback|*|REMOVESELF

[Hi-Rez Studios *]
Section=Games
Detect=HKLM\Software\Hi-Rez Studios
FileKey1=%ProgramData%\Hi-Rez Studios\BrowserCacheTribes\Default|*|RECURSE
FileKey2=%ProgramData%\Hi-Rez Studios\HiPatchService\log|*
FileKey3=%ProgramFiles%\Hi-Rez Studios\hireztemp|*
FileKey4=%SystemDrive%|HiRezUpdateInstallLog.txt

[HiBit Uninstaller *]
LangSecRef=3024
DetectFile=%AppData%\HiBitSoftware\HiBit Uninstaller
FileKey1=%AppData%\HiBitSoftware\HiBit Uninstaller|ListCach.dbu;ListN.dbu

[Hide.me VPN *]
LangSecRef=3022
DetectFile=%AppData%\Hide.me
FileKey1=%AppData%\Hide.me\Logs|*

[HistoryKill *]
LangSecRef=3024
DetectFile=%LocalAppData%\HistoryKill
FileKey1=%LocalAppData%\HistoryKill|hk.dat;reseller.txt

[HitmanPro *]
LangSecRef=3024
Detect1=HKCU\Software\HitMan Pro
Detect2=HKCU\Software\HitMan Pro 2
Detect3=HKCU\Software\HitMan Pro 3
Detect4=HKLM\Software\HitmanPro
FileKey1=%ProgramData%\HitmanPro\Logs|*
FileKey2=%ProgramFiles%\Hitman Pro*\downloads|*
FileKey3=%ProgramFiles%\Hitman Pro*\logs|*.htm
FileKey4=%ProgramFiles%\Hitman Pro*\updates|*
FileKey5=%WinDir%\System32|HitmanPro*.log
FileKey6=%WinDir%\SysWOW64|HitmanPro*.log

[HM NIS Edit *]
LangSecRef=3021
Detect=HKCU\Software\HM Software\Nis Edit
RegKey1=HKCU\Software\HM Software\Nis Edit\Recent

[Hob *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\404680
FileKey1=%Documents%\My Games\runic games\hob|microcodecache*;ogre.log

[Holiday Express *]
Section=Games
Detect1=HKLM\Software\GameHouse\Holiday Express
Detect2=HKLM\Software\HipSoft\Holiday Express
FileKey1=%ProgramFiles%\GameHouse Games Collection\Holiday Express|*.txt
FileKey2=%ProgramFiles%\Holiday Express|*.txt;*html

[Homeworld Remastered Collection *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\244160
FileKey1=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\CACHE|*|RECURSE
FileKey2=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\LOGFILES|*
FileKey3=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\Release|*.dmp;*.log;*.mdmp;*ErrorLog.txt

[Homeworld: Deserts of Kharak Backups *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\281610
FileKey1=%ProgramFiles%\Steam\steamapps\common\Deserts of Kharak\out\backup|*|RECURSE

[Honeyview *]
LangSecRef=3023
Detect=HKCU\Software\Honeyview
RegKey1=HKCU\Software\Honeyview|sExtProg0
RegKey2=HKCU\Software\Honeyview|sLastCheckDay
RegKey3=HKCU\Software\Honeyview|transf.sFileNameHeader
RegKey4=HKCU\Software\Honeyview\BMPath0
RegKey5=HKCU\Software\Honeyview\BMPath1
RegKey6=HKCU\Software\Honeyview\BMPath2
RegKey7=HKCU\Software\Honeyview\BMPath3
RegKey8=HKCU\Software\Honeyview\BMPath4
RegKey9=HKCU\Software\Honeyview\BMPath5
RegKey10=HKCU\Software\Honeyview\BMPath6
RegKey11=HKCU\Software\Honeyview\BMPath7
RegKey12=HKCU\Software\Honeyview\BMPath8
RegKey13=HKCU\Software\Honeyview\BMPath9
RegKey14=HKCU\Software\Honeyview\BMPath10
RegKey15=HKCU\Software\Honeyview\BMPath11
RegKey16=HKCU\Software\Honeyview\BMPath12
RegKey17=HKCU\Software\Honeyview\BMPath13
RegKey18=HKCU\Software\Honeyview\BMPath14
RegKey19=HKCU\Software\Honeyview\BMPath15
RegKey20=HKCU\Software\Honeyview\BMPath16
RegKey21=HKCU\Software\Honeyview\BMPath17
RegKey22=HKCU\Software\Honeyview\BMPath18
RegKey23=HKCU\Software\Honeyview\BMPath19
RegKey24=HKCU\Software\Honeyview\BMPath20
RegKey25=HKCU\Software\Honeyview\BMPath21
RegKey26=HKCU\Software\Honeyview\BMPath22
RegKey27=HKCU\Software\Honeyview\BMPath23
RegKey28=HKCU\Software\Honeyview\BMPath24
RegKey29=HKCU\Software\Honeyview\BMPath25
RegKey30=HKCU\Software\Honeyview\BMPath26
RegKey31=HKCU\Software\Honeyview\BMPath27
RegKey32=HKCU\Software\Honeyview\BMPath28
RegKey33=HKCU\Software\Honeyview\BMPath29
RegKey34=HKCU\Software\Honeyview\RecentFolder0
RegKey35=HKCU\Software\Honeyview\RecentFolder1
RegKey36=HKCU\Software\Honeyview\RecentFolder2
RegKey37=HKCU\Software\Honeyview\RecentFolder3
RegKey38=HKCU\Software\Honeyview\RecentFolder4
RegKey39=HKCU\Software\Honeyview\RecentFolder5
RegKey40=HKCU\Software\Honeyview\RecentFolder6
RegKey41=HKCU\Software\Honeyview\RecentFolder7
RegKey42=HKCU\Software\Honeyview\RecentFolder8
RegKey43=HKCU\Software\Honeyview\RecentFolder9
RegKey44=HKCU\Software\Honeyview\sRecentFolder
RegKey45=HKCU\Software\Honeyview\transf.sTargetFolder

[Hostile Makeover *]
Section=Games
DetectFile=%AppData%\Merscom\Hostile Makeover
FileKey1=%AppData%\Merscom\Hostile Makeover|logfile.txt

[HostsMan Backups *]
LangSecRef=3024
DetectFile=%ProgramData%\abelhadigital.com\HostsMan
FileKey1=%Public%\Documents\HostsMan Backups|*|REMOVESELF
FileKey2=%WinDir%\System32\drivers\etc|HOSTS.bak;HOSTS.tmp

[HostsMan HostsServer *]
LangSecRef=3024
Detect=HKLM\Software\abelhadigital.com\HostsServer
DetectFile=%ProgramFiles%\HostsMan\hostssrv.exe
FileKey1=%AppData%\abelhadigital.com\HostsServer|*.log|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\abelhadigital.com\HostsServer\Logs|*.log

[Hotline Miami *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219150
FileKey1=%UserProfile%\Documents\My Games\HotlineMiami|debug.log

[Hotspot Shield *]
LangSecRef=3021
DetectFile1=%ProgramData%\Hotspot Shield
DetectFile2=%ProgramFiles%\Hotspot Shield
FileKey1=%ProgramData%\Hotspot Shield\system\logs|*|RECURSE
FileKey2=%ProgramData%\Hotspot Shield\system\Update|*
FileKey3=%ProgramData%\Hotspot Shield\user\logs|*|RECURSE
FileKey4=%ProgramFiles%\Hotspot Shield\log|*.log
FileKey5=%UserProfile%\AppData\LocalLow\Hotspot_Shield\Logs|*|RECURSE

[Hover Desk *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HoverDesk
FileKey1=%ProgramFiles%\HoverDesk\User|hdcmdrec.txt

[HP *]
LangSecRef=3021
Detect=HKCU\Software\HP
DetectFile1=%AppData%\hpqlog
DetectFile2=%LocalAppData%\Hewlett-Packard
DetectFile3=%LocalAppData%\TouchSmartData
DetectFile4=%ProgramData%\Hewlett-Packard
DetectFile5=%ProgramData%\HP
DetectFile6=%ProgramFiles%\HPQ\Shared\Sierra Wireless
DetectFile7=%UserProfile%\HPRemote\RGReceiver
FileKey1=%AppData%\hp active health\app analytics\*logs|*|RECURSE
FileKey2=%AppData%\HP\*Logs|*Log.txt
FileKey3=%AppData%\hpqlog|*.log
FileKey4=%LocalAppData%\Hewlett-Packard\HP Support Framework\Profile\Upload|*.log
FileKey5=%LocalAppData%\HP\AtInstall|*.log;*log.txt|REMOVESELF
FileKey6=%LocalAppData%\TouchSmartData\Log|*
FileKey7=%ProgramData%|hpzinstall.log
FileKey8=%ProgramData%\Hewlett-Packard|*.log*.*;*Log.txt|RECURSE
FileKey9=%ProgramData%\Hewlett-Packard\HP*\Log*|*|RECURSE
FileKey10=%ProgramData%\HP Audio Switch|*.log*
FileKey11=%ProgramData%\HP\HP Audio Switch|*.log
FileKey12=%ProgramData%\HP\HP Touchpoint Analytics Client\Logs|*
FileKey13=%ProgramData%\HP\HP Touchpoint Analytics Client\Monitor-History|*
FileKey14=%ProgramData%\HP\HP Touchpoint Analytics Client\MRU|*
FileKey15=%ProgramData%\HP\logs|*|RECURSE
FileKey16=%ProgramData%\HP\StreamLog|*|RECURSE
FileKey17=%ProgramFiles%\HPQ\Shared\Sierra Wireless|*.log|RECURSE
FileKey18=%SystemDrive%|dism.log
FileKey19=%SystemDrive%\hp\bin\logs|*.log
FileKey20=%SystemDrive%\HP\Diagnostics\PSDR|logFile.txt
FileKey21=%SystemDrive%\system.sav\logs|*|RECURSE
FileKey22=%UserProfile%\HPRemote\RGReceiver|*.log
FileKey23=%WinDir%\HP|Installer.log

[HP Display Center *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AD2F1837.HPDisplayCenter_v10z8vjag6ke6
FileKey1=%LocalAppData%\Packages\AD2F1837.HPDisplayCenter_v10z8vjag6ke6\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AD2F1837.HPDisplayCenter_v10z8vjag6ke6\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\AD2F1837.HPDisplayCenter_v10z8vjag6ke6\Settings|*.log*
FileKey4=%LocalAppData%\Packages\AD2F1837.HPDisplayCenter_v10z8vjag6ke6\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\AD2F1837.HPDisplayCenter_v10z8vjag6ke6\TempState|*|REMOVESELF

[HP Drive Key Boot Utility *]
LangSecRef=3024
Detect=HKLM\Software\microsoft\windows\currentversion\uninstall\HP Drive Key Boot Utility
FileKey1=%SystemDrive%\CPQSYSTEM|*|REMOVESELF

[HP Guide *]
LangSecRef=3024
DetectFile=%LocalAppData%\HP Guide
FileKey1=%LocalAppData%\HP Guide|log1.*
FileKey2=%LocalAppData%\HP Guide\mp_cache|*

[HP HyperX NGENUITY *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\33C30B79.HyperXNGenuity_0a78dr3hq0pvt
FileKey1=%LocalAppData%\Packages\33C30B79.HyperXNGenuity_0a78dr3hq0pvt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\33C30B79.HyperXNGenuity_0a78dr3hq0pvt\LocalState\Logs|*
FileKey3=%LocalAppData%\Packages\33C30B79.HyperXNGenuity_0a78dr3hq0pvt\Settings|*.log*
FileKey4=%LocalAppData%\Packages\33C30B79.HyperXNGenuity_0a78dr3hq0pvt\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\33C30B79.HyperXNGenuity_0a78dr3hq0pvt\TempState|*|REMOVESELF

[HP Installation Files *]
LangSecRef=3024
Detect=HKCU\Software\HP
DetectFile1=%ProgramData%\HP
DetectFile2=%SystemDrive%\HP Universal Print Driver
DetectFile3=%SystemDrive%\swsetup
FileKey1=%ProgramData%\HP\Installer\Temp|*
FileKey2=%ProgramData%\HP\Temp|*
FileKey3=%ProgramFiles%\HP\Temp|*|RECURSE
FileKey4=%SystemDrive%\HP Universal Print Driver|*|REMOVESELF
FileKey5=%SystemDrive%\swsetup|*|REMOVESELF
FileKey6=%WinDir%|*.dat.temp

[HP Jumpstart *]
LangSecRef=3021
DetectFile=%LocalAppData%\HP Jumpstart Apps
FileKey1=%LocalAppData%\HP Jumpstart Apps\User Data\Default|*-journal;Extension Cookies;LOG;LOG.old;Network Persistent State;Top Sites;Visited Links;Web Data|RECURSE
FileKey2=%LocalAppData%\HP Jumpstart Apps\User Data\Default\*Cache|*|RECURSE
FileKey3=%LocalAppData%\HP Jumpstart Apps\User Data\ShaderCache\GPUCache|*

[HP MediaSmart Photo *]
LangSecRef=3023
DetectFile=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo
FileKey1=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo|subsys.cache
FileKey2=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo\tm*Cache|*|REMOVESELF

[HP OMEN Gaming Hub *]
Section=Games
DetectFile=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6
FileKey1=%LocalAppData%\HPOMEN|*.log
FileKey2=%LocalAppData%\HPOmenServices|*|RECURSE
FileKey3=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey5=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\*Cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\AutoFill*|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Avatars|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Crash Reports|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Crashpad|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Crowd Deny|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey16=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Download Service|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Extension State|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\File System|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey34=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\optimization*|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Sessions|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Local Traces|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\MEIPreload|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Optimization*|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\OriginTrials|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\PKIMetadata|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Safe Browsing|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\SafetyTips|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\SmartScreen|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Stability|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\Subresource Filter|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\WidevineCdm|*|REMOVESELF
FileKey67=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalCache\Local\LeftNav\WebViewCache\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey68=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey69=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey70=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey71=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey72=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey73=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey74=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey75=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey76=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey77=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey78=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey79=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey80=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey81=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey82=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey83=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey84=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey85=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey86=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey87=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey88=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey89=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey90=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey91=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey92=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey93=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey94=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey95=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey96=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey97=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey98=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey99=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey100=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey101=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey102=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey103=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey104=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey105=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey106=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey107=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey108=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey109=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey110=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey111=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey112=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey113=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey114=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey115=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey116=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey117=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey118=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey119=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey120=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey121=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey122=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey123=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey124=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey125=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey126=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey127=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey128=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey129=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey130=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey131=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey132=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\Settings|*.log*
FileKey133=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\SystemAppData\Helium|*.log*
FileKey134=%LocalAppData%\Packages\AD2F1837.OMENCommandCenter_v10z8vjag6ke6\TempState|*|REMOVESELF

[HP Smart *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6
FileKey1=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6\Settings|*.log*
FileKey4=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6\TempState|*|REMOVESELF

[HP Support Assistant *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AD2F1837.HPSupportAssistant_v10z8vjag6ke6
FileKey1=%LocalAppData%\Packages\AD2F1837.HPSupportAssistant_v10z8vjag6ke6\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AD2F1837.HPSupportAssistant_v10z8vjag6ke6\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\AD2F1837.HPSupportAssistant_v10z8vjag6ke6\Settings|*.log*
FileKey4=%LocalAppData%\Packages\AD2F1837.HPSupportAssistant_v10z8vjag6ke6\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\AD2F1837.HPSupportAssistant_v10z8vjag6ke6\TempState|*|REMOVESELF

[HP Update *]
LangSecRef=3021
DetectFile=%AppData%\HPUpdate
FileKey1=%AppData%\HpUpdate|*

[HTC *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Installer\Products\34180280D77760A4BB4517FBA01DBB07\SourceList
FileKey1=%SystemDrive%\Temp|HSM*.txt

[HTC Home Apis *]
LangSecRef=3021
DetectFile=%ProgramFiles%\HTC Home
FileKey1=%ProgramFiles%\HTC Home\log|*|RECURSE

[Huawei *]
LangSecRef=3023
Detect=HKLM\Software\Huawei technologies
FileKey1=%ProgramData%\MobileBrServ\log|*|REMOVESELF
FileKey2=%ProgramFiles%\BILDmobil\Log|*
FileKey3=%ProgramFiles%\HUAWEI Modem Driver|*.log

[Huawei Hisuite *]
LangSecRef=3021
DetectFile=%LocalAppData%\Hisuite
FileKey1=%LocalAppData%\Hisuite\log|*.log;*.zip
FileKey2=%LocalAppData%\Hisuite\UserData\AppIcon|*.png
FileKey3=%LocalAppData%\Hisuite\UserData\driver\all|*.log
FileKey4=%LocalAppData%\Hisuite\UserData\DropTemp|*
FileKey5=%LocalAppData%\HiSuite\UserData\hwtools\old|*
FileKey6=%ProgramFiles%\HiSuite\HandSetService\log|*.log

[Hue Sync *]
LangSecRef=3022
DetectFile1=%LocalAppData%\Packages\Signify.HueSync_j13q1hys0cg9e
DetectFile2=%LocalAppData%\Signify\huesync
FileKey1=%AppData%\HueSync\attachments|*
FileKey2=%AppData%\HueSync\reports|*
FileKey3=%LocalAppData%\Packages\Signify.HueSync_j13q1hys0cg9e\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\Signify.HueSync_j13q1hys0cg9e\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Signify.HueSync_j13q1hys0cg9e\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Signify.HueSync_j13q1hys0cg9e\TempState|*|REMOVESELF
FileKey7=%LocalAppData%\Signify\huesync\cache|*|RECURSE

[Hulu *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\HULULLC.HULUPLUS_fphbd361v8tya
FileKey1=%LocalAppData%\Packages\HULULLC.HULUPLUS_fphbd361v8tya\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\HULULLC.HULUPLUS_fphbd361v8tya\LocalState|*.tmp|RECURSE
FileKey3=%LocalAppData%\Packages\HULULLC.HULUPLUS_fphbd361v8tya\Settings|*.log*
FileKey4=%LocalAppData%\Packages\HULULLC.HULUPLUS_fphbd361v8tya\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\HULULLC.HULUPLUS_fphbd361v8tya\TempState|*|REMOVESELF

[Hulubulu Advanced Renamer *]
LangSecRef=3024
DetectFile1=%AppData%\Hulubulu\Advanced Renamer 3
DetectFile2=%AppData%\Hulubulu\Advanced Renamer 4
FileKey1=%AppData%\Hulubulu\Advanced Renamer *\Data\UndoLists|*

[Humble App *]
Section=Games
DetectFile=%AppData%\Humble App
FileKey1=%AppData%\Humble App|*-journal;*.old;LOG;QuotaManager|RECURSE
FileKey2=%AppData%\Humble App\*Cache|*|REMOVESELF
FileKey3=%AppData%\Humble App\blob_storage|*|RECURSE
FileKey4=%AppData%\Humble App\Crashpad\Reports|*
FileKey5=%AppData%\Humble App\Logs|*
FileKey6=%AppData%\Humble App\Service Worker\*Cache*|*|RECURSE
FileKey7=%LocalAppData%\humble-client-updater|*
FileKey8=%LocalAppData%\humble-client-updater\*|*|REMOVESELF

[Huru Beach Party *]
Section=Games
DetectFile=%AppData%\HuruBeachParty
FileKey1=%AppData%\HuruBeachParty|*log.html

[HxD Hexeditor *]
LangSecRef=3021
Detect=HKCU\Software\Mael\HxD
RegKey1=HKCU\Software\Mael\HxD\History Lists\Recent Files

[HyperSnap *]
LangSecRef=3021
Detect1=HKCU\Software\Hyperionics\HyperSnap 7
Detect2=HKCU\Software\Hyperionics\HyperSnap 8
FileKey1=%ProgramFiles%\HyperSnap *|*.url
RegKey1=HKCU\Software\Hyperionics\HyperSnap 7\Recent File List
RegKey2=HKCU\Software\Hyperionics\HyperSnap 8\Recent File List

[I2P *]
LangSecRef=3022
Detect=HKLM\System\CurrentControlSet\Services\i2p
DetectFile1=%AppData%\I2P
DetectFile2=%ProgramFiles%\i2p
FileKey1=%AppData%\I2P\eepsite\logs|*
FileKey2=%AppData%\I2P\netDb|*
FileKey3=%ProgramFiles%\i2p|*.log
FileKey4=%ProgramFiles%\i2p\eepsite\logs|*

[IBM Security Trusteer Rapport *]
LangSecRef=3022
Detect=HKCU\Software\Trusteer\Rapport
FileKey1=%AppData%\Trusteer\Rapport\user\Logs|*
FileKey2=%LocalAppData%\Trusteer\Rapport\user\logs|*
FileKey3=%ProgramData%\Trusteer\Rapport\logs|*
FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Trusteer\Rapport\user\logs|*

[Icaros *]
LangSecRef=3024
DetectFile=%LocalAppData%\Icaros
FileKey1=%LocalAppData%\Icaros\IcarosCache|*.icdb

[IceCat Autocomplete History *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|formhistory*

[IceCat Autofill Data *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|autofill-profiles.json

[IceCat Bookmark Backups *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*\bookmarkbackups|*

[IceCat Bookmark Favicons *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|favicons*

[IceCat Caches *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Mozilla\icecat\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Mozilla\icecat\Profiles\*\notificationstore|*
FileKey4=%AppData%\Mozilla\icecat\Profiles\*\security_state|*
FileKey5=%AppData%\Mozilla\icecat\Profiles\*\shader-cache|*
FileKey6=%AppData%\Mozilla\icecat\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Mozilla\icecat\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Mozilla\icecat\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Mozilla\icecat\Profiles\*\thumbnails|*|REMOVESELF

[IceCat Privacy Sandbox *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|credentialstate.sqlite

[IceCat Saved Usernames & Passwords *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|key4.db;logins.json

[IceCat Synced Tabs *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|synced-tabs.db*

[IceCat Telemetry *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat|*.log|RECURSE
FileKey2=%AppData%\Mozilla\icecat\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Mozilla\icecat\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Mozilla\icecat\Profiles\*\crashes|*
FileKey5=%AppData%\Mozilla\icecat\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Mozilla\icecat\Profiles\*\minidumps|*
FileKey7=%AppData%\Mozilla\icecat\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Mozilla\icecat\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Mozilla\icecat\Profiles\*\weave\logs|*

[IceCat Web Browsing Cookies *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|cookies*

[IceCat Web Browsing Session *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|session*.json*

[IceCat Web Browsing Session Backups *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*\sessionstore-backups|*

[IceCat Web Storage *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Mozilla\icecat\Profiles\*\storage\default\http*|*|REMOVESELF

[IceCat Website Permissions *]
Section=GNU IceCat Web Browser
DetectFile=%AppData%\Mozilla\icecat\Profiles
FileKey1=%AppData%\Mozilla\icecat\Profiles\*|content-prefs.sqlite;permissions.sqlite

[IceChat *]
LangSecRef=3022
DetectFile=%LocalAppData%\IceChat Networks\IceChat
FileKey1=%LocalAppData%\IceChat Networks\IceChat\Logs|*.log|RECURSE

[Icecream Screen Recorder *]
LangSecRef=3024
DetectFile=%LocalAppData%\Icecream\Icecream Screen Recorder
FileKey1=%LocalAppData%\Icecream\Icecream Screen Recorder|history.json
FileKey2=%UserProfile%\.Icecream Screen Recorder\log|log_*.txt

[Icewind Dale *]
Section=Games
DetectFile=%ProgramFiles%\Black Isle\Icewind Dale
FileKey1=%ProgramFiles%\Black Isle\Icewind Dale\Temp|*

[IcoFX *]
LangSecRef=3023
DetectFile=%AppData%\IcoFX*
FileKey1=%AppData%\IcoFX*\Settings|filebrecentcul.cfg;recent.cfg;recentIcl.cfg

[IconCool Editor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IconCoolEditor
FileKey1=%ProgramFiles%\IconCoolEditor|IconFileList.src;Recentlyused.src

[Icons from File *]
LangSecRef=3024
Detect=HKCU\Software\Vitaliy Levchenko\Icons from File
RegKey1=HKCU\Software\Vitaliy Levchenko\Icons from File\Recent

[ID Privacy Shield *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ID Security Suite\ID Privacy Shield
FileKey1=%ProgramFiles%\ID Security Suite\ID Privacy Shield\logs|*|RECURSE

[IdeaSoft Scrapbooks Plus 1.0 *]
LangSecRef=3021
Detect=HKCU\Software\IdeaSoft\Scrapbooks Plus\1.0
RegKey1=HKCU\Software\IdeaSoft\Scrapbooks Plus\1.0\Recent File List

[IDLE *]
LangSecRef=3024
Detect=HKCU\Software\Python
FileKey1=%UserProfile%\.idlerc|recent-files.lst

[idoo Video Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\idoo\Video Editor
FileKey1=%ProgramFiles%\idoo\Video Editor|*.log

[IDrive *]
LangSecRef=3021
DetectFile1=%LocalAppData%\IDrive
DetectFile2=%ProgramFiles%\IDriveWindows
FileKey1=%LocalAppData%\IDrive\IBCOMMON|SerTraceFile.txt
FileKey2=%ProgramData%\IDrive\IBCOMMON|Tracefile.txt
FileKey3=%ProgramFiles%\IDriveWindows\IBCOMMON|SerTraceFile.txt

[IDT NetGUI *]
LangSecRef=3022
DetectFile=%AppData%\IDT\NetGUI
FileKey1=%AppData%\IDT\NetGUI\Log|*.log

[iExpert Registry Clean Expert *]
LangSecRef=3024
Detect=HKCU\Software\iExpertSoft\Registry Clean Expert
DetectFile=%ProgramFiles%\Registry Clean Expert
FileKey1=%AppData%\iExpert Software\Registry Clean Expert\UndoCenter|*
FileKey2=%ProgramFiles%\Registry Clean Expert|*.LOG
RegKey1=HKCU\Software\iExpertSoft\Registry Clean Expert\Recent File List

[iFunbox *]
LangSecRef=3024
DetectFile=%ProgramFiles%\i-Funbox DevTeam
FileKey1=%ProgramFiles%\i-Funbox DevTeam|debug.log

[iGP11 *]
Section=Games
DetectFile=%ProgramFiles%\S17L\iGP11
FileKey1=%ProgramFiles%\S17L\iGP11\logs|*

[IISExpress *]
LangSecRef=3022
DetectFile=%UserProfile%\Documents\IISExpress
FileKey1=%UserProfile%\Documents\IISExpress\Logs|*
FileKey2=%UserProfile%\Documents\IISExpress\TraceLogFiles|*|RECURSE

[ImageDupeless *]
LangSecRef=3023
Detect=HKCU\Software\ImageDupeless\ImageDupeless
RegKey1=HKCU\Software\ImageDupeless\ImageDupeless\Parameters|Last Decoded File
RegKey2=HKCU\Software\ImageDupeless\ImageDupeless\Recent File List

[ImageGlass *]
LangSecRef=3023
DetectFile=%LocalAppData%\ImageGlass
FileKey1=%LocalAppData%\ImageGlass\ThumbnailsCache|*|REMOVESELF

[ImagePrinter Pro *]
LangSecRef=3021
Detect=HKCU\Software\Code Industry\ImagePrinterPro
FileKey1=%LocalAppData%\ImagePrinter Pro\Temp|*
RegKey1=HKCU\Software\Code Industry\ImagePrinterPro|path
RegKey2=HKCU\Software\Code Industry\ImagePrinterPro|temp_path

[ImageRanger *]
LangSecRef=3023
DetectFile=%ProgramFiles%\ImageRanger
FileKey1=%ProgramFiles%\ImageRanger|vc*redist*x*.exe

[ImgBurn *]
LangSecRef=3021
Detect=HKCU\Software\ImgBurn
RegKey1=HKCU\Software\ImgBurn|ISOREAD_RecentFiles_Destination
RegKey2=HKCU\Software\ImgBurn|ISOREAD_RecentFolders_Destination

[Immersity *]
Section=Games
DetectFile=%ProgramData%\Simulated Reality
FileKey1=%ProgramData%\Simulated Reality\Applications\SRSession\Log|*
FileKey2=%ProgramData%\Simulated Reality\Eye Tracker\Log|*
FileKey3=%ProgramData%\Simulated RealityServer\Log|*

[Immunet *]
LangSecRef=3021
Detect=HKLM\Software\Immunet Protect
FileKey1=%AppData%\Immunet|*|REMOVESELF
FileKey2=%ProgramData%\Immunet|*.log
FileKey3=%ProgramFiles%\Immunet|*.log|RECURSE

[Imo Messenger *]
LangSecRef=3022
DetectFile=%AppData%\Imo Messenger
FileKey1=%AppData%\Imo Messenger\Data\*\images|*
FileKey2=%AppData%\Imo Messenger\Logs|*
FileKey3=%AppData%\Imo Messenger\updates|*

[iMobie *]
LangSecRef=3024
DetectFile=%AppData%\iMobie
FileKey1=%AppData%\iMobie\*|iTunesPrefs
FileKey2=%AppData%\iMobie\*\AutoUpdate|*|RECURSE
FileKey3=%AppData%\iMobie\*\Configue|Settings.plist
FileKey4=%AppData%\iMobie\*\EasyLoseFiles|*|RECURSE
FileKey5=%AppData%\iMobie\*\ErrorLog|*|RECURSE
FileKey6=%AppData%\iMobie\*\Files|*|RECURSE
FileKey7=%AppData%\iMobie\*\iMobieConfig|*|RECURSE
FileKey8=%AppData%\iMobie\*\TempFiles|*|RECURSE
ExcludeKey1=FILE|%AppData%\iMobie\*\iMobieConfig\|ConfigReg.ini

[iMobie Backups *]
LangSecRef=3024
DetectFile=%AppData%\iMobie
FileKey1=%AppData%\iMobie\*\*Backup|*|RECURSE
FileKey2=%AppData%\iMobie\Backup|*|RECURSE

[Imperator Rome *]
Section=Games
DetectFile=%UserProfile%\Documents\Paradox Interactive\Imperator
FileKey1=%UserProfile%\Documents\Paradox Interactive\Imperator\*Cache|*|RECURSE
FileKey2=%UserProfile%\Documents\Paradox Interactive\Imperator\Crashes|*|REMOVESELF
FileKey3=%UserProfile%\Documents\Paradox Interactive\Imperator\Dumps|*
FileKey4=%UserProfile%\Documents\Paradox Interactive\Imperator\Logs|*

[ImTOO iPad Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\ImTOO\iPad Video Converter
FileKey1=%ProgramFiles%\ImTOO\iPad Video Converter|*.log;ERRORLOG.TXT

[ImTOO Video Converter Ultimate *]
LangSecRef=3023
Detect=HKCU\Software\ImTOO\Video Converter Ultimate
FileKey1=%ProgramData%\ImTOO\Video Converter Ultimate\customdata|settings.old
RegKey1=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_openfile_dir
RegKey2=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_output_dir
RegKey3=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_profile_group
RegKey4=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_profile_url
RegKey5=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|recent_profiles
RegKey6=HKCU\Software\ImTOO\Video Converter Ultimate\Settings\output

[IMVU *]
Section=Games
Detect=HKCU\Software\IMVU
DetectFile=%AppData%\IMVU*
FileKey1=%AppData%\IMVU|*.chk|RECURSE
FileKey2=%AppData%\IMVU|*.db;*.jpg;*.log*;*.pickle;*.txt;mini.dmp.bak
FileKey3=%AppData%\IMVU Desktop*|cookies*;network persistent state
FileKey4=%AppData%\IMVU Desktop*\*Cache|*|REMOVESELF
FileKey5=%AppData%\IMVU Desktop*\blob_storage|*|REMOVESELF
FileKey6=%AppData%\IMVU Desktop*\Crashpad\Reports|*|RECURSE
FileKey7=%AppData%\IMVU\*Cache|*|REMOVESELF
FileKey8=%AppData%\IMVUApp|*.log
FileKey9=%AppData%\IMVUClient|*.icns|RECURSE
FileKey10=%AppData%\IMVUClient\installer|*|RECURSE
FileKey11=%AppData%\IMVUClient\ui\profile|*.dat;*.js;*.mfl;*.sqlite
FileKey12=%AppData%\IMVUClient\ui\profile\cache|*|REMOVESELF
FileKey13=%LocalAppData%\IMVU*|*.log

[iMyFone Umate *]
LangSecRef=3024
Detect=HKLM\Software\iMyFone\Umate
FileKey1=%ProgramFiles%\iMyFone\iMyFone Umate|mate.log
FileKey2=%ProgramFiles%\iMyFone\iMyFone Umate\cache|*|RECURSE
FileKey3=%ProgramFiles%\iMyFone\iMyFone Umate\Log|*|RECURSE
FileKey4=%ProgramFiles%\iMyFone\iMyFone Umate\temp|*|RECURSE

[Infinity Engine *]
Section=Games
DetectFile=%UserProfile%\Documents\Infinity Engine - Enhanced Edition
FileKey1=%UserProfile%\Documents\Infinity Engine - Enhanced Edition\Crash|*.dmp

[Infix PDF Editor *]
LangSecRef=3021
DetectFile=%LocalAppData%\Iceni\Infix
FileKey1=%LocalAppData%\Iceni\Infix\*|fontcache;lastFileOpenned.txt
RegKey1=HKCU\Software\Iceni Technology Limited\Infix\Find Replace|Find Save
RegKey2=HKCU\Software\Iceni Technology Limited\Infix\Find Replace|Replace Save
RegKey3=HKCU\Software\Iceni Technology Limited\Infix\Find Replace File|Find Save
RegKey4=HKCU\Software\Iceni Technology Limited\Infix\Find Replace File|Replace Save
RegKey5=HKCU\Software\Iceni Technology Limited\Infix\Watermark dialog|Find Save
RegKey6=HKCU\Software\Iceni Technology Limited\Infix\Watermark dialog|Replace Save

[inFlow Inventory *]
LangSecRef=3021
DetectFile=%AppData%\inFlow Inventory
FileKey1=%AppData%\inFlow Inventory|log.txt
FileKey2=%ProgramData%\inFlow Inventory\Logs|*

[Infonautics File Date Corrector *]
LangSecRef=3024
Detect=HKCU\Software\Infonautics\FileDateCorrector
FileKey1=%AppData%\FileDateCorrector\Logs|*

[InfraRecorder *]
LangSecRef=3023
DetectFile=%AppData%\InfraRecorder
FileKey1=%AppData%\InfraRecorder\logs|*

[Ingit MapGPS *]
LangSecRef=3021
Detect=HKCU\Software\Ingit\MapGPS\MapGPS
RegKey1=HKCU\Software\Ingit\MapGPS\MapGPS\RARU0205|LastOpenChart
RegKey2=HKCU\Software\Ingit\MapGPS\MapGPS\RARU0205 Recent Files

[Injector DLL *]
LangSecRef=3024
Detect=HKCU\Software\Drowse\Injector
RegKey1=HKCU\Software\Drowse\Injector|DLL

[InkScape *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\inkscape.exe
FileKey1=%AppData%\InkScape|*.log|RECURSE
FileKey2=%LocalAppData%|recently-used.xbel

[Inno Setup *]
LangSecRef=3021
Detect=HKCU\Software\Jordan Russell\Inno Setup
RegKey1=HKCU\Software\Jordan Russell\Inno Setup\ScriptFileHistoryNew

[InnoExtractor *]
LangSecRef=3024
DetectFile1=%AppData%\InnoExtractor
DetectFile2=%LocalAppData%\InnoExtractor
DetectFile3=%ProgramFiles%\InnoExtractor
DetectFile4=%SystemDrive%\Programs\InnoExtractor
FileKey1=%AppData%\InnoExtractor|Historial.dat
FileKey2=%LocalAppData%\InnoExtractor|Historial.dat
FileKey3=%ProgramFiles%\InnoExtractor|Historial.dat
FileKey4=%SystemDrive%\Programs\InnoExtractor|Historial.dat

[InnoTab *]
LangSecRef=3021
DetectFile=%ProgramData%\VTech\DA
FileKey1=%ProgramData%\VTech\DA|*.log;InnoTab.txt;IntallLog.txt|RECURSE
FileKey2=%ProgramData%\VTech\DA\InnoTab\ConsoleLog|*
FileKey3=%ProgramData%\VTech\DA\InnoTab\Games\tmp|*|REMOVESELF

[Inpaint *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\Inpaint
RegKey1=HKCU\Software\Teorex\Inpaint\Recent File List
RegKey2=HKCU\Software\Teorex\Inpaint\RecentFileList
RegKey3=HKCU\Software\Teorex\Inpaint\Settings|Folder

[inSSIDer Home *]
LangSecRef=3024
Detect=HKCU\Software\MetaGeek, LLC\inSSIDer Home
FileKey1=%LocalAppData%\MetaGeek,_LLC|ConnectionErrorLog;MetaGeek-OUI.backup

[InstallShield *]
LangSecRef=3024
Detect=HKCU\Software\InstallShield
FileKey1=%ProgramFiles%|_ISTMP1.DIR
FileKey2=%ProgramFiles%\InstallShield Installation Information|*.log|RECURSE
FileKey3=%SystemDrive%|_ISTMP*.DIR
RegKey1=HKCU\Software\InstallShield\16.0\Professional\Recent File List
RegKey2=HKCU\Software\InstallShield\17.0\Professional\Recent File List
RegKey3=HKCU\Software\InstallShield\18.0\Professional\Recent File List
RegKey4=HKCU\Software\InstallShield\19.0\Professional\Recent File List
RegKey5=HKCU\Software\InstallShield\20.0\Professional\Recent File List
RegKey6=HKCU\Software\InstallShield\21.0\Professional\Recent File List
RegKey7=HKCU\Software\InstallShield\InstallShield Cabinet and Log File Viewer\Recent File List
RegKey8=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU1
RegKey9=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU2
RegKey10=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU3
RegKey11=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU4

[Instant Dungeon! *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\326720
FileKey1=%AppData%\Instant Dungeon|log.txt

[InstEd *]
LangSecRef=3024
Detect=HKCU\Software\instedit.com\insted
RegKey1=HKCU\Software\instedit.com\insted\MRU

[Intel *]
LangSecRef=3024
Detect1=HKCU\Software\Intel
Detect2=HKLM\Software\Intel
FileKey1=%LocalAppData%\Intel\IGN\Logs|*.log
FileKey2=%ProgramData%\Intel|*.bak;*.log;*Log*.txt|RECURSE
FileKey3=%ProgramData%\Intel\*\Log*|*
FileKey4=%ProgramData%\Intel\Logs|*|RECURSE
FileKey5=%ProgramData%\Intel\Uploader\Intel Telemetry\uploader\*|*
FileKey6=%ProgramFiles%\Intel\*|*.log;*Log.txt|RECURSE
FileKey7=%ProgramFiles%\Intel\InfInst|*|REMOVESELF
FileKey8=%SystemDrive%|IFRToolLog.txt
FileKey9=%SystemDrive%\Driver_allOS\MEI\Drivers\MEI\INTERNAL|*.log|RECURSE
FileKey10=%SystemDrive%\Intel|*.log|REMOVESELF
FileKey11=%SystemDrive%\Intel\Logs|*|REMOVESELF
FileKey12=%UserProfile%|BullseyeCoverageError.txt
FileKey13=%UserProfile%\Intel\Logs|*|REMOVESELF
FileKey14=%WinDir%\debug\Intel\Logs|*|REMOVESELF
FileKey15=%WinDir%\INF\Intel Storage Counters|*.tmp|RECURSE
FileKey16=%WinDir%\System32|Default_error_Stack-*.txt;Gms.log
FileKey17=%WinDir%\System32\config\systemprofile\Intel\Logs|*|REMOVESELF
FileKey18=%WinDir%\SysWOW64|Gms.log
FileKey19=%WinDir%\SysWOW64\config\systemprofile\Intel\Logs|*|REMOVESELF

[Intel Application Optimization *]
Section=Games
DetectFile=%AppData%\Intel\ApplicationOptimization
FileKey1=%AppData%\Intel\ApplicationOptimization|*.log

[Intel Driver & Support Assistant *]
LangSecRef=3024
DetectFile=%ProgramData%\Intel\DSA
FileKey1=%ProgramData%\Intel\DSA\Data|*
FileKey2=%ProgramData%\Intel\DSA\Logs|*|RECURSE
FileKey3=%WinDir%\System32\config\systemprofile\AppData\Local\Intel\SUR\IDSA|*

[Intel Extreme Tuning Utility *]
LangSecRef=3024
DetectFile=%ProgramData%\Intel\Intel Extreme Tuning Utility
FileKey1=%ProgramData%\Intel\Intel Extreme Tuning Utility\Logs|*|RECURSE

[Intel Graphics Command Center *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt
FileKey1=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\LocalState|gcc*_log_*.txt|RECURSE
FileKey4=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\LocalState\Games2\cache|*|RECURSE
FileKey5=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\LocalState\MetroLogs|*|RECURSE
FileKey6=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\LocalState\Promotions|*|RECURSE
FileKey7=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\Settings|*.log*
FileKey8=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\SystemAppData\Helium|*.log*
FileKey9=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\TempState|*|REMOVESELF
FileKey10=%ProgramData%\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\*\SystemAppData\Helium\Cache|*

[Intel Graphics Driver *]
LangSecRef=3024
DetectFile=%ProgramData%\Intel\GCC
FileKey1=%LocalAppData%\Intel\GCC|*log*
FileKey2=%ProgramData%\Intel\GCC|*
FileKey3=%ProgramData%\Intel\GFXInstaller|*.dmp;*.log|RECURSE
FileKey4=%SystemDrive%\Intel\GfxCPLBatchFiles|*|REMOVESELF
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Intel\GCC|*
FileKey6=%WinDir%\System32\drivers\DriverData\Intel\GfxDriver|*.etl
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\GCC|*log*.txt

[Intel Graphics Software *]
LangSecRef=3024
DetectFile=%LocalAppData%\Intel\IntelGraphicsSoftware
FileKey1=%LocalAppData%\Intel\IntelGraphicsSoftware\EBWebView\*cache*|*|RECURSE
FileKey2=%LocalAppData%\Intel\IntelGraphicsSoftware\EBWebView\Crashpad|*|RECURSE
FileKey3=%LocalAppData%\Intel\IntelGraphicsSoftware\EBWebView\Default\*cache*|*|RECURSE

[Intel NPU Driver *]
LangSecRef=3024
DetectFile=%ProgramData%\Intel\NPUInstaller
FileKey1=%ProgramData%\Intel\NPUInstaller|*.log|RECURSE

[Intel Processor Diagnostic Tool *]
LangSecRef=3024
Detect=HKCU\Software\Intel Corporation\Intel Processor Diagnostic Tool 64bit
FileKey1=%ProgramFiles%\Intel Corporation\Intel Processor Diagnostic Tool 64bit|*Results.txt;System_Info.txt;TestResults_Full.txt

[Intel Shader Cache *]
LangSecRef=3024
DetectFile1=%ProgramData%\Intel\ShaderCache
DetectFile2=%UserProfile%\AppData\LocalLow\Intel\ShaderCache
FileKey1=%ProgramData%\Intel\ShaderCache|*
FileKey2=%UserProfile%\AppData\LocalLow\Intel\ShaderCache|*
FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\LocalLow\Intel\ShaderCache|*

[Intel System Usage Report Service *]
LangSecRef=3024
DetectFile=%LocalAppData%\Intel\SUR
FileKey1=%LocalAppData%\Intel\SUR\QueenCreek\Collected Data|*error_stack-*.txt
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\collected_data|*.txt
FileKey3=%WinDir%\System32\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\collected_data\DebugLogs|*
FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\intermediate_data|*
FileKey5=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\collected_data\DebugLogs|*
FileKey6=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\intermediate_data|*
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData|*.bak;*.log;last_cfu.txt
FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\captured_logs|*
FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\downloads\*|*
FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\history|*

[Intel Thunderbolt Control Center *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AppUp.ThunderboltControlCenter_8j3eq9eme6ctt
FileKey1=%LocalAppData%\Packages\AppUp.ThunderboltControlCenter_8j3eq9eme6ctt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppUp.ThunderboltControlCenter_8j3eq9eme6ctt\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\AppUp.ThunderboltControlCenter_8j3eq9eme6ctt\Settings|*.log*
FileKey4=%LocalAppData%\Packages\AppUp.ThunderboltControlCenter_8j3eq9eme6ctt\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\AppUp.ThunderboltControlCenter_8j3eq9eme6ctt\TempState|*|REMOVESELF
FileKey6=%ProgramData%\Dell\UpdatePackage\Log|Intel-Thunderbolt-Controller-Application*.txt

[Intel Unison *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt
FileKey1=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\LocalCache|*.log
FileKey3=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\LocalState|bg_cache.bin
FileKey4=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\LocalState\BlobCache|*
FileKey5=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\Settings|*.log*
FileKey6=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\AppUp.IntelTechnologyMDE_8j3eq9eme6ctt\TempState|*|REMOVESELF

[Intel Update Manager *]
LangSecRef=3024
DetectFile=%ProgramData%\Intel(R) Update Manager
FileKey1=%ProgramData%\Intel(R) Update Manager\AppData|ium.log

[Intel Wireless Wi-Fi Drivers *]
LangSecRef=3024
Detect=HKLM\Software\RivetNetworks
FileKey1=%AppData%\Intel\Wireless\CrashDumps|*
FileKey2=%ProgramData%\RivetNetworks\ImageCache|*
FileKey3=%ProgramData%\RivetNetworks\Killer|*.log
FileKey4=%WinDir%\System32\drivers\RivetNetworks\Killer|*.log

[Inter-Tel Device *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Inter-Tel
FileKey1=%ProgramFiles%\Inter-Tel|*.log|RECURSE

[Internet Business Promoter *]
LangSecRef=3022
DetectFile=%AppData%\IBP
FileKey1=%AppData%\IBP|*.bak;*Log.txt|RECURSE

[Internet Download Manager *]
LangSecRef=3022
Detect=HKCU\Software\DownloadManager
FileKey1=%AppData%\IDM|*.Log;*.txt
FileKey2=%AppData%\IDM\DwnlData|*|REMOVESELF
FileKey3=%ProgramFiles%\Internet Download Manager|*.log
FileKey4=%SystemDrive%|IDMSetup2.log
RegKey1=HKCU\Software\DownloadManager\1
RegKey2=HKCU\Software\DownloadManager\2
RegKey3=HKCU\Software\DownloadManager\3
RegKey4=HKCU\Software\DownloadManager\4
RegKey5=HKCU\Software\DownloadManager\5
RegKey6=HKCU\Software\DownloadManager\6
RegKey7=HKCU\Software\DownloadManager\7
RegKey8=HKCU\Software\DownloadManager\8
RegKey9=HKCU\Software\DownloadManager\9
RegKey10=HKCU\Software\DownloadManager\10
RegKey11=HKCU\Software\DownloadManager\11
RegKey12=HKCU\Software\DownloadManager\12
RegKey13=HKCU\Software\DownloadManager\13
RegKey14=HKCU\Software\DownloadManager\14
RegKey15=HKCU\Software\DownloadManager\15
RegKey16=HKCU\Software\DownloadManager\16
RegKey17=HKCU\Software\DownloadManager\17
RegKey18=HKCU\Software\DownloadManager\18
RegKey19=HKCU\Software\DownloadManager\19
RegKey20=HKCU\Software\DownloadManager\20
RegKey21=HKCU\Software\DownloadManager\21
RegKey22=HKCU\Software\DownloadManager\22
RegKey23=HKCU\Software\DownloadManager\23
RegKey24=HKCU\Software\DownloadManager\24
RegKey25=HKCU\Software\DownloadManager\25
RegKey26=HKCU\Software\DownloadManager\26
RegKey27=HKCU\Software\DownloadManager\27
RegKey28=HKCU\Software\DownloadManager\28
RegKey29=HKCU\Software\DownloadManager\29
RegKey30=HKCU\Software\DownloadManager\30
RegKey31=HKCU\Software\DownloadManager\31
RegKey32=HKCU\Software\DownloadManager\32
RegKey33=HKCU\Software\DownloadManager\33
RegKey34=HKCU\Software\DownloadManager\34
RegKey35=HKCU\Software\DownloadManager\35
RegKey36=HKCU\Software\DownloadManager\36
RegKey37=HKCU\Software\DownloadManager\37
RegKey38=HKCU\Software\DownloadManager\38
RegKey39=HKCU\Software\DownloadManager\39
RegKey40=HKCU\Software\DownloadManager\40
RegKey41=HKCU\Software\DownloadManager\41
RegKey42=HKCU\Software\DownloadManager\42
RegKey43=HKCU\Software\DownloadManager\43
RegKey44=HKCU\Software\DownloadManager\44
RegKey45=HKCU\Software\DownloadManager\45
RegKey46=HKCU\Software\DownloadManager\46
RegKey47=HKCU\Software\DownloadManager\47
RegKey48=HKCU\Software\DownloadManager\48
RegKey49=HKCU\Software\DownloadManager\49
RegKey50=HKCU\Software\DownloadManager\50
RegKey51=HKCU\Software\DownloadManager\51
RegKey52=HKCU\Software\DownloadManager\52
RegKey53=HKCU\Software\DownloadManager\53
RegKey54=HKCU\Software\DownloadManager\54
RegKey55=HKCU\Software\DownloadManager\55
RegKey56=HKCU\Software\DownloadManager\56
RegKey57=HKCU\Software\DownloadManager\57
RegKey58=HKCU\Software\DownloadManager\58
RegKey59=HKCU\Software\DownloadManager\59
RegKey60=HKCU\Software\DownloadManager\60
RegKey61=HKCU\Software\DownloadManager\61
RegKey62=HKCU\Software\DownloadManager\62
RegKey63=HKCU\Software\DownloadManager\63
RegKey64=HKCU\Software\DownloadManager\64
RegKey65=HKCU\Software\DownloadManager\65
RegKey66=HKCU\Software\DownloadManager\66
RegKey67=HKCU\Software\DownloadManager\67
RegKey68=HKCU\Software\DownloadManager\68
RegKey69=HKCU\Software\DownloadManager\69
RegKey70=HKCU\Software\DownloadManager\70
RegKey71=HKCU\Software\DownloadManager\71
RegKey72=HKCU\Software\DownloadManager\72
RegKey73=HKCU\Software\DownloadManager\73
RegKey74=HKCU\Software\DownloadManager\74
RegKey75=HKCU\Software\DownloadManager\75
RegKey76=HKCU\Software\DownloadManager\maxID

[Intuit Data Protect *]
LangSecRef=3024
DetectFile=%LocalAppData%\Intuit\Intuit Data Protect
FileKey1=%LocalAppData%\Intuit\Intuit Data Protect|*.log
FileKey2=%ProgramData%\Intuit\Intuit Data Protect|*.log

[Intuit Entitlement Client *]
LangSecRef=3021
DetectFile=%ProgramData%\Intuit\Entitlement Client
FileKey1=%ProgramData%\Intuit\Entitlement Client\*|IntuitEntitlementLog*

[Intuit Proline Tax Import *]
LangSecRef=3021
DetectFile=%AppData%\Intuit\PTI
FileKey1=%AppData%\Intuit\PTI\Log|*

[Intuit QuickBooks *]
LangSecRef=3021
Detect=HKLM\Software\Intuit\QuickBooks
FileKey1=%CommonProgramFiles%\Intuit\Quickbooks\QBUpdate\Log|*
FileKey2=%LocalAppData%\Intuit\QuickBooks\Log|*|RECURSE
FileKey3=%ProgramData%\Common Files\Intuit\Quickbooks\qbupdate\log|*
FileKey4=%ProgramData%\Intuit\QBWebConnector\log|*
FileKey5=%ProgramData%\Intuit\Quickbooks|*.log;qbsdklog.txt
FileKey6=%ProgramData%\Intuit\QuickBooks DB Server Manager|*.log;*.old

[Intuit Quicken *]
LangSecRef=3021
Detect1=HKLM\Software\Intuit\Quicken
Detect2=HKLM\Software\Quicken
FileKey1=%AppData%\Intuit\Quicken\Log|*.log;*.txt
FileKey2=%AppData%\Quicken\Log|*.log;*.txt
FileKey3=%LocalAppData%\Intuit\Common\Authorization\V1\Logs|*.txt
FileKey4=%LocalAppData%\Quicken\Common\Authorization\V1\Logs|*.txt
FileKey5=%ProgramData%\Intuit\Quicken\Log|*.log
FileKey6=%ProgramData%\Intuit\Quicken\Log\installer|*|REMOVESELF
FileKey7=%ProgramData%\Intuit\SendError|*.log
FileKey8=%ProgramData%\Quicken\Inet\QWWebData|LOG.old|RECURSE
FileKey9=%ProgramData%\Quicken\Inet\QWWebData\Cache|*
FileKey10=%ProgramData%\Quicken\Inet\QWWebData\GPUCache|*|REMOVESELF
FileKey11=%ProgramData%\Quicken\Inet\QWWebData\Local Storage\leveldb|*tmp
FileKey12=%ProgramData%\Quicken\Log|*.log
FileKey13=%ProgramData%\Quicken\Log\installer|*|REMOVESELF
FileKey14=%ProgramData%\Quicken\SendError|*.log
FileKey15=%ProgramFiles%\Quicken\PDFDrv|install.log;InstallPDFConverter.log
FileKey16=%UserProfile%\Documents\Quicken\GPUCache|*|REMOVESELF

[Intuit TurboTax *]
LangSecRef=3021
DetectFile=%ProgramFiles%\TurboTax*
FileKey1=%AppData%\Intuit*|*.log|RECURSE
FileKey2=%CommonProgramFiles%\Intuit\Internet Client|Msdun13.exe
FileKey3=%ProgramData%|*.bc
FileKey4=%ProgramData%\Intuit*|*.log|RECURSE
FileKey5=%ProgramData%\Intuit\Common\*\*\Logs|*
FileKey6=%ProgramData%\Intuit\TurboTax\MSI\*\Logs|*
FileKey7=%ProgramFiles%\TurboTax*|*.txt

[inZOI *]
Section=Games
DetectFile=%LocalAppData%\BlueClient
FileKey1=%LocalAppData%\BlueClient\Intermediate\AssetRegistryCache|*
FileKey2=%LocalAppData%\BlueClient\Saved|*.upipelinecache
FileKey3=%LocalAppData%\BlueClient\Saved\Logs|*|RECURSE
FileKey4=%LocalAppData%\BlueClient\Saved\webcache_*|*|RECURSE
FileKey5=%UserProfile%\Documents\inZOI|*.log

[IObit Advanced SystemCare *]
LangSecRef=3024
Detect=HKLM\Software\IObit\Advanced SystemCare
FileKey1=%AppData%\IObit\Advanced SystemCare*|*.log;*_UndeleteReg.dat
FileKey2=%AppData%\IObit\Advanced SystemCare*\Backup|*.reg
FileKey3=%AppData%\IObit\Advanced SystemCare*\Boottime|*.log
FileKey4=%AppData%\IObit\Advanced SystemCare*\ClonedFilesScanner|*_log.txt
FileKey5=%AppData%\IObit\Advanced SystemCare*\EmptyFolder|*|RECURSE
FileKey6=%AppData%\IObit\Advanced SystemCare*\Homepage*|*.new;*.old
FileKey7=%AppData%\IObit\Advanced SystemCare*\Log|*|RECURSE
FileKey8=%AppData%\IObit\Advanced SystemCare*\LogBackup*|*|RECURSE
FileKey9=%AppData%\IObit\Advanced SystemCare*\TrayProductData|StatCache.db
FileKey10=%ProgramData%\IObit\Advanced SystemCare*\Homepage*|*.log
FileKey11=%ProgramData%\IObit\Advanced SystemCare*\Log|*|REMOVESELF
FileKey12=%ProgramData%\IObit\ASCDownloader|*.log
FileKey13=%ProgramFiles%\IObit\Advanced SystemCare Ultimate\Antivirus\BackupRec|*|RECURSE
FileKey14=%ProgramFiles%\IObit\Advanced SystemCare*|*.log;*.tmp;*.txt|RECURSE
FileKey15=%ProgramFiles%\IObit\Advanced SystemCare*\*.cab_Temp|*|REMOVESELF
FileKey16=%ProgramFiles%\IObit\Advanced SystemCare*\ASCServiceLog|*|RECURSE
FileKey17=%ProgramFiles%\IObit\Advanced SystemCare*\DumpFile|*.dmp
FileKey18=%ProgramFiles%\IObit\Advanced SystemCare*\LatestNews|*.dat
FileKey19=%ProgramFiles%\IObit\Advanced SystemCare*\Update|UpdateHistory.ini
FileKey20=%SystemDrive%\Users\Default\AppData\Roaming\IObit\Advanced SystemCare*|*.log
FileKey21=%WinDir%\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare*|*.log
FileKey22=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare*|*.log
RegKey1=HKLM\Software\IObit\Advanced SystemCare|LastUseDate
RegKey2=HKLM\Software\IObit\Advanced SystemCare|LastWrite
RegKey3=HKLM\Software\IObit\ASC|UninstallDate

[IObit Driver Booster *]
LangSecRef=3024
DetectFile1=%AppData%\IObit\Driver Booster
DetectFile2=%ProgramFiles%\IObit\Driver Booster
FileKey1=%AppData%\IObit\Driver Booster|*.log|RECURSE
FileKey2=%AppData%\IObit\Driver Booster\Logs|*|RECURSE
FileKey3=%ProgramFiles%\IObit\Driver Booster|*.log
FileKey4=%ProgramFiles%\IObit\Driver Booster\Update|*.tmp

[IObit KB Downloader *]
LangSecRef=3024
DetectFile=%ProgramData%\IObit\KBDownloader
FileKey1=%ProgramData%\IObit\KBDownloader|*|RECURSE

[IObit LiveUpdate *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\LiveUpdate
FileKey1=%ProgramFiles%\IObit\LiveUpdate|*.log|RECURSE

[IObit Malware Fighter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\IObit Malware Fighter
FileKey1=%ProgramFiles%\IObit\IObit Malware Fighter\adsremoval\IE|*.log
FileKey2=%ProgramFiles%\IObit\IObit Malware Fighter\log|*|RECURSE

[IObit Smart Defrag *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\Smart Defrag*
FileKey1=%ProgramFiles%\IObit\Smart Defrag*|*.log
FileKey2=%ProgramFiles%\IObit\Smart Defrag*\Log|*
FileKey3=%ProgramFiles%\IObit\Smart Defrag*\Temp|*|RECURSE
FileKey4=%ProgramFiles%\IObit\Smart Defrag*\Update|*.tmp

[IObit Software Updater *]
LangSecRef=3024
DetectFile=%AppData%\IObit\Software Updater
FileKey1=%AppData%\IObit\Software Updater|*.log;UpdateInfo.ini
FileKey2=%AppData%\IObit\Software Updater\*Log|*

[IObit StartMenu8 *]
LangSecRef=3024
Detect=HKLM\Software\IObit\StartMenu
FileKey1=%AppData%\IObit\StartMenu 8|*.log
FileKey2=%ProgramFiles%\IObit\Start Menu 8\Freeware|*.exe

[IObit Uninstaller *]
LangSecRef=3024
DetectFile=%AppData%\IObit\IObit Uninstaller
FileKey1=%AppData%\IObit\IObit Uninstaller\*Log|*
FileKey2=%AppData%\IObit\IObit Uninstaller\Installer|*.dbg
FileKey3=%ProgramFiles%\IObit\iObit Uninstaller|*.log|RECURSE

[IP Hider Pro *]
LangSecRef=3022
DetectFile=%AppData%\IP Hider Pro
FileKey1=%AppData%\IP Hider Pro\Logs|*

[Iperius Backup *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Iperius Backup
FileKey1=%ProgramData%\IperiusBackup\Logs|*|RECURSE

[IPinside LWS Agent *]
LangSecRef=3021
DetectFile=%UserProfile%\AppData\LocalLow\IPinside
FileKey1=%UserProfile%\AppData\LocalLow\IPinside|*.log

[iPod-Cloner *]
LangSecRef=3023
Detect=HKCU\Software\iPod-Cloner
FileKey1=%ProgramFiles%\iPod-Cloner|*.log
FileKey2=%ProgramFiles%\iPod-Cloner\ReadCache|*
FileKey3=%SystemDrive%|dtdlog.txt

[iResizer *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\iResizer
RegKey1=HKCU\Software\Teorex\iResizer\RecentFileList

[Iridium Autofill Data & Search Engine Preferences *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|*Web Data
FileKey2=%LocalAppData%\Iridium\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Iridium\User Data\AutoFill*|*|REMOVESELF

[Iridium Autoplay Preferences *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\MEIPreload|*|REMOVESELF

[Iridium Bookmark Backups *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|Bookmarks.bak

[Iridium Bookmark Favicons *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|favicons*

[Iridium Caches *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Iridium\User Data|Module Info Cache
FileKey3=%LocalAppData%\Iridium\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Iridium\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Iridium\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Iridium\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Iridium\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Iridium\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Iridium\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Iridium\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Iridium\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Iridium\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Iridium\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Iridium\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Iridium\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Iridium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Iridium\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Iridium\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Iridium\User Data\Optimization*|*|REMOVESELF

[Iridium Default App Handlers *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|PreferredApps

[Iridium Download History *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Iridium\User Data\*\shared_proto_db|*|REMOVESELF

[Iridium DRM Data *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Iridium\User Data\WidevineCdm|*|REMOVESELF

[Iridium Extension Cookies *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|Extension Cookies

[Iridium Pinned Tabs *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
RegKey1=HKCU\Software\Iridium\PreferenceMACs\Default|pinned_tabs

[Iridium Privacy Sandbox *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Iridium\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Iridium\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Iridium\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Iridium\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Iridium\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Iridium\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Iridium\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Iridium Progressive Web Apps *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\Web Applications|*|REMOVESELF

[Iridium Saved Usernames & Passwords *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|Login Data*

[Iridium Security & Threat Detection *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|DIPS*
FileKey2=%LocalAppData%\Iridium\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Iridium\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Iridium\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Iridium\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Iridium\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Iridium\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Iridium\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Iridium\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Iridium\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Iridium\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Iridium\User Data\ZxcvbnData|*|REMOVESELF

[Iridium Shopping Insights *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Iridium\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Iridium\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Iridium\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Iridium\User Data\*\parcel_tracking_db|*|REMOVESELF

[Iridium Storage Quota Manager *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|QuotaManager

[Iridium Sync Data *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\Sync Data|*|REMOVESELF

[Iridium Telemetry *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\Application|debug.log
FileKey2=%LocalAppData%\Iridium\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Iridium\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Iridium\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Iridium\User Data\*|*.log
FileKey6=%LocalAppData%\Iridium\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Iridium\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Iridium\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Iridium\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Iridium\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Iridium\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Iridium\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Iridium\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Iridium\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Iridium\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Iridium\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Iridium\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Iridium\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Iridium\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Iridium\Application|debug.log
FileKey21=%ProgramFiles%\Iridium\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Iridium\BlBeacon|failed_count
RegKey2=HKCU\Software\Iridium\BlBeacon|state
RegKey3=HKCU\Software\Iridium\Installer|LastChecked
RegKey4=HKCU\Software\Iridium\StabilityMetrics

[Iridium Web Browsing Cookies *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\Network|Cookies*;Device Bound Sessions*

[Iridium Web Browsing History *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Iridium Web Browsing Session *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Iridium\User Data\*\Sessions|*|REMOVESELF

[Iridium Web Storage *]
Section=Iridium Web Browser
DetectFile=%LocalAppData%\Iridium\User Data
FileKey1=%LocalAppData%\Iridium\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Iridium\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Iridium\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Iridium\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Iridium\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Iridium\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Iridium\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Iridium\User Data\*\WebStorage|*|REMOVESELF

[iSkysoft Helper Compact *]
LangSecRef=3023
DetectFile=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact
FileKey1=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact|ISHelper*.exe_temp;ProductUpdateLists.xml
FileKey2=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\DATADICT|*|RECURSE
FileKey3=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\log|*|RECURSE
FileKey4=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\Temp|*|RECURSE
RegKey1=HKLM\Software\iSkysoft\iSkysoft Helper Compact
RegKey2=HKLM\Software\Wow6432Node\iSkysoft\iSkysoft Helper Compact

[iSkysoft Video Converter *]
LangSecRef=3023
Detect1=HKLM\Software\iSkysoft\iSkysoft Video Converter
Detect2=HKLM\Software\iSkysoft\iSkysoft Video Converter Ultimate
FileKey1=%ProgramData%\iSkysoft Video Converter*|*.dat.bak
FileKey2=%ProgramData%\iSkysoft Video Converter*\Temp*Dir|*|RECURSE
FileKey3=%ProgramFiles%\iSkysoft\Video Converter*\Log|*|RECURSE
FileKey4=%ProgramFiles%\iSkysoft\Video Converter*\TempThumbDir|*|RECURSE

[iSkysoft Video Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\iSkysoft\Video Editor
FileKey1=%ProgramFiles%\iSkysoft\Video Editor\Log|*.txt

[IsoBuster *]
LangSecRef=3021
Detect=HKCU\Software\Smart Projects\IsoBuster
RegKey1=HKCU\Software\Smart Projects\IsoBuster\RecentImages

[iSpy *]
LangSecRef=3021
Detect=HKCU\Software\ISpy\ISPY
FileKey1=%AppData%\iSpy\WebServerRoot\Media|*|RECURSE
FileKey2=%LocalAppData%\iSpy\WebServerRoot\Media|*|RECURSE

[iSysCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Utils\iSysCleaner
FileKey1=%ProgramFiles%\Utils\iSysCleaner\traces|*

[It Takes Two *]
Section=Games
DetectFile=%LocalAppData%\ItTakesTwo
FileKey1=%LocalAppData%\ItTakesTwo\Saved\Logs|*

[iTop Screen Recorder *]
LangSecRef=3023
DetectFile=%AppData%\iTop Screen Recorder
FileKey1=%AppData%\iTop Screen Recorder\Logs|*

[iTop Screenshot *]
LangSecRef=3024
DetectFile=%AppData%\iTop Screenshot
FileKey1=%AppData%\iTop Screenshot\Log|*.log

[iTop VPN *]
LangSecRef=3022
DetectFile=%AppData%\iTop VPN
FileKey1=%AppData%\iTop VPN\Log|*.bak*;*.log

[iWisoft Free Video Converter *]
LangSecRef=3023
DetectFile=%ProgramFiles%\iWisoft Free Video Converter
FileKey1=%ProgramFiles%\iWisoft Free Video Converter|VideoConverter.log

[iXL *]
LangSecRef=3021
DetectFile=%AppData%\Fisher-Price\iXL
FileKey1=%AppData%\Fisher-Price\iXL\Log|*

[iZotope RX 2 *]
LangSecRef=3021
DetectFile=%AppData%\iZotope\iZotope RX 2 Session Data
FileKey1=%AppData%\iZotope\iZotope RX 2 Session Data|*|RECURSE

[Jade Empire *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\7110
FileKey1=%ProgramFiles%\Steam\steamapps\common\Jade Empire\logs|*

[Jagex Launcher *]
Section=Games
DetectFile=%UserProfile%\jagexcache
FileKey1=%ProgramData%\Jagex|*.jcache|RECURSE
FileKey2=%UserProfile%\jagex*|*|RECURSE
FileKey3=%WinDir%\.jagex*|*|REMOVESELF
ExcludeKey1=PATH|%UserProfile%\jagexcache\jagexlauncher\|*

[JAJC *]
LangSecRef=3022
DetectFile=%UserProfile%\JAJC
FileKey1=%UserProfile%\JAJC\Avatars|*|RECURSE
FileKey2=%UserProfile%\JAJC\Logs|*|RECURSE

[Jalatext *]
LangSecRef=3021
DetectFile=%UserProfile%\.jalatext
FileKey1=%UserProfile%\.jalatext\log|*

[James Patterson's Women's Murder Club: Twice in a Blue Moon *]
Section=Games
DetectFile=%AppData%\Flood Light Games\WMC3
FileKey1=%AppData%\Flood Light Games\WMC3|*.log

[jAnrufmonitor *]
LangSecRef=3022
DetectFile=%ProgramFiles%\jAnrufmonitor
FileKey1=%ProgramFiles%\jAnrufmonitor\data|*.log
FileKey2=%ProgramFiles%\jAnrufmonitor\lib\cache|classloader.cache.log
FileKey3=%ProgramFiles%\jAnrufmonitor\logs|*

[Jasc Animation Shop *]
LangSecRef=3023
Detect1=HKCU\Software\JASC\Animation Shop
Detect2=HKCU\Software\Jasc\Animation Shop 2
RegKey1=HKCU\Software\Jasc\Animation Shop 2\Recent File List
RegKey2=HKCU\Software\JASC\Animation Shop\Cache

[Jatter Autofill Data & Search Engine Preferences *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|*Web Data
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Jatter\Jatter\User Data\AutoFill*|*|REMOVESELF

[Jatter Autoplay Preferences *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\MEIPreload|*|REMOVESELF

[Jatter Bookmark Backups *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|Bookmarks.bak

[Jatter Bookmark Favicons *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|favicons*

[Jatter Caches *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Jatter\Jatter\User Data|Module Info Cache
FileKey3=%LocalAppData%\Jatter\Jatter\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Jatter\Jatter\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Jatter\Jatter\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Jatter\Jatter\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Jatter\Jatter\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Jatter\Jatter\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Jatter\Jatter\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Jatter\Jatter\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Jatter\Jatter\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Jatter\Jatter\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Jatter\Jatter\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Jatter\Jatter\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Jatter\Jatter\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Jatter\Jatter\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Jatter\Jatter\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Jatter\Jatter\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Jatter\Jatter\User Data\Optimization*|*|REMOVESELF

[Jatter Default App Handlers *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|PreferredApps

[Jatter Download History *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*\shared_proto_db|*|REMOVESELF

[Jatter DRM Data *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\WidevineCdm|*|REMOVESELF

[Jatter Extension Cookies *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|Extension Cookies

[Jatter Pinned Tabs *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
RegKey1=HKCU\Software\Jatter\Jatter\PreferenceMACs\Default|pinned_tabs

[Jatter Privacy Sandbox *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Jatter\Jatter\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Jatter\Jatter\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Jatter\Jatter\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Jatter\Jatter\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Jatter\Jatter\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Jatter\Jatter\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Jatter Progressive Web Apps *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\Web Applications|*|REMOVESELF

[Jatter Saved Usernames & Passwords *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|Login Data*

[Jatter Security & Threat Detection *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|DIPS*
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Jatter\Jatter\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Jatter\Jatter\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Jatter\Jatter\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Jatter\Jatter\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Jatter\Jatter\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Jatter\Jatter\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Jatter\Jatter\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Jatter\Jatter\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Jatter\Jatter\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Jatter\Jatter\User Data\ZxcvbnData|*|REMOVESELF

[Jatter Shopping Insights *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Jatter\Jatter\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Jatter\Jatter\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Jatter\Jatter\User Data\*\parcel_tracking_db|*|REMOVESELF

[Jatter Storage Quota Manager *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|QuotaManager

[Jatter Sync Data *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\Sync Data|*|REMOVESELF

[Jatter Telemetry *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\Application|debug.log
FileKey2=%LocalAppData%\Jatter\Jatter\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Jatter\Jatter\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Jatter\Jatter\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Jatter\Jatter\User Data\*|*.log
FileKey6=%LocalAppData%\Jatter\Jatter\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Jatter\Jatter\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Jatter\Jatter\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Jatter\Jatter\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Jatter\Jatter\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Jatter\Jatter\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Jatter\Jatter\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Jatter\Jatter\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Jatter\Jatter\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Jatter\Jatter\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Jatter\Jatter\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Jatter\Jatter\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Jatter\Jatter\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Jatter\Jatter\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Jatter\Jatter\Application|debug.log
FileKey21=%ProgramFiles%\Jatter\Jatter\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Jatter\Jatter\BlBeacon|failed_count
RegKey2=HKCU\Software\Jatter\Jatter\BlBeacon|state
RegKey3=HKCU\Software\Jatter\Jatter\Installer|LastChecked
RegKey4=HKCU\Software\Jatter\Jatter\StabilityMetrics

[Jatter Web Browsing Cookies *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\Network|Cookies*;Device Bound Sessions*

[Jatter Web Browsing History *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Jatter Web Browsing Session *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*\Sessions|*|REMOVESELF

[Jatter Web Storage *]
Section=Jatter Web Browser
DetectFile=%LocalAppData%\Jatter\Jatter\User Data
FileKey1=%LocalAppData%\Jatter\Jatter\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Jatter\Jatter\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Jatter\Jatter\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Jatter\Jatter\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Jatter\Jatter\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Jatter\Jatter\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Jatter\Jatter\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Jatter\Jatter\User Data\*\WebStorage|*|REMOVESELF

[JavaRa *]
LangSecRef=3022
DetectFile=%ProgramFiles%\JavaRa*
FileKey1=%ProgramFiles%\JavaRa 2.0|*.log|RECURSE
FileKey2=%SystemDrive%|JavaRa.log

[Javelin PDF Reader *]
LangSecRef=3021
DetectFile=%AppData%\DrumlinSecurity\JavelinNew
FileKey1=%AppData%\DrumlinSecurity\JavelinNew|*history.xml
FileKey2=%AppData%\DrumlinSecurity\JavelinNew\logs|*

[JDownloader *]
LangSecRef=3022
Detect1=HKLM\Software\Classes\JDownloader2
Detect2=HKLM\Software\JDownloader
DetectFile1=%ProgramFiles%\JDownloader
DetectFile2=%ProgramFiles%\JDownloader 2
FileKey1=%LocalAppData%\JDownloader*2*|*.log;SessionInstallLog.json.*|RECURSE
FileKey2=%LocalAppData%\JDownloader*2*\.install4j|*.log
FileKey3=%LocalAppData%\JDownloader*2*\captchas|*|RECURSE
FileKey4=%LocalAppData%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey5=%LocalAppData%\JDownloader*2*\logs|*|RECURSE
FileKey6=%LocalAppData%\JDownloader*2*\tmp|*|RECURSE
FileKey7=%ProgramFiles%\JDownloader*|*.lck;*.log;*.log.*;SessionInstallLog.json.*;updateLog.txt|RECURSE
FileKey8=%ProgramFiles%\JDownloader*\.junique|*
FileKey9=%ProgramFiles%\JDownloader*\captchas|*|RECURSE
FileKey10=%ProgramFiles%\JDownloader*\container|*
FileKey11=%ProgramFiles%\JDownloader*\downloads|*
FileKey12=%ProgramFiles%\JDownloader*\tmp\linksave|*
FileKey13=%ProgramFiles%\JDownloader*2*\.install4j|*.log
FileKey14=%ProgramFiles%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey15=%ProgramFiles%\JDownloader*2*\logs|*|RECURSE
FileKey16=%ProgramFiles%\JDownloader*2*\tmp|*|RECURSE
FileKey17=%UserProfile%\.jd_home|JDownloader.log
FileKey18=%UserProfile%\.jd_home\logs|*.0
ExcludeKey1=FILE|%LocalAppData%\JDownloader 2.0\.install4j\|files.log
ExcludeKey2=PATH|%LocalAppData%\JDownloader*2*\cfg\|subconf_*.ejs
ExcludeKey3=PATH|%ProgramFiles%\JDownloader*2*\cfg\|subconf_*.ejs

[JDownloader Backups *]
LangSecRef=3022
Detect=HKLM\Software\JDownloader
DetectFile=%ProgramFiles%\JDownloader
FileKey1=%ProgramFiles%\JDownloader*\backup|*

[jEdit *]
LangSecRef=3021
DetectFile=%UserProfile%\.jedit
FileKey1=%UserProfile%\.jedit|*.log|RECURSE
FileKey2=%UserProfile%\.jedit\jars-cache|*|RECURSE

[Jellyfin Media Player *]
LangSecRef=3023
DetectFile=%LocalAppData%\JellyfinMediaPlayer
FileKey1=%LocalAppData%\Jellyfin Media Player\cache|*|RECURSE
FileKey2=%LocalAppData%\Jellyfin Media Player\QtWebEngine\Default\GPUCache|*
FileKey3=%LocalAppData%\JellyfinMediaPlayer\logs|*.log

[Jet Downloader *]
LangSecRef=3022
DetectFile=%ProgramFiles%\CloudTech\Jet Downloader
FileKey1=%ProgramFiles%\CloudTech\Jet Downloader|*.log

[JetBrains dotPeek v1.1 *]
LangSecRef=3024
Detect=HKLM\Software\JetBrains\dotPeek
FileKey1=%LocalAppData%\JetBrains\dotPeek\v1.1\Caches|*|REMOVESELF

[Jetbrains IntelliJ IDEA *]
LangSecRef=3024
Detect1=HKCU\Software\JetBrains\IntelliJ IDEA
Detect2=HKCU\Software\JetBrains\IntelliJ IDEA Community Edition
FileKey1=%UserProfile%\.IdeaC*\System\Caches|*
FileKey2=%UserProfile%\.IdeaC*\System\LocalHistory|*
FileKey3=%UserProfile%\.IdeaC*\System\Logs|*
FileKey4=%UserProfile%\.IdeaC*\System\tmp|*|RECURSE
FileKey5=%UserProfile%\.IntelliJIdea12\system\Caches|*
FileKey6=%UserProfile%\.IntelliJIdea12\system\LocalHistory|*
FileKey7=%UserProfile%\.IntelliJIdea12\system\log|*
FileKey8=%UserProfile%\.IntelliJIdea12\system\tmp|*|RECURSE

[Jetbrains Pycharm *]
LangSecRef=3024
Detect=HKCU\Software\JetBrains\PyCharm
FileKey1=%UserProfile%\.PyCharm*\system\caches|*
FileKey2=%UserProfile%\.PyCharm*\system\log|*

[Jetbrains WebStorm *]
LangSecRef=3024
Detect=HKCU\Software\JetBrains\WebStorm
FileKey1=%UserProfile%\.WebIde50\system\Caches|*|RECURSE
FileKey2=%UserProfile%\.WebIde50\system\LocalHistory|*|RECURSE
FileKey3=%UserProfile%\.WebIde50\system\Log|*|RECURSE
FileKey4=%UserProfile%\.WebIde50\system\tmp|*|RECURSE

[Jetico Personal Firewall *]
LangSecRef=3022
Detect=HKCU\Software\Jetico\Personal Firewall
FileKey1=%ProgramFiles%\Jetico\Jetico Personal Firewall|*.log

[Jitsi *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Jitsi
FileKey1=%AppData%\Jitsi\avatarcache|*|RECURSE
FileKey2=%AppData%\Jitsi\Log|*|RECURSE

[Jitsi Chat/File History *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Jitsi
FileKey1=%AppData%\Jitsi\History*|*|RECURSE

[Joboshare DVD Toolkit *]
LangSecRef=3023
Detect=HKCU\Software\Joboshare
FileKey1=%SystemDrive%|*temp.txt;*test.txt
FileKey2=%UserProfile%\Documents\Joboshare\DVD Copy\ifo_temp|*|REMOVESELF
FileKey3=%UserProfile%\Documents\Joboshare\DVD Copy\log|*|REMOVESELF

[Join.Me *]
LangSecRef=3022
Detect=HKCU\Software\join.me
FileKey1=%LocalAppData%\join.me|*.log
FileKey2=%LocalAppData%\join.me\join.me.*.*.*.*|*|REMOVESELF

[Jojo's Fashion Show *]
Section=Games
DetectFile=%AppData%\Gamelab\Jojos Fashion Show
FileKey1=%AppData%\Gamelab\Jojos Fashion Show|log.txt

[JOSM *]
LangSecRef=3021
DetectFile=%LocalAppData%\JOSM
FileKey1=%LocalAppData%\JOSM\cache\tiles|*|RECURSE

[JRecoverer Software *]
LangSecRef=3024
DetectFile=%UserProfile%\.jrecoverer-*
FileKey1=%UserProfile%\.jrecoverer-*\logs|*.log
FileKey2=%UserProfile%\.jrecoverer-*\reports|*|RECURSE

[JRiver Media Center 18 *]
LangSecRef=3023
Detect=HKCU\Software\J. River\Media Center 18
FileKey1=%AppData%\J River\Media Center 18\Library|field (filename).jmd;field (name).jmd
FileKey2=%UserProfile%\Documents\J River\Media Center 18\Library|*|RECURSE

[Jubler Subtitle Editor *]
LangSecRef=3023
DetectFile=%AppData%\Jubler
FileKey1=%AppData%\Jubler|log.txt

[Juniper Networks *]
LangSecRef=3021
Detect1=HKCU\Software\Juniper Networks
Detect2=HKLM\Software\Juniper Networks
FileKey1=%AppData%\Juniper Networks|*.log;*.old|RECURSE
FileKey2=%LocalAppData%\Juniper Networks\Logging|*
RegKey1=HKLM\Software\Juniper Networks\Default

[Just King *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Vish Game Studio\King
FileKey1=%UserProfile%\AppData\LocalLow\Vish Game Studio\King|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Vish Game Studio\King\Unity|*|REMOVESELF

[Just Manager *]
LangSecRef=3021
Detect=HKLM\Software\JustManager
DetectFile=%ProgramFiles%\JustManager
FileKey1=%LocalAppData%\JustManager|Log.txt

[jv16 PowerTools *]
LangSecRef=3024
DetectFile=%ProgramFiles%\jv16 PowerTools*
FileKey1=%LocalAppData%\jv16PowerTools|*.log
FileKey2=%ProgramFiles%\jv16 PowerTools*|*.log
FileKey3=%ProgramFiles%\jv16 PowerTools*\Settings|*.log
FileKey4=%ProgramFiles%\jv16 PowerTools*\Temp|*|RECURSE
FileKey5=%ProgramFiles%\jv16 PowerTools\Debug|*.log;*.txt

[jv16 PowerTools Backups *]
LangSecRef=3024
DetectFile=%ProgramFiles%\jv16 PowerTools*
FileKey1=%ProgramFiles%\jv16 PowerTools*|*.reg
FileKey2=%ProgramFiles%\jv16 PowerTools*\Backups|*|RECURSE

[jv16 RegCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegCleaner
FileKey1=%ProgramFiles%\RegCleaner|old.dat
FileKey2=%ProgramFiles%\RegCleaner\Backups|*

[K-Lite Codec Pack *]
LangSecRef=3023
Detect=HKLM\Software\KLCodecPack
FileKey1=%ProgramFiles%\K-Lite*|*.log;*.txt|RECURSE
FileKey2=%SystemDrive%|*klcp_iph_*.tmp;*klcp_itp_*.tmp
FileKey3=%UserProfile%\Desktop|klcp_codec_log.txt
RegKey1=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path0
RegKey2=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path1
RegKey3=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path2

[Kakao Talk *]
LangSecRef=3022
DetectFile=%LocalAppData%\Kakao\KakaoTalk
FileKey1=%LocalAppData%\Kakao\KakaoTalk\Dump|*|RECURSE

[Kalypso Launcher *]
Section=Games
DetectFile=%AppData%\Kalypso Media\Launcher
FileKey1=%AppData%\Kalypso Media\Launcher|log*.txt

[Kamo *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\Kamo
FileKey1=%LocalAppData%\Kamo\TempBrowserDB|*
FileKey2=%ProgramFiles%\Kamo|*.log;*.old
FileKey3=%ProgramFiles%\Kamo\cache|*.old;LOG|RECURSE
FileKey4=%ProgramFiles%\Kamo\cache\*Cache|*|RECURSE
FileKey5=%ProgramFiles%\Kamo\NetFilter|*Log.txt
FileKey6=%ProgramFiles%\Kamo\Support\Log|ErrorLog_*.txt
FileKey7=%SystemDrive%\Support\Log|ErrorLog_*.txt
RegKey1=HKCU\Software\Piriform\Kamo|epochAtInstall
RegKey2=HKCU\Software\Piriform\Kamo|epochAtLastIPM
RegKey3=HKCU\Software\Piriform\Kamo|epochForNextIPM
RegKey4=HKCU\Software\Piriform\Kamo|epochSinceUILastUsed
ExcludeKey1=FILE|%ProgramFiles%\Kamo\|install.log

[KarenWare Hasher *]
LangSecRef=3024
Detect=HKCU\Software\KarenWare\Power Tools\Hasher
RegKey1=HKCU\Software\KarenWare\Power Tools\Hasher|LastRun

[Kaseto *]
LangSecRef=3023
DetectFile=%LocalAppData%\Kaseto
FileKey1=%LocalAppData%\Kaseto|*.backup
FileKey2=%LocalAppData%\Kaseto\Logs|*

[Kaspersky *]
LangSecRef=3024
Detect=HKCU\Software\KasperskyLab
FileKey1=%ProgramData%\Kaspersky Lab|*.dmp*;*.log
FileKey2=%ProgramData%\Kaspersky Lab\*\Bases|hdhm_temp_drives_*
FileKey3=%ProgramData%\Kaspersky Lab\*\Bases\*|log*;strg*|RECURSE
FileKey4=%ProgramData%\Kaspersky Lab\*\Bases\*\Cache|*|RECURSE
FileKey5=%ProgramData%\Kaspersky Lab\*\Bases\Cache|*|RECURSE
FileKey6=%ProgramData%\Kaspersky Lab\*\Data|*.*-shm;*.*-wal;*.bak*|RECURSE
FileKey7=%ProgramData%\Kaspersky Lab\*\Data\KDSCRL|log*
FileKey8=%ProgramData%\Kaspersky Lab\*\Data\Updater\Temporary Files|*|RECURSE
FileKey9=%ProgramData%\Kaspersky Lab\*\Logs|*|RECURSE
FileKey10=%ProgramData%\Kaspersky Lab\*\Report|*|RECURSE
FileKey11=%ProgramData%\Kaspersky Lab\*\Temp|*|RECURSE
FileKey12=%ProgramData%\Kaspersky Lab\Kaspersky Password Manager*\Logs|*
FileKey13=%ProgramData%\Kaspersky Lab\UCPStorage|ucp_agent.bin.bak
FileKey14=%ProgramFiles%\Kaspersky Lab\Kaspersky Password Manager*|*.bak*
FileKey15=%ProgramFiles%\Kaspersky Lab\NetworkAgent\~dumps|*

[Kate's Video Toolkit *]
LangSecRef=3023
Detect=HKCU\Software\Web Solution Mart\Kate's Video Toolkit
FileKey1=%ProgramData%\Web Solution Mart\*|*.log|RECURSE

[Kazaa Lite Resurrection *]
LangSecRef=3022
Detect=HKCU\Software\Kazaa\Kazaa Lite Resurrection
RegKey1=HKCU\Software\Kazaa\Kazaa Lite Resurrection\Recent File List

[KDE *]
LangSecRef=3021
Detect=HKCU\Software\KDE.org
FileKey1=%UserProfile%\.kde\cache*|*|RECURSE

[Kerish Doctor *]
LangSecRef=3024
Detect=HKLM\Software\Kerish Products\Kerish Doctor
FileKey1=%ProgramData%\Kerish Products\Kerish Doctor\Reports|*
RegKey1=HKLM\Software\Kerish Products\Kerish Doctor|InstallDate
RegKey2=HKLM\Software\Kerish Products\Kerish Doctor|LastScan
RegKey3=HKLM\Software\Kerish Products\Kerish Doctor|LastStart
RegKey4=HKLM\Software\Kerish Products\Kerish Doctor|LastUpdate
RegKey5=HKLM\Software\Kerish Products\Kerish Doctor|LastWeeklyReport
RegKey6=HKLM\Software\Kerish Products\Kerish Doctor|ServerDate

[Keroon Reset Local Password Pro *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Reset Local Password Pro
FileKey1=%ProgramFiles%\Reset Local Password Pro|*.log

[Keyboard Tracer *]
LangSecRef=3024
DetectFile=%ProgramData%\Keyboard Tracer
FileKey1=%ProgramData%\Keyboard Tracer|*.log

[KeyMapper *]
LangSecRef=3024
DetectFile=%LocalAppData%\KeyMapper
FileKey1=%LocalAppData%\KeyMapper|*.log

[Killing Floor 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\232090
FileKey1=%UserProfile%\Documents\My Games\KillingFloor2\KFGame\Logs|*|RECURSE

[Kinetic Jump Updater *]
LangSecRef=3021
DetectFile=%LocalAppData%\Kjs.AppLife.Update
FileKey1=%LocalAppData%\Kjs.AppLife.Update|*.log

[Kingo Root *]
LangSecRef=3021
DetectFile=%LocalAppData%\Kingosoft\Kingo Root
FileKey1=%LocalAppData%\Kingosoft\Kingo Root|*.log
FileKey2=%LocalAppData%\Kingosoft\Kingo Root\LastLog|*

[Kingsoft Office *]
LangSecRef=3021
Detect=HKCU\Software\Kingsoft
DetectFile=%AppData%\Kingsoft\Office*
FileKey1=%AppData%\Kingsoft\*|*.bak
FileKey2=%AppData%\Kingsoft\*\backup|*
FileKey3=%AppData%\Kingsoft\*\update\log|*.log
FileKey4=%AppData%\Kingsoft\Office*\log\setup|*.log
FileKey5=%AppData%\Kingsoft\Office*\OfficeSpace\log|*.log
FileKey6=%LocalAppData%\Kingsoft\*\cache\http*|*
FileKey7=%LocalAppData%\Kingsoft\WPS Cloud Files\UserData\Default\WebCache\http*|*
FileKey8=%ProgramFiles%\Kingsoft\Kingsoft Office\*|*.log

[Kingston SSD Manager *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Kingston_SSD_Manager
FileKey1=%ProgramFiles%\Kingston_SSD_Manager|*.log;*log.txt

[Kite Plugin *]
LangSecRef=3024
DetectFile=%AppData%\Kite
FileKey1=%AppData%\Kite\*Cache|*

[Kiwix JS *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\Kiwix.KiwixJS_mc3511b08yc0e
FileKey1=%LocalAppData%\Packages\Kiwix.KiwixJS_mc3511b08yc0e\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Kiwix.KiwixJS_mc3511b08yc0e\LocalCache\Roaming\Kiwix JS Electron\*cache*|*|RECURSE
FileKey3=%LocalAppData%\Packages\Kiwix.KiwixJS_mc3511b08yc0e\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Kiwix.KiwixJS_mc3511b08yc0e\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Kiwix.KiwixJS_mc3511b08yc0e\TempState|*|REMOVESELF

[Kleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Skyler Lyon\Kleaner
FileKey1=%ProgramFiles%\Skyler Lyon\Kleaner|*.txt

[KlokworkTeamConsole *]
LangSecRef=3024
DetectFile=%ProgramFiles%\KlokworkTeamConsole
FileKey1=%AppData%\com.mcgraphix.KlokworkTeamConsole\local store|debug.txt

[KMS Emulator *]
LangSecRef=3024
DetectFile1=%ProgramData%\KMSAuto*
DetectFile2=%ProgramData%\Online_KMS_Activation
DetectFile3=%ProgramFiles%\KMSpico
DetectFile4=%WinDir%\AutoKMS
FileKey1=%ProgramData%\KMSAuto*\bin|*.log
FileKey2=%ProgramData%\Online_KMS_Activation|Logs.txt
FileKey3=%ProgramFiles%\KMSpico\Logs|*
FileKey4=%WinDir%\AutoKMS|*.log

[Kobo Desktop *]
LangSecRef=3021
DetectFile=%LocalAppData%\Kobo\Kobo Desktop Edition
FileKey1=%LocalAppData%\Kobo\Kobo Desktop Edition\WebCache|*|RECURSE

[Kodak *]
LangSecRef=3021
Detect1=HKCU\Software\Kodak
Detect2=HKLM\Software\Eastman Kodak Company\KODAK AiO Home Center
Detect3=HKLM\Software\Kodak\Kodak AiO Software
DetectFile=%AppData%\Kodak\Share Button App
FileKey1=%AppData%\Kodak\Share Button App|*.log
FileKey2=%LocalAppData%|LaunchHomeCenter.log
FileKey3=%LocalAppData%\Kodak\Diagnostics|UploadLog.xml
FileKey4=%LocalAppData%\Kodak\Inkjet Logging|Status Monitor Log.*
FileKey5=%ProgramData%\Kodak\Diagnostics|*
FileKey6=%ProgramData%\Kodak\Inkjet Logging|*|RECURSE
RegKey1=HKCU\Software\Kodak\Imaging\Recent File List

[Kodi *]
LangSecRef=3023
DetectFile=%AppData%\kodi*
FileKey1=%AppData%\kodi*|*.dmp;*.log;*.txt
FileKey2=%AppData%\kodi*\Addons\Packages|*|RECURSE
FileKey3=%AppData%\kodi*\Cache|*|RECURSE
FileKey4=%AppData%\kodi*\UserData\Cache|*|RECURSE
FileKey5=%AppData%\kodi*\UserData\Thumbnails|*|RECURSE

[Koffix Blocker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Koffix Blocker
FileKey1=%UserProfile%\Documents\My Koffix Blocker Logs|*

[Koinonein Bittorrent Client *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Koinonein BitTorrent Client
FileKey1=%LocalAppData%\Koinonein BitTorrent Client*\Application|log.db

[KoolPlaya *]
LangSecRef=3023
Detect=HKCU\Software\AKi-Software\Kool-Playa
RegKey1=HKCU\Software\AKi-Software\Kool-Playa\VideoHistory
RegKey2=HKCU\Software\AKi-Software\Kool-Playa\Videos
RegKey3=HKCU\Software\AKi-Software\Kool-PlayaX64\VideoHistory
RegKey4=HKCU\Software\AKi-Software\Kool-PlayaX64\Videos

[KoPlayer *]
LangSecRef=3021
DetectFile=%LocalAppData%\KoPlayerData
FileKey1=%LocalAppData%\KoPlayerData|*.log

[Krita *]
LangSecRef=3023
Detect=HKLM\Software\Krita
FileKey1=%LocalAppData%|krita*.log
FileKey2=%LocalAppData%\krita\cache|*|RECURSE

[L0pht AntiSniff *]
LangSecRef=3024
Detect=HKCU\Software\L0pht\AntiSniff
RegKey1=HKCU\Software\L0pht\AntiSniff\Recent File List

[L0phtCrack *]
LangSecRef=3024
Detect=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6
DetectFile=%ProgramFiles%\L0phtCrack*
FileKey1=%ProgramFiles%\L0phtCrack *|vc*redist*x*.exe
RegKey1=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Recent File List
RegKey2=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last LC File
RegKey3=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last Remote Machine
RegKey4=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last SAM File
RegKey5=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last SYSTEM File

[Lantern *]
LangSecRef=3022
DetectFile=%AppData%\Lantern
FileKey1=%AppData%\Lantern|*.old;proxystats.csv
FileKey2=%AppData%\Lantern\logs|*.log

[Larian Launcher *]
Section=Games
DetectFile=%LocalAppData%\Larian Studios\Launcher
FileKey1=%LocalAppData%\Larian Studios\*cache|*|RECURSE
FileKey2=%LocalAppData%\Larian Studios\logs|*
FileKey3=%ProgramFiles%\Steam\steamapps\common\Baldur's Gate 3\Launcher|debug

[Last.FM *]
LangSecRef=3023
DetectFile=%LocalAppData%\Last.fm
FileKey1=%LocalAppData%\Last.fm|*_recent_tracks.xml

[LastPass *]
LangSecRef=3024
DetectFile=%UserProfile%\AppData\LocalLow\LastPass
FileKey1=%UserProfile%\AppData\LocalLow\LastPass|debug.txt

[Launchy *]
LangSecRef=3021
DetectFile=%AppData%\Launchy
FileKey1=%AppData%\Launchy\*-icon-cache|*

[Lavender's Botanicals *]
Section=Games
DetectFile=%AppData%\MysteryStudio\Lavender
FileKey1=%AppData%\MysteryStudio\Lavender|*.log

[Layers of Fear *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\391720
FileKey1=%AppData%\Aspyr Media\GameGuide\Cache|*|RECURSE

[LBRY *]
LangSecRef=3022
DetectFile=%AppData%\LBRY
FileKey1=%AppData%\LBRY|*-journal;*.old;LOG;QuotaManager|RECURSE
FileKey2=%AppData%\LBRY\*Cache|*

[LDPlayer *]
LangSecRef=3021
DetectFile=%AppData%\lddownloader
FileKey1=%AppData%\lddownloader|*.log
FileKey2=%UserProfile%\.Ld2VirtualBox|VBoxSVC.log

[Leadtek WinFast *]
LangSecRef=3023
Detect=HKCU\Software\Leadtek\Video\WFFM
FileKey1=%WinDir%\System32\WinFast\Multimedia\DirectBurn|*.log
RegKey1=HKCU\Software\Leadtek\Video\WFFM|Last Name

[League of Legends *]
Section=Games
DetectFile=%LocalAppData%\Riot Games\*League of Legends*
FileKey1=%LocalAppData%\Riot Games\*League of Legends*\logs|*|RECURSE
FileKey2=%LocalAppData%\Riot Games\League of Legends\League*\Crashes|*|REMOVESELF
FileKey3=%SystemDrive%\Riot Games\League of Legends|*.log*;*.pandurl;*.tmp;*netlog.txt;*r3dlog.txt;Localization_Errors.txt|RECURSE
FileKey4=%UserProfile%\riotsGamesLogs|*

[Leapfrog Connect *]
LangSecRef=3021
DetectFile=%ProgramFiles%\LeapFrog\LeapFrog Connect
FileKey1=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\cookies|*
FileKey2=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\data7\*|*
FileKey3=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\http*|*
FileKey4=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\prepared|*
FileKey5=%ProgramData%\Leapfrog\LeapFrog Connect\DownloadCache|*

[LeapFTP *]
LangSecRef=3022
DetectFile=%ProgramFiles%\LeapFTP
FileKey1=%ProgramFiles%\LeapFTP|stats.dat

[Leawo Blu-ray Ripper *]
LangSecRef=3023
DetectFile=%AppData%\Leawo\Blu-ray Ripper
FileKey1=%AppData%\Leawo\Blu-ray Ripper\Burn|*.log
FileKey2=%AppData%\Leawo\Blu-ray Ripper\CrashReport|*
FileKey3=%AppData%\Leawo\Blu-ray Ripper\Download\WebCache|*
FileKey4=%AppData%\Leawo\Blu-ray Ripper\Download\WebFiles|WebpageIcons.db
FileKey5=%AppData%\Leawo\Blu-ray Ripper\Log|*
FileKey6=%LocalAppData%\Leawo Blu-ray Ripper\Cache|*|RECURSE

[Leawo Prof. Media *]
LangSecRef=3023
Detect=HKCU\Software\Leawo Software\SoftwarePassport\Leawo Prof. Media
FileKey1=%AppData%\Leawo\Prof. Media|*.xml
FileKey2=%AppData%\Leawo\Prof. Media\Burn|*.log
FileKey3=%AppData%\Leawo\Prof. Media\Burn\MenuTemplate\Cache|*|RECURSE
FileKey4=%AppData%\Leawo\Prof. Media\CrashReport|*|RECURSE
FileKey5=%AppData%\Leawo\Prof. Media\Download|*.dat;*.db;*.xml;*log
FileKey6=%AppData%\Leawo\Prof. Media\Download\Thumbnails|*|RECURSE
FileKey7=%AppData%\Leawo\Prof. Media\Download\WebCache|*|RECURSE
FileKey8=%AppData%\Leawo\Prof. Media\Download\WebFiles|*|RECURSE
FileKey9=%AppData%\Leawo\Prof. Media\Log|*|RECURSE
FileKey10=%LocalAppData%\Leawo Prof\cache|*|RECURSE

[Leawo Video Converter *]
LangSecRef=3023
DetectFile=%AppData%\Leawo\Video Converter*
FileKey1=%AppData%\Leawo\Video Converter*|*.log
FileKey2=%AppData%\Leawo\Video Converter*\CrashReport|*|RECURSE
FileKey3=%LocalAppData%\Video Converter*\cache|*|RECURSE

[Legacy Games Launcher *]
Section=Games
DetectFile=%AppData%\legacy-games-launcher
FileKey1=%AppData%\legacy-games-launcher|*state;Cookies*
FileKey2=%AppData%\legacy-games-launcher\*cache|*|REMOVESELF
FileKey3=%AppData%\legacy-games-launcher\blob_storage|*|REMOVESELF
FileKey4=%AppData%\legacy-games-launcher\logs|*
FileKey5=%LocalAppData%\legacy-games-launcher-updater|*
FileKey6=%LocalAppData%\legacy-games-launcher-updater\*|*|REMOVESELF

[Legends of Amberland *]
Section=Games
DetectFile=%AppData%\Legends of Amberland
FileKey1=%AppData%\Legends of Amberland|logs.txt

[LEGO Universe *]
Section=Games
DetectFile=%LocalAppData%\LEGO Software\LEGO Universe
FileKey1=%LocalAppData%\LEGO Software\LEGO Universe\Log Files|*

[LeiaSR SDK *]
LangSecRef=3021
DetectFile=%ProgramData%\Simulated Reality
FileKey1=%ProgramData%\Simulated Reality\Applications\SRSession\Log|*
FileKey2=%ProgramData%\Simulated Reality\Eye Tracker\Log|*
FileKey3=%ProgramData%\Simulated Reality\Server\Log|*

[Leica Cyclone *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\Cyclone
FileKey1=%UserProfile%\Documents\Cyclone\Log|*.err
FileKey2=%UserProfile%\Documents\Cyclone\Temp|*

[Lenovo SWTOOLS *]
LangSecRef=3024
DetectFile=%SystemDrive%\SWTOOLS
FileKey1=%SystemDrive%\SWTOOLS|*|REMOVESELF

[Lenovo System Update *]
LangSecRef=3024
DetectFile=%ProgramData%\Lenovo\SystemUpdate
FileKey1=%ProgramData%\Lenovo\SystemUpdate\sessionSE\Repository|*|RECURSE
FileKey2=%ProgramData%\Lenovo\SystemUpdate\sessionSE\system\SSClientCommon|*.xml

[Lenovo Vantage *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8
FileKey1=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\Logs\Lenovo.Vantage.DeployAssistant|*
FileKey3=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey4=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\*Cache*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\AutoFill*|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Avatars|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Crashpad|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Crowd Deny|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey15=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Download Service|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Extension State|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\File System|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey33=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\optimization*|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Sessions|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Local Traces|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\MEIPreload|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Optimization*|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\OriginTrials|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\PKIMetadata|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Safe Browsing|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\SafetyTips|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\SmartScreen|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Stability|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\Subresource Filter|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\WidevineCdm|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\LocalState\UDF\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey67=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\Settings|*.log*
FileKey68=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\SystemAppData\Helium|*.log*
FileKey69=%LocalAppData%\Packages\E046963F.LenovoCompanion_k1h2ywk1493x8\TempState|*|REMOVESELF

[Letasoft Sound Booster *]
LangSecRef=3024
DetectFile=%ProgramData%\Letasoft\Sound Booster
FileKey1=%ProgramData%\Letasoft\Sound Booster\Logs|*

[Leviev Sales Information Portal *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Leviev Sales Information Portal
FileKey1=%ProgramFiles%\JMS|JMSErrors.txt
FileKey2=%ProgramFiles%\Leviev Sales Information Portal|JMSErrors.txt

[Lexmark *]
LangSecRef=3021
DetectFile=%ProgramData%\gn_logs
FileKey1=%ProgramData%\gn_logs\*|*

[Lexmark Inkjet *]
LangSecRef=3021
Detect=HKLM\Software\LexmarkInkjet
FileKey1=%SystemDrive%|lxbt.log
FileKey2=%SystemDrive%\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}|*|REMOVESELF
RegKey1=HKLM\Software\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}\lxbt\Product|CdRoot
RegKey2=HKLM\Software\Lexmark\5200 Series|Path

[Lexmark Photo Editor *]
LangSecRef=3021
Detect=HKCU\Software\LexmarkPhoto\Lexmark Photo Software\pheditor
DetectFile=%ProgramFiles%\Lexmark 5200 Series\pheditor.exe
RegKey1=HKCU\Software\LexmarkPhoto\Lexmark Photo Software\pheditor\Recent File List

[Lexware *]
LangSecRef=3021
DetectFile=%LocalAppData%\Lexware
FileKey1=%AppData%\Lexware|*.log|RECURSE
FileKey2=%CommonProgramFiles%\Lexware|*.log|RECURSE
FileKey3=%LocalAppData%\Lexware|*.log*|RECURSE
FileKey4=%ProgramData%\Lexware|*.log*|RECURSE
FileKey5=%ProgramData%\Lexware\elster\Log|*|REMOVESELF
FileKey6=%ProgramData%\Lexware\logs|*|REMOVESELF
FileKey7=%ProgramFiles%\Lexware|*.log*|RECURSE
FileKey8=%SystemDrive%|LxDasi.Log

[LG ODD Auto Firmware Update *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ODD Auto Firmware Update
FileKey1=%ProgramFiles%\ODD Auto Firmware Update\Log|*|RECURSE

[LG PC Suite *]
LangSecRef=3021
DetectFile=%LocalAppData%\LG Electronics\LG PC Suite
FileKey1=%LocalAppData%\LG Electronics\LG PC Suite\Connection|*.log
FileKey2=%LocalAppData%\LG Electronics\LG PC Suite\ocbr\bnr_ui_log|*.log
FileKey3=%LocalAppData%\LG Electronics\LG PC Suite\Upgrade\UpgradeLog|*

[LG Software Innovations 1Click DVD Copy Pro *]
LangSecRef=3023
DetectFile=%ProgramData%\1click dvd copy pro
FileKey1=%ProgramData%\1click dvd copy pro|*.log

[LibreCAD *]
LangSecRef=3021
Detect=HKCU\Software\LibreCAD
RegKey1=HKCU\Software\LibreCAD\LibreCAD\RecentFiles

[LibreOffice *]
LangSecRef=3021
Detect=HKLM\Software\LibreOffice
FileKey1=%AppData%\LibreOffice\*\cache|*.log
FileKey2=%AppData%\LibreOffice\*\crash|*
FileKey3=%AppData%\LibreOffice\*\User\backup|*
FileKey4=%AppData%\LibreOffice\*\User\extensions\shared|log.*
FileKey5=%AppData%\LibreOffice\*\User\temp|*
FileKey6=%AppData%\LibreOffice\*\User\uno_packages\cache|log.*
FileKey7=%ProgramFiles%\LibreOffice*\program_old*|*|REMOVESELF
FileKey8=%ProgramFiles%\LibreOffice\program\logs|*

[LibreWolf Autocomplete History *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|formhistory*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|formhistory*

[LibreWolf Autofill Data *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|autofill-profiles.json
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|autofill-profiles.json

[LibreWolf Bookmark Backups *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*\bookmarkbackups|*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\bookmarkbackups|*

[LibreWolf Bookmark Favicons *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|favicons*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|favicons*

[LibreWolf Caches *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\librewolf\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\librewolf\Profiles\*\notificationstore|*
FileKey4=%AppData%\librewolf\Profiles\*\security_state|*
FileKey5=%AppData%\librewolf\Profiles\*\shader-cache|*
FileKey6=%AppData%\librewolf\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\librewolf\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\librewolf\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\librewolf\Profiles\*\thumbnails|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|*.corrupt|RECURSE
FileKey11=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey12=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\*cache*|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\notificationstore|*
FileKey15=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\security_state|*
FileKey16=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\shader-cache|*
FileKey17=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\storage\temporary|*|RECURSE
FileKey18=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\thumbnails|*|REMOVESELF

[LibreWolf Privacy Sandbox *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|credentialstate.sqlite
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|credentialstate.sqlite

[LibreWolf Saved Usernames & Passwords *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|key4.db;logins.json
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|key4.db;logins.json

[LibreWolf Synced Tabs *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|synced-tabs.db*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|synced-tabs.db*

[LibreWolf Telemetry *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf|*.log|RECURSE
FileKey2=%AppData%\librewolf\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\librewolf\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\librewolf\Profiles\*\crashes|*
FileKey5=%AppData%\librewolf\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\librewolf\Profiles\*\minidumps|*
FileKey7=%AppData%\librewolf\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\librewolf\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\librewolf\Profiles\*\weave\logs|*
FileKey10=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf|*.log|RECURSE
FileKey11=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey13=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\crashes|*
FileKey14=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\datareporting|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\minidumps|*
FileKey16=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\saved-telemetry-pings|*
FileKey17=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\sessionstore-logs|*
FileKey18=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\weave\logs|*

[LibreWolf Web Browsing Cookies *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|cookies*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|cookies*

[LibreWolf Web Browsing Session *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|session*.json*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|session*.json*

[LibreWolf Web Browsing Session Backups *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*\sessionstore-backups|*
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\sessionstore-backups|*

[LibreWolf Web Storage *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\librewolf\Profiles\*\storage\default\http*|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey4=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*\storage\default\http*|*|REMOVESELF

[LibreWolf Website Permissions *]
Section=LibreWolf Web Browser
DetectFile1=%AppData%\librewolf\Profiles
DetectFile2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles
FileKey1=%AppData%\librewolf\Profiles\*|content-prefs.sqlite;permissions.sqlite
FileKey2=%LocalAppData%\Packages\31856maltejur.LibreWolf_ssmwz6s360tct\LocalCache\Roaming\librewolf\Profiles\*|content-prefs.sqlite;permissions.sqlite

[LightScribe *]
LangSecRef=3023
Detect=HKCU\Software\LightScribe
FileKey1=%ProgramData%\LightScribe\log|*.xml

[LightShot *]
LangSecRef=3022
DetectFile1=%LocalAppData%\Skillbrains\lightshot
DetectFile2=%ProgramFiles%\Skillbrains\Updater
FileKey1=%LocalAppData%|updater.log
FileKey2=%ProgramFiles%\Skillbrains\Updater|*.log

[Lightworks *]
LangSecRef=3021
Detect=HKLM\Software\Lightworks
FileKey1=%Public%\Documents\Lightworks\Logs|*|REMOVESELF

[Lili: Child of Geos - Complete Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\266490
FileKey1=%UserProfile%\Documents\my games\UnrealEngine3-MazeGame\MazeGame\Logs|*

[LimePro *]
LangSecRef=3022
Detect=HKCU\Software\LimePro
RegKey1=HKCU\Software\LimePro|GUI.LastChatRoomBrowse
RegKey2=HKCU\Software\LimePro|GUI.LastSearch

[LimeWire *]
LangSecRef=3022
Detect=HKLM\Software\LimeWire
FileKey1=%AppData%\LimeWire|createtimes.cache;fileurns.cache;gnutella.net;responses.cache;ttree.cache
FileKey2=%UserProfile%\Incomplete|*|RECURSE

[LINE Messenger *]
LangSecRef=3022
DetectFile=%LocalAppData%\LINE
FileKey1=%LocalAppData%\LINE\bin|update_log*.txt
FileKey2=%LocalAppData%\LINE\bin\current|*_CrashLog.txt
FileKey3=%LocalAppData%\LINE\Cache|*|RECURSE
FileKey4=%LocalAppData%\LINE\Data\advertisement|*|RECURSE
FileKey5=%LocalAppData%\LINE\Data\Sticker|*|RECURSE
FileKey6=%LocalAppData%\LINE\Data\Sticon|*|RECURSE
FileKey7=%LocalAppData%\LINE\QtWebEngine\Default|Visited Links

[LINE Messenger Plugin *]
LangSecRef=3022
DetectFile1=%LocalAppData%\LineCall
DetectFile2=%LocalAppData%\LineMediaPlayer
FileKey1=%LocalAppData%\LineCall\Cache|*|RECURSE
FileKey2=%LocalAppData%\LineMediaPlayer\Cache|*|RECURSE

[LinkAlyzer *]
LangSecRef=3024
Detect=HKCU\Software\Sanderson Forensics\LinkAlyzer
RegKey1=HKCU\Software\Sanderson Forensics\LinkAlyzer|LastOpenFolder
RegKey2=HKCU\Software\Sanderson Forensics\LinkAlyzer|LastSaveFolder

[Listary *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
FileKey1=%AppData%\Listary\CrashRpt|*|REMOVESELF
FileKey2=%AppData%\Listary\UserData|*.log;DiskSearch.db;History_v2.sqlite
FileKey3=%ProgramFiles%\Listary|*.log

[Loadout *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\208090
FileKey1=%LocalAppData%\EdgeOfReality\Loudout\CrashReports|*

[Locate32 *]
LangSecRef=3024
Detect=HKCU\Software\Update\Locate32
RegKey1=HKCU\Software\Update\Locate32\Dialogs|Advanced/ContainData
RegKey2=HKCU\Software\Update\Locate32\Dialogs|Name/LookIn
RegKey3=HKCU\Software\Update\Locate32\Dialogs|Name/Name
RegKey4=HKCU\Software\Update\Locate32\Dialogs|Name/Type
RegKey5=HKCU\Software\Update\Locate32\Recent Strings

[LockHunter *]
LangSecRef=3024
Detect=HKCU\Software\LockHunter
FileKey1=%AppData%\LockHunter|*.log;*.txt
FileKey2=%ProgramData%\LHService|*.log;*.txt

[Logitech Alert Commander *]
LangSecRef=3024
DetectFile=%ProgramData%\Logitech\Logitech Alert Commander
FileKey1=%ProgramData%\Logitech\Logitech Alert Commander|Commander Event Log.txt;Tamper Log.txt
FileKey2=%ProgramData%\Logitech\Logitech Alert Commander\Install Logs|*

[Logitech ASTRO C40 TR Configuration Software *]
LangSecRef=3024
DetectFile=%LocalAppData%\Astro Gaming\ASTRO C40 TR Configuration Software
FileKey1=%LocalAppData%\Astro Gaming\ASTRO C40 TR Configuration Software\cache|*|RECURSE
FileKey2=%WinDir%|DPINST.LOG

[Logitech Astro Command Center *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\AstroGaming.AstroCommandCenter_9cg1kgznx2mv2
FileKey1=%LocalAppData%\Packages\AstroGaming.AstroCommandCenter_9cg1kgznx2mv2\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\AstroGaming.AstroCommandCenter_9cg1kgznx2mv2\Settings|*.log*
FileKey3=%LocalAppData%\Packages\AstroGaming.AstroCommandCenter_9cg1kgznx2mv2\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\AstroGaming.AstroCommandCenter_9cg1kgznx2mv2\TempState|*|REMOVESELF

[Logitech Capture *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Logitech\LogiCapture
FileKey1=%LocalAppData%\Logitech\LogiCapture\cefcache|*|RECURSE
FileKey2=%ProgramFiles%\Logitech\LogiCapture\bin\service|LogiFacecamService.exe.log

[Logitech Firmware Update Tool *]
LangSecRef=3024
DetectFile=%LocalAppData%\FirmwareUpdateTool
FileKey1=%LocalAppData%\FirmwareUpdateTool\devio_cache|*
FileKey2=%ProgramData%\FirmwareUpdateTool\analytics\*|*|REMOVESELF

[Logitech G HUB - Window Size/Location *]
LangSecRef=3024
Detect=HKCU\SOFTWARE\Logitech\LGHUB
FileKey1=%AppData%\lghub|window-state.json

[Logitech G HUB *]
LangSecRef=3024
Detect=HKCU\SOFTWARE\Logitech\LGHUB
FileKey1=%AppData%\G HUB|Local State
FileKey2=%AppData%\G HUB\*Cache|*|REMOVESELF
FileKey3=%AppData%\G HUB\Crashpad|*|REMOVESELF
FileKey4=%AppData%\G HUB\Network|*|REMOVESELF
FileKey5=%LocalAppData%\Logi\LogiPluginService|*.log;*.txt|RECURSE
FileKey6=%LocalAppData%\Logi\LogiPluginService\Temp|*|REMOVESELF
FileKey7=%ProgramData%\LGHUB\Cache|*
FileKey8=%ProgramData%\LogiShrd\LGHUB\analytics|*|REMOVESELF
FileKey9=%SystemDrive%\Users\Default\AppData\Local\Logi\LogiPluginService\Logs\installer_ca|*.log
FileKey10=%WinDir%\System32\config\systemprofile\AppData\Local\LGHUB\sentry_db_lghub_updater\*|*.json;__sentry-*
FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\com.logi.ghub.software_manager.logs|*|REMOVESELF

[Logitech Gaming Software *]
LangSecRef=3024
DetectFile=%AppData%\LogiShrd\LGS8_setup
FileKey1=%AppData%\LogiShrd\LGS8_setup|*.log

[Logitech Harmony *]
LangSecRef=3024
Detect=HKCU\Software\JavaSoft\Prefs\Com\Logitech\harmony
FileKey1=%UserProfile%\Logitech\browser - logitech\Cache|*

[Logitech Logi Bolt *]
LangSecRef=3024
DetectFile=%LocalAppData%\LogiBolt
FileKey1=%LocalAppData%\LogiBolt|InstallerLog.txt;settings.backup
FileKey2=%LocalAppData%\LogiBolt\devio_cache|*
FileKey3=%ProgramData%\Logishrd\LogiBolt\analytics\*|*|REMOVESELF

[Logitech Logi Tune *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Logitech\LogiTune
FileKey1=%AppData%\logitune\*cache*|*|RECURSE
FileKey2=%AppData%\logitune\*logs|*|RECURSE
FileKey3=%AppData%\logitune\dumps|*|RECURSE
FileKey4=%ProgramData%\RightSightForWebcams\Logs|*.log
FileKey5=%ProgramFiles%\Logitech\LogiTune\data\dumps|*|RECURSE
FileKey6=%ProgramFiles%\Logitech\LogiTune\data\logs|*.log|RECURSE
FileKey7=%ProgramFiles%\Logitech\LogiTune\data\sentry\LogiTuneUpdater\attachments|*
FileKey8=%ProgramFiles%\Logitech\LogiTune\data\sentry\LogiTuneUpdater\reports|*

[Logitech LogiOptions *]
LangSecRef=3024
DetectFile=%AppData%\LogiShrd\LogiOptions
FileKey1=%AppData%\LogiShrd\LogiOptions|*.log
FileKey2=%ProgramFiles%\Logitech\LogiOptions\LogiBolt|*|REMOVESELF

[Logitech LogiOptions+ *]
LangSecRef=3024
Detect=HKLM\Software\Logitech\LogiOptionsPlus
FileKey1=%AppData%\logioptionsplus\*Cache*|*|RECURSE
FileKey2=%LocalAppData%\flutter_webview_windows\LogiAiPromptBuilder\EBWebView|DIPS*
FileKey3=%LocalAppData%\flutter_webview_windows\LogiAiPromptBuilder\EBWebView\*Cache*|*|RECURSE
FileKey4=%LocalAppData%\flutter_webview_windows\LogiAiPromptBuilder\EBWebView\Default\*Cache*|RECURSE
FileKey5=%LocalAppData%\LogiOptionsPlus\*_cache|*
FileKey6=%ProgramData%\LogiOptionsPlus\Cache|*

[Logitech MIXLINE *]
LangSecRef=3024
DetectFile=%LocalAppData%\Logi\MIXLINE
FileKey1=%LocalAppData%\Logi\MIXLINE\logs|*.log

[Logitech Presentation *]
LangSecRef=3021
DetectFile=%AppData%\LogiShrd\LogiPresentation
FileKey1=%AppData%\LogiShrd\LogiPresentation|*.log|RECURSE

[Logitech SetPoint *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Logitech\SetPointP
FileKey1=%AppData%\Logishrd\sp*_Log|*
FileKey2=%ProgramData%\Logitech\KHAL\Battery|*.log

[Logitech Streamlabs Desktop *]
LangSecRef=3023
DetectFile=%AppData%\slobs-client
FileKey1=%AppData%\slobs-client|*.bak;*.log;long_calls.txt
FileKey2=%AppData%\slobs-client\*cache*|*|RECURSE
FileKey3=%AppData%\slobs-client\CrashMemoryDump|*
FileKey4=%AppData%\slobs-client\Crashpad|*|RECURSE
FileKey5=%AppData%\slobs-client\node-obs\logs|*
FileKey6=%LocalAppData%\slobs-client-updater|installer.exe

[Logitech Unifying Software *]
LangSecRef=3024
DetectFile=%ProgramData%\LogiShrd\Unifying
FileKey1=%ProgramData%\LogiShrd\Unifying|EngineLog.txt

[LogMeIn Hamachi *]
LangSecRef=3022
Detect=HKLM\Software\LogMeIn, Inc.
FileKey1=%WinDir%\System32\config\systemprofile\*\*\LogMeIn Hamachi|*.bak;*.log;*.old
FileKey2=%WinDir%\SysWOW64\config\systemprofile\*\*\LogMeIn Hamachi|*.bak;*.log;*.old

[Lost Photos *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Lost Photos
FileKey1=%LocalAppData%\Lost_Photos\*|ResultSearchFile.info
FileKey2=%ProgramFiles%\Lost Photos\Logs|*

[Luck be a Landlord *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1404850
DetectFile=%AppData%\Godot\app_userdata\Luck be a Landlord
FileKey1=%AppData%\Godot\app_userdata\Luck be a Landlord|errors.log
FileKey2=%AppData%\Godot\app_userdata\Luck be a Landlord\*|*.log

[Lunascape Phoebe Bookmark Favicons *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\favicons|*

[Lunascape Phoebe Caches *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe|cacheUrl.db
FileKey2=%AppData%\Phoebe\*cache*|*|RECURSE

[Lunascape Phoebe Cookies *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\Network|cookies*

[Lunascape Phoebe Crash Reports *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\Crashpad|*|RECURSE

[Lunascape Phoebe Privacy Sandbox *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\Network|Trust Tokens*

[Lunascape Phoebe Storage Quota Manager *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\WebStorage|QuotaManager*

[Lunascape Phoebe Telemetry *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\Network|Network Persistent State

[Lunascape Phoebe Web Browsing History *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe|history.db

[Lunascape Phoebe Web Storage *]
Section=Lunascape Phoebe Web Browser
DetectFile=%AppData%\Phoebe
FileKey1=%AppData%\Phoebe\WebStorage\*|*|RECURSE

[Lupinho.Net Hardlink *]
LangSecRef=3023
Detect=HKLM\Software\Lupinho.Net
FileKey1=%LocalAppData%\Lupinho.Net|*.log|RECURSE

[Lynx Web Browser *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Lynx - web browser
FileKey1=%ProgramFiles%\Lynx - web browser\tmp|*

[Lyrik *]
LangSecRef=3023
Detect=HKLM\Software\Lyrik
FileKey1=%LocalAppData%\Lyrik|*

[Lyx *]
LangSecRef=3021
DetectFile=%AppData%\LyX2.0
FileKey1=%AppData%\LyX2.0|*.log|RECURSE
FileKey2=%AppData%\LyX2.0\Cache|*|RECURSE

[Macaw *]
LangSecRef=3022
DetectFile=%AppData%\Macaw
FileKey1=%AppData%\Macaw\Cef_Data|cookies*.*;data*.;index.
FileKey2=%AppData%\Macaw\Cef_Data\GPUCache|*|RECURSE
FileKey3=%AppData%\Macaw\Cef_Data\Local Storage|*

[Machete *]
LangSecRef=3023
Detect=HKCU\Software\MacheteSoft\Machete
DetectFile=%ProgramFiles%\MacheteSoft\Machete
FileKey1=%AppData%\Machete|MacheteSettings.xml.bak
RegKey1=HKCU\Software\Local AppWizard-Generated Applications\Machete\Recent File List
RegKey2=HKCU\Software\MacheteSoft\Machete\Recent File List

[Macrium Reflect *]
LangSecRef=3024
Detect=HKCU\Software\Macrium\Reflect
FileKey1=%ProgramData%\Macrium|*.log|RECURSE
FileKey2=%ProgramData%\Macrium\Reflect|*.html;*.tmp;*.vsslog;loaderrors.txt
FileKey3=%ProgramData%\Macrium\waik|waiklog.txt
FileKey4=%SystemDrive%|Recovery.txt;Reflect_Install.log;ref~tmp~.txt;rescuepe.log

[Magic: The Gathering Arena *]
Section=Games
DetectFile=%ProgramFiles%\MTG Arena
FileKey1=%ProgramFiles%\MTG Arena\MTGA_Data\Logs|*|RECURSE

[Magicka *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\42910
FileKey1=%ProgramFiles%\Steam\steamapps\common\magicka|errorReport*.txt

[Magicka 2 *]
Section=Games
DetectFile=%AppData%\ParadoxInteractive\Magicka2
FileKey1=%AppData%\ParadoxInteractive\Magicka2\logs|*

[MagicLine4NX *]
LangSecRef=3021
DetectFile=%LocalAppData%\DreamSecurity\MagicLine4NX
FileKey1=%LocalAppData%\DreamSecurity\MagicLine4NX\Logs|*

[MagicTweak Magic Utilities *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Mgutil
FileKey1=%ProgramFiles%\Mgutil|*_log.txt

[MAGIX ACID Pro *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Sony\ACID Pro 5.0
FileKey1=%ProgramFiles%\Sony\ACID Pro 5.0|Acid*.log
FileKey2=%UserProfile%\Documents\ACID Pro 5.0 projects|*.bak

[MAGIX Installation Manager *]
LangSecRef=3023
Detect=HKCU\Software\Magix\MAGIX Installation manager
FileKey1=%ProgramData%\MAGIX\*|*.log;*.reg
FileKey2=%ProgramData%\MAGIX\*\download|*|RECURSE

[MAGIX Photostory *]
LangSecRef=3023
DetectFile=%AppData%\MAGIX\Photostory*
FileKey1=%AppData%\MAGIX\Photostory*\Crash|*

[MAGIX Vegas Pro *]
LangSecRef=3023
Detect1=HKLM\Software\Sony Creative Software\Vegas
Detect2=HKLM\Software\Sony Media Software\Vegas
FileKey1=%AppData%\Sony|*.log
FileKey2=%LocalAppData%\Sony\Vegas Pro\*|*.log

[MAGIX Video Easy TERRATEC Edition *]
LangSecRef=3023
Detect=HKLM\Software\MAGIX\Video_easy_3_TerraTec
FileKey1=%AppData%\MAGIX\Video_easy_TERRATEC_Edition|*.log|RECURSE

[MAGIX Video Pro *]
LangSecRef=3023
Detect1=HKCU\Software\MAGIX AG\Videodeluxe18_pro
Detect2=HKCU\Software\MAGIX AG\Videodeluxe19_pro
FileKey1=%AppData%\MAGIX\Video*Pro*|*.log
FileKey2=%UserProfile%\Documents\MAGIX\Video*Pro*\AudioTemp|*|RECURSE
RegKey1=HKCU\Software\MAGIX AG\Videodeluxe19_pro\ExportConfigurator\DialogItems|LastFile
RegKey2=HKCU\Software\MAGIX AG\Videodeluxe19_pro\ExportConfigurator\DialogItems|LastPreset

[Mailbird *]
LangSecRef=3022
DetectFile=%LocalAppData%\Mailbird
FileKey1=%LocalAppData%\Mailbird|*.log
FileKey2=%LocalAppData%\Mailbird\Misc|favicons*;History*;Visited Links*;Web Data*
FileKey3=%LocalAppData%\Mailbird\Misc\*cache*|*|RECURSE
FileKey4=%LocalAppData%\Mailbird\Misc\Default\*cache*|*|RECURSE

[MailWasher Pro *]
LangSecRef=3022
DetectFile=%AppData%\Firetrust\MailWasher
FileKey1=%AppData%\Firetrust\MailWasher|log_*|RECURSE
FileKey2=%AppData%\Firetrust\MailWasher|regex.txt;updatesAIU.txt
FileKey3=%AppData%\Firetrust\MailWasher\cache|*|RECURSE
FileKey4=%AppData%\Firetrust\MailWasher\logs|*|RECURSE
ExcludeKey1=FILE|%AppData%\Firetrust\MailWasher\cache\|MWP.db3
ExcludeKey2=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_conv.dat
ExcludeKey3=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_exw.dat
ExcludeKey4=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_inw.dat
ExcludeKey5=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_pmap.dat

[MakeHuman *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\makehuman
FileKey1=%UserProfile%\Documents\makehuman\v1|makehuman-debug.txt;makehuman.log;python_err.txt;python_out.txt
FileKey2=%UserProfile%\Documents\makehuman\v1\cache|*.mhc

[MAL Updater *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Mal Updater 2
FileKey1=%AppData%\Mal Updater\*Pics|*
FileKey2=%AppData%\Mal Updater\SeasonData|*
FileKey3=%AppData%\Mal Updater\Users|*.log|RECURSE

[Malwarebytes *]
LangSecRef=3024
Detect1=HKCU\Software\Malwarebytes
Detect2=HKLM\Software\Malwarebytes
FileKey1=%AppData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|*
FileKey2=%LocalAppData%\Crashdumps\Malwarebytes|*|REMOVESELF
FileKey3=%LocalAppData%\MBAM*\Cache\qmlcache|*
FileKey4=%ProgramData%\Malwarebytes Anti-Exploit|*.log;mbae*.bak
FileKey5=%ProgramData%\Malwarebytes\Malwarebytes*Anti-Malware|mbam-setup.exe
FileKey6=%ProgramData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|*
FileKey7=%ProgramData%\Malwarebytes\MBAMService|*-ntuser.dat;*-UsrClass.dat;*.bak;*.log;*.LOG*;*.regtrans-ms;*.TM.blf
FileKey8=%ProgramData%\Malwarebytes\MBAMService\config|*.bak
FileKey9=%ProgramData%\Malwarebytes\MBAMService\logs|*
FileKey10=%ProgramData%\Malwarebytes\MBAMService\ScanResults|*
FileKey11=%ProgramData%\Malwarebytes\MBAMService\tmp|*
FileKey12=%ProgramFiles%\Malwarebytes Anti-Exploit|changelog.txt;mbae-uninstall.log
FileKey13=%SystemDrive%\Malwarebytes|*|REMOVESELF
FileKey14=%UserProfile%\AppData\LocalLow\IGDump|*|REMOVESELF

[ManiacTools mp3Tag Pro *]
LangSecRef=3023
Detect=HKCU\Software\ManiacTools\mp3Tag Pro
FileKey1=%AppData%\mp3tagpro|Temp.~Txt
RegKey1=HKCU\Software\ManiacTools\mp3Tag Pro|fmImageOpen
RegKey2=HKCU\Software\ManiacTools\mp3Tag Pro|fmImageSave
RegKey3=HKCU\Software\ManiacTools\mp3Tag Pro|fmTextOpen
RegKey4=HKCU\Software\ManiacTools\mp3Tag Pro|fmTextSave
RegKey5=HKCU\Software\ManiacTools\mp3Tag Pro|StartDir
RegKey6=HKCU\Software\ManiacTools\mp3Tag Pro|StartFile

[ManiacTools Music Duplicate *]
LangSecRef=3023
Detect=HKCU\Software\ManiacTools\MusicDuplicate
RegKey1=HKCU\Software\ManiacTools\MusicDuplicate|DateLastLaunch
RegKey2=HKCU\Software\ManiacTools\MusicDuplicate|DuplicatesFolders
RegKey3=HKCU\Software\ManiacTools\MusicDuplicate|MoveFilesFolder
RegKey4=HKCU\Software\ManiacTools\MusicDuplicate|NotDuplicatesFolders
RegKey5=HKCU\Software\ManiacTools\MusicDuplicate|SavedFoldersList

[ManiaPlanet *]
Section=Games
DetectFile=%ProgramData%\ManiaPlanet
FileKey1=%ProgramData%\ManiaPlanet\Cache|*

[ManyCam *]
LangSecRef=3023
Detect1=HKCU\Software\ManyCam
Detect2=HKLM\Software\ManyCam
DetectFile=%LocalAppData%\Visicom Media\ManyCam
FileKey1=%AppData%\ManyCam\Logs|*
FileKey2=%AppData%\ManyCam\Settings\MoviesThumbnails|*|RECURSE
FileKey3=%LocalAppData%\ManyCam|*.log|RECURSE
FileKey4=%LocalAppData%\ManyCam\cache\gallery|*|RECURSE
FileKey5=%LocalAppData%\Visicom Media\ManyCam\Cache\QtWebEngine\Default\Cache|*

[Marine Sharpshooter 3 *]
Section=Games
DetectFile=%ProgramFiles%\Groove Games\Marine Sharpshooter 3
FileKey1=%ProgramFiles%\Groove Games\Marine Sharpshooter 3|*.*dmp|RECURSE

[Mass Effect *]
Section=Games
DetectFile=%UserProfile%\Documents\Bioware\Mass Effect*
FileKey1=%UserProfile%\Documents\BioWare\Mass Effect*\BIOGame\Logs|*
FileKey2=%UserProfile%\Documents\BioWare\Mass Effect*\Logs|*

[MassTube *]
LangSecRef=3024
DetectFile1=%AppData%\MassTube
DetectFile2=%LocalAppData%\MassTube
DetectFile3=%ProgramFiles%\MassTube
DetectFile4=%SystemDrive%\Programs\MassTube
FileKey1=%AppData%\MassTube|Historial.dat
FileKey2=%AppData%\MassTube\Miniaturas|*.jpg
FileKey3=%LocalAppData%\MassTube|Historial.dat
FileKey4=%LocalAppData%\MassTube\Miniaturas|*.jpg
FileKey5=%ProgramFiles%\MassTube|Historial.dat
FileKey6=%ProgramFiles%\MassTube\Miniaturas|*.jpg
FileKey7=%SystemDrive%\Programs\MassTube|Historial.dat
FileKey8=%SystemDrive%\Programs\MassTube\Miniaturas|*.jpg

[Master PDF Editor *]
LangSecRef=3021
Detect=HKCU\Software\Code Industry\Master PDF Editor 5
RegKey1=HKCU\Software\Code Industry\Master PDF Editor 5|ImportFilePath
RegKey2=HKCU\Software\Code Industry\Master PDF Editor 5|openFilePath
RegKey3=HKCU\Software\Code Industry\Master PDF Editor 5|saveFilePath
RegKey4=HKCU\Software\Code Industry\Master PDF Editor 5|str_destination_save_as
RegKey5=HKCU\Software\Code Industry\Master PDF Editor 5\pinned_files_history
RegKey6=HKCU\Software\Code Industry\Master PDF Editor 5\resent_files_history

[MATLAB *]
LangSecRef=3021
DetectFile=%ProgramFiles%\MATLAB
FileKey1=%AppData%\MathWorks\MATLAB\R20*|*.prev;cwdhistory.m;History.xml;matlab.prf;MATLABDesktop.xml
FileKey2=%AppData%\MathWorks\MATLAB\R20*\HtmlPanel\cache|*|RECURSE
FileKey3=%ProgramFiles%\MATLAB\R20*\polyspace\examples\cxx\*|*.log|RECURSE
FileKey4=%ProgramFiles%\MATLAB\R20*\sys\jxbrowser-chromium\win32\chromium|*.log
FileKey5=%ProgramFiles%\MATLAB\R20*\sys\tex\latex\base|*.log
FileKey6=%ProgramFiles%\MATLAB\R20*\sys\tomcat\temp|*.tmp
FileKey7=%ProgramFiles%\MATLAB\R20*\toolbox\rtw\rtwdemos\tlctutorial\tlcdebug\solutions|*.log

[Mavis Beacon *]
LangSecRef=3021
DetectFile=%AppData%\Broderbund\Mavis
FileKey1=%AppData%\Broderbund\Mavis|logfile.*

[Max Recorder *]
LangSecRef=3023
Detect=HKLM\Software\MaxRecorder
FileKey1=%LocalAppData%\MaxRecorder|*.tmp|RECURSE

[Maxprog iCash *]
LangSecRef=3021
Detect=HKCR\iCash
FileKey1=%ProgramFiles%\iCash\vlogs|*|REMOVESELF
FileKey2=%UserProfile%\Documents\Maxprog\iCash\Database Logs|*|REMOVESELF
FileKey3=%UserProfile%\Documents\Maxprog\iCash\Error Logs|*|REMOVESELF
FileKey4=%UserProfile%\Documents\Maxprog\iCash\XML Dumps|*|REMOVESELF

[MAXQDA Reader *]
LangSecRef=3021
DetectFile=%ProgramFiles%\MAXQDA*_Reader
FileKey1=%AppData%\MAXQDA* Reader|*Log_*.html
FileKey2=%LocalAppData%\MAXQDA*_Reader\cache\QtWebEngine\Default\Cache|*
FileKey3=%LocalAppData%\MAXQDA*_Reader\QtWebEngine\Default\GPUCache|*
FileKey4=%ProgramFiles%\MAXQDA*_Reader|debug.log
FileKey5=%UserProfile%\Documents\MAXQDA*\_MAXQDA_System|MAXQDA*_Support.zip

[Maxthon Autofill Backups *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\Backups\MagicFill|*|REMOVESELF

[Maxthon Autofill Data & Search Engine Preferences *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|*Web Data
FileKey2=%LocalAppData%\Maxthon\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Maxthon\User Data\AutoFill*|*|REMOVESELF

[Maxthon Autoplay Preferences *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\MEIPreload|*|REMOVESELF

[Maxthon Bookmark Backups *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|Bookmarks.bak
FileKey2=%LocalAppData%\Maxthon\User Data\*\Backups\BookMarks|*|REMOVESELF

[Maxthon Bookmark Favicons *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|favicons*

[Maxthon Caches *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Maxthon\User Data|Module Info Cache
FileKey3=%LocalAppData%\Maxthon\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Maxthon\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Maxthon\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Maxthon\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Maxthon\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Maxthon\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Maxthon\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Maxthon\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Maxthon\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Maxthon\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Maxthon\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Maxthon\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Maxthon\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Maxthon\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Maxthon\User Data\*\Thumbnail|*|REMOVESELF
FileKey18=%LocalAppData%\Maxthon\User Data\*Cache*|*|REMOVESELF
FileKey19=%LocalAppData%\Maxthon\User Data\Avatars|*|REMOVESELF
FileKey20=%LocalAppData%\Maxthon\User Data\Optimization*|*|REMOVESELF

[Maxthon Default App Handlers *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|PreferredApps

[Maxthon Download History *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Maxthon\User Data\*\shared_proto_db|*|REMOVESELF

[Maxthon DRM Data *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Maxthon\User Data\WidevineCdm|*|REMOVESELF

[Maxthon Extension Cookies *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|Extension Cookies

[Maxthon Pinned Tabs *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
RegKey1=HKCU\Software\Maxthon\PreferenceMACs\Default|pinned_tabs

[Maxthon Privacy Sandbox *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Maxthon\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Maxthon\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Maxthon\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Maxthon\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Maxthon\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Maxthon\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Maxthon\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Maxthon Progressive Web Apps *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\Web Applications|*|REMOVESELF

[Maxthon Saved Usernames & Passwords *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|Login Data*;Mx Login Data

[Maxthon Security & Threat Detection *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|DIPS*
FileKey2=%LocalAppData%\Maxthon\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Maxthon\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Maxthon\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Maxthon\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Maxthon\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Maxthon\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Maxthon\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Maxthon\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Maxthon\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Maxthon\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Maxthon\User Data\ZxcvbnData|*|REMOVESELF

[Maxthon Shopping Insights *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Maxthon\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Maxthon\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Maxthon\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Maxthon\User Data\*\parcel_tracking_db|*|REMOVESELF

[Maxthon Storage Quota Manager *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|QuotaManager

[Maxthon Sync Data *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\Sync Data|*|REMOVESELF

[Maxthon Telemetry *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon|debug.log
FileKey2=%LocalAppData%\Maxthon\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Update State.json
FileKey3=%LocalAppData%\Maxthon\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\Maxthon\User Data\*|*.log
FileKey5=%LocalAppData%\Maxthon\User Data\*\DataSharing|*|REMOVESELF
FileKey6=%LocalAppData%\Maxthon\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey7=%LocalAppData%\Maxthon\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey8=%LocalAppData%\Maxthon\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey9=%LocalAppData%\Maxthon\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey10=%LocalAppData%\Maxthon\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey11=%LocalAppData%\Maxthon\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey12=%LocalAppData%\Maxthon\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey13=%LocalAppData%\Maxthon\User Data\*BrowserMetrics|*|REMOVESELF
FileKey14=%LocalAppData%\Maxthon\User Data\Crash Reports|*|REMOVESELF
FileKey15=%LocalAppData%\Maxthon\User Data\Crashpad|*|REMOVESELF
FileKey16=%LocalAppData%\Maxthon\User Data\Local Traces|*|REMOVESELF
FileKey17=%LocalAppData%\Maxthon\User Data\Log Files|*|REMOVESELF
FileKey18=%LocalAppData%\Maxthon\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Maxthon\User Data\Stability|*|REMOVESELF
RegKey1=HKCU\Software\Maxthon\BlBeacon|failed_count
RegKey2=HKCU\Software\Maxthon\BlBeacon|state
RegKey3=HKCU\Software\Maxthon\Installer|LastChecked
RegKey4=HKCU\Software\Maxthon\StabilityMetrics

[Maxthon Web Browsing Cookies *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\Network|Cookies*;Device Bound Sessions*

[Maxthon Web Browsing History *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Maxthon Web Browsing Session *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Maxthon\User Data\*\Sessions|*|REMOVESELF

[Maxthon Web Storage *]
Section=Maxthon Web Browser
DetectFile=%LocalAppData%\Maxthon\User Data
FileKey1=%LocalAppData%\Maxthon\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Maxthon\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Maxthon\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Maxthon\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Maxthon\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Maxthon\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Maxthon\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Maxthon\User Data\*\WebStorage|*|REMOVESELF

[MBBSoftware Audio Control *]
LangSecRef=3023
DetectFile=%LocalAppData%\MBBSoftware\Audio Control
FileKey1=%LocalAppData%\MBBSoftware\Audio Control\*\TemporaryFolder|*

[McAfee *]
LangSecRef=3024
DetectFile=%ProgramData%\McAfee
FileKey1=%ProgramData%\McAfee\AMCore\datreputation\Logs|*|RECURSE
FileKey2=%ProgramData%\McAfee\Common Framework\AgentEvents|*
FileKey3=%ProgramData%\McAfee\CSP\ETW|*.bak
FileKey4=%ProgramData%\McAfee\Jcm|*.tmp
FileKey5=%ProgramData%\McAfee\MCLOGS|*.bak;*.log|RECURSE
FileKey6=%ProgramData%\McAfee\MHN|*.bak
FileKey7=%ProgramData%\McAfee\modulecoreservice.exe|*.txt
FileKey8=%ProgramData%\McAfee\MPF|*.tmp
FileKey9=%ProgramData%\McAfee\MPF\data|*|RECURSE
FileKey10=%ProgramData%\McAfee\MSC\Cache|McSubDB.Bak
FileKey11=%ProgramData%\McAfee\MSC\Logs|*.log
FileKey12=%ProgramData%\McAfee\SiteAdvisor|*.log;*.tmp;*.txt|RECURSE
FileKey13=%ProgramData%\McAfee\Uninstall.exe|log.txt
FileKey14=%ProgramData%\McAfee\Update|*|RECURSE
FileKey15=%ProgramData%\McAfee\VirusScan\Data|*.log;*.old
FileKey16=%ProgramData%\McAfee\VirusScan\Logs|*|RECURSE
FileKey17=%ProgramData%\Network Associates\Common Framework\AgentEvents|*

[McAfee Real Protect *]
LangSecRef=3024
DetectFile=%ProgramFiles%\McAfee\Real Protect
FileKey1=%ProgramFiles%\McAfee\Real Protect|*.log

[McAfee Safe Connect *]
LangSecRef=3024
DetectFile=%AppData%\McAfee Safe Connect
FileKey1=%AppData%\McAfee Safe Connect|*.log

[McPixel *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\220860
FileKey1=%ProgramFiles%\Steam\Steamapps\common\mcpixel|log.txt

[Meausoft Mo-Search *]
LangSecRef=3024
Detect=HKCU\Software\Meauxsoft\Mo-Search
FileKey1=%LocalAppData%\Meauxsoft\Mo-Search4.0\Logs|*
RegKey1=HKCU\Software\Meauxsoft\Mo-Search\Mo-Search v4.0.13\Last Position

[Media Jukebox *]
LangSecRef=3023
Detect=HKCU\Software\J. River\Music Exchange\1.0\Media Jukebox
FileKey1=%ProgramFiles%\J River\Media Jukebox\Data|*.jmd

[Media Player Classic *]
LangSecRef=3023
Detect1=HKCU\Software\Gabest\Media Player Classic
Detect2=HKCU\Software\MPC-BE
Detect3=HKCU\Software\MPC-HC\MPC-HC
FileKey1=%AppData%\Media Player Classic|*.dmp
FileKey2=%AppData%\MPC-*|*.dmp
RegKey1=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 0
RegKey2=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 1
RegKey3=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 2
RegKey4=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 3
RegKey5=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 4
RegKey6=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 5
RegKey7=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 6
RegKey8=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 7
RegKey9=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 8
RegKey10=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 9
RegKey11=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 10
RegKey12=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 11
RegKey13=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 12
RegKey14=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 13
RegKey15=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 14
RegKey16=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 15
RegKey17=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 16
RegKey18=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 17
RegKey19=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 18
RegKey20=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 19
RegKey21=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 20
RegKey22=HKCU\Software\MPC-BE\Recent File List
RegKey23=HKCU\Software\MPC-BE\RecentFiles
RegKey24=HKCU\Software\MPC-BE\Settings|DVDPath
RegKey25=HKCU\Software\MPC-BE\Settings|LastOpenDir
RegKey26=HKCU\Software\MPC-BE\Settings|LastOpenFilterDir
RegKey27=HKCU\Software\MPC-BE\Settings|LastSavedPlaylistDir
RegKey28=HKCU\Software\MPC-BE\Settings|SnapShotPath
RegKey29=HKCU\Software\MPC-HC\MPC-HC\Recent File List
RegKey30=HKCU\Software\MPC-HC\MPC-HC\Settings|SnapshotPath

[Mediachance UtraSnap Pro *]
LangSecRef=3023
Detect=HKCU\Software\Mediachance\UtraSnapPRO
RegKey1=HKCU\Software\Mediachance\UtraSnapPRO\Disk|Filename
RegKey2=HKCU\Software\Mediachance\UtraSnapPRO\Recent File List

[MEGAsync *]
LangSecRef=3022
DetectFile=%LocalAppData%\Mega Limited\MEGAsync
FileKey1=%LocalAppData%\Mega Limited\MEGAsync|*.bak
FileKey2=%LocalAppData%\Mega Limited\MEGAsync\crashDumps|*
FileKey3=%LocalAppData%\Mega Limited\MEGAsync\logs|*

[Melbits World *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Melbot Studios\Melbits World
FileKey1=%UserProfile%\AppData\LocalLow\Melbot Studios\Melbits World|*log
FileKey2=%UserProfile%\AppData\LocalLow\Melbot Studios\Melbits World\Unity|*|REMOVESELF

[Melodics *]
LangSecRef=3023
DetectFile=%LocalAppData%\Melodics\Melodics
FileKey1=%LocalAppData%\Melodics\Melodics\Cache\qmlcache|*
FileKey2=%LocalAppData%\Melodics\Melodics\Crashes|*|RECURSE
FileKey3=%LocalAppData%\Melodics\Melodics\Logs|*
FileKey4=%LocalAppData%\Melodics\Melodics\NetworkCache|*|RECURSE

[Meltytech Shotcut *]
LangSecRef=3023
DetectFile=%LocalAppData%\Meltytech\Shotcut
FileKey1=%LocalAppData%\Meltytech\Shotcut|*-log.txt

[Memeo *]
LangSecRef=3024
DetectFile=%AppData%\Memeo
FileKey1=%AppData%\Memeo\AutoBackup\Logs|*
FileKey2=%AppData%\Memeo\Memeo Send\Logs|*

[MemoMaster 5 *]
LangSecRef=3021
Detect=HKCU\Software\JBSoftware\MemoMaster5
RegKey1=HKCU\Software\JBSoftware\MemoMaster5|FileMRU1
RegKey2=HKCU\Software\JBSoftware\MemoMaster5|FileMRU2
RegKey3=HKCU\Software\JBSoftware\MemoMaster5|FileMRU3
RegKey4=HKCU\Software\JBSoftware\MemoMaster5|FileMRU4
RegKey5=HKCU\Software\JBSoftware\MemoMaster5|FileMRU5
RegKey6=HKCU\Software\JBSoftware\MemoMaster5|FileMRU6
RegKey7=HKCU\Software\JBSoftware\MemoMaster5|FileMRU7
RegKey8=HKCU\Software\JBSoftware\MemoMaster5|FileMRU8
RegKey9=HKCU\Software\JBSoftware\MemoMaster5|FileMRU9
RegKey10=HKCU\Software\JBSoftware\MemoMaster5|FileMRU10
RegKey11=HKCU\Software\JBSoftware\MemoMaster5|FileMRU11
RegKey12=HKCU\Software\JBSoftware\MemoMaster5|FileMRU12
RegKey13=HKCU\Software\JBSoftware\MemoMaster5|FileMRU13
RegKey14=HKCU\Software\JBSoftware\MemoMaster5|FileMRU14
RegKey15=HKCU\Software\JBSoftware\MemoMaster5|FileMRU15

[MemoQ *]
LangSecRef=3022
DetectFile=%AppData%\MemoQ
FileKey1=%AppData%\MemoQ\Log|*.log
FileKey2=%ProgramData%\MemoQ Server\Log|*.log

[MEmu Android Emulator *]
LangSecRef=3021
DetectFile=%LocalAppData%\Microvirt\MEmu
FileKey1=%LocalAppData%\Microvirt\dump|*
FileKey2=%LocalAppData%\Microvirt\MEmu|*.log
FileKey3=%LocalAppData%\Microvirt\Setup|*.log

[Men of War *]
Section=Games
DetectFile1=%UserProfile%\Documents\My Games\Men of War*
DetectFile2=%UserProfile%\Documents\My Games\mow *
FileKey1=%UserProfile%\Documents\My Games\men of war*\log|*
FileKey2=%UserProfile%\Documents\My Games\men of war*\shader_cache|*|RECURSE
FileKey3=%UserProfile%\Documents\My Games\mow *\log|*
FileKey4=%UserProfile%\Documents\My Games\mow *\shader_cache|*|RECURSE

[Mercury Autocomplete History *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|formhistory*

[Mercury Autofill Data *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|autofill-profiles.json

[Mercury Bookmark Backups *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*\bookmarkbackups|*

[Mercury Bookmark Favicons *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|favicons*

[Mercury Caches *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\mercury\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\mercury\Profiles\*\notificationstore|*
FileKey4=%AppData%\mercury\Profiles\*\security_state|*
FileKey5=%AppData%\mercury\Profiles\*\shader-cache|*
FileKey6=%AppData%\mercury\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\mercury\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\mercury\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\mercury\Profiles\*\thumbnails|*|REMOVESELF

[Mercury Privacy Sandbox *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|credentialstate.sqlite

[Mercury Saved Usernames & Passwords *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|key4.db;logins.json

[Mercury Synced Tabs *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|synced-tabs.db*

[Mercury Telemetry *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury|*.log|RECURSE
FileKey2=%AppData%\mercury\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\mercury\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\mercury\Profiles\*\crashes|*
FileKey5=%AppData%\mercury\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\mercury\Profiles\*\minidumps|*
FileKey7=%AppData%\mercury\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\mercury\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\mercury\Profiles\*\weave\logs|*

[Mercury Web Browsing Cookies *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|cookies*

[Mercury Web Browsing Session *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|session*.json*

[Mercury Web Browsing Session Backups *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*\sessionstore-backups|*

[Mercury Web Storage *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\mercury\Profiles\*\storage\default\http*|*|REMOVESELF

[Mercury Website Permissions *]
Section=Mercury Web Browser
DetectFile=%AppData%\mercury\Profiles
FileKey1=%AppData%\mercury\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Messenger for Desktop *]
LangSecRef=3022
DetectFile=%LocalAppData%\Programs\messengerfordesktop
FileKey1=%LocalAppData%\messengerfordesktop-updater|*|RECURSE

[Metadata Analyzer *]
LangSecRef=3024
Detect=HKCU\Software\Smart PC Solutions\Metadata Analyzer
RegKey1=HKCU\Software\Smart PC Solutions\Metadata Analyzer|LastFile
RegKey2=HKCU\Software\Smart PC Solutions\Metadata Analyzer|LastFolder

[Metamorphose *]
LangSecRef=3024
DetectFile=%ProgramFiles%\metamorphose
FileKey1=%AppData%\.metamorphose\undo|*

[Metapad *]
LangSecRef=3021
Detect=HKCU\Software\metapad
RegKey1=HKCU\Software\metapad|mru_1
RegKey2=HKCU\Software\metapad|mru_2
RegKey3=HKCU\Software\metapad|mru_3
RegKey4=HKCU\Software\metapad|mru_4
RegKey5=HKCU\Software\metapad|mru_5
RegKey6=HKCU\Software\metapad|mru_6
RegKey7=HKCU\Software\metapad|mru_7
RegKey8=HKCU\Software\metapad|mru_8
RegKey9=HKCU\Software\metapad|mru_9
RegKey10=HKCU\Software\metapad|mru_10
RegKey11=HKCU\Software\metapad|szLastDirectory

[MetaTrader *]
LangSecRef=3021
DetectFile=%ProgramFiles%\MetaTrader*
FileKey1=%ProgramFiles%\MetaTrader*\experts|*.log|RECURSE
FileKey2=%ProgramFiles%\MetaTrader*\Logs|*

[MetaX *]
LangSecRef=3024
Detect=HKCU\Software\No Bull Software\MetaX
FileKey1=%UserProfile%\Documents\MetaX|*.log
RegKey1=HKCU\Software\No Bull Software\MetaX\Preferences|lastDir

[Metin2 *]
Section=Games
DetectFile=%ProgramFiles%\Metin2
FileKey1=%ProgramFiles%\Metin2|*.log
FileKey2=%ProgramFiles%\Metin2\hshield|*.log
FileKey3=%ProgramFiles%\Metin2\hshield\Update|*.log
FileKey4=%ProgramFiles%\Metin2\temp|*.log

[Microangelo *]
LangSecRef=3021
Detect1=HKCU\Software\Eclipsit\Microangelo\Toolset 6
Detect2=HKCU\Software\Impact\Microangelo
RegKey1=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Animator\MRU List
RegKey2=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Librarian\MRU List
RegKey3=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Studio\MRU List
RegKey4=HKCU\Software\Impact\Microangelo\Animator\MRU List
RegKey5=HKCU\Software\Impact\Microangelo\Librarian\MRU List
RegKey6=HKCU\Software\Impact\Microangelo\Studio\MRU List

[Micron Storage Executive *]
LangSecRef=3024
Detect=HKLM\Software\Micron\StorageExecutive
FileKey1=%ProgramFiles%\Micron Technology\Micron Storage Executive\logs|*.txt

[Microsoft 3D Viewer *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed

[Microsoft App-V *]
LangSecRef=3022
DetectFile=%AppData%\SoftGrid Client
FileKey1=%AppData%\SoftGrid Client|*.tmp|RECURSE
FileKey2=%AppData%\SoftGrid Client\Icon Cache|*
FileKey3=%LocalAppData%\SoftGrid Client|*.tmp|RECURSE
FileKey4=%ProgramData%\Microsoft\Application Virtualization Client\SoftGrid Client|*.tmp|RECURSE

[Microsoft Azure VPN Client *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\LocalState\LogFiles|*
FileKey3=%LocalAppData%\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Bing Dynamic *]
LangSecRef=3023
DetectFile=%LocalAppData%\Microsoft\Windows\Themes\BingDynamic1.theme
FileKey1=%LocalAppData%\Microsoft\Feeds|http~c~f~fthemeserver~dmicrosoft~dcom~fdefault~daspx~mp*Bing*

[Microsoft Bing Wallpapers *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey3=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\AutoFill*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Avatars|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Crash Reports|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Crashpad|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Crowd Deny|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Download Service|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Extension State|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\File System|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey32=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\optimization*|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Sessions|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Local Traces|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\MEIPreload|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Optimization*|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\OriginTrials|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\PKIMetadata|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Safe Browsing|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\SafetyTips|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\SmartScreen|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Stability|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\Subresource Filter|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\WidevineCdm|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\BingWallpaper_Widget\1001\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\LocalState\images\bing|*
FileKey67=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\Settings|*.log*
FileKey68=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey69=%LocalAppData%\Packages\Microsoft.BingWallpaper_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Clipchamp *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt
FileKey1=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey3=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey32=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\Settings|*.log*
FileKey67=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\SystemAppData\Helium|*.log*
FileKey68=%LocalAppData%\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\TempState|*|REMOVESELF

[Microsoft Company Portal *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\LocalState|*.log
FileKey3=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey4=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Copilot *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.Copilot_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Copilot_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Copilot_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.Copilot_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.Copilot_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Dependency Walker *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Dependency Walker
RegKey1=HKCU\Software\Microsoft\Dependency Walker\Recent File List

[Microsoft Deployment Toolkit *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Microsoft Deployment Toolkit
FileKey1=%ProgramFiles%\Microsoft Deployment Toolkit\Downloads|*|RECURSE

[Microsoft Diagnostics and Recovery Toolkit *]
LangSecRef=3025
Detect=HKCU\Software\MSDART
RegKey1=HKCU\Software\MSDART\Explorer\Recent File List

[Microsoft DirectX *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Direct3D\MostRecentApplication
RegKey2=HKCU\SOFTWARE\Microsoft\DirectInput\MostRecentApplication
RegKey3=HKCU\Software\Microsoft\MPEG2Demultiplexer|WriteCaptureDir
RegKey4=HKCU\Software\Microsoft\MPEG2Demultiplexer|WriteCapturePath
RegKey5=HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache
RegKey6=HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache64
RegKey7=HKLM\Software\Microsoft\Direct3D\MostRecentApplication
RegKey8=HKLM\Software\Microsoft\DirectDraw\MostRecentApplication
RegKey9=HKLM\Software\Wow6432Node\Microsoft\Direct3D\MostRecentApplication
RegKey10=HKLM\Software\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication

[Microsoft DirectX Shader Cache *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\D3DSCache|*|REMOVESELF
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\D3DSCache|*|RECURSE

[Microsoft Expression Encoder *]
LangSecRef=3023
DetectFile=%UserProfile%\Documents\Expression\Expression Encoder
FileKey1=%UserProfile%\Documents\Expression\Expression Encoder\Logs|*

[Microsoft Expression Web *]
LangSecRef=3024
Detect=HKCU\Software\Microsoft\Expression\Web Designer
RegKey1=HKCU\Software\Microsoft\Expression\Web Designer\FindMRU

[Microsoft Flight Simulator X *]
Section=Games
Detect=HKLM\Software\Microsoft\Microsoft Games\Flight Simulator\10.0
FileKey1=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*.html;*.log;*.rtf;*.URL
FileKey2=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log
ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\|kiosk.rtf
ExcludeKey2=PATH|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\|readme.*

[Microsoft Garage Mouse Without Borders *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Microsoft Garage\Mouse without Borders
FileKey1=%ProgramFiles%\Microsoft Garage\Mouse without Borders|*.log

[Microsoft HTML Help *]
LangSecRef=3025
Detect1=HKCU\Software\Microsoft\HTML Help Workshop
Detect2=HKCU\Software\Microsoft\Microsoft Help Workshop
Detect3=HKLM\Software\Microsoft\HTMLHelp
FileKey1=%AppData%\Microsoft\HTML Help|*.chw;hh.dat;hhcolreg.dat
FileKey2=%ProgramData%\Microsoft\HTML Help|hh.dat;hhcolreg.dat
FileKey3=%SystemDrive%\Documents and Settings\LocalService\Application Data\Microsoft\HTML Help|hh.dat
FileKey4=%WinDir%\Application Data\Microsoft\HTML Help|hh.dat
FileKey5=%WinDir%\Help|*.chw;*.cnt
RegKey1=HKCU\Software\Microsoft\HTML Help Workshop\Compressed HTML
RegKey2=HKCU\Software\Microsoft\HTML Help Workshop\Html Titles
RegKey3=HKCU\Software\Microsoft\HTML Help Workshop\Project Files
RegKey4=HKCU\Software\Microsoft\HTML Help Workshop\Recent File List
RegKey5=HKCU\Software\Microsoft\HTML Help Workshop\Settings|LastProject
RegKey6=HKCU\Software\Microsoft\Microsoft Help Workshop\Cnt Files
RegKey7=HKCU\Software\Microsoft\Microsoft Help Workshop\Forage Files
RegKey8=HKCU\Software\Microsoft\Microsoft Help Workshop\Hlp Files
RegKey9=HKCU\Software\Microsoft\Microsoft Help Workshop\Hpj Files
RegKey10=HKCU\Software\Microsoft\Microsoft Help Workshop\Map Files
RegKey11=HKCU\Software\Microsoft\Microsoft Help Workshop\Recent File List
RegKey12=HKCU\Software\Microsoft\Microsoft HTML Help Image Editor\Folders
RegKey13=HKCU\Software\Microsoft\Microsoft HTML Help Image Editor\Recent File List

[Microsoft Journal *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe\LocalCache|cache*
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe\LocalCache\SearchIndex|*
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftJournal_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Management Console *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\MMC
FileKey1=%AppData%\Microsoft\MMC|*
RegKey1=HKCU\SOFTWARE\Microsoft\Microsoft Management Console\Recent File List

[Microsoft Message Analyzer *]
LangSecRef=3024
DetectFile=%LocalAppData%\Microsoft\MessageAnalyzer
FileKey1=%LocalAppData%\Microsoft\MessageAnalyzer|*.log
FileKey2=%UserProfile%\Documents\MessageAnalyzer\Traces|*|RECURSE

[Microsoft Messaging *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalCache|*.etl;*.xml
FileKey3=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Messaging_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Mixed Reality Link *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.MixedRealityLink_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MixedRealityLink_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MixedRealityLink_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.MixedRealityLink_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.MixedRealityLink_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Mixed Reality Portal *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Mobile Plans *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir|*.txt
FileKey5=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\Settings|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Mouse and Keyboard Center *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\Microsoft Device Center
DetectFile2=%ProgramFiles%\Microsoft Mouse and Keyboard Center
Warning=This will also delete all app-specific settings.
RegKey1=HKCU\Software\Microsoft\IntelliPoint\AppSpecific
RegKey2=HKCU\Software\Microsoft\IntelliType Pro\AppSpecific

[Microsoft Movies & TV *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\PlayReady|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous|*.log
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\ImageCache|*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\ImageRetrievalFailure|*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\ImageStore|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\PlayReady|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings|*.log*
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory\SearchHistory

[Microsoft News *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe\LocalState\Cache\Images|*
FileKey3=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe\SearchHistory

[Microsoft NuGet Package Cache *]
LangSecRef=3021
DetectFile=%LocalAppData%\NuGet
FileKey1=%LocalAppData%\NuGet\*Cache|*|REMOVESELF

[Microsoft Office *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
FileKey1=%AppData%\Microsoft\Clip Organizer|mstore*.mgc;Offic*.MGC
FileKey2=%AppData%\Microsoft\Document Building Blocks|*|RECURSE
FileKey3=%AppData%\Microsoft\Office|*.tmp|RECURSE
FileKey4=%AppData%\Microsoft\Office\Recent|*
FileKey5=%AppData%\Microsoft\OIS|Toolbars.dat
FileKey6=%AppData%\Microsoft\PowerPoint\Sync\Temp|*
FileKey7=%AppData%\Microsoft\Templates|*.dot*;*.pot*;*.xlt*
FileKey8=%AppData%\Microsoft\UProof|*.bin;*.XML
FileKey9=%AppData%\Microsoft\Windows\Recent\AutomaticDestinations|*a7fd3622d948815;*b711200c399477;*d006197d08ade86|RECURSE
FileKey10=%LocalAppData%\Microsoft Help|*
FileKey11=%LocalAppData%\Microsoft\MSOIdentityCRL\production\temp|._sync
FileKey12=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache
FileKey13=%LocalAppData%\Microsoft\Office\*\BackstageInAppNavCache|*|RECURSE
FileKey14=%LocalAppData%\Microsoft\Office\16.0\OfficeFileCache|*|RECURSE
FileKey15=%LocalAppData%\Microsoft\Office\16.0\WebServiceCache|*|RECURSE
FileKey16=%LocalAppData%\Microsoft\Office\DLP\mip\Logs|*
FileKey17=%LocalAppData%\Microsoft\Office\OTele|*|RECURSE
FileKey18=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache
FileKey19=%LocalAppData%\Microsoft\OneNote\*\cache|*|RECURSE
FileKey20=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*|RECURSE
FileKey21=%LocalAppData%\Microsoft\Visio|thumbs.dat
FileKey22=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC|*|RECURSE
FileKey23=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey24=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\AppData\Local\Office\*\WebServiceCache|*|RECURSE
FileKey25=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey26=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey27=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey28=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey34=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey44=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings|*.log*
FileKey60=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey61=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\oice_*\AC|*|RECURSE
FileKey63=%LocalAppData%\TempOffice*|*|REMOVESELF
FileKey64=%SystemDrive%|propfix.log
FileKey65=%UserProfile%\Documents|~*.doc*;~*.ppt*|RECURSE
FileKey66=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*|RECURSE
FileKey67=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*|RECURSE
RegKey1=HKCU\Software\Microsoft\ClipArt Gallery\2.0\MRUDescription
RegKey2=HKCU\Software\Microsoft\Office\11.0\Common\General|SymbolMRU
RegKey3=HKCU\Software\Microsoft\Office\11.0\Excel|FontInfoCache
RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution
RegKey5=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList
RegKey6=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList
RegKey7=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList
RegKey8=HKCU\Software\Microsoft\Office\11.0\Word|FontInfoCache
RegKey9=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation
RegKey10=HKCU\Software\Microsoft\Office\12.0\Common\OfficeStart\Web\Templates
RegKey11=HKCU\Software\Microsoft\Office\12.0\Excel\Recent Templates
RegKey12=HKCU\Software\Microsoft\Office\12.0\PowerPoint\Recent Templates
RegKey13=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations
RegKey14=HKCU\Software\Microsoft\Office\12.0\Word\Recent Templates
RegKey15=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation
RegKey16=HKCU\Software\Microsoft\Office\14.0\Common\OfficeStart\Web\Templates
RegKey17=HKCU\Software\Microsoft\Office\14.0\Common\Open Find\Microsoft Word\Settings\Print to file\File Name MRU
RegKey18=HKCU\Software\Microsoft\Office\14.0\Excel\Recent Templates
RegKey19=HKCU\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents\TrustRecords
RegKey20=HKCU\Software\Microsoft\Office\14.0\PowerPoint\Recent Templates
RegKey21=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations
RegKey22=HKCU\Software\Microsoft\Office\14.0\Word\Recent Templates
RegKey23=HKCU\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents\TrustRecords
RegKey24=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation
RegKey25=HKCU\Software\Microsoft\Office\15.0\Common\OfficeStart\Web\Templates
RegKey26=HKCU\Software\Microsoft\Office\15.0\Excel\Recent Templates
RegKey27=HKCU\Software\Microsoft\Office\15.0\PowerPoint\Recent Templates
RegKey28=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations
RegKey29=HKCU\Software\Microsoft\Office\15.0\Word\Recent Templates
RegKey30=HKCU\Software\Microsoft\Office\16.0\Access\File MRU
RegKey31=HKCU\Software\Microsoft\Office\16.0\Access\User MRU
RegKey32=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation
RegKey33=HKCU\Software\Microsoft\Office\16.0\Common\OfficeStart\Web\Templates
RegKey34=HKCU\Software\Microsoft\Office\16.0\Excel\File MRU
RegKey35=HKCU\Software\Microsoft\Office\16.0\Excel\Place MRU
RegKey36=HKCU\Software\Microsoft\Office\16.0\Excel\Recent Templates
RegKey37=HKCU\Software\Microsoft\Office\16.0\Excel\User MRU
RegKey38=HKCU\Software\Microsoft\Office\16.0\Excel\User MRU\ADAL_\File MRU
RegKey39=HKCU\Software\Microsoft\Office\16.0\Excel\User MRU\ADAL_\Place MRU
RegKey40=HKCU\Software\Microsoft\Office\16.0\Excel\User MRU\LiveId_\File MRU
RegKey41=HKCU\Software\Microsoft\Office\16.0\Excel\User MRU\LiveId_\Place MRU
RegKey42=HKCU\Software\Microsoft\Office\16.0\OneNote\RecentNotebooks
RegKey43=HKCU\Software\Microsoft\Office\16.0\PowerPoint\File MRU
RegKey44=HKCU\Software\Microsoft\Office\16.0\PowerPoint\Place MRU
RegKey45=HKCU\Software\Microsoft\Office\16.0\PowerPoint\Recent Templates
RegKey46=HKCU\Software\Microsoft\Office\16.0\PowerPoint\RecentAnimationList
RegKey47=HKCU\Software\Microsoft\Office\16.0\PowerPoint\User MRU
RegKey48=HKCU\Software\Microsoft\Office\16.0\PowerPoint\User MRU\ADAL_\File MRU
RegKey49=HKCU\Software\Microsoft\Office\16.0\PowerPoint\User MRU\ADAL_\Place MRU
RegKey50=HKCU\Software\Microsoft\Office\16.0\PowerPoint\User MRU\LiveId_\File MRU
RegKey51=HKCU\Software\Microsoft\Office\16.0\PowerPoint\User MRU\LiveId_\Place MRU
RegKey52=HKCU\Software\Microsoft\Office\16.0\Publisher\File MRU
RegKey53=HKCU\Software\Microsoft\Office\16.0\Publisher\User MRU
RegKey54=HKCU\Software\Microsoft\Office\16.0\Word\File MRU
RegKey55=HKCU\Software\Microsoft\Office\16.0\Word\Place MRU
RegKey56=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations
RegKey57=HKCU\Software\Microsoft\Office\16.0\Word\Recent Templates
RegKey58=HKCU\Software\Microsoft\Office\16.0\Word\User MRU
RegKey59=HKCU\Software\Microsoft\Office\16.0\Word\User MRU\ADAL_\File MRU
RegKey60=HKCU\Software\Microsoft\Office\16.0\Word\User MRU\ADAL_\Place MRU
RegKey61=HKCU\Software\Microsoft\Office\16.0\Word\User MRU\LiveId_\File MRU
RegKey62=HKCU\Software\Microsoft\Office\16.0\Word\User MRU\LiveId_\Place MRU
RegKey63=HKCU\Software\Microsoft\Office\Common|FontBmpCache
RegKey64=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList
RegKey65=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList
RegKey66=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList
RegKey67=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList
ExcludeKey1=FILE|%AppData%\Microsoft\Office\Recent\|Welcome to MS Project.LNK
ExcludeKey2=FILE|%AppData%\Microsoft\Office\Recent\|Welcome to OneNote.LNK
ExcludeKey3=FILE|%AppData%\Microsoft\Office\Recent\|Welcome to Publisher.LNK
ExcludeKey4=FILE|%AppData%\Microsoft\Office\Recent\|Welcome to Visio.LNK
ExcludeKey5=FILE|%AppData%\Microsoft\Office\Recent\|Welcome to Word.LNK
ExcludeKey6=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\*\|www.office[1].xml
ExcludeKey7=PATH|%UserProfile%\Documents\*\|~*.doc*.*
ExcludeKey8=PATH|%UserProfile%\Documents\*\|~*.ppt*.*

[Microsoft Office Unsaved Files *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office
FileKey1=%AppData%\Microsoft\Excel|*|RECURSE
FileKey2=%AppData%\Microsoft\PowerPoint|*|RECURSE
FileKey3=%AppData%\Microsoft\Word|*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Office\UnsavedFiles|*|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Word\|listgal.dat
ExcludeKey2=PATH|%AppData%\Microsoft\Excel\XLSTART\|*
ExcludeKey3=PATH|%AppData%\Microsoft\PowerPoint\|PPT*.pcb
ExcludeKey4=PATH|%AppData%\Microsoft\Word\STARTUP\|*

[Microsoft OneDrive *]
LangSecRef=3021
DetectFile1=%LocalAppData%\Microsoft\OneDrive
DetectFile2=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Microsoft\OneDrive\Logs|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\OneDrive\Setup\Logs|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\SkyDrive\logs|*
FileKey4=%LocalAppData%\Microsoft\Windows\OneDrive\logs|*|RECURSE
FileKey5=%LocalAppData%\OneDrive\Cache|*|RECURSE
FileKey6=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe\AC|*|RECURSE
FileKey7=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey8=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe\LocalState\Logs|*.log
FileKey9=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe\Settings|*.log*
FileKey10=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey11=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey12=%ProgramFiles%\Microsoft OneDrive\FileSyncHelper\logs|*.odl|RECURSE
FileKey13=%ProgramFiles%\Microsoft OneDrive\Setup\Logs|*
FileKey14=%ProgramFiles%\Microsoft OneDrive\UpdaterService\logs|*.odl|RECURSE
FileKey15=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\Logs|*|RECURSE
FileKey16=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\Setup\Logs|*|RECURSE
FileKey17=%WinDir%\System32\LogFiles\CloudFiles|*|RECURSE
FileKey18=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\Logs|*|RECURSE
FileKey19=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\Setup\Logs|*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\PersistedPickerData\microsoft.microsoftskydrive_8wekyb3d8bbwe!Microsoft.MicrosoftSkyDrive\DefaultOpenFileMultiple|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\SearchHistory

[Microsoft OneNote *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\AppData\Local|msodata*.dat
FileKey3=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\office*client.microsoft.com|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\AppData\Local\Office\OTele|*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\AppData\Local\OneNote\16.0|*.onecache
FileKey6=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\AppData\Local\OneNote\16.0\OneNote*Cache_Files|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings|*.log*
FileKey8=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey9=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.OneNote_8wekyb3d8bbwe\SearchHistory

[Microsoft Orca *]
LangSecRef=3024
Detect=HKCU\Software\Microsoft\Orca
RegKey1=HKCU\Software\Microsoft\Orca\Recent File List

[Microsoft Outlook *]
LangSecRef=3022
Detect1=HKCU\Software\Microsoft\Office\9.0\Outlook
Detect2=HKCU\Software\Microsoft\Office\10.0\Outlook
Detect3=HKCU\Software\Microsoft\Office\11.0\Outlook
Detect4=HKCU\Software\Microsoft\Office\12.0\Outlook
Detect5=HKCU\Software\Microsoft\Office\14.0\Outlook
Detect6=HKCU\Software\Microsoft\Office\15.0\Outlook
Detect7=HKCU\Software\Microsoft\Office\16.0\Outlook
RegKey1=HKCU\Identities\{9745A9A1-95D3-4584-B4E8-C9C2374B3BD3}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List
RegKey2=HKCU\Software\Microsoft\Office\9.0\Outlook\Office Finder|1
RegKey3=HKCU\Software\Microsoft\Office\9.0\Outlook\Office Finder|2
RegKey4=HKCU\Software\Microsoft\Office\9.0\Outlook\Office Finder|3
RegKey5=HKCU\Software\Microsoft\Office\9.0\Outlook\Preferences|LocationMRU
RegKey6=HKCU\Software\Microsoft\Office\9.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445
RegKey7=HKCU\Software\Microsoft\Office\10.0\Outlook\Office Finder|1
RegKey8=HKCU\Software\Microsoft\Office\10.0\Outlook\Office Finder|2
RegKey9=HKCU\Software\Microsoft\Office\10.0\Outlook\Office Finder|3
RegKey10=HKCU\Software\Microsoft\Office\10.0\Outlook\Preferences|LocationMRU
RegKey11=HKCU\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445
RegKey12=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|1
RegKey13=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|2
RegKey14=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|3
RegKey15=HKCU\Software\Microsoft\Office\11.0\Outlook\Preferences|LocationMRU
RegKey16=HKCU\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445
RegKey17=HKCU\Software\Microsoft\Office\12.0\Outlook\Office Finder|1
RegKey18=HKCU\Software\Microsoft\Office\12.0\Outlook\Office Finder|2
RegKey19=HKCU\Software\Microsoft\Office\12.0\Outlook\Office Finder|3
RegKey20=HKCU\Software\Microsoft\Office\12.0\Outlook\Preferences|LocationMRU
RegKey21=HKCU\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445
RegKey22=HKCU\Software\Microsoft\Office\14.0\Outlook\Office Finder|1
RegKey23=HKCU\Software\Microsoft\Office\14.0\Outlook\Office Finder|2
RegKey24=HKCU\Software\Microsoft\Office\14.0\Outlook\Office Finder|3
RegKey25=HKCU\Software\Microsoft\Office\14.0\Outlook\Preferences|LocationMRU
RegKey26=HKCU\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445
RegKey27=HKCU\Software\Microsoft\Office\15.0\Outlook\Office Finder|1
RegKey28=HKCU\Software\Microsoft\Office\15.0\Outlook\Office Finder|2
RegKey29=HKCU\Software\Microsoft\Office\15.0\Outlook\Office Finder|3
RegKey30=HKCU\Software\Microsoft\Office\15.0\Outlook\Preferences|LocationMRU
RegKey31=HKCU\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445
RegKey32=HKCU\Software\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData|BootDiagnosticsLogFile
RegKey33=HKCU\Software\Microsoft\Office\16.0\Outlook\Office Finder|1
RegKey34=HKCU\Software\Microsoft\Office\16.0\Outlook\Office Finder|2
RegKey35=HKCU\Software\Microsoft\Office\16.0\Outlook\Office Finder|3
RegKey36=HKCU\Software\Microsoft\Office\16.0\Outlook\Preferences|LocationMRU
RegKey37=HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046|101f0445

[Microsoft Outlook For Windows *]
LangSecRef=3022
DetectFile=%LocalAppData%\Microsoft\Olk
FileKey1=%LocalAppData%\Microsoft\Olk\Application|debug.log
FileKey2=%LocalAppData%\Microsoft\Olk\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\Olk\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey4=%LocalAppData%\Microsoft\Olk\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Microsoft\Olk\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey6=%LocalAppData%\Microsoft\Olk\EBWebView\*Cache*|*|REMOVESELF
FileKey7=%LocalAppData%\Microsoft\Olk\EBWebView\AutoFill*|*|REMOVESELF
FileKey8=%LocalAppData%\Microsoft\Olk\EBWebView\Avatars|*|REMOVESELF
FileKey9=%LocalAppData%\Microsoft\Olk\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey10=%LocalAppData%\Microsoft\Olk\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey11=%LocalAppData%\Microsoft\Olk\EBWebView\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Microsoft\Olk\EBWebView\Crashpad|*|REMOVESELF
FileKey13=%LocalAppData%\Microsoft\Olk\EBWebView\Crowd Deny|*|REMOVESELF
FileKey14=%LocalAppData%\Microsoft\Olk\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;Login Data*;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey15=%LocalAppData%\Microsoft\Olk\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Microsoft\Olk\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey17=%LocalAppData%\Microsoft\Olk\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey18=%LocalAppData%\Microsoft\Olk\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey19=%LocalAppData%\Microsoft\Olk\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey20=%LocalAppData%\Microsoft\Olk\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey21=%LocalAppData%\Microsoft\Olk\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey22=%LocalAppData%\Microsoft\Olk\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey23=%LocalAppData%\Microsoft\Olk\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey24=%LocalAppData%\Microsoft\Olk\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey25=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Download Service|*|REMOVESELF
FileKey26=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Extension State|*|REMOVESELF
FileKey27=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey28=%LocalAppData%\Microsoft\Olk\EBWebView\Default\File System|*|REMOVESELF
FileKey29=%LocalAppData%\Microsoft\Olk\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey30=%LocalAppData%\Microsoft\Olk\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%LocalAppData%\Microsoft\Olk\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey32=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey33=%LocalAppData%\Microsoft\Olk\EBWebView\Default\optimization*|*|REMOVESELF
FileKey34=%LocalAppData%\Microsoft\Olk\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey35=%LocalAppData%\Microsoft\Olk\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey36=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey37=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey38=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey39=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Sessions|*|REMOVESELF
FileKey40=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey41=%LocalAppData%\Microsoft\Olk\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey42=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey43=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey44=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey45=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey46=%LocalAppData%\Microsoft\Olk\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey47=%LocalAppData%\Microsoft\Olk\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey48=%LocalAppData%\Microsoft\Olk\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey49=%LocalAppData%\Microsoft\Olk\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey50=%LocalAppData%\Microsoft\Olk\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey51=%LocalAppData%\Microsoft\Olk\EBWebView\Local Traces|*|REMOVESELF
FileKey52=%LocalAppData%\Microsoft\Olk\EBWebView\MEIPreload|*|REMOVESELF
FileKey53=%LocalAppData%\Microsoft\Olk\EBWebView\Optimization*|*|REMOVESELF
FileKey54=%LocalAppData%\Microsoft\Olk\EBWebView\OriginTrials|*|REMOVESELF
FileKey55=%LocalAppData%\Microsoft\Olk\EBWebView\PKIMetadata|*|REMOVESELF
FileKey56=%LocalAppData%\Microsoft\Olk\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey57=%LocalAppData%\Microsoft\Olk\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey58=%LocalAppData%\Microsoft\Olk\EBWebView\Safe Browsing|*|REMOVESELF
FileKey59=%LocalAppData%\Microsoft\Olk\EBWebView\SafetyTips|*|REMOVESELF
FileKey60=%LocalAppData%\Microsoft\Olk\EBWebView\SmartScreen|*|REMOVESELF
FileKey61=%LocalAppData%\Microsoft\Olk\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey62=%LocalAppData%\Microsoft\Olk\EBWebView\Stability|*|REMOVESELF
FileKey63=%LocalAppData%\Microsoft\Olk\EBWebView\Subresource Filter|*|REMOVESELF
FileKey64=%LocalAppData%\Microsoft\Olk\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey65=%LocalAppData%\Microsoft\Olk\EBWebView\WidevineCdm|*|REMOVESELF
FileKey66=%LocalAppData%\Microsoft\Olk\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey67=%LocalAppData%\Microsoft\Olk\Logs|*|REMOVESELF

[Microsoft Paint 3D *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.MsPaint_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MsPaint_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MsPaint_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MsPaint_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.MsPaint_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.MsPaint_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft PC Manager *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\Microsoft.MicrosoftPCManager_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\PC Manager Store
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftPCManager_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftPCManager_8wekyb3d8bbwe\LocalCache\Windows Master Store\IconCache|*
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftPCManager_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftPCManager_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftPCManager_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey6=%LocalAppData%\PC Manager Store\webview2\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey7=%LocalAppData%\PC Manager Store\webview2\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey8=%LocalAppData%\PC Manager Store\webview2\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey9=%LocalAppData%\PC Manager Store\webview2\EBWebView\*Cache*|*|REMOVESELF
FileKey10=%LocalAppData%\PC Manager Store\webview2\EBWebView\AutoFill*|*|REMOVESELF
FileKey11=%LocalAppData%\PC Manager Store\webview2\EBWebView\Avatars|*|REMOVESELF
FileKey12=%LocalAppData%\PC Manager Store\webview2\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey13=%LocalAppData%\PC Manager Store\webview2\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey14=%LocalAppData%\PC Manager Store\webview2\EBWebView\Crash Reports|*|REMOVESELF
FileKey15=%LocalAppData%\PC Manager Store\webview2\EBWebView\Crashpad|*|REMOVESELF
FileKey16=%LocalAppData%\PC Manager Store\webview2\EBWebView\Crowd Deny|*|REMOVESELF
FileKey17=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;Login Data*;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey18=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey19=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey20=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey21=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey22=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey23=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey24=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey25=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey26=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey27=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey28=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Download Service|*|REMOVESELF
FileKey29=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Extension State|*|REMOVESELF
FileKey30=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey31=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\File System|*|REMOVESELF
FileKey32=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey33=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey34=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey35=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey36=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\optimization*|*|REMOVESELF
FileKey37=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey38=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey39=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey40=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey41=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey42=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Sessions|*|REMOVESELF
FileKey43=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey44=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey45=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey46=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey47=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey48=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey49=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey50=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey51=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey52=%LocalAppData%\PC Manager Store\webview2\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey53=%LocalAppData%\PC Manager Store\webview2\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey54=%LocalAppData%\PC Manager Store\webview2\EBWebView\Local Traces|*|REMOVESELF
FileKey55=%LocalAppData%\PC Manager Store\webview2\EBWebView\MEIPreload|*|REMOVESELF
FileKey56=%LocalAppData%\PC Manager Store\webview2\EBWebView\Optimization*|*|REMOVESELF
FileKey57=%LocalAppData%\PC Manager Store\webview2\EBWebView\OriginTrials|*|REMOVESELF
FileKey58=%LocalAppData%\PC Manager Store\webview2\EBWebView\PKIMetadata|*|REMOVESELF
FileKey59=%LocalAppData%\PC Manager Store\webview2\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey60=%LocalAppData%\PC Manager Store\webview2\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey61=%LocalAppData%\PC Manager Store\webview2\EBWebView\Safe Browsing|*|REMOVESELF
FileKey62=%LocalAppData%\PC Manager Store\webview2\EBWebView\SafetyTips|*|REMOVESELF
FileKey63=%LocalAppData%\PC Manager Store\webview2\EBWebView\SmartScreen|*|REMOVESELF
FileKey64=%LocalAppData%\PC Manager Store\webview2\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey65=%LocalAppData%\PC Manager Store\webview2\EBWebView\Stability|*|REMOVESELF
FileKey66=%LocalAppData%\PC Manager Store\webview2\EBWebView\Subresource Filter|*|REMOVESELF
FileKey67=%LocalAppData%\PC Manager Store\webview2\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey68=%LocalAppData%\PC Manager Store\webview2\EBWebView\WidevineCdm|*|REMOVESELF
FileKey69=%LocalAppData%\PC Manager Store\webview2\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey70=%LocalAppData%\Windows Master Store\IconCache|*
FileKey71=%ProgramData%\Windows Master Store\assets\image|*
FileKey72=%ProgramData%\Windows Master Store\common|*.log
FileKey73=%ProgramData%\Windows Master Store\common\crash|*|RECURSE

[Microsoft People *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\LocalState\DiagOutputDir|*.etl
FileKey5=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\Settings|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\Microsoft.People_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Phone Link *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft PlayReady *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe
DetectFile2=%ProgramData%\Microsoft\Windows\DRM
FileKey1=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey7=%ProgramData%\Microsoft\PlayReady|*.hds
FileKey8=%ProgramData%\Microsoft\PlayReady\Cache|*
FileKey9=%ProgramData%\Microsoft\Windows\DRM|*.log
FileKey10=%ProgramData%\Microsoft\Windows\DRM\Cache|*|RECURSE
FileKey11=%ProgramData%\Microsoft\Windows\DRM\PreUpgrade|*.log

[Microsoft Power Automate *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Microsoft\Power Automate Desktop
DetectFile2=%LocalAppData%\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Microsoft\Power Automate Desktop\DataCollection|*
FileKey2=%LocalAppData%\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\AC|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft PowerToys *]
Section=Microsoft PowerToys
Detect=HKCU\Software\Microsoft\PowerToys
DetectFile=%LocalAppData%\Packages\Microsoft.PowerToys.SparseApp_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Microsoft\PowerToys\*Logs|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys-*.etl
FileKey3=%LocalAppData%\Packages\Microsoft.PowerToys.SparseApp_8wekyb3d8bbwe\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.PowerToys.SparseApp_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.PowerToys.SparseApp_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.PowerToys.SparseApp_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft PowerToys Advanced Paste *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\AdvancedPaste
FileKey1=%LocalAppData%\Microsoft\PowerToys\AdvancedPaste|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.AdvancedPaste*.etl

[Microsoft PowerToys Always On Top *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\AlwaysOnTop
FileKey1=%LocalAppData%\Microsoft\PowerToys\AlwaysOnTop|*.log|REMOVESELF

[Microsoft PowerToys Awake *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Awake
FileKey1=%LocalAppData%\Microsoft\PowerToys\Awake|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.Awake*.etl

[Microsoft PowerToys Color Picker *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\ColorPicker
FileKey1=%LocalAppData%\Microsoft\PowerToys\ColorPicker|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.ColorPickerUI*.etl

[Microsoft PowerToys Command Not Found *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\CmdNotFound
FileKey1=%LocalAppData%\Microsoft\PowerToys\CmdNotFound|*.log|REMOVESELF

[Microsoft PowerToys Command Palette *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\CmdPal
FileKey1=%LocalAppData%\Microsoft\PowerToys\CmdPal|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|Microsoft.CmdPal*.etl

[Microsoft PowerToys Crop And Lock *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\CropAndLock
FileKey1=%LocalAppData%\Microsoft\PowerToys\CropAndLock|*.log|REMOVESELF

[Microsoft PowerToys Environment Variables *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\EnvironmentVariables
FileKey1=%LocalAppData%\Microsoft\PowerToys\EnvironmentVariables|*.log|REMOVESELF

[Microsoft PowerToys Fancy Zones *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\FancyZones
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys_FancyZones*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\FancyZones|*.log|REMOVESELF

[Microsoft PowerToys File Explorer Add-ons *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\File Explorer
FileKey1=%LocalAppData%\Microsoft\PowerToys\File Explorer|*.log|REMOVESELF
FileKey2=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\etw|PowerToys.MarkdownPreviewHandler*.etl;PowerToys.PdfPreviewHandler*.etl
FileKey3=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\FileExplorer_localLow|*.log|REMOVESELF
FileKey4=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\logs\FileExplorer_localLow|*.log|REMOVESELF
FileKey5=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\MarkdownPreview-Temp\EBWebview|*|REMOVESELF
FileKey6=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\MonacoPreview-Temp\EBWebview|*|REMOVESELF
FileKey7=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\PdfThumbnail-Temp\EBWebview|*|REMOVESELF
FileKey8=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\Svg*-Temp\EBWebview|*|REMOVESELF

[Microsoft PowerToys File Locksmith *]
Section=Microsoft PowerToys
DetectFile1=%LocalAppData%\Microsoft\PowerToys\File Locksmith
DetectFile2=%LocalAppData%\Packages\Microsoft.PowerToys.FileLocksmithContextMenu_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Microsoft\PowerToys\File Locksmith|*.log|REMOVESELF
FileKey2=%LocalAppData%\Packages\Microsoft.PowerToys.FileLocksmithContextMenu_8wekyb3d8bbwe\AC|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.PowerToys.FileLocksmithContextMenu_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.PowerToys.FileLocksmithContextMenu_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.PowerToys.FileLocksmithContextMenu_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft PowerToys Hosts File Editor *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Hosts
FileKey1=%LocalAppData%\Microsoft\PowerToys\Hosts|*.log|REMOVESELF

[Microsoft PowerToys Image Resizer *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Image Resizer
FileKey1=%LocalAppData%\Microsoft\PowerToys\Image Resizer|*.log|REMOVESELF

[Microsoft PowerToys Keyboard Manager *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Keyboard Manager
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys_KeyboardManagerEngine*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\Keyboard Manager|*.log|REMOVESELF

[Microsoft PowerToys Light Switch *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\LightSwitch
FileKey1=%LocalAppData%\Microsoft\PowerToys\LightSwitch|*.log|REMOVESELF

[Microsoft PowerToys Mouse Utilities *]
Section=Microsoft PowerToys
DetectFile1=%LocalAppData%\Microsoft\PowerToys\FindMyMouse
DetectFile2=%LocalAppData%\Microsoft\PowerToys\MouseHighlighter
DetectFile3=%LocalAppData%\Microsoft\PowerToys\MouseJump
DetectFile4=%LocalAppData%\Microsoft\PowerToys\MousePointerCrosshairs
FileKey1=%LocalAppData%\Microsoft\PowerToys\FindMyMouse|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\MouseHighlighter|*.log|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\PowerToys\MouseJump|*.log|REMOVESELF
FileKey4=%LocalAppData%\Microsoft\PowerToys\MousePointerCrosshairs|*.log|REMOVESELF

[Microsoft PowerToys Mouse Without Borders *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\MouseWithoutBorders
FileKey1=%LocalAppData%\Microsoft\PowerToys\MouseWithoutBorders|*.log|REMOVESELF

[Microsoft PowerToys New+ *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\NewPlus
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.Awake*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\NewPlus\NewPlus.ShellExtension|*.log|REMOVESELF

[Microsoft PowerToys Peek *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Peek
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.Peek.UI*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\Peek|*.log|REMOVESELF
FileKey3=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\Peek-Temp\EBWebview|*|REMOVESELF

[Microsoft PowerToys PowerRename *]
Section=Microsoft PowerToys
DetectFile1=%LocalAppData%\Microsoft\PowerToys\PowerRename
DetectFile2=%LocalAppData%\Packages\Microsoft.PowerToys.PowerRenameContextMenu_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Microsoft\PowerToys\PowerRename|*.log;power-rename-last-run-data.json|REMOVESELF
FileKey2=%LocalAppData%\Packages\Microsoft.PowerToys.PowerRenameContextMenu_8wekyb3d8bbwe\AC|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.PowerToys.PowerRenameContextMenu_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.PowerToys.PowerRenameContextMenu_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.PowerToys.PowerRenameContextMenu_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft PowerToys Quick Accent *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\QuickAccent
FileKey1=%LocalAppData%\Microsoft\PowerToys\*Accent|*.log|REMOVESELF
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.PowerAccent*.etl

[Microsoft PowerToys Registry Preview *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\RegistryPreview
FileKey1=%LocalAppData%\Microsoft\PowerToys\RegistryPreview|*.log|REMOVESELF
FileKey2=%UserProfile%\AppData\LocalLow\Microsoft\PowerToys\RegistryPreview-Temp\EBWebview|*|REMOVESELF

[Microsoft PowerToys Run *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\PowerToys Run
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.PowerLauncher*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\PowerToys Run\Logs*|*|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\PowerToys\PowerToys Run\Settings|ImageCache.json;QueryHistory.json

[Microsoft PowerToys Screen Ruler *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Measure Tool
FileKey1=%LocalAppData%\Microsoft\PowerToys\Measure Tool|*.log|REMOVESELF

[Microsoft PowerToys Settings *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Settings
FileKey1=%LocalAppData%\Microsoft\PowerToys|settings-telemetry.json;UpdateState.json
FileKey2=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.Settings*.etl
FileKey3=%LocalAppData%\Microsoft\PowerToys\Settings|*.log|REMOVESELF

[Microsoft PowerToys Shortcut Guide *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Shortcut Guide
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys_ShortcutGuide*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\Shortcut Guide|*.log|REMOVESELF

[Microsoft PowerToys Text Extractor *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\TextExtractor
FileKey1=%LocalAppData%\Microsoft\PowerToys\etw|PowerToys.PowerOCR*.etl
FileKey2=%LocalAppData%\Microsoft\PowerToys\TextExtractor|*.log|REMOVESELF

[Microsoft PowerToys Workspaces *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\Workspaces
FileKey1=%LocalAppData%\Microsoft\PowerToys\Workspaces|*.log|REMOVESELF

[Microsoft PowerToys ZoomIt *]
Section=Microsoft PowerToys
DetectFile=%LocalAppData%\Microsoft\PowerToys\ZoomIt
FileKey1=%LocalAppData%\Microsoft\PowerToys\ZoomIt|*.log|REMOVESELF

[Microsoft Print 3D *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Print3D_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Project 2010 *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\14.0\MS Project
RegKey1=HKCU\Software\Microsoft\Office\14.0\MS Project\Recent File List
RegKey2=HKCU\Software\Microsoft\Office\14.0\MS Project\Recent Templates

[Microsoft Robocopy GUI *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Microsoft Robocopy GUI
FileKey1=%AppData%\Microsoft Robocopy GUI\Logs|*
FileKey2=%ProgramFiles%\Microsoft\Microsoft Robocopy GUI\Logs|*

[Microsoft Small Basic *]
LangSecRef=3021
DetectFile=%LocalAppData%\SmallBasic\SB.exe.settings.catalog
FileKey1=%LocalAppData%\SmallBasic|*

[Microsoft Solitaire Collection *]
Section=Games
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft SQL Server *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Microsoft SQL Server
Detect2=HKLM\Software\Microsoft\Microsoft SQL Server
FileKey1=%ProgramFiles%\Microsoft SQL Server\*\*\Log|*|RECURSE
RegKey1=HKCU\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\FileMRUList
RegKey2=HKCU\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\ProjectMRUList
RegKey3=HKCU\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\FileMRUList
RegKey4=HKCU\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\ProjectMRUList
RegKey5=HKCU\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\FileMRUList
RegKey6=HKCU\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\ProjectMRUList
RegKey7=HKCU\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\FileMRUList
RegKey8=HKCU\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\ProjectMRUList
RegKey9=HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\FileMRUList
RegKey10=HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\ProjectMRUList
RegKey11=HKLM\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\FileMRUList
RegKey12=HKLM\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\ProjectMRUList
RegKey13=HKLM\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\FileMRUList
RegKey14=HKLM\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\ProjectMRUList
RegKey15=HKLM\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\FileMRUList
RegKey16=HKLM\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\ProjectMRUList

[Microsoft Sticky Notes *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState|log*.txt|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Store *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe
DetectFile3=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings|*.log*
FileKey11=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey12=%LocalAppData%\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\AC|*|RECURSE
FileKey14=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey15=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey16=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\LocalState\LiveTile|*|RECURSE
FileKey17=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\Settings|*.log*
FileKey18=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey19=%LocalAppData%\Packages\winstore_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey20=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\InstallService|*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PolicyCache
RegKey2=HKLM\Software\Microsoft\Windows\CurrentVersion\InstallService\State\CategoryCache

[Microsoft Support and Recovery Assistant *]
LangSecRef=3024
DetectFile=%LocalAppData%\SaRALogs
FileKey1=%LocalAppData%\SaRALogs|*|RECURSE
FileKey2=%LocalAppData%\SaraResults|SaraResult_*.xml

[Microsoft Surface *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.SurfaceHub_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.SurfaceHub_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.SurfaceHub_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.SurfaceHub_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.SurfaceHub_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey5=%ProgramData%\SurfaceExperienceService\Etl|*

[Microsoft Sway *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Teams *]
LangSecRef=3021
DetectFile1=%LocalAppData%\Microsoft\Teams
DetectFile2=%LocalAppData%\Packages\MicrosoftTeams_8wekyb3d8bbwe
FileKey1=%AppData%\Microsoft Teams\Logs|*
FileKey2=%AppData%\Microsoft\Teams|*.log;*first_party_sets*;*logs*.txt;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache;watchdog.txt;watchdog_*.json
FileKey3=%AppData%\Microsoft\Teams|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%AppData%\Microsoft\Teams\*BrowserMetrics|*|REMOVESELF
FileKey5=%AppData%\Microsoft\Teams\*Cache*|*|REMOVESELF
FileKey6=%AppData%\Microsoft\Teams\AutoFill*|*|REMOVESELF
FileKey7=%AppData%\Microsoft\Teams\Avatars|*|REMOVESELF
FileKey8=%AppData%\Microsoft\Teams\CertificateRevocation|*|REMOVESELF
FileKey9=%AppData%\Microsoft\Teams\CookieReadinessList|*|REMOVESELF
FileKey10=%AppData%\Microsoft\Teams\Crash Reports|*|REMOVESELF
FileKey11=%AppData%\Microsoft\Teams\Crashpad|*|REMOVESELF
FileKey12=%AppData%\Microsoft\Teams\Crowd Deny|*|REMOVESELF
FileKey13=%AppData%\Microsoft\Teams\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%AppData%\Microsoft\Teams\Default\*Cache*|*|REMOVESELF
FileKey15=%AppData%\Microsoft\Teams\Default\AutoFill*|*|REMOVESELF
FileKey16=%AppData%\Microsoft\Teams\Default\blob_storage|*|REMOVESELF
FileKey17=%AppData%\Microsoft\Teams\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%AppData%\Microsoft\Teams\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%AppData%\Microsoft\Teams\Default\ClientCertificates|*|REMOVESELF
FileKey20=%AppData%\Microsoft\Teams\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%AppData%\Microsoft\Teams\Default\coupon_db|*|REMOVESELF
FileKey22=%AppData%\Microsoft\Teams\Default\DataSharing|*|REMOVESELF
FileKey23=%AppData%\Microsoft\Teams\Default\discount*_db|*|REMOVESELF
FileKey24=%AppData%\Microsoft\Teams\Default\Download Service|*|REMOVESELF
FileKey25=%AppData%\Microsoft\Teams\Default\Extension State|*|REMOVESELF
FileKey26=%AppData%\Microsoft\Teams\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%AppData%\Microsoft\Teams\Default\File System|*|REMOVESELF
FileKey28=%AppData%\Microsoft\Teams\Default\GCM Store|*|REMOVESELF
FileKey29=%AppData%\Microsoft\Teams\Default\IndexedDB|*|REMOVESELF
FileKey30=%AppData%\Microsoft\Teams\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%AppData%\Microsoft\Teams\Default\Local Storage\*\IndexedDB\https*|*
FileKey32=%AppData%\Microsoft\Teams\Default\Local Storage\*\Session Storage|*
FileKey33=%AppData%\Microsoft\Teams\Default\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey34=%AppData%\Microsoft\Teams\Default\Local Storage\*\WebStorage|*|RECURSE
FileKey35=%AppData%\Microsoft\Teams\Default\Local Storage\leveldb|*|REMOVESELF
FileKey36=%AppData%\Microsoft\Teams\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey37=%AppData%\Microsoft\Teams\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey38=%AppData%\Microsoft\Teams\Default\optimization*|*|REMOVESELF
FileKey39=%AppData%\Microsoft\Teams\Default\parcel_tracking_db|*|REMOVESELF
FileKey40=%AppData%\Microsoft\Teams\Default\PersistentOriginTrials|*|REMOVESELF
FileKey41=%AppData%\Microsoft\Teams\Default\Platform Notifications|*|REMOVESELF
FileKey42=%AppData%\Microsoft\Teams\Default\Safe Browsing Network|*|REMOVESELF
FileKey43=%AppData%\Microsoft\Teams\Default\Service Worker|*|REMOVESELF
FileKey44=%AppData%\Microsoft\Teams\Default\Session Storage|*|REMOVESELF
FileKey45=%AppData%\Microsoft\Teams\Default\Sessions|*|REMOVESELF
FileKey46=%AppData%\Microsoft\Teams\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey47=%AppData%\Microsoft\Teams\Default\shared_proto_db|*|REMOVESELF
FileKey48=%AppData%\Microsoft\Teams\Default\Site Characteristics Database|*|REMOVESELF
FileKey49=%AppData%\Microsoft\Teams\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey50=%AppData%\Microsoft\Teams\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey51=%AppData%\Microsoft\Teams\Default\Sync Data|*|REMOVESELF
FileKey52=%AppData%\Microsoft\Teams\Default\VideoDecodeStats|*|REMOVESELF
FileKey53=%AppData%\Microsoft\Teams\Default\Web Applications|*|REMOVESELF
FileKey54=%AppData%\Microsoft\Teams\Default\WebRTC Logs|*|REMOVESELF
FileKey55=%AppData%\Microsoft\Teams\Default\WebrtcVideoStats|*|REMOVESELF
FileKey56=%AppData%\Microsoft\Teams\Default\WebStorage|*|REMOVESELF
FileKey57=%AppData%\Microsoft\Teams\FirstPartySetsPreloaded|*|REMOVESELF
FileKey58=%AppData%\Microsoft\Teams\Local Traces|*|REMOVESELF
FileKey59=%AppData%\Microsoft\Teams\media-stack|*.bak;*.blog;*.etl
FileKey60=%AppData%\Microsoft\Teams\MEIPreload|*|REMOVESELF
FileKey61=%AppData%\Microsoft\Teams\Optimization*|*|REMOVESELF
FileKey62=%AppData%\Microsoft\Teams\OriginTrials|*|REMOVESELF
FileKey63=%AppData%\Microsoft\Teams\PKIMetadata|*|REMOVESELF
FileKey64=%AppData%\Microsoft\Teams\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey65=%AppData%\Microsoft\Teams\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey66=%AppData%\Microsoft\Teams\Safe Browsing|*|REMOVESELF
FileKey67=%AppData%\Microsoft\Teams\SafetyTips|*|REMOVESELF
FileKey68=%AppData%\Microsoft\Teams\skylib|*.blog;*.data-shm;*.data-wal
FileKey69=%AppData%\Microsoft\Teams\SmartScreen|*|REMOVESELF
FileKey70=%AppData%\Microsoft\Teams\SSLErrorAssistant|*|REMOVESELF
FileKey71=%AppData%\Microsoft\Teams\Stability|*|REMOVESELF
FileKey72=%AppData%\Microsoft\Teams\Subresource Filter|*|REMOVESELF
FileKey73=%AppData%\Microsoft\Teams\tmp|*|RECURSE
FileKey74=%AppData%\Microsoft\Teams\TrustTokenKeyCommitments|*|REMOVESELF
FileKey75=%AppData%\Microsoft\Teams\WidevineCdm|*|REMOVESELF
FileKey76=%AppData%\Microsoft\Teams\ZxcvbnData|*|REMOVESELF
FileKey77=%LocalAppData%\Microsoft\Teams|*.log
FileKey78=%LocalAppData%\Microsoft\Teams*Addin|*-logs.txt
FileKey79=%LocalAppData%\Microsoft\Teams\current|*.log
FileKey80=%LocalAppData%\Microsoft\Teams\current\resources\tmp|*|REMOVESELF
FileKey81=%LocalAppData%\Microsoft\Teams\packaqes\squirreltemp|*
FileKey82=%LocalAppData%\Microsoft\Teams\previous|*|REMOVESELF
FileKey83=%LocalAppData%\Packages\MicrosoftTeams_8wekyb3d8bbwe\AC|*|RECURSE
FileKey84=%LocalAppData%\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey85=%LocalAppData%\Packages\MicrosoftTeams_8wekyb3d8bbwe\Settings|*.log*
FileKey86=%LocalAppData%\Packages\MicrosoftTeams_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey87=%LocalAppData%\Packages\MicrosoftTeams_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Tips *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft To Do *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Microsoft.Todos_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Todos_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Todos_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Todos_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.Todos_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.Todos_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Ultimate Word Games *]
Section=Games
DetectFile=%LocalAppData%\Packages\Microsoft.Studios.Wordament_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Studios.Wordament_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Studios.Wordament_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.Studios.Wordament_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.Studios.Wordament_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Microsoft Visio *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\14.0\Visio
Detect2=HKCU\Software\Microsoft\Office\15.0\Visio
Detect3=HKCU\Software\Microsoft\Office\16.0\Visio
RegKey1=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile1
RegKey2=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile2
RegKey3=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile3
RegKey4=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile4
RegKey5=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile5
RegKey6=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile6
RegKey7=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile7
RegKey8=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile8
RegKey9=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile9
RegKey10=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile10
RegKey11=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile11
RegKey12=HKCU\Software\Microsoft\Office\14.0\Visio\Application|LastFile12
RegKey13=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Friendly1
RegKey14=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Friendly2
RegKey15=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Friendly3
RegKey16=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Friendly4
RegKey17=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Template1
RegKey18=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Template2
RegKey19=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Template3
RegKey20=HKCU\Software\Microsoft\Office\14.0\Visio\Recent Templates|Template4
RegKey21=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile1
RegKey22=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile2
RegKey23=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile3
RegKey24=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile4
RegKey25=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile5
RegKey26=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile6
RegKey27=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile7
RegKey28=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile8
RegKey29=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile9
RegKey30=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile10
RegKey31=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile11
RegKey32=HKCU\Software\Microsoft\Office\15.0\Visio\Application|LastFile12
RegKey33=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Friendly1
RegKey34=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Friendly2
RegKey35=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Friendly3
RegKey36=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Friendly4
RegKey37=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Template1
RegKey38=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Template2
RegKey39=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Template3
RegKey40=HKCU\Software\Microsoft\Office\15.0\Visio\Recent Templates|Template4
RegKey41=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile1
RegKey42=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile2
RegKey43=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile3
RegKey44=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile4
RegKey45=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile5
RegKey46=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile6
RegKey47=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile7
RegKey48=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile8
RegKey49=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile9
RegKey50=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile10
RegKey51=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile11
RegKey52=HKCU\Software\Microsoft\Office\16.0\Visio\Application|LastFile12
RegKey53=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Friendly1
RegKey54=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Friendly2
RegKey55=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Friendly3
RegKey56=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Friendly4
RegKey57=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Template1
RegKey58=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Template2
RegKey59=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Template3
RegKey60=HKCU\Software\Microsoft\Office\16.0\Visio\Recent Templates|Template4

[Microsoft Visual Studio *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%AppData%\Visual Studio Setup\*Cache|*
FileKey2=%LocalAppData%\Microsoft\VisualStudio\*\ComponentModelCache|*
FileKey3=%LocalAppData%\Microsoft\VisualStudio\*\Extensions|*.cache
FileKey4=%LocalAppData%\Microsoft\VisualStudio\*\ImageLibrary|*.cache
FileKey5=%LocalAppData%\Microsoft\VisualStudio\*\MEFCacheBackup|*
FileKey6=%LocalAppData%\Microsoft\VisualStudio\*\Notifications|*.cache
FileKey7=%LocalAppData%\Microsoft\VisualStudio\*\ProjectAssemblies|*
FileKey8=%LocalAppData%\Microsoft\VisualStudio\*\TextMateCache|*
FileKey9=%LocalAppData%\Microsoft\VisualStudio\SettingsLogs|*|RECURSE
FileKey10=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache|*.pma|RECURSE
FileKey11=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache\*\EBWebView\*cache*|*
FileKey12=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache\*\EBWebView\Crashpad\Reports|*
FileKey13=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache\*\EBWebView\default\*cache*|*
FileKey14=%LocalAppData%\Microsoft\websiteCache|*|RECURSE
FileKey15=%LocalAppData%\PerfWatson|*
FileKey16=%ProgramFiles%\Microsoft Visual Studio*\*\Logs|*|RECURSE
FileKey17=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\VisualStudio\17.*|*.log*
FileKey18=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\VisualStudio\SettingsLogs|*
FileKey19=%WinDir%\System32\config\systemprofile\AppData\Roaming\Microsoft\VisualStudio\17.*|ActivityLog.Setup.xml
FileKey20=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\VisualStudio\17.*|*.log*

[Microsoft Visual Studio Backups *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%UserProfile%\Documents\Visual Studio*\Backup Files|*|RECURSE

[Microsoft Visual Studio Installation Packages *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%ProgramData%\Microsoft\VisualStudio\Packages|*|RECURSE
ExcludeKey1=PATH|%ProgramData%\Microsoft\VisualStudio\Packages\_Instances\|*

[Microsoft VS Code *]
LangSecRef=3021
DetectFile=%AppData%\Code
FileKey1=%AppData%\Code|cookies*
FileKey2=%AppData%\Code\GPUCache|*
FileKey3=%AppData%\Code\Local Storage|*

[Microsoft Web Platform Installer *]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft\Web Platform Installer\logs\webpi
FileKey1=%LocalAppData%\Microsoft\Web Platform Installer\logs\webpi|*.txt

[Microsoft Whiteboard *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey4=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey15=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey33=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey67=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalState\SURFACE*|*|REMOVESELF
FileKey68=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\Settings|*.log*
FileKey69=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey70=%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\TempState|*|REMOVESELF
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Whiteboard_8wekyb3d8bbwe\LocalCache\|.msalcache.bin3

[Microsoft Works Suite 2006 *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Works\8.0
RegKey1=HKCU\Software\Microsoft\Works\8.0\Recent File List

[Microsoft Xbox *]
Section=Games
DetectFile1=%LocalAppData%\Packages\Microsoft.GamingApp_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.GamingServices_8wekyb3d8bbwe
DetectFile3=%LocalAppData%\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe
DetectFile4=%LocalAppData%\Packages\Microsoft.XboxDevices_8wekyb3d8bbwe
DetectFile5=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe
DetectFile6=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
DetectFile7=%LocalAppData%\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe
FileKey1=%LocalAppData%\EAConnect_microsoft\Cache|*|RECURSE
FileKey2=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default|Network Persistent State;Visited Links
FileKey3=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default\GPUCache|*
FileKey4=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default\Platform Notifications|*
FileKey5=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default\Session Storage|*.old;LOG
FileKey6=%LocalAppData%\Packages\Microsoft.Gaming*\AC|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Gaming*\LocalCache|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Gaming*\LocalState|*.etl;*log*;asyncache.db|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Gaming*\Settings|*.log*
FileKey10=%LocalAppData%\Packages\Microsoft.Gaming*\TempState|*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.Xbox*\AC|*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.Xbox*\LocalCache|*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState|*.etl;*.log*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState|*gamestreaming_log*.txt;Async*.db
FileKey15=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\*Cache|*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\DiagOutputDir|*.txt
FileKey17=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\navigationHistory|*|RECURSE
FileKey18=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\PlayReady|*|RECURSE
FileKey19=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\SmartGlass|*.log
FileKey20=%LocalAppData%\Packages\Microsoft.Xbox*\Settings|*.log*
FileKey21=%LocalAppData%\Packages\Microsoft.Xbox*\TempState|*|RECURSE
FileKey22=%ProgramData%\Microsoft\Windows\WindowsApps\Microsoft.GamingServices*\Cache|*|REMOVESELF
FileKey23=%WinDir%\System32\config\systemprofile\AppData\Local\Packages\Microsoft.GamingServices_8wekyb3d8bbwe\LocalState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxLIVEGames_8wekyb3d8bbwe\SearchHistory

[Microsoft XML Notepad *]
LangSecRef=3024
Detect=HKCU\Software\Microsoft\XML Notepad
RegKey1=HKCU\Software\Microsoft\XML Notepad\Recent File List

[Microsoft XNA Game Studio *]
Section=Games
DetectFile=%ProgramFiles%\Microsoft XNA\XNA Game Studio
FileKey1=%ProgramFiles%\Microsoft XNA\XNA Game Studio\*\Redist|*|REMOVESELF

[Microsys Backgammon Classic *]
Section=Games
DetectFile=%UserProfile%\Documents\Microsys\Backgammon Classic*
FileKey1=%UserProfile%\Documents\Microsys\Backgammon Classic*|bc.gam;history.csv;history.txt;last*.gam;users.txt
FileKey2=%UserProfile%\Documents\Microsys\Backgammon Classic*\Games|bcp.gam;bcp.txt;last*.gam;last*.txt

[Microsys Gammonet *]
Section=Games
DetectFile=%UserProfile%\Documents\Microsys\Gammonet
FileKey1=%UserProfile%\Documents\Microsys\Gammonet|users.csv

[Midori Autocomplete History *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|formhistory*

[Midori Autofill Data *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|autofill-profiles.json

[Midori Bookmark Backups *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*\bookmarkbackups|*

[Midori Bookmark Favicons *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|favicons*

[Midori Caches *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Midori\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Midori\Profiles\*\notificationstore|*
FileKey4=%AppData%\Midori\Profiles\*\security_state|*
FileKey5=%AppData%\Midori\Profiles\*\shader-cache|*
FileKey6=%AppData%\Midori\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Midori\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Midori\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Midori\Profiles\*\thumbnails|*|REMOVESELF

[Midori Privacy Sandbox *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|credentialstate.sqlite

[Midori Saved Usernames & Passwords *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|key4.db;logins.json

[Midori Synced Tabs *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|synced-tabs.db*

[Midori Telemetry *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori|*.log|RECURSE
FileKey2=%AppData%\Midori\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Midori\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Midori\Profiles\*\crashes|*
FileKey5=%AppData%\Midori\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Midori\Profiles\*\minidumps|*
FileKey7=%AppData%\Midori\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Midori\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Midori\Profiles\*\weave\logs|*

[Midori Web Browsing Cookies *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|cookies*

[Midori Web Browsing Session *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|session*.json*

[Midori Web Browsing Session Backups *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*\sessionstore-backups|*

[Midori Web Storage *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Midori\Profiles\*\storage\default\http*|*|REMOVESELF

[Midori Website Permissions *]
Section=Midori Web Browser
DetectFile=%AppData%\Midori\Profiles
FileKey1=%AppData%\Midori\Profiles\*|content-prefs.sqlite;permissions.sqlite

[MiKTeX *]
LangSecRef=3021
Detect=HKCU\Software\MiKTeX.org\MiKTeX
FileKey1=%LocalAppData%\MiKTeX\*\miktex\log|*.log
FileKey2=%ProgramData%\MiKTeX\*\miktex\log|*.log
FileKey3=%ProgramFiles%\MiKTeX\miktex\config|*.log

[MindGems Audio Dedupe *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Audio Dedupe
FileKey1=%LocalAppData%\MindGems\Audio Dedupe|*.dat;*.idx
RegKey1=HKCU\Software\MindGems\Audio Dedupe|MRU1
RegKey2=HKCU\Software\MindGems\Audio Dedupe|MRU2
RegKey3=HKCU\Software\MindGems\Audio Dedupe|MRU3
RegKey4=HKCU\Software\MindGems\Audio Dedupe|MRU4
RegKey5=HKCU\Software\MindGems\Audio Dedupe|MRU5
RegKey6=HKCU\Software\MindGems\Audio Dedupe\Settings|ExcludeExt
RegKey7=HKCU\Software\MindGems\Audio Dedupe\Settings|ExcludeFileNameWords
RegKey8=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeExt
RegKey9=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeFileNameWords
RegKey10=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeFolderNameWords
RegKey11=HKCU\Software\MindGems\Audio Dedupe\Settings|LastFolder
RegKey12=HKCU\Software\MindGems\Audio Dedupe\Settings|MoveToFolder
RegKey13=HKCU\Software\MindGems\Audio Dedupe\Settings|QuickCheckExt
RegKey14=HKCU\Software\MindGems\Audio Dedupe\Settings|QuickCheckFileNameWords

[MindGems Easy Web Gallery Builder *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2
RegKey1=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU1
RegKey2=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU2
RegKey3=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU3
RegKey4=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU4
RegKey5=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU5

[MindGems Fast Duplicate File Finder *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Fast Duplicate File Finder
RegKey1=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU1
RegKey2=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU2
RegKey3=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU3
RegKey4=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU4
RegKey5=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU5
RegKey6=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|ExcludeExt
RegKey7=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|ExcludeFileNameWords
RegKey8=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeExt
RegKey9=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeFileNameWords
RegKey10=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeFolderNameWords
RegKey11=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|LastFolder
RegKey12=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|MoveToFolder
RegKey13=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|QuickCheckExt
RegKey14=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|QuickCheckFileNameWords

[MindGems Folder Size *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Folder Size
FileKey1=%ProgramData%\MindGems\FolderSize|FolderSizeLog.txt

[MindGems Visual Similarity Duplicate Image Finder *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder
FileKey1=%LocalAppData%\MindGems\VSDIF|*.dat;*.idx
RegKey1=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU1
RegKey2=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU2
RegKey3=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU3
RegKey4=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU4
RegKey5=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU5
RegKey6=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|ExcludeExt
RegKey7=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|ExcludeFileNameWords
RegKey8=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeExt
RegKey9=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeFileNameWords
RegKey10=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeFolderNameWords
RegKey11=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|LastFolder
RegKey12=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|MoveToFolder
RegKey13=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|QuickCheckExt
RegKey14=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|QuickCheckFileNameWords

[MindManager *]
LangSecRef=3021
DetectFile=%LocalAppData%\Mindjet\MindManager
FileKey1=%LocalAppData%\Mindjet\MindManager\*\Connect\*Cache|*|RECURSE
FileKey2=%LocalAppData%\Mindjet\MindManager\*\MindManager Explorer for SharePoint\Logs|*
FileKey3=%LocalAppData%\Mindjet\MindManager\*\Temp|*|RECURSE

[Minecraft *]
Section=Games
DetectFile1=%AppData%\.minecraft
DetectFile2=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe
DetectFile3=%ProgramFiles%\Minecraft
DetectFile4=%UserProfile%\curseforge\minecraft\install
DetectFile5=%UserProfile%\Twitch\Minecraft
FileKey1=%AppData%\.minecraft|*.log*;*.old;*log*.txt;command_history.txt|RECURSE
FileKey2=%AppData%\.minecraft\crash-reports|*
FileKey3=%AppData%\.minecraft\debug|*
FileKey4=%AppData%\.minecraft\logs|*|REMOVESELF
FileKey5=%AppData%\.minecraft\stats|*.old
FileKey6=%AppData%\.minecraft\webcache2|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe\AC|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe\Settings|*.log*
FileKey11=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey12=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey13=%ProgramFiles%\Minecraft|*.log
FileKey14=%UserProfile%\curseforge\minecraft\install|*.log*;*.old;*log*.txt;command_history.txt|RECURSE
FileKey15=%UserProfile%\curseforge\minecraft\install\crash-reports|*
FileKey16=%UserProfile%\curseforge\minecraft\install\debug|*
FileKey17=%UserProfile%\curseforge\minecraft\install\logs|*|REMOVESELF
FileKey18=%UserProfile%\curseforge\minecraft\install\stats|*.old
FileKey19=%UserProfile%\curseforge\minecraft\install\webcache2|visited*
FileKey20=%UserProfile%\curseforge\minecraft\install\webcache2\*cache|*|RECURSE
FileKey21=%UserProfile%\curseforge\minecraft\install\webcache2\*Storage|*.old;LOG|RECURSE
FileKey22=%UserProfile%\curseforge\minecraft\install\webcache2\blob_storage|*|REMOVESELF
FileKey23=%UserProfile%\Twitch\Minecraft\Install|launcher_log.txt
FileKey24=%UserProfile%\Twitch\Minecraft\Install\logs|*
FileKey25=%UserProfile%\Twitch\Minecraft\Instances\*|*.log
FileKey26=%UserProfile%\Twitch\Minecraft\Instances\*\crash-reports|*
FileKey27=%UserProfile%\Twitch\Minecraft\Instances\*\logs|*

[MiniTool Partition Wizard *]
LangSecRef=3024
Detect=HKCU\Software\MiniTool Software Limited\MiniTool Partition Wizard
FileKey1=%ProgramFiles%\MiniTool Partition Wizard *|log.txt

[MiniTool ShadowMaker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\MiniTool ShadowMaker
FileKey1=%ProgramFiles%\MiniTool ShadowMaker|*log.txt
FileKey2=%ProgramFiles%\MiniTool ShadowMaker\dump|*.dmp
FileKey3=%ProgramFiles%\MiniTool ShadowMaker\log|*

[Miranda IM *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Miranda IM
FileKey1=%AppData%\Miranda IM\Profiles|*|REMOVESELF

[Miranda IM Chat Logs *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Miranda IM
FileKey1=%AppData%\Miranda IM\Profiles\*\Logs\Chat|*|REMOVESELF

[mIRC Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\mIRC
FileKey1=%AppData%\mIRC\Logs|*
FileKey2=%ProgramFiles%\mIRC\logs|*

[Mirkes.De Tiny Hexer *]
LangSecRef=3021
Detect=HKCU\Software\mirkes.de\Tiny Hexer
FileKey1=%AppData%\mirkes.de\Tiny Hexer\*|*.bak

[MirrorFolder *]
LangSecRef=3024
DetectFile=%ProgramData%\Techsoft\MirrorFolder
FileKey1=%ProgramData%\Techsoft\MirrorFolder\Log|*

[Mirrors Edge Catalyst Backup *]
Section=Games
Detect=HKLM\Software\EA Games\1026480
FileKey1=%UserProfile%\Documents\Mirrors Edge Catalyst\settings|PROF_SAVE_backup*

[MiTeC DFM Editor *]
LangSecRef=3021
Detect=HKCU\Software\MiTeC\DFM Editor
RegKey1=HKCU\Software\MiTeC\DFM Editor\5.x\Main\MRUHistory
RegKey2=HKCU\Software\MiTeC\DFM Editor\6.x\wnd_dfm_Main\Twnd_dfm_Main.MRUMan

[MiTeC HexEditor *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\HexEditor
RegKey1=HKCU\Software\MiTeC\HexEditor\4.x\wnd_hex_Main|od_InitialDir
RegKey2=HKCU\Software\MiTeC\HexEditor\4.x\wnd_hex_Main|sd_InitialDir

[MiTeC Icon Explorer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\Icon Explorer
RegKey1=HKCU\Software\MiTeC\Icon Explorer\4.x\wnd_icoexp_Main|de_Text
RegKey2=HKCU\Software\MiTeC\Icon Explorer\4.x\wnd_icoexp_Main|ShellTree_StartInFolder

[MiTeC INI Editor *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\INI Editor
RegKey1=HKCU\Software\MiTeC\INI Editor\1.0|od_InitialDir

[MiTeC SQLite Query *]
LangSecRef=3024
DetectFile=%AppData%\MiTeC\SQLite Query
FileKey1=%AppData%\MiTeC\SQLite Query|*|REMOVESELF

[MiTeC Structured Storage Viewer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\SSViewer
RegKey1=HKCU\Software\MiTeC\SSViewer\3.x\MRU
RegKey2=HKCU\Software\MiTeC\SSViewer\3.x\wnd_re_Main\MRUHistory
RegKey3=HKCU\Software\MiTeC\SSViewer\4.x\MRU

[MiTeC Windows Registry Analyzer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\WRA
RegKey1=HKCU\Software\MiTeC\WRA\1.x\Main\MRUHistory

[MiTeC Windows Registry File Viewer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\RFV
RegKey1=HKCU\Software\MiTeC\RFV\2.x\Recent Files

[MiTeC Windows Registry Recovery *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\WRR
RegKey1=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find|eFind_Text
RegKey2=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find\eFind_Items
RegKey3=HKCU\Software\MiTeC\WRR\1.x\Main\MRUHistory
RegKey4=HKCU\Software\MiTeC\WRR\1.x\wnd_wrr_Main\Twnd_wrr_Main.MRUMan
RegKey5=HKCU\Software\MiTeC\WRR\3.x\MRU

[MiTeC XMLViewer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\XMLViewer
RegKey1=HKCU\Software\MiTeC\XMLViewer\4.x\wnd_xmlv_Main\Twnd_xmlv_Main.MRUManager

[Mixed In Key *]
LangSecRef=3023
DetectFile=%LocalAppData%\Mixed In Key\Mixed In Key
FileKey1=%LocalAppData%\Mixed In Key\Mixed In Key\*|*.log
FileKey2=%LocalAppData%\Mixed In Key\Mixed In Key\*\AudioAnalysisCache*|*
FileKey3=%LocalAppData%\Mixed In Key\Mixed In Key\*\QueryLogs|*
FileKey4=%LocalAppData%\Mixed In Key\Mixed In Key\*\Temp|*
FileKey5=%LocalAppData%\Mixed In Key\Mixed In Key\*\Updates|update.exe

[Mixilab Animotica *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80
FileKey1=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey3=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\LocalState\AppCenter\Errors|*
FileKey4=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\LocalState\Logs|*
FileKey5=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\Settings|*.log*
FileKey6=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\24711Mixilab.Animotica_c39s816dkej80\TempState|*|REMOVESELF

[MixMeister *]
LangSecRef=3023
DetectFile=%ProgramFiles%\MixMeister*
FileKey1=%ProgramFiles%\MixMeister*|*.dmp

[Mixxx *]
LangSecRef=3023
DetectFile=%LocalAppData%\Mixxx
FileKey1=%LocalAppData%\Mixxx|*.log*

[MKJogo MKLOL *]
Section=Games
DetectFile=%ProgramFiles%\MKJogo\MKLOL
FileKey1=%ProgramFiles%\MKJogo\MKLOL|*.log

[MKS_Vir Skaner Online *]
LangSecRef=3024
DetectFile=%ProgramFiles%\SkanerOnline
FileKey1=%ProgramFiles%\SkanerOnline\Raporty|*
FileKey2=%ProgramFiles%\SkanerOnline\tmp|*
FileKey3=%SystemDrive%|*.cpp.log

[MKVToolNix GUI *]
LangSecRef=3023
DetectFile=%LocalAppData%\bunkus.org\MKVToolNix-Gui
FileKey1=%LocalAppData%\bunkus.org\MKVToolNix-Gui\Cache|*|RECURSE

[MMOUI Minion *]
Section=Games
DetectFile=%AppData%\MMOUI\Minion
FileKey1=%AppData%\MMOUI\Minion|log.*

[Mobogenie *]
LangSecRef=3021
DetectFile=%LocalAppData%\Mobogenie
FileKey1=%LocalAppData%\Mobogenie|*.log
FileKey2=%LocalAppData%\Mobogenie\Version\OldVersion\Mobogenie\log|*.log

[ModelPort Object Importer for ArchiCAD *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\ModelPort
FileKey1=%UserProfile%\Documents\ModelPort|*.log

[Molotov.tv *]
LangSecRef=3023
DetectFile=%AppData%\Molotov
FileKey1=%AppData%\Molotov|Cookies*;QuotaManager*
FileKey2=%AppData%\Molotov\*Cache|*
FileKey3=%AppData%\Molotov\databases|*
FileKey4=%AppData%\Molotov\IndexedDB|*|RECURSE
FileKey5=%LocalAppData%\Molotov|SquirrelSetup.log

[MonAlbumPhoto *]
LangSecRef=3023
DetectFile=%LocalAppData%\MonAlbumPhoto
FileKey1=%LocalAppData%\MonAlbumPhoto\Logs|*.log
FileKey2=%LocalAppData%\MonAlbumPhoto\non enregistr*|*.log
FileKey3=%UserProfile%\Documents\MonAlbumPhoto|*.log|RECURSE

[Monkey's Audio *]
LangSecRef=3023
Detect=HKCU\Software\Monkey's Audio
RegKey1=HKCU\Software\Monkey's Audio\Settings|Add Files MRU List
RegKey2=HKCU\Software\Monkey's Audio\Settings|Add Folder MRU List
RegKey3=HKCU\Software\Monkey's Audio\Settings|Output Location Directory

[MonoSnap *]
LangSecRef=3023
DetectFile=%LocalAppData%\MonoSnap
FileKey1=%LocalAppData%\MonoSnap\lastscreenshot|*
FileKey2=%LocalAppData%\MonoSnap\logs|*.xml
FileKey3=%LocalAppData%\MonoSnap\recent|*
FileKey4=%LocalAppData%\MonoSnap\temp|*

[Monster Prom *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Beautiful Glitch\Monster Prom
FileKey1=%UserProfile%\AppData\LocalLow\Beautiful Glitch\Monster Prom|*txt
FileKey2=%UserProfile%\AppData\LocalLow\Beautiful Glitch\Monster Prom\Crashes|*
FileKey3=%UserProfile%\AppData\LocalLow\Beautiful Glitch\Monster Prom\Unity|*|REMOVESELF

[Moon Hunters *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\320040
FileKey1=%ProgramFiles%\Steam\steamapps\common\Moon Hunters|log*.txt

[Moonlight Game Streaming *]
LangSecRef=3022
Detect=HKCU\Software\Moonlight Game Streaming Project\Moonlight
DetectFile1=%LocalAppData%\Moonlight Game Streaming Project\Moonlight
DetectFile2=%ProgramFiles%\Moonlight Game Streaming
FileKey1=%LocalAppData%\Moonlight Game Streaming Project\Moonlight|Moonlight-*.log
FileKey2=%LocalAppData%\Moonlight Game Streaming Project\Moonlight\cache|gamecontrollerdb.txt
FileKey3=%LocalAppData%\Moonlight Game Streaming Project\Moonlight\cache\boxart\*|*
FileKey4=%ProgramFiles%\Moonlight Game Streaming|Moonlight-*.log
FileKey5=%ProgramFiles%\Moonlight Game Streaming\boxart\*|*
FileKey6=%ProgramFiles%\Moonlight Game Streaming\cache|gamecontrollerdb.txt

[Moonlighter *]
Section=Games
DetectFile=%UserProfile%\AppData%\LocalLow\11BitStudios\Moonlighter
FileKey1=%UserProfile%\AppData%\LocalLow\11BitStudios\Moonlighter|*.log
FileKey2=%UserProfile%\AppData%\LocalLow\11BitStudios\Moonlighter\Unity|*|REMOVESELF

[MoreTerra *]
Section=Games
DetectFile=%AppData%\MoreTerra
FileKey1=%AppData%\MoreTerra\Logs|*|RECURSE

[Mortal Kombat Arcade Kollection *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\205350
FileKey1=%ProgramFiles%\Steam\steamapps\common\Mortal Kombat Arcade Kollection\Engine\EditorResources\FaceFX\Logs|*
FileKey2=%ProgramFiles%\Steam\steamapps\common\Mortal Kombat Arcade Kollection\MKHDGame\Logs|*

[Motherboard Monitor 5 *]
LangSecRef=3023
Detect=HKCU\Software\Alexander van Kaam\MBM 5
FileKey1=%ProgramFiles%\Motherboard Monitor 5\Log|*|REMOVESELF

[Motorola Device Manager *]
LangSecRef=3024
Detect=HKLM\Software\Motorola
FileKey1=%AppData%\Motorola\MotoHelper|*.log
FileKey2=%ProgramData%\Motorola\SUE|*.log
FileKey3=%ProgramData%\Motorola\SUE\Firmwares|*
FileKey4=%ProgramFiles%\Motorola|*.log|RECURSE
FileKey5=%ProgramFiles%\Motorola Mobility\DeviceSoftwareUpdate|*.log
FileKey6=%ProgramFiles%\Motorola Mobility\Motorola Device Manager|*.log

[Mount & Blade *]
Section=Games
DetectFile1=%ProgramFiles%\Mount&Blade*
DetectFile2=%ProgramFiles%\Napoleonic Wars
DetectFile3=%ProgramFiles%\Steam\steamapps\common\Mount&Blade*
FileKey1=%ProgramFiles%\Mount&Blade*|rgl_log.txt|RECURSE
FileKey2=%ProgramFiles%\Napoleonic Wars|rgl_log.txt|RECURSE
FileKey3=%ProgramFiles%\Steam\steamapps\common\Mount&Blade*|rgl_log.txt|RECURSE

[Mousotron *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Mousotron
FileKey1=%ProgramFiles%\Mousotron|*.log

[Movavi *]
LangSecRef=3023
DetectFile=%AppData%\Movavi*
FileKey1=%LocalAppData%\Movavi\Logs|*|RECURSE

[Movavi Photo Editor *]
LangSecRef=3022
DetectFile=%AppData%\Movavi Photo Editor*
FileKey1=%LocalAppData%\Movavi\Photo Editor\*\Cache|*|RECURSE

[Movavi Screen Recorder *]
LangSecRef=3023
DetectFile=%AppData%\Movavi Screen Recorder*
FileKey1=%LocalAppData%\Movavi Screen Recorder\Cache|*|RECURSE
FileKey2=%LocalAppData%\Movavi\Screen Recorder\Cache|*|RECURSE

[Movavi Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\MOVAVI
FileKey1=%LocalAppData%\Movavi\*Video Converter*|Log.txt
FileKey2=%LocalAppData%\Movavi\*Video Converter*\Cache|*|RECURSE
FileKey3=%LocalAppData%\Movavi\*Video Converter*\TranscoderTemp|*|RECURSE
ExcludeKey1=PATH|%LocalAppData%\Movavi\*Video Converter*\Cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe

[Movavi Video Editor *]
LangSecRef=3022
DetectFile=%AppData%\Movavi Video Editor*
FileKey1=%AppData%\Movavi Video Editor*|debug.log
FileKey2=%LocalAppData%\Movavi\SharedData\VideoEditor\waveforms\cache|*
FileKey3=%LocalAppData%\Movavi\Video Editor\Cache|*|RECURSE

[Movavi Video Suite *]
LangSecRef=3022
DetectFile=%AppData%\Movavi Video Suite*
FileKey1=%LocalAppData%\Movavi\Video Suite|Log.txt
FileKey2=%LocalAppData%\Movavi\Video Suite\Cache|*|RECURSE
FileKey3=%LocalAppData%\Movavi\Video Suite\QtWebEngine\Default\*Cache|*

[MP3Gain *]
LangSecRef=3023
Detect=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis
FileKey1=%ProgramFiles%\MP3Gain|*.log

[MP3Gain StartUp *]
LangSecRef=3023
Detect=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis
RegKey1=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|AddFilesPath
RegKey2=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|AddFolderPath

[MP3jam *]
LangSecRef=3023
DetectFile=%AppData%\MP3jam
FileKey1=%AppData%\MP3jam|DownloadsHistory.xml

[Mp3Rocket *]
LangSecRef=3023
DetectFile=%AppData%\Mp3Rocket
FileKey1=%AppData%\Mp3Rocket|*.cache

[Mp3tag *]
LangSecRef=3021
Detect=HKLM\Software\Florian Heidenreich\Mp3tag
FileKey1=%AppData%\Mp3tag|Mp3tagError.log

[MPEG Audio Collection *]
LangSecRef=3023
Detect=HKCU\Software\MPEG Audio Collection
RegKey1=HKCU\Software\MPEG Audio Collection|LastNameText1
RegKey2=HKCU\Software\MPEG Audio Collection|LastNameText2
RegKey3=HKCU\Software\MPEG Audio Collection|LastNameText3
RegKey4=HKCU\Software\MPEG Audio Collection|LastNameText4
RegKey5=HKCU\Software\MPEG Audio Collection|LastNameText5
RegKey6=HKCU\Software\MPEG Audio Collection|LastNameText6

[MPK mini Software Manager *]
LangSecRef=3023
DetectFile=%AppData%\MPK-mini-Software-Manager
FileKey1=%AppData%\MPK-mini-Software-Manager|*.old;LOG|RECURSE
FileKey2=%AppData%\MPK-mini-Software-Manager\*Cache|*|RECURSE
FileKey3=%AppData%\MPK-mini-Software-Manager\*Storage|*|RECURSE
FileKey4=%AppData%\MPK-mini-Software-Manager\blob_storage|*|RECURSE
FileKey5=%AppData%\MPK-mini-Software-Manager\Logs|*
FileKey6=%AppData%\MPK-mini-Software-Manager\MPK mini Software Manager\Logs|*
FileKey7=%LocalAppData%\MPK-mini-Software-Manager-Updater|*|RECURSE

[MPlayer *]
LangSecRef=3023
DetectFile=%LocalAppData%\MPlayer
FileKey1=%LocalAppData%\MPlayer|*.cache-3

[mpv *]
LangSecRef=3023
DetectFile=%LocalAppData%\mpv
FileKey1=%LocalAppData%\mpv\cache|*

[mRemoteNG *]
LangSecRef=3021
Detect=HKLM\Software\mRemoteNG
FileKey1=%AppData%\mRemoteNG|*.log;confCons.xml.*.backup

[MrSafe *]
LangSecRef=3021
DetectFile=%ProgramFiles%\MrSafe
FileKey1=%ProgramFiles%\MrSafe|ClientLog.db;Supplier.db

[MSI Afterburner *]
LangSecRef=3024
Detect=HKCU\Software\MSI
FileKey1=%ProgramFiles%\Geeks3D\MSI Kombustor*\logs|*
FileKey2=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml

[MTA: San Andreas *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%ProgramData%\MTA San Andreas All\1.*|report.log
FileKey2=%ProgramData%\MTA San Andreas All\1.*\temp|*|RECURSE
FileKey3=%ProgramData%\MTA San Andreas All\1.*\upcache|*|RECURSE
FileKey4=%ProgramData%\MTA San Andreas All\Common\Installer|nsis.log
FileKey5=%ProgramFiles%\MTA San Andreas 1.*\mods\deathmatch\resources|*|RECURSE
FileKey6=%ProgramFiles%\MTA San Andreas 1.*\MTA|core.dmp;core.log
FileKey7=%ProgramFiles%\MTA San Andreas 1.*\MTA\CEF|cefdebug.txt
FileKey8=%ProgramFiles%\MTA San Andreas 1.*\MTA\CEF\Cache|*|RECURSE
FileKey9=%ProgramFiles%\MTA San Andreas 1.*\MTA\config|servercache.xml
FileKey10=%ProgramFiles%\MTA San Andreas 1.*\MTA\dumps|*.dmp|RECURSE
FileKey11=%ProgramFiles%\MTA San Andreas 1.*\MTA\logs|*|RECURSE

[MTA: San Andreas Config/Login Data *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%ProgramFiles%\MTA San Andreas 1.*\mods\deathmatch\priv|*|RECURSE

[MTA: San Andreas Dedicated Server *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%ProgramFiles%\MTA San Andreas 1.*\server\mods\deathmatch\logs|*.log
FileKey2=%ProgramFiles%\MTA San Andreas 1.*\server\mods\deathmatch\resource-cache|*|RECURSE

[Mth Degree Samsung TV Discovery Tool *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\MthDegree.SamsungTVConfigurator_eym3e5s6pgfvg
FileKey1=%LocalAppData%\Packages\MthDegree.SamsungTVConfigurator_eym3e5s6pgfvg\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\MthDegree.SamsungTVConfigurator_eym3e5s6pgfvg\Settings|*.log*
FileKey3=%LocalAppData%\Packages\MthDegree.SamsungTVConfigurator_eym3e5s6pgfvg\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\MthDegree.SamsungTVConfigurator_eym3e5s6pgfvg\TempState|*|REMOVESELF

[Mullvad Autocomplete History *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|formhistory*

[Mullvad Autofill Data *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|autofill-profiles.json

[Mullvad Bookmark Backups *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*\bookmarkbackups|*

[Mullvad Bookmark Favicons *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|favicons*

[Mullvad Caches *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Mullvad\MullvadBrowser\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Mullvad\MullvadBrowser\Profiles\*\notificationstore|*
FileKey4=%AppData%\Mullvad\MullvadBrowser\Profiles\*\security_state|*
FileKey5=%AppData%\Mullvad\MullvadBrowser\Profiles\*\shader-cache|*
FileKey6=%AppData%\Mullvad\MullvadBrowser\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Mullvad\MullvadBrowser\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Mullvad\MullvadBrowser\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Mullvad\MullvadBrowser\Profiles\*\thumbnails|*|REMOVESELF

[Mullvad Privacy Sandbox *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|credentialstate.sqlite

[Mullvad Saved Usernames & Passwords *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|key4.db;logins.json

[Mullvad Synced Tabs *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|synced-tabs.db*

[Mullvad Telemetry *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser|*.log|RECURSE
FileKey2=%AppData%\Mullvad\MullvadBrowser\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Mullvad\MullvadBrowser\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Mullvad\MullvadBrowser\Profiles\*\crashes|*
FileKey5=%AppData%\Mullvad\MullvadBrowser\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Mullvad\MullvadBrowser\Profiles\*\minidumps|*
FileKey7=%AppData%\Mullvad\MullvadBrowser\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Mullvad\MullvadBrowser\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Mullvad\MullvadBrowser\Profiles\*\weave\logs|*

[Mullvad VPN *]
LangSecRef=3022
Detect=HKLM\Software\Mullvad VPN
FileKey1=%LocalAppData%\Mullvad VPN|Network Persistent State
FileKey2=%LocalAppData%\Mullvad VPN\*Cache|*|RECURSE
FileKey3=%LocalAppData%\Mullvad VPN\Local Storage|*|RECURSE
FileKey4=%LocalAppData%\Mullvad VPN\logs|*
FileKey5=%LocalAppData%\Mullvad VPN\Session Storage|*
FileKey6=%ProgramData%\Mullvad VPN|*.log
FileKey7=%ProgramData%\Mullvad VPN\cache|*
FileKey8=%WinDir%\System32\config\systemprofile\AppData\Local\Mullvad VPN|account-history.json

[Mullvad Web Browsing Cookies *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|cookies*

[Mullvad Web Browsing Session *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|session*.json*

[Mullvad Web Browsing Session Backups *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*\sessionstore-backups|*

[Mullvad Web Storage *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Mullvad\MullvadBrowser\Profiles\*\storage\default\http*|*|REMOVESELF

[Mullvad Website Permissions *]
Section=Mullvad Web Browser
DetectFile=%AppData%\Mullvad\MullvadBrowser\Profiles
FileKey1=%AppData%\Mullvad\MullvadBrowser\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Multi-Edit 2008 *]
LangSecRef=3024
Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0
FileKey1=%AppData%\Multi Edit Software|*.log|RECURSE
FileKey2=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP
ExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|EVOLVE.LOG
ExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|FILEPANE.LOG
ExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|INSTALL.LOG
ExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|POLYSTYLE.LOG
ExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|TMPLPANE.LOG
ExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|WINLIST.LOG

[Multi Commander *]
LangSecRef=3024
Detect=HKCU\Software\MultiCommander
FileKey1=%AppData%\MultiCommander\Logs|*.log
FileKey2=%ProgramFiles%\MultiCommander*|*Log.txt

[Multi Password Recovery *]
LangSecRef=3021
Detect=HKLM\System\CurrentControlSet\enum\root\legacy_block_reader
RegKey1=HKLM\Software\Classes\.mpf
RegKey2=HKLM\Software\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
RegKey3=HKLM\Software\Classes\MPR.DocHostUIHandler
RegKey4=HKLM\System\CurrentControlSet\enum\root\legacy_block_reader
RegKey5=HKLM\System\CurrentControlSet\Services\block_reader

[MultiHasher *]
LangSecRef=3024
Detect=HKLM\Software\abelhadigital.com\MultiHasher
FileKey1=%ProgramFiles%\MultiHasher|*.txt;*.zip|RECURSE

[MultiView Inpaint *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\MultiViewInpaint
RegKey1=HKCU\Software\Teorex\MultiViewInpaint\Recent File List
RegKey2=HKCU\Software\Teorex\MultiViewInpaint\RecentFileList

[Mumble *]
LangSecRef=3022
Detect=HKCU\Software\Mumble
FileKey1=%AppData%\Mumble|console.txt

[Murder, She Wrote *]
Section=Games
DetectFile=%AppData%\MysteryStudio\MSW
FileKey1=%AppData%\MysteryStudio\MFW|*.log

[Muse Group Muse Hub *]
LangSecRef=3021
DetectFile=%LocalAppData%\Muse Hub
FileKey1=%LocalAppData%\Muse Hub|.*cache
FileKey2=%LocalAppData%\Muse Hub\Images|*
FileKey3=%LocalAppData%\Muse Hub\Logs|*
FileKey4=%LocalAppData%\Muse Hub\Sentry|*|RECURSE
FileKey5=%ProgramData%\MuseAuthService\Logs|*|RECURSE

[MuseScore *]
LangSecRef=3023
DetectFile=%LocalAppData%\MusE\MuseScore
FileKey1=%LocalAppData%\MusE\MuseScore|cookies.txt

[MusicBee *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MusicBee
FileKey1=%AppData%\MusicBee|*.dat
FileKey2=%AppData%\MusicBee\InternalCache|*|REMOVESELF

[My Family Tree *]
LangSecRef=3021
DetectFile=%LocalAppData%\My Family Tree
FileKey1=%LocalAppData%\My Family Tree\MapCache|*|RECURSE
FileKey2=%LocalAppData%\My Family Tree\Temp|*|RECURSE

[My Horse and Me *]
Section=Games
Detect=HKLM\Software\My Horse and Me 2
FileKey1=%ProgramFiles%\Atari\Mein Pferd und ich*\System|*.log;*log.txt|RECURSE
FileKey2=%ProgramFiles%\Atari\My Horse and Me|*.log;*log.txt|RECURSE
FileKey3=%ProgramFiles%\Atari\W!Games\My Horse and Me|*.log;*log.txt|RECURSE

[My Movies Collection *]
LangSecRef=3023
DetectFile=%ProgramData%\My Movies
FileKey1=%ProgramData%\My Movies|*log.txt;vc*redist*.*
FileKey2=%ProgramData%\My Movies\File Storage\Temp|*|RECURSE
FileKey3=%ProgramData%\My Movies\Temp|*|RECURSE

[My Riding Stables *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyRidingStables
FileKey1=%ProgramFiles%\My Riding Stables*|*.txt;*.url

[My Singing Monsters *]
Section=Games
DetectFile=%ProgramFiles%\My Singing Monsters
FileKey1=%ProgramFiles%\My Singing Monsters|*.log;*.txt;dotnetfx35setup.exe;vc*redist*.exe|RECURSE

[My ViewPad *]
LangSecRef=3023
DetectFile=%ProgramFiles%\My ViewPad
FileKey1=%ProgramFiles%\My ViewPad|ICP_MyViewPad.ini

[MyCraft *]
Section=Games
DetectFile=%UserProfile%\Desktop\MyCraft
FileKey1=%UserProfile%\Desktop\MyCraft|MyCraft Log.*

[MyDefrag *]
LangSecRef=3021
Detect=HKCU\Software\MyDefrag
FileKey1=%ProgramFiles%\MyDefrag *|*.log
FileKey2=%ProgramFiles%\MyDefrag *\LOGs|*

[MyLanViewer *]
LangSecRef=3022
DetectFile=%ProgramFiles%\MyLanViewer
FileKey1=%LocalAppData%\MyLanViewer\Config|FriendlyNamesByMac.dat
FileKey2=%LocalAppData%\MyLanViewer\Data\History|history_auto.dat
FileKey3=%LocalAppData%\MyLanViewer\Data\Scanner|scanner_auto.dat
FileKey4=%LocalAppData%\MyLanViewer\Data\SubnetMonitor|devices_auto.dat
FileKey5=%LocalAppData%\MyLanViewer\Logs|*|RECURSE
FileKey6=%ProgramFiles%\MyLanViewer\Data\History|history_auto.dat
FileKey7=%ProgramFiles%\MyLanViewer\Data\Scanner|scanner_auto.dat
FileKey8=%ProgramFiles%\MyLanViewer\Data\SubnetMonitor|devices_auto.dat
FileKey9=%ProgramFiles%\MyLanViewer\Logs|*|RECURSE

[MyNextbase Player *]
LangSecRef=3023
DetectFile=%AppData%\MyNextbase Player
FileKey1=%AppData%\MyNextbase Player|*-journal;*.old;LOG;QuotaManager|RECURSE
FileKey2=%AppData%\MyNextbase Player\*Cache|*|RECURSE
FileKey3=%AppData%\MyNextbase Player\Logs|*

[Mypal Autocomplete History *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|formhistory*

[Mypal Autofill Data *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|autofill-profiles.json

[Mypal Bookmark Backups *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*\bookmarkbackups|*

[Mypal Bookmark Favicons *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|favicons*

[Mypal Caches *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Mypal68\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Mypal68\Profiles\*\notificationstore|*
FileKey4=%AppData%\Mypal68\Profiles\*\security_state|*
FileKey5=%AppData%\Mypal68\Profiles\*\shader-cache|*
FileKey6=%AppData%\Mypal68\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Mypal68\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Mypal68\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Mypal68\Profiles\*\thumbnails|*|REMOVESELF

[Mypal Privacy Sandbox *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|credentialstate.sqlite

[Mypal Saved Usernames & Passwords *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|key4.db;logins.json

[Mypal Synced Tabs *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|synced-tabs.db*

[Mypal Telemetry *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68|*.log|RECURSE
FileKey2=%AppData%\Mypal68\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Mypal68\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Mypal68\Profiles\*\crashes|*
FileKey5=%AppData%\Mypal68\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Mypal68\Profiles\*\minidumps|*
FileKey7=%AppData%\Mypal68\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Mypal68\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Mypal68\Profiles\*\weave\logs|*

[Mypal Web Browsing Cookies *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|cookies*

[Mypal Web Browsing Session *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|session*.json*

[Mypal Web Browsing Session Backups *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*\sessionstore-backups|*

[Mypal Web Storage *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Mypal68\Profiles\*\storage\default\http*|*|REMOVESELF

[Mypal Website Permissions *]
Section=Mypal Web Browser
DetectFile=%AppData%\Mypal68\Profiles
FileKey1=%AppData%\Mypal68\Profiles\*|content-prefs.sqlite;permissions.sqlite

[MyPC Backup *]
LangSecRef=3022
DetectFile=%ProgramFiles%\MyPC Backup
FileKey1=%ProgramFiles%\MyPC Backup\log|*

[MyPhoneExplorer *]
LangSecRef=3024
Detect=HKCU\Software\MyPhoneExplorer
FileKey1=%AppData%\MyPhoneExplorer|Debug.txt

[MySMS *]
LangSecRef=3022
Detect=HKCU\Software\sms.at\mysms
FileKey1=%LocalAppData%\sms.at\mysms\LocalStorage|*
RegKey1=HKCU\Software\sms.at\mysms\cookies

[MySQL Workbench *]
LangSecRef=3021
DetectFile=%AppData%\MySQL\Workbench
FileKey1=%AppData%\MySQL\Workbench\cache|*
FileKey2=%AppData%\MySQL\Workbench\log|*.log
FileKey3=%AppData%\MySQL\Workbench\sql_history|*

[Myst *]
Section=Games
DetectFile=%LocalAppData%\Myst
FileKey1=%LocalAppData%\Myst\Saved\Logs|*

[MyToolkit *]
LangSecRef=3024
Detect=HKCU\Software\FutureFog\MyToolkit\Options
RegKey1=HKCU\Software\FutureFog\MyToolkit\Options|LastUsedFolder

[MyWinLocker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\EgisTec\MyWinLocker*
FileKey1=%LocalAppData%|MyWinLockerInstaller.*
FileKey2=%ProgramFiles%\EgisTec\MyWinLocker*\log|*

[Nahimic Companion *]
LangSecRef=3023
DetectFile=%LocalAppData%\NhNotifSys\nahimic
FileKey1=%LocalAppData%\NhNotifSys\shared|notif_history

[Nancy Drew: The Secret of Shadow Ranch *]
Section=Games
DetectFile=%ProgramFiles%\Nancy Drew*
FileKey1=%ProgramFiles%\Nancy Drew*|*.html;dxwebsetup.exe

[Nanjing Swansoft SSCNC Simulator *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Nanjing Swansoft\SSCNC
FileKey1=%ProgramFiles%\Nanjing Swansoft\SSCNC|*.log|RECURSE

[Napoleon *]
Section=Games
DetectFile=%AppData%\The Creative Assembly\Napoleon
FileKey1=%AppData%\The Creative Assembly\Napoleon\*_cache|*
FileKey2=%AppData%\The Creative Assembly\Napoleon\Logs|*

[Native Instruments Software *]
LangSecRef=3023
DetectFile1=%LocalAppData%\Native Instruments
DetectFile2=%UserProfile%\Documents\Native Instruments
FileKey1=%LocalAppData%\Cache\Native Instruments\Native Access|*.log
FileKey2=%LocalAppData%\Cache\Native Instruments\Native Access\Cache|*|RECURSE
FileKey3=%LocalAppData%\Native Instruments\Guitar Rig*\Temp|*
FileKey4=%LocalAppData%\Native Instruments\Kontakt*\Kconvert Logs|*
FileKey5=%LocalAppData%\Native Instruments\Kontakt*\Kconvert Temp|*
FileKey6=%LocalAppData%\Native Instruments\Kontakt*\LibrariesCache|*.cache
FileKey7=%LocalAppData%\Native Instruments\Native Access*\Cache|*|RECURSE
FileKey8=%LocalAppData%\Native Instruments\Reaktor*\Cache|*
FileKey9=%UserProfile%\Documents\Native Instruments\*\CrashLogs|*
FileKey10=%UserProfile%\Documents\Native Instruments\Traktor*|*.log
FileKey11=%UserProfile%\Documents\Native Instruments\Traktor*\History|*
FileKey12=%UserProfile%\Documents\Native Instruments\Traktor*\Logs|*

[Natural Selection 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\4920
DetectFile=%ProgramFiles%\Steam\steamapps\common\Natural Selection 2
FileKey1=%AppData%\Natural Selection 2|log.txt
FileKey2=%AppData%\Natural Selection 2\cache|*|RECURSE

[NaturalReader Free 12 *]
LangSecRef=3021
Detect=HKLM\Software\Naturalreaderfree
FileKey1=%ProgramFiles%\Naturalsoft\Free12\log|*
FileKey2=%UserProfile%\Documents\Naturalsoft|*.msi;nrtemp.txt|RECURSE
FileKey3=%UserProfile%\Documents\Naturalsoft\log|*|RECURSE

[NAVER Whale Autofill Data & Search Engine Preferences *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|*Web Data
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data\AutoFill*|*|REMOVESELF

[NAVER Whale Autoplay Preferences *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\MEIPreload|*|REMOVESELF

[NAVER Whale Bookmark Backups *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|Bookmarks.bak

[NAVER Whale Bookmark Favicons *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|favicons*

[NAVER Whale Caches *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data|Module Info Cache
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Naver\Naver Whale\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Naver\Naver Whale\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Naver\Naver Whale\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Naver\Naver Whale\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Naver\Naver Whale\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Naver\Naver Whale\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Naver\Naver Whale\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Naver\Naver Whale\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Naver\Naver Whale\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Naver\Naver Whale\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Naver\Naver Whale\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Naver\Naver Whale\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Naver\Naver Whale\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Naver\Naver Whale\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Naver\Naver Whale\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Naver\Naver Whale\User Data\Optimization*|*|REMOVESELF

[NAVER Whale Default App Handlers *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|PreferredApps

[NAVER Whale Download History *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*\shared_proto_db|*|REMOVESELF

[NAVER Whale DRM Data *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\WidevineCdm|*|REMOVESELF

[NAVER Whale Extension Cookies *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|Extension Cookies

[NAVER Whale Pinned Tabs *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
RegKey1=HKCU\Software\Naver\Naver Whale\PreferenceMACs\Default|pinned_tabs

[NAVER Whale Privacy Sandbox *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Naver\Naver Whale\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Naver\Naver Whale\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Naver\Naver Whale\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Naver\Naver Whale\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Naver\Naver Whale\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[NAVER Whale Progressive Web Apps *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\Web Applications|*|REMOVESELF

[NAVER Whale Saved Usernames & Passwords *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|Login Data*

[NAVER Whale Security & Threat Detection *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data|Safe Browsing Prefix Set
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*|DIPS*
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data\*\ClientCertificates|*|REMOVESELF
FileKey4=%LocalAppData%\Naver\Naver Whale\User Data\*\Network|TransportSecurity*
FileKey5=%LocalAppData%\Naver\Naver Whale\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey6=%LocalAppData%\Naver\Naver Whale\User Data\CertificateRevocation|*|REMOVESELF
FileKey7=%LocalAppData%\Naver\Naver Whale\User Data\Crowd Deny|*|REMOVESELF
FileKey8=%LocalAppData%\Naver\Naver Whale\User Data\PKIMetadata|*|REMOVESELF
FileKey9=%LocalAppData%\Naver\Naver Whale\User Data\Safe Browsing|*|REMOVESELF
FileKey10=%LocalAppData%\Naver\Naver Whale\User Data\SafetyTips|*|REMOVESELF
FileKey11=%LocalAppData%\Naver\Naver Whale\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey12=%LocalAppData%\Naver\Naver Whale\User Data\Subresource Filter|*|REMOVESELF
FileKey13=%LocalAppData%\Naver\Naver Whale\User Data\ZxcvbnData|*|REMOVESELF

[NAVER Whale Shopping Insights *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Naver\Naver Whale\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Naver\Naver Whale\User Data\*\parcel_tracking_db|*|REMOVESELF

[NAVER Whale Storage Quota Manager *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|QuotaManager

[NAVER Whale Sync Data *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\Sync Data|*|REMOVESELF

[NAVER Whale Telemetry *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\Application|debug.log
FileKey2=%LocalAppData%\Naver\Naver Whale\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Naver\Naver Whale\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Naver\Naver Whale\User Data\*|*.log
FileKey6=%LocalAppData%\Naver\Naver Whale\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Naver\Naver Whale\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Naver\Naver Whale\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Naver\Naver Whale\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Naver\Naver Whale\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Naver\Naver Whale\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Naver\Naver Whale\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Naver\Naver Whale\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Naver\Naver Whale\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Naver\Naver Whale\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Naver\Naver Whale\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Naver\Naver Whale\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Naver\Naver Whale\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Naver\Naver Whale\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Naver\Naver Whale\Application|debug.log
FileKey21=%ProgramFiles%\Naver\Naver Whale\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Naver\Naver Whale\BlBeacon|failed_count
RegKey2=HKCU\Software\Naver\Naver Whale\BlBeacon|state
RegKey3=HKCU\Software\Naver\Naver Whale\Installer|LastChecked
RegKey4=HKCU\Software\Naver\Naver Whale\StabilityMetrics

[NAVER Whale Web Browsing Cookies *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\Network|Cookies*;Device Bound Sessions*

[NAVER Whale Web Browsing History *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[NAVER Whale Web Browsing Session *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*\Sessions|*|REMOVESELF

[NAVER Whale Web Storage *]
Section=NAVER Whale Web Browser
DetectFile=%LocalAppData%\Naver\Naver Whale\User Data
FileKey1=%LocalAppData%\Naver\Naver Whale\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Naver\Naver Whale\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Naver\Naver Whale\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Naver\Naver Whale\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Naver\Naver Whale\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Naver\Naver Whale\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Naver\Naver Whale\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Naver\Naver Whale\User Data\*\WebStorage|*|REMOVESELF

[NCH Software BroadWave Streaming Audio *]
LangSecRef=3022
DetectFile=%ProgramData%\NCH Software\BroadWave
FileKey1=%ProgramData%\NCH Software\BroadWave\Logs|*

[NCH Software Express Burn *]
LangSecRef=3021
Detect=HKCU\Software\NCH Software\ExpressBurn
FileKey1=%ProgramFiles%\NCH Software\ExpressBurn|expressburnsetup_*.exe
RegKey1=HKCU\Software\NCH Software\ExpressBurn\Settings|InstallDate
RegKey2=HKCU\Software\NCH Software\ExpressBurn\Settings|InstallDateFirst
RegKey3=HKCU\Software\NCH Software\ExpressBurn\Settings|LoadFromFolder
RegKey4=HKCU\Software\NCH Software\ExpressBurn\Settings|MinutesRunSinceLastInstall
RegKey5=HKCU\Software\NCH Software\ExpressBurn\Settings|Runs
RegKey6=HKCU\Software\NCH Software\ExpressBurn\Settings|RunsSinceLastInstall
RegKey7=HKLM\Software\NCH Software\ExpressBurn\Software|Installer

[NCH Software Express Points *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\ExpressPoints
RegKey1=HKCU\Software\NCH Software\ExpressPoints\RecentFileList

[NCH Software Express Rip CD Ripper *]
LangSecRef=3023
DetectFile=%ProgramFiles%\NCH Software\ExpressRip
FileKey1=%ProgramFiles%\NCH Software\ExpressRip|expressripsetup_*.exe

[NCH Software Express Zip *]
LangSecRef=3024
DetectFile=%AppData%\NCH Software\ExpressZip
FileKey1=%AppData%\NCH Software\ExpressZip\Logs|*

[NCH Software Golden Records *]
LangSecRef=3023
DetectFile=%AppData%\NCH Software\Golden
FileKey1=%AppData%\NCH Software\Golden\Logs|*

[NCH Software MixPad Multitrack Mixer *]
LangSecRef=3023
DetectFile=%ProgramFiles%\NCH Software\MixPad
FileKey1=%ProgramFiles%\NCH Software\MixPad|mixpadsetup_*.exe

[NCH Software PhotoPad Photo Editor *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\PhotoPad
FileKey1=%ProgramFiles%\NCH Software\PhotoPad|photopadsetup_*.exe
RegKey1=HKCU\Software\NCH Software\PhotoPad\RecentFileList
RegKey2=HKCU\Software\NCH Software\PhotoPad\Settings|DefaultExt
RegKey3=HKCU\Software\NCH Software\PhotoPad\Settings|MinutesRunSinceLastInstall
RegKey4=HKCU\Software\NCH Software\PhotoPad\Settings|ProjectFolder
RegKey5=HKCU\Software\NCH Software\PhotoPad\UsageStats

[NCH Software PicoPDF PDF Editor *]
LangSecRef=3021
Detect=HKCU\Software\NCH Software\PicoPDF
FileKey1=%ProgramFiles%\NCH Software\PicoPDF|picopdfsetup_*.exe
RegKey1=HKCU\Software\NCH Software\PicoPDF\General|lastfile
RegKey2=HKCU\Software\NCH Software\PicoPDF\General|lastimagefolder
RegKey3=HKCU\Software\NCH Software\PicoPDF\RecentFileList
RegKey4=HKLM\Software\NCH Software\PicoPDF\Settings|InstallerName
RegKey5=HKLM\Software\NCH Software\PicoPDF\Software|Installer

[NCH Software Pixillion Image Converter *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\Pixillion
FileKey1=%ProgramFiles%\NCH Software\Pixillion|pixsetup_*.exe
RegKey1=HKCU\Software\NCH Software\Pixillion\Options|Image path
RegKey2=HKCU\Software\NCH Software\Pixillion\Options|Input folder
RegKey3=HKCU\Software\NCH Software\Pixillion\Options|Output folder
RegKey4=HKCU\Software\NCH Software\Pixillion\Options|Output format

[NCH Software RecordPad Sound Recorder *]
LangSecRef=3023
DetectFile1=%ProgramFiles%\NCH Software\Recordpad
DetectFile2=%ProgramFiles%\NCH Swift Sound\Recordpad
FileKey1=%AppData%\NCH Software\RecordPad\logs|*.txt

[NCH Software Scribe *]
LangSecRef=3021
Detect=HKCU\Software\NCH Software\Scribe
FileKey1=%AppData%\NCH Software\Scribe\Done|*
FileKey2=%AppData%\NCH Software\Scribe\Logs|*

[NCH Software SoundTap Streaming Audio Recorder *]
LangSecRef=3023
DetectFile=%AppData%\NCH Software\SoundTap
FileKey1=%AppData%\NCH Software\SoundTap\Logs|*

[NCH Software Switch Audio-Converter *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\Switch
FileKey1=%AppData%\NCH Software\Switch\Logs|*|RECURSE

[NCH Software VideoPad Video Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\NCH Software\VideoPad
FileKey1=%ProgramFiles%\NCH Software\VideoPad|videopadsetup_*.exe

[NCH Software Warp Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NCH Software\Warp
FileKey1=%AppData%\NCH Software\Warp\Logs|*.csv

[NCH Software WavePad Sound Editor *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\WavePad
DetectFile=%AppData%\NCH Software\WavePad
FileKey1=%AppData%\NCH Software\WavePad\Logs|*
FileKey2=%AppData%\NCH Software\WavePad\SoundCache|*
FileKey3=%ProgramFiles%\NCH Software\WavePad|wavepadsetup_*.exe
RegKey1=HKCU\Software\NCH Software\WavePad\Recent

[NCSOFT Game Launcher *]
Section=Games
DetectFile=%AppData%\NCSoft\ncDownloader
FileKey1=%AppData%\NCSoft\ncDownloader\config|*.log
FileKey2=%AppData%\NCSoft\ncDownloader\config\Log|*
FileKey3=%LocalAppData%\NCStreaming\Cef_Cache|*-journal;Visited Links
FileKey4=%LocalAppData%\NCStreaming\Cef_Cache\GPUCache|*

[Neon Abyss *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Veewo\Neon Abyss
FileKey1=%UserProfile%\AppData\LocalLow\Veewo\Neon Abyss\Unity|*|REMOVESELF

[Neostar CMS Station Client *]
LangSecRef=3024
Detect=HKLM\Software\company\Neostar CMS
FileKey1=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\log|*
FileKey2=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\StreamServer|*.log
FileKey3=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\StreamServer\log|*

[Nero *]
LangSecRef=3021
Detect1=HKCU\Software\Ahead
Detect2=HKCU\Software\Nero
FileKey1=%AppData%\Nero|*.log|RECURSE
FileKey2=%AppData%\Nero\Nero ControlCenter\Logs|*
FileKey3=%AppData%\Nero\Nero Start\CefCache*|*.ldb;Cookies*;CURRENT;LOCK;LOG;LOG.old;MANIFEST-*;QuotaManager*;Visited Links
FileKey4=%AppData%\Nero\Nero Start\CefCache*\*Cache|*|RECURSE
FileKey5=%AppData%\Nero\Nero Start\CefCache*\IndexedDB|*|RECURSE
FileKey6=%AppData%\Nero\Nero Start\CefCache*\Local Storage\leveldb|*
FileKey7=%AppData%\Nero\Nero Start\CefCache*\Session Storage|*|RECURSE
FileKey8=%AppData%\Nero\Nero Start\Logs|*|RECURSE
FileKey9=%AppData%\Nero\Nero Start\temp|*|RECURSE
FileKey10=%AppData%\Nero\Nero*\Nero BackItUp\Cache|*
FileKey11=%AppData%\Nero\Nero*\Nero Recode\AnalysisData|*.dat
FileKey12=%AppData%\Nero\Nero*\Nero Recode\Thumbs|*
FileKey13=%AppData%\Nero\Nero*\Nero Vision|*.bin;*.txt
FileKey14=%AppData%\Nero\Nero*\Nero Vision\NVFACache|*
FileKey15=%LocalAppData%\Nero\Nero*\Nero Vision\Cache|*
FileKey16=%LocalAppData%\Nero\Nero*\Nero Vision\Cache\GraphicObjectCache|*
FileKey17=%LocalAppData%\Nero\NeroKnowHowPLUS|*.log
FileKey18=%LocalAppData%\Nero\NeroKnowHowPLUS\*|*.cache
FileKey19=%LocalAppData%\Nero\Transfer|*.log
FileKey20=%ProgramData%\Ahead\Nero BackItUp*\Cache|*
FileKey21=%ProgramData%\Nero|*.log|RECURSE
FileKey22=%ProgramData%\Nero\Nero BackItUp*\Cache|*
FileKey23=%ProgramData%\Nero\NeroUpdate\Logs|*
FileKey24=%ProgramData%\Nero\PeakFiles|*.tmp
RegKey1=HKCU\Software\ahead\Nero PhotoSnap\Recent File List
RegKey2=HKCU\Software\Ahead\NeroSearch\NeroSavedSearches\SavedSearches
RegKey3=HKCU\Software\ahead\NeroVision\2.0\RecentFiles
RegKey4=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelAutoTemplate
RegKey5=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelISOTemplate
RegKey6=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumelabelJolietTemplate
RegKey7=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelUDFTemplate
RegKey8=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Recent File List
RegKey9=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|EncodingLastDir
RegKey10=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|NeroCompilation
RegKey11=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|TrackSaveDir
RegKey12=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|WorkingDir
RegKey13=HKCU\Software\Nero\Nero 11\Nero CoverDesigner\Recent File List
RegKey14=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelAutoTemplate
RegKey15=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelISOTemplate
RegKey16=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumelabelJolietTemplate
RegKey17=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelUDFTemplate
RegKey18=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastAudioDir
RegKey19=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastISODir
RegKey20=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastVideoDVDKey
RegKey21=HKCU\Software\Nero\Nero 11\Nero Express\Recent File List
RegKey22=HKCU\Software\Nero\Nero 11\Nero Express\Settings|BootImageDir
RegKey23=HKCU\Software\Nero\Nero 11\Nero Express\Settings|BrowserDir
RegKey24=HKCU\Software\Nero\Nero 11\Nero Express\Settings|ImageDir
RegKey25=HKCU\Software\Nero\Nero 11\Nero Express\Settings|NeroCompilation
RegKey26=HKCU\Software\Nero\Nero 11\Nero Express\Settings|TrackSaveDir
RegKey27=HKCU\Software\Nero\Nero 11\Nero Express\Settings|WorkingDir
RegKey28=HKCU\Software\Nero\Nero 11\Nero Toolkit\DiscSpeed\Capture|Folder
RegKey29=HKCU\Software\Nero\Nero 11\Nero Toolkit\DiscSpeed\Save|Folder
RegKey30=HKCU\Software\Nero\Nero 11\Nero Vision\Application|AudioDir
RegKey31=HKCU\Software\Nero\Nero 11\Nero Vision\Application|CaptureDir
RegKey32=HKCU\Software\Nero\Nero 11\Nero Vision\Application|DocDir
RegKey33=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ExportAudioDir
RegKey34=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ExportVideoDir
RegKey35=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ImportVideoDir
RegKey36=HKCU\Software\Nero\Nero 11\Nero Vision\Application|MediaDir
RegKey37=HKCU\Software\Nero\Nero 11\Nero Vision\Application|PicDir
RegKey38=HKCU\Software\Nero\Nero 11\Nero Vision\Application|PicSaveDir
RegKey39=HKCU\Software\Nero\Nero 11\Nero Vision\Application|TmpDir
RegKey40=HKCU\Software\Nero\Nero 11\Nero Vision\Application|VideoDir
RegKey41=HKCU\Software\Nero\Nero 11\Nero WaveEditor\Directories|Last
RegKey42=HKCU\Software\Nero\Nero 11\Nero WaveEditor\Recent File List
RegKey43=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelAutoTemplate
RegKey44=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelISOTemplate
RegKey45=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumelabelJolietTemplate
RegKey46=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelUDFTemplate
RegKey47=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Recent File List
RegKey48=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|EncodingLastDir
RegKey49=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|NeroCompilation
RegKey50=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|TrackSaveDir
RegKey51=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|WorkingDir
RegKey52=HKCU\Software\Nero\Nero 12\Nero CoverDesigner\Recent File List
RegKey53=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelAutoTemplate
RegKey54=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelISOTemplate
RegKey55=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumelabelJolietTemplate
RegKey56=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelUDFTemplate
RegKey57=HKCU\Software\Nero\Nero 12\Nero Express\General|OFDLastAudioDir
RegKey58=HKCU\Software\Nero\Nero 12\Nero Express\General|OFDLastISODir
RegKey59=HKCU\Software\Nero\Nero 12\Nero Express\General|OFDLastVideoDVDKey
RegKey60=HKCU\Software\Nero\Nero 12\Nero Express\Recent File List
RegKey61=HKCU\Software\Nero\Nero 12\Nero Express\Settings|BootImageDir
RegKey62=HKCU\Software\Nero\Nero 12\Nero Express\Settings|BrowserDir
RegKey63=HKCU\Software\Nero\Nero 12\Nero Express\Settings|ImageDir
RegKey64=HKCU\Software\Nero\Nero 12\Nero Express\Settings|NeroCompilation
RegKey65=HKCU\Software\Nero\Nero 12\Nero Express\Settings|TrackSaveDir
RegKey66=HKCU\Software\Nero\Nero 12\Nero Express\Settings|WorkingDir
RegKey67=HKCU\Software\Nero\Nero 12\Nero Toolkit\DiscSpeed\Capture|Folder
RegKey68=HKCU\Software\Nero\Nero 12\Nero Toolkit\DiscSpeed\Save|Folder
RegKey69=HKCU\Software\Nero\Nero 12\Nero Vision\Application|AudioDir
RegKey70=HKCU\Software\Nero\Nero 12\Nero Vision\Application|CaptureDir
RegKey71=HKCU\Software\Nero\Nero 12\Nero Vision\Application|DocDir
RegKey72=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ExportAudioDir
RegKey73=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ExportVideoDir
RegKey74=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ImportVideoDir
RegKey75=HKCU\Software\Nero\Nero 12\Nero Vision\Application|MediaDir
RegKey76=HKCU\Software\Nero\Nero 12\Nero Vision\Application|PicDir
RegKey77=HKCU\Software\Nero\Nero 12\Nero Vision\Application|PicSaveDir
RegKey78=HKCU\Software\Nero\Nero 12\Nero Vision\Application|TmpDir
RegKey79=HKCU\Software\Nero\Nero 12\Nero Vision\Application|VideoDir
RegKey80=HKCU\Software\Nero\Nero 12\Nero WaveEditor\Directories|Last
RegKey81=HKCU\Software\Nero\Nero 12\Nero WaveEditor\Recent File List
RegKey82=HKCU\Software\Nero\Nero Blu-ray Player\Settings|DefFolder
RegKey83=HKCU\Software\Nero\Nero8\Cover Designer\Recent File List
RegKey84=HKCU\Software\Nero\Nero8\Nero - Burning Rom\Recent File List
RegKey85=HKU\.DEFAULT\Software\Ahead\Cover Designer\Recent File List
RegKey86=HKU\.DEFAULT\Software\Ahead\Nero - Burning Rom\Recent File List
RegKey87=HKU\.DEFAULT\Software\Ahead\Nero Wave Editor\Recent File List

[Nero TuneItUp *]
LangSecRef=3024
DetectFile=%ProgramData%\Nero\Nero TuneItUp
FileKey1=%ProgramData%\Nero\Nero TuneItUp|Setup Log*.log
FileKey2=%ProgramData%\Nero\Nero TuneItUp\cache|*|RECURSE
FileKey3=%ProgramData%\Nero\Nero TuneItUp\DriverUpdate|*.log
FileKey4=%ProgramData%\Nero\Nero TuneItUp\ExceptionHandlerDll|*.*log;*.dmp
FileKey5=%ProgramData%\Nero\Nero TuneItUp\RegCleanerDll\Log|*.log
FileKey6=%ProgramData%\Nero\Nero TuneItUp\RegDefragDll\Log|*.log
FileKey7=%ProgramData%\Nero\Nero TuneItUp\Reports|*.html|RECURSE
FileKey8=%ProgramData%\Nero\Nero TuneItUp\Services|*.log
FileKey9=%ProgramData%\Nero\Nero TuneItUp\SoftwareProducts|*.log
FileKey10=%ProgramData%\Nero\Nero TuneItUp\Startup|*.log
FileKey11=%ProgramData%\Nero\Nero TuneItUp\TemperatureMonitoringModule|*.log

[NesterJ *]
LangSecRef=3024
Detect=HKCU\Software\nesterJ
RegKey1=HKCU\Software\nesterJ\Recent

[Net-Peeker *]
LangSecRef=3024
Detect=HKLM\Software\eMingSoftware\NetPeeker
FileKey1=%ProgramData%\eMingSoftware\NetPeeker\Log|*
RegKey1=HKCU\Software\eMingSoftware\Net-Peeker Group Console\Recent File List
RegKey2=HKLM\Software\eMingSoftware\NetPeeker|ConsoleName

[Net2Printer RDP *]
LangSecRef=3021
DetectFile=%AppData%\Net2Printer RDP Client
FileKey1=%AppData%\Net2Printer RDP Client|*

[NetBeans IDE *]
LangSecRef=3024
DetectFile1=%AppData%\NetBeans
DetectFile2=%UserProfile%\.nbi\log
FileKey1=%AppData%\NetBeans\*\var\log|*|RECURSE
FileKey2=%UserProfile%\.nbi\log|*.log|RECURSE

[Netflix *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8
FileKey1=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\AppData\Indexed DB|*.log
FileKey3=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\LocalCache|*|RECURSE
FileKey4=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\LocalState|*.tmp
FileKey5=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\LocalState\LiveTile|*|RECURSE
FileKey6=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\Settings|*.log*
FileKey7=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\SystemAppData\Helium|*.log*
FileKey8=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\4DF9E0F8.Netflix_mcm4njqhnhss8\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8\AC\Microsoft\Internet Explorer\DOMStore\*\|www.netflix[1].xml

[NETGEAR Genie *]
LangSecRef=3024
Detect=HKLM\Software\NETGEAR Genie
FileKey1=%LocalAppData%\NETGEARGenie|*.txt
FileKey2=%LocalAppData%\NETGEARGenie\log|*.log
FileKey3=%LocalAppData%\NETGEARGenie\update_temp|*

[NetLimiter *]
LangSecRef=3022
Detect=HKCU\Software\LockTime\NetLimiter
RegKey1=HKCU\Software\LockTime\NetLimiter\Recent File List

[NetSurf Browser *]
LangSecRef=3022
DetectFile=%AppData%\NetSurf
FileKey1=%AppData%\NetSurf|Cookies;URLs

[NetUtils WNetStat *]
LangSecRef=3024
Detect=HKCU\Software\NetUtils\WNetStat
RegKey1=HKCU\Software\NetUtils\WNetStat|LastFile

[NetworkActiv AUTAPF *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NetworkActiv AUTAPF*
FileKey1=%ProgramFiles%\NetworkActiv AUTAPF*|*log.txt

[Neverwinter *]
Section=Games
Detect=HKCU\Software\Cryptic\Neverwinter
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios|*.log|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios\localdata|_SWMWindowPosList.txt
FileKey3=%Public%\Games\Cryptic Studios|*.log|RECURSE
FileKey4=%Public%\Games\Cryptic Studios\localdata|_SWMWindowPosList.txt

[New Yankee in Santa's Service *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\New Yankee 3 - In Santas ServiceFinal
FileKey1=%AppData%\AlawarEntertainment|*_log.html|RECURSE
FileKey2=%ProgramFiles%\New Yankee 3 - In Santas Service|*.nfo

[Newsbin Pro *]
LangSecRef=3021
Detect1=HKCU\Software\DJI Interprises\Newsbin Pro
Detect2=HKCU\Software\DJI Interprises\Newsbin50
DetectFile=%LocalAppData%\Newsbin
FileKey1=%LocalAppData%\Newsbin|Download*.db3*;Logfile.txt
FileKey2=%LocalAppData%\Newsbin\Logging|*.log
FileKey3=%LocalAppData%\Newsbin\Nzbs\Temp|*.nzb
FileKey4=%LocalAppData%\Newsbin\SPOOL_V6|*
FileKey5=%LocalAppData%\Newsbin\temp|*
RegKey1=HKCU\Software\DJI Interprises\Newsbin Pro\FilterHistory
RegKey2=HKCU\Software\DJI Interprises\Newsbin Pro\Recent File List

[Newsleecher *]
LangSecRef=3021
DetectFile=%AppData%\Newsleecher\Backups
FileKey1=%AppData%\Newsleecher\Backups|*

[neXBC *]
LangSecRef=3022
DetectFile=%ProgramFiles%\neXBC
FileKey1=%ProgramFiles%\neXBC|messages.txt
FileKey2=%ProgramFiles%\neXBC\Logs\Hosted|*
FileKey3=%ProgramFiles%\neXBC\Logs\Joined|*

[Nexon Launcher *]
Section=Games
DetectFile=%AppData%\NexonLauncher*
FileKey1=%AppData%\NexonLauncher|*-journal;*.old;LOG|RECURSE
FileKey2=%AppData%\NexonLauncher\*Cache|*
FileKey3=%AppData%\NexonLauncherSwapApp\GPUCache|*

[Nextcloud *]
LangSecRef=3022
DetectFile=%AppData%\Nextcloud
FileKey1=%AppData%\Nextcloud|*.log;*.msi;nextcloud.cfg.backup_*
FileKey2=%AppData%\Nextcloud\Logs|*
FileKey3=%LocalAppData%\Nextcloud\Cache\qmlcache|*|RECURSE

[NextSecurity GetKey *]
LangSecRef=3024
Detect=HKCU\Software\NextSecurity\GetKey
RegKey1=HKCU\Software\NextSecurity\GetKey\Recent File List

[Nextup TextAloud *]
LangSecRef=3021
Detect=HKCU\Software\NextUpTech\TextAloud3
FileKey1=%LocalAppData%\NextUp\TextAloud|*.adl;*.adu;*.dbg
FileKey2=%LocalAppData%\NextUp\TextAloud\Articles|*|RECURSE
RegKey1=HKCU\Software\NextUpTech\TextAloud3|AudioClipFileOpenDirectory
RegKey2=HKCU\Software\NextUpTech\TextAloud3|DocFileOpenDirectory

[Nexus Mod Manager *]
Section=Games
DetectFile=%UserProfile%\Documents\Nexus Mod Manager
FileKey1=%UserProfile%\Documents\Nexus Mod Manager|*.txt

[Nexus Mods App *]
Section=Games
DetectFile=%LocalAppData%\NexusMods.App
FileKey1=%LocalAppData%\NexusMods.App|NexusMods.App-sync_file.sync
FileKey2=%LocalAppData%\NexusMods.App\DataModel\MnemonicDB.rocksdb|*.log;log.*
FileKey3=%LocalAppData%\NexusMods.App\Logs|*|RECURSE

[Nicotine+ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Nicotine+
FileKey1=%AppData%\nicotine|*.backup;*.bak;*.old|RECURSE
FileKey2=%AppData%\nicotine\logs|*|RECURSE
FileKey3=%LocalAppData%|recently-used.xbel

[Nidhogg *]
Section=Games
DetectFile=%AppData%\Nidhogg
FileKey1=%AppData%\Nidhogg|*.log

[Nikon Capture NX2 *]
LangSecRef=3023
Detect=HKLM\Software\Nikon\Capture NX 2
FileKey1=%LocalAppData%\Nikon\Capture NX\ThumbnailCache|*|RECURSE

[Nikon ViewNX 2 Pic Viewer *]
LangSecRef=3023
Detect=HKLM\Software\Nikon\MCA2\ViewNX 2
FileKey1=%LocalAppData%\Nikon\mPT\*\CacheData\Original|*
FileKey2=%LocalAppData%\Nikon\mPT\*\CacheData\Others|*
FileKey3=%LocalAppData%\Nikon\mPT\*\CacheData\Screen|*
FileKey4=%LocalAppData%\Nikon\mPT\*\CacheData\Thumbnail|*
FileKey5=%LocalAppData%\Nikon\ViewNX 2\Cache|*

[NirSoft AddrView *]
LangSecRef=3024
Detect=HKCU\Software\NirSoft\AddrView
RegKey1=HKCU\Software\NirSoft\AddrView|LastUrlAddr

[NirSoft RegistryChangesView *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NirSoft\RegistryChangesView.exe
FileKey1=%ProgramFiles%\NirSoft\RegSnapshot*|*|REMOVESELF
FileKey2=%ProgramFiles%\NirSoft\x64\RegSnapshot*|*|REMOVESELF

[NirSoft RegScanner *]
LangSecRef=3024
Detect=HKCU\Software\NirSoft\RegScanner
FileKey1=%ProgramFiles%\NirSoft|report.html
FileKey2=%ProgramFiles%\NirSoft\x64|report.html
RegKey1=HKCU\Software\NirSoft\RegScanner|BaseKey
RegKey2=HKCU\Software\NirSoft\RegScanner|ExcludeList
RegKey3=HKCU\Software\NirSoft\RegScanner|Find
RegKey4=HKCU\Software\NirSoft\RegScanner|RemoteComputer
RegKey5=HKCU\Software\NirSoft\RegScanner|TimeFrom
RegKey6=HKCU\Software\NirSoft\RegScanner|TimeTo

[Nitro PDF Reader *]
LangSecRef=3021
Detect=HKCU\Software\Nitro PDF\Reader
DetectFile=%AppData%\Nitro\Reader
FileKey1=%AppData%\Nitro\Reader\*|*Log.txt;NitroPDFHistory.dat
RegKey1=HKCU\Software\Nitro PDF\Reader\1.0\Recent File List
RegKey2=HKCU\Software\Nitro PDF\Reader\2.0\Recent File List

[Nitrous Backups *]
Section=Games
DetectFile=%AppData%\.nitrous
FileKey1=%AppData%\.nitrous\backups|*|REMOVESELF

[nLite *]
LangSecRef=3024
DetectFile=%ProgramFiles%\nLite
FileKey1=%ProgramFiles%\nLite\Presets|*

[No-IP DUC *]
LangSecRef=3022
Detect=HKCU\Software\Vitalwerks\DUC
FileKey1=%LocalAppData%\Vitalwerks\DUC|*.log
FileKey2=%ProgramData%\Vitalwerks\DUC|*.log

[NoBot *]
LangSecRef=3024
Detect=HKLM\Software\NoBot
DetectFile=%SystemDrive%\NoBot
FileKey1=%SystemDrive%\NoBot\Logs|*
FileKey2=%SystemDrive%\NoBot\Quarantine|*

[NodeSoft FileVer *]
LangSecRef=3024
Detect=HKLM\Software\NodeSoft\FileVer
RegKey1=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunFile
RegKey2=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunPath
RegKey3=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunTime

[Noise Blocker *]
LangSecRef=3023
DetectFile=%AppData%\Noise Blocker
FileKey1=%AppData%\Noise Blocker|info.log

[Noise Engineering *]
LangSecRef=3023
DetectFile=%UserProfile%\Noise Engineering\NE products
FileKey1=%UserProfile%\Noise Engineering\NE products|*.log

[NordVPN *]
LangSecRef=3022
DetectFile=%LocalAppData%\NordVPN
FileKey1=%LocalAppData%\NordVPN\logs|*

[Norman Malware Cleaner *]
LangSecRef=3024
DetectFile=%UserProfile%\Desktop\NFix_*.log
FileKey1=%UserProfile%\Desktop|NFix_*.log

[Norman Security Suite *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Norman
FileKey1=%ProgramFiles%\Norman|*.log
FileKey2=%ProgramFiles%\Norman\Download|*
FileKey3=%ProgramFiles%\Norman\Logs|*
FileKey4=%ProgramFiles%\Norman\Temp|*

[Norton *]
LangSecRef=3024
DetectFile=%AppData%\Norton
FileKey1=%AppData%\Norton\logs|*
FileKey2=%ProgramData%\Norton|*.log;*.txt
FileKey3=%ProgramData%\Norton\LocalDumps|*.dmp
FileKey4=%ProgramData%\NortonInstaller\Logs|*|RECURSE
FileKey5=%ProgramData%\VPNService|*.log

[Norton Neo Autofill Data & Search Engine Preferences *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|*Web Data
FileKey2=%LocalAppData%\NEO\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\NEO\User Data\AutoFill*|*|REMOVESELF

[Norton Neo Autoplay Preferences *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\MEIPreload|*|REMOVESELF

[Norton Neo Bookmark Backups *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|Bookmarks.bak

[Norton Neo Bookmark Favicons *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|favicons*

[Norton Neo Caches *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\NEO\User Data|Module Info Cache
FileKey3=%LocalAppData%\NEO\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\NEO\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\NEO\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\NEO\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\NEO\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\NEO\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\NEO\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\NEO\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\NEO\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\NEO\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\NEO\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\NEO\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\NEO\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\NEO\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\NEO\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\NEO\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\NEO\User Data\Optimization*|*|REMOVESELF

[Norton Neo Default App Handlers *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|PreferredApps

[Norton Neo Download History *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\NEO\User Data\*\shared_proto_db|*|REMOVESELF

[Norton Neo DRM Data *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\NEO\User Data\WidevineCdm|*|REMOVESELF

[Norton Neo Extension Cookies *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|Extension Cookies

[Norton Neo Pinned Tabs *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
RegKey1=HKCU\Software\NEO\PreferenceMACs\Default|pinned_tabs

[Norton Neo Privacy Sandbox *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data|*first_party_sets*
FileKey2=%LocalAppData%\NEO\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\NEO\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\NEO\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\NEO\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\NEO\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\NEO\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\NEO\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Norton Neo Progressive Web Apps *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\Web Applications|*|REMOVESELF

[Norton Neo Saved Usernames & Passwords *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|Login Data*

[Norton Neo Security & Threat Detection *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|DIPS*
FileKey2=%LocalAppData%\NEO\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\NEO\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\NEO\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\NEO\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\NEO\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\NEO\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\NEO\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\NEO\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\NEO\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\NEO\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\NEO\User Data\ZxcvbnData|*|REMOVESELF

[Norton Neo Shopping Insights *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\NEO\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\NEO\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\NEO\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\NEO\User Data\*\parcel_tracking_db|*|REMOVESELF

[Norton Neo Storage Quota Manager *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|QuotaManager

[Norton Neo Sync Data *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\Sync Data|*|REMOVESELF

[Norton Neo Telemetry *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\Application|debug.log
FileKey2=%LocalAppData%\NEO\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\NEO\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\NEO\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\NEO\User Data\*|*.log
FileKey6=%LocalAppData%\NEO\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\NEO\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\NEO\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\NEO\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\NEO\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\NEO\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\NEO\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\NEO\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\NEO\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\NEO\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\NEO\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\NEO\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\NEO\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\NEO\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\NEO\Application|debug.log
FileKey21=%ProgramFiles%\NEO\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\NEO\BlBeacon|failed_count
RegKey2=HKCU\Software\NEO\BlBeacon|state
RegKey3=HKCU\Software\NEO\Installer|LastChecked
RegKey4=HKCU\Software\NEO\StabilityMetrics

[Norton Neo Web Browsing Cookies *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\Network|Cookies*;Device Bound Sessions*

[Norton Neo Web Browsing History *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Norton Neo Web Browsing Session *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\NEO\User Data\*\Sessions|*|REMOVESELF

[Norton Neo Web Storage *]
Section=Norton Neo Web Browser
DetectFile=%LocalAppData%\NEO\User Data
FileKey1=%LocalAppData%\NEO\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\NEO\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\NEO\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\NEO\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\NEO\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\NEO\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\NEO\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\NEO\User Data\*\WebStorage|*|REMOVESELF

[Norton Online Backup *]
LangSecRef=3024
DetectFile=%ProgramData%\Symantec\Norton Online Backup
FileKey1=%ProgramData%\Symantec\Norton Online Backup|*.log*|RECURSE

[Norton Power Eraser *]
LangSecRef=3024
DetectFile=%ProgramData%\Norton\NPE\NPEsettings.dat
FileKey1=%LocalAppData%\NPE|*|REMOVESELF
FileKey2=%ProgramData%\Norton\NPE|*|REMOVESELF
FileKey3=%UserProfile%\Desktop|NPE.exe

[Norton Secure Browser Autofill Data & Search Engine Preferences *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|*Web Data
FileKey2=%LocalAppData%\Norton\Browser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Norton\Browser\User Data\AutoFill*|*|REMOVESELF

[Norton Secure Browser Autoplay Preferences *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\MEIPreload|*|REMOVESELF

[Norton Secure Browser Bookmark Backups *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|Bookmarks.bak

[Norton Secure Browser Bookmark Favicons *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|favicons*

[Norton Secure Browser Caches *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Norton\Browser\User Data|Module Info Cache
FileKey3=%LocalAppData%\Norton\Browser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Norton\Browser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Norton\Browser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Norton\Browser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Norton\Browser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Norton\Browser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Norton\Browser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Norton\Browser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Norton\Browser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Norton\Browser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Norton\Browser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Norton\Browser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Norton\Browser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Norton\Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Norton\Browser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Norton\Browser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Norton\Browser\User Data\Optimization*|*|REMOVESELF

[Norton Secure Browser Default App Handlers *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|PreferredApps

[Norton Secure Browser Download History *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Norton\Browser\User Data\*\shared_proto_db|*|REMOVESELF

[Norton Secure Browser DRM Data *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Norton\Browser\User Data\WidevineCdm|*|REMOVESELF

[Norton Secure Browser Extension Cookies *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|Extension Cookies

[Norton Secure Browser Pinned Tabs *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
RegKey1=HKCU\Norton\Browser\PreferenceMACs\Default|pinned_tabs

[Norton Secure Browser Privacy Sandbox *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Norton\Browser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Norton\Browser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Norton\Browser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Norton\Browser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Norton\Browser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Norton\Browser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Norton\Browser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Norton Secure Browser Progressive Web Apps *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\Web Applications|*|REMOVESELF

[Norton Secure Browser Saved Usernames & Passwords *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|Login Data*

[Norton Secure Browser Security & Threat Detection *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|DIPS*
FileKey2=%LocalAppData%\Norton\Browser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Norton\Browser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Norton\Browser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Norton\Browser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Norton\Browser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Norton\Browser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Norton\Browser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Norton\Browser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Norton\Browser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Norton\Browser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Norton\Browser\User Data\ZxcvbnData|*|REMOVESELF

[Norton Secure Browser Shopping Insights *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Norton\Browser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Norton\Browser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Norton\Browser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Norton\Browser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Norton Secure Browser Storage Quota Manager *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|QuotaManager

[Norton Secure Browser Sync Data *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\Sync Data|*|REMOVESELF

[Norton Secure Browser Telemetry *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\Application|debug.log
FileKey2=%LocalAppData%\Norton\Browser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Norton\Browser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Norton\Browser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Norton\Browser\User Data\*|*.log
FileKey6=%LocalAppData%\Norton\Browser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Norton\Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Norton\Browser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Norton\Browser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Norton\Browser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Norton\Browser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Norton\Browser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Norton\Browser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Norton\Browser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Norton\Browser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Norton\Browser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Norton\Browser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Norton\Browser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Norton\Browser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Norton\Browser\Application|debug.log
FileKey21=%ProgramFiles%\Norton\Browser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Norton\Browser\BlBeacon|failed_count
RegKey2=HKCU\Norton\Browser\BlBeacon|state
RegKey3=HKCU\Norton\Browser\Installer|LastChecked
RegKey4=HKCU\Norton\Browser\StabilityMetrics

[Norton Secure Browser Web Browsing Cookies *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Norton Secure Browser Web Browsing History *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Norton Secure Browser Web Browsing Session *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Norton\Browser\User Data\*\Sessions|*|REMOVESELF

[Norton Secure Browser Web Storage *]
LangSecRef=3043
DetectFile=%LocalAppData%\Norton\Browser\User Data
FileKey1=%LocalAppData%\Norton\Browser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Norton\Browser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Norton\Browser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Norton\Browser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Norton\Browser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Norton\Browser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Norton\Browser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Norton\Browser\User Data\*\WebStorage|*|REMOVESELF

[Norton Secure VPN *]
LangSecRef=3022
DetectFile=%LocalAppData%\Norton Secure VPN
FileKey1=%LocalAppData%\Norton Secure VPN|*.log
FileKey2=%LocalAppData%\Norton Secure VPN\Cache\qmlcache|*

[Norton Utilities *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\Norton SystemWorks Premier Edition\Norton Utilities
DetectFile2=%ProgramFiles%\Norton Utilities*
FileKey1=%AppData%\Norton Utilities *\cleanreports|pgscan_*.html
FileKey2=%AppData%\Norton Utilities\log|pgscan_*.html
FileKey3=%ProgramData%\Norton\NortonUtility\logs|*.log
FileKey4=%ProgramFiles%\Norton SystemWorks Premier Edition\Norton Utilities|*.log;*.tmp

[Notepad++ - Backups & Unsaved Files *]
LangSecRef=3021
Detect=HKLM\Software\Notepad++
FileKey1=%AppData%\Notepad++\backup*|*

[Notepad++ - Session *]
LangSecRef=3021
Detect=HKLM\Software\Notepad++
FileKey1=%AppData%\Notepad++|session.xml

[Notepad++ *]
LangSecRef=3021
Detect=HKLM\Software\Notepad++
FileKey1=%AppData%\Notepad++|*.log
FileKey2=%AppData%\Notepad++\plugins\config\plugin_install_temp|*|REMOVESELF

[Notion *]
LangSecRef=3021
DetectFile=%AppData%\Notion
FileKey1=%AppData%\Notion|DIPS*
FileKey2=%AppData%\Notion\*Cache|*|RECURSE
FileKey3=%AppData%\Notion\logs|*
FileKey4=%AppData%\Notion\partitions|DIPS*
FileKey5=%AppData%\Notion\partitions\*Cache|*|RECURSE
FileKey6=%LocalAppData%\notion-updater|*|REMOVESELF

[NowSmart Cut *]
LangSecRef=3023
Detect=HKLM\Software\NowSmart\Cut
FileKey1=%LocalAppData%\Cut|*.dmp;log.txt

[Nox *]
LangSecRef=3024
Detect=HKLM\Software\BigNox
DetectFile=%UserProfile%\.BigNox
FileKey1=%LocalAppData%\Nox|*.log*
FileKey2=%UserProfile%\.BigNox|*.log*
FileKey3=%UserProfile%\vmlogs|Nox.log*

[Npcap Loopback Adapter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Npcap
FileKey1=%ProgramFiles%\NpCap|*.log|RECURSE

[nProtect Online Security *]
LangSecRef=3021
DetectFile=%UserProfile%\AppData\LocalLow\nProtect
FileKey1=%UserProfile%\AppData\LocalLow\nProtect\Log|*

[NSIS *]
LangSecRef=3021
Detect=HKLM\Software\NSIS
RegKey1=HKLM\Software\NSIS\MRU

[NT Registry Optimizer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NT Registry Optimizer
FileKey1=%LocalAppData%\Microsoft\Windows|UsrClass.bak
FileKey2=%WinDir%\*\LocalService|NTUSER.bak
FileKey3=%WinDir%\System32\config|COMPONENTS.bak;DEFAULT.bak;SAM.bak;SECURITY.bak;Software.bak;SYSTEM.bak

[NTI Backup Now *]
LangSecRef=3024
DetectFile=%ProgramFiles%\New Tech Infosystems\NTI Backup Now 5
FileKey1=%ProgramFiles%\New Tech Infosystems\NTI Backup Now 5\logs|*

[Nuance Dragon Natually Speaking 12 *]
LangSecRef=3021
Detect=HKCU\Software\ScanSoft\NaturallySpeaking12
FileKey1=%AppData%\Nuance\NaturallySpeaking12\RIA|*DragonNatuallySpeakingRIA_IE_Shim_log_*.txt

[Nuclear Dawn Cache *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\config\html|*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\cache|*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\downloads|*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\temp|*.vtf|RECURSE

[Nuclear Dawn Custom Content *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*corner*;*frost*;*mars*;*roadwork*;*rock*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\models|*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\sprites|*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\models|*|RECURSE
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\sound\quake|*|RECURSE

[Nuclear Dawn Developer Files *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\bin|*bsp*;*vtex*;modelbrowser.exe;SDKLauncher.exe|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*example*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps\ai_data|nd_codetest.nav|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\scripted_props|*|REMOVESELF
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\units|*|REMOVESELF
FileKey6=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\vehicles|*|REMOVESELF
FileKey7=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\platform\AddOns|*|RECURSE
FileKey8=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\sdk_content|*|REMOVESELF
FileKey9=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\sdk_tools|*|REMOVESELF

[Nuclear Dawn Mac/Linux Binaries *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\bin|client.dylib;client.so|RECURSE

[Nuclear Dawn SK Gamemode *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*sk_*|RECURSE

[Nuclear Dawn Tutorials *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*training*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps\ai_data|*training*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\media|*tutorial*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\sound\voices\tutorial|*|REMOVESELF

[NVIDIA App *]
LangSecRef=3024
DetectFile=%LocalAppData%\NVIDIA Corporation\NVIDIA App
FileKey1=%LocalAppData%|NVIDIA_App_Performance_Log_*
FileKey2=%LocalAppData%\NVIDIA Corporation\NVIDIA App|*.log*
FileKey3=%LocalAppData%\NVIDIA Corporation\NVIDIA App\assets|*.tmp
FileKey4=%LocalAppData%\NVIDIA Corporation\NVIDIA App\CefCache|*.pma
FileKey5=%LocalAppData%\NVIDIA Corporation\NVIDIA App\CefCache\*cache*|*|RECURSE
FileKey6=%LocalAppData%\NVIDIA Corporation\NVIDIA App\CefCache\Default|Affiliation Database*;BrowsingTopicsState*;DIPS*;Favicons*;History*;LOCK;LOG;LOG.old;Network Action Predictor*;Top Sites*;Visited Links*;Web Data*
FileKey7=%LocalAppData%\NVIDIA Corporation\NVIDIA App\CefCache\Default\*cache*|*|RECURSE
FileKey8=%LocalAppData%\NVIDIA Corporation\NVIDIA App\gfe_backup\nvbackend\cefcache|*|RECURSE
FileKey9=%LocalAppData%\NVIDIA Corporation\NVIDIA App\NvBackend|*.bak;*.log*
FileKey10=%LocalAppData%\NVIDIA Corporation\NVIDIA App\UXD|*.log
FileKey11=%ProgramData%\NVIDIA Corporation\NVIDIA App|*.log*|RECURSE

[NVIDIA Broadcast *]
LangSecRef=3024
DetectFile=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast
FileKey1=%AppData%\nvidia-broadcast\*Cache*|*|REMOVESELF
FileKey2=%AppData%\nvidia-broadcast\logs|*.log
FileKey3=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast|*.log;*.txt
FileKey4=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast\logs|*
FileKey5=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast\NvBroadcastLogsZip|*.zip
FileKey6=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast\temp|*

[NVIDIA Control Panel *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\NVIDIACorp.NVIDIAControlPanel_56jybvy8sckqj
FileKey1=%LocalAppData%\Packages\NVIDIACorp.NVIDIAControlPanel_56jybvy8sckqj\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\NVIDIACorp.NVIDIAControlPanel_56jybvy8sckqj\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\NVIDIACorp.NVIDIAControlPanel_56jybvy8sckqj\Settings|*.log*
FileKey4=%LocalAppData%\Packages\NVIDIACorp.NVIDIAControlPanel_56jybvy8sckqj\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\NVIDIACorp.NVIDIAControlPanel_56jybvy8sckqj\TempState|*|REMOVESELF

[NVIDIA ForceWare *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NVIDIA Corporation\NetworkAccessManager
FileKey1=%ProgramFiles%\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs|*

[NVIDIA FrameView *]
LangSecRef=3024
DetectFile=%LocalAppData%\NVIDIA Corporation\FrameViewSDK
FileKey1=%LocalAppData%\NVIDIA Corporation\FrameViewSDK|*.log
FileKey2=%ProgramData%\NVIDIA Corporation\FrameView*|*.log*|RECURSE

[NVIDIA G-Assist *]
LangSecRef=3024
DetectFile=%ProgramData%\NVIDIA Corporation\NVIDIA App\G-Assist
FileKey1=%ProgramData%\NVIDIA Corporation\NVIDIA App\G-Assist|*.log

[NVIDIA Geforce Experience *]
LangSecRef=3024
DetectFile=%ProgramData%\NVIDIA Corporation\GeForce Experience
FileKey1=%ProgramData%\NVIDIA Corporation\Downloader|*|RECURSE
FileKey2=%ProgramData%\NVIDIA Corporation\GeForce Experience\Update|*|RECURSE
FileKey3=%ProgramData%\NVIDIA\NvBackend\Updatus\DownloadManager|*
FileKey4=%ProgramData%\NVIDIA\Updatus|*.bak;*.log
FileKey5=%ProgramData%\NVIDIA\Updatus\DownloadManager|*
FileKey6=%ProgramFiles%\NVIDIA Corporation\NVIDIA GeForce Experience|*.log
FileKey7=%SystemDrive%\NvidiaLogging\GFExperience|GridClientLog.log*|RECURSE

[NVIDIA Graphics Drivers *]
LangSecRef=3024
DetectFile=%ProgramData%\NVIDIA Corporation
FileKey1=%ProgramData%\NVIDIA|*.log*
FileKey2=%ProgramData%\NVIDIA Corporation\CrashDumps|*
FileKey3=%ProgramData%\NVIDIA Corporation\DisplayDriverRAS\NvTelemetry|events.dat
FileKey4=%ProgramData%\NVIDIA Corporation\DisplayDriverRAS\NvTelemetry\feedbacks|*|REMOVESELF
FileKey5=%ProgramData%\NVIDIA Corporation\GameSessionTelemetry|*.log*
FileKey6=%ProgramData%\NVIDIA Corporation\NvFBCPlugin|log*.txt
FileKey7=%ProgramData%\NVIDIA Corporation\NvProfileUpdaterPlugin|*.log*
FileKey8=%ProgramData%\NVIDIA Corporation\NvTelemetry|*.log*;events*
FileKey9=%ProgramData%\NVIDIA Corporation\NvTelemetry\feedbacks|*|REMOVESELF
FileKey10=%ProgramData%\NVIDIA Corporation\nvtopps|*.log
FileKey11=%ProgramData%\NVIDIA Corporation\nvtopps\nct|nvlog.nvlgstg
FileKey12=%ProgramData%\NVIDIA Corporation\NvVAD|*.log
FileKey13=%ProgramData%\NVIDIA Corporation\ShadowPlay|*.log
FileKey14=%ProgramData%\NVIDIA Corporation\umdlogs|*

[NVIDIA Image Comparison Analysis Tool *]
LangSecRef=3024
DetectFile=%AppData%\icat
FileKey1=%AppData%\icat\*cache*|*|REMOVESELF
FileKey2=%LocalAppData%\icat-updater|*
FileKey3=%ProgramData%|DisplaySessionContainer*.log*;NvcDispCorePlugin.log*;NVDisplay.Container*.log*

[NVIDIA Omniverse *]
LangSecRef=3024
DetectFile=%UserProfile%\.nvidia-omniverse
FileKey1=%LocalAppData%\ov\cache|*|RECURSE
FileKey2=%UserProfile%\.nvidia-omniverse\logs|*.log|RECURSE

[NVIDIA Overlay *]
LangSecRef=3024
DetectFile=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay
FileKey1=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay|*.log*
FileKey2=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay\CefCache|*.pma
FileKey3=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay\CefCache\*cache*|*|RECURSE
FileKey4=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay\CefCache\BrowserMetrics|*
FileKey5=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay\CefCache\Default|Affiliation Database*;BrowsingTopicsState*;DIPS*;Favicons*;History*;LOCK;LOG;LOG.old;Network Action Predictor*;Top Sites*;Visited Links*;Web Data*
FileKey6=%LocalAppData%\NVIDIA Corporation\NVIDIA Overlay\CefCache\Default\*cache*|*|RECURSE

[NVIDIA Shader Cache *]
LangSecRef=3024
Detect=HKLM\Software\NVIDIA Corporation
FileKey1=%AppData%\NVIDIA\ComputeCache|*|RECURSE
FileKey2=%LocalAppData%\NVIDIA Corporation\NV_Cache|*|RECURSE
FileKey3=%LocalAppData%\NVIDIA\*Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\*\AC\*\NVIDIA Corporation\NV_Cache|*|RECURSE
FileKey5=%LocalAppData%\Packages\*\AC\NVIDIA Corporation\NV_Cache|*|RECURSE
FileKey6=%LocalAppData%\Packages\*\AC\NVIDIA\DXCache|*|RECURSE
FileKey7=%ProgramData%\NVIDIA Corporation\NV_Cache|*|RECURSE
FileKey8=%UserProfile%\AppData\LocalLow\NVIDIA\DXCache|*|RECURSE
FileKey9=%UserProfile%\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache|*|RECURSE
FileKey10=%WinDir%\ServiceProfiles\LocalService\AppData\Local\NVIDIA\*Cache|*|RECURSE
FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\NVIDIA\*Cache|*|RECURSE
FileKey12=%WinDir%\System32\config\systemprofile\AppData\LocalLow\NVIDIA\PerDriverVersion\*Cache|*|RECURSE
FileKey13=%WinDir%\System32\config\systemprofile\AppData\Roaming\NVIDIA\ComputeCache|*|RECURSE

[NVIDIA Update Files *]
LangSecRef=3024
DetectFile=%ProgramData%\NVIDIA Corporation\NVIDIA App\UpdateFramework
FileKey1=%ProgramData%\NVIDIA Corporation\NVIDIA App\UpdateFramework\ota-artifacts|*|RECURSE

[O&O Defrag *]
LangSecRef=3024
Detect=HKCU\Software\O&O\O&O Defrag
FileKey1=%UserProfile%\Documents\O&O\O&O Defrag\data\reports|*|RECURSE

[O&O SafeErase *]
LangSecRef=3024
Detect=HKCU\Software\O&O\O&O SafeErase\7
FileKey1=%UserProfile%\Documents\O&O\O&O SafeErase\7\Reports|*.html
RegKey1=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisAdditionalErrorMessage
RegKey2=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisDateTime
RegKey3=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisReportPath
RegKey4=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisResultString

[OBS Studio *]
LangSecRef=3023
DetectFile1=%AppData%\OBS
DetectFile2=%AppData%\obs-studio
DetectFile3=%AppData%\obs-studio-node-server
DetectFile4=%ProgramData%\obs-studio
FileKey1=%AppData%\OBS|*.log|RECURSE
FileKey2=%AppData%\OBS\crashDumps|*
FileKey3=%AppData%\obs-studio\crashes|*
FileKey4=%AppData%\obs-studio\logs|*
FileKey5=%AppData%\obs-studio\plugin_config\obs-browser|*|REMOVESELF
FileKey6=%AppData%\obs-studio\profiler_data|*
FileKey7=%AppData%\obs-studio-node-server\attachments|*
FileKey8=%AppData%\obs-studio-node-server\reports|*
FileKey9=%ProgramData%\obs-studio\shader-cache|*
ExcludeKey1=FILE|%AppData%\obs-studio\plugin_config\obs-browser\|LocalPrefs.json

[Observer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\514900
FileKey1=%AppData%\Aspyr Media\Game Guide 3\Cache|*|RECURSE
FileKey2=%LocalAppData%\TheObserver\Saved\Logs|*

[OcenAudio *]
LangSecRef=3023
DetectFile=%LocalAppData%\OcenAudio
FileKey1=%LocalAppData%\OcenAudio|ocen.database

[Oculus *]
Section=Games
DetectFile=%AppData%\Oculus
FileKey1=%AppData%\Oculus\Logs|*
FileKey2=%AppData%\OculusClient|*-journal;*.old;LOG;Network Persistent State|RECURSE
FileKey3=%AppData%\OculusClient\*Cache|*|RECURSE
FileKey4=%AppData%\OculusClient\webrtc_event_logs|*
FileKey5=%LocalAppData%\Oculus|*.log;*.txt;PerfLog_*.json

[OE Classic *]
LangSecRef=3022
Detect=HKCU\Software\OEClassic
FileKey1=%LocalAppData%\OEClassic\Prg\Res|*|RECURSE
FileKey2=%LocalAppData%\OEClassic\Prg\T|*|RECURSE
ExcludeKey1=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.aff
ExcludeKey2=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.dic
ExcludeKey3=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.license

[OEM Logs *]
LangSecRef=3021
DetectFile1=%ProgramData%\oem
DetectFile2=%SystemDrive%\OEM
DetectFile3=%WinDir%\System32\OEM
DetectFile4=%WinDir%\SysWOW64\OEM
FileKey1=%ProgramData%\oem|*.log|RECURSE
FileKey2=%SystemDrive%\OEM|*.log|RECURSE
FileKey3=%WinDir%\oem|*.log;*.log.txt|RECURSE
FileKey4=%WinDir%\System32\OEM|*.log
FileKey5=%WinDir%\SysWOW64\OEM|*.log

[Off-Road Drive *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\200230
FileKey1=%UserProfile%\Documents\My Games\PP3\PP3WorkGame\Logs|*

[Office Password Recovery *]
LangSecRef=3024
Detect=HKCU\Software\Intelore\Office Password Recovery
FileKey1=%AppData%\Intelore\Password Recovery\logs|*

[Okular *]
LangSecRef=3021
DetectFile=%LocalAppData%\okular
FileKey1=%LocalAppData%\okular\docdata|*.xml

[OmniTracker *]
LangSecRef=3021
Detect=HKCU\Software\OmniNet\OmniTracker
FileKey1=%LocalAppData%\OMNINET GmbH\OMNITRACKER\Temp|*|RECURSE
RegKey1=HKCU\Software\OmniNet\OmniTracker\MRU
RegKey2=HKCU\Software\OmniNet\OmniTracker\SearchTextHistory

[One More Multiverse *]
Section=Games
DetectFile=%AppData%\OneMoreMultiverse
FileKey1=%AppData%\OneMoreMultiverse|*State;Cookies*;Quota*
FileKey2=%AppData%\OneMoreMultiverse\*cache|*|RECURSE
FileKey3=%AppData%\OneMoreMultiverse\blob_storage|*|REMOVESELF
FileKey4=%AppData%\OneMoreMultiverse\logs|*
FileKey5=%AppData%\OneMoreMultiverse\One More Multiverse\logs|*
FileKey6=%LocalAppData%\onemoremultiverse-updater|*
FileKey7=%LocalAppData%\onemoremultiverse-updater\*|*|REMOVESELF

[OneSafe PC Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\OneSafe PC Cleaner
FileKey1=%AppData%\OneSafe PC Cleaner\Log|*.xml
RegKey1=HKCU\Software\OneSafe PC Cleaner|InstallationDate
RegKey2=HKCU\Software\OneSafe PC Cleaner|InstallerName
RegKey3=HKCU\Software\OneSafe PC Cleaner|LastScanDate
RegKey4=HKCU\Software\OneSafe PC Cleaner|LastUpdCheck

[Ontrack EasyRecovery *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery*
FileKey1=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery*|*er*_log.txt
FileKey2=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery*\licman|*.tmp;*_log.txt

[Ookla Speed Test *]
LangSecRef=3022
DetectFile1=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6
DetectFile2=%UserProfile%\AppData\LocalLow\Ookla\Speedtest
FileKey1=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6\LocalState|*.tmp|RECURSE
FileKey3=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6\LocalState\Unity\Local.*\Analytics\ArchivedEvents\*|*|REMOVESELF
FileKey4=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6\TempState|*|REMOVESELF
FileKey7=%UserProfile%\AppData\LocalLow\Ookla\Speedtest|*log.txt

[OpalCalc *]
LangSecRef=3021
DetectFile1=%AppData%\OpalCalc_prefs
DetectFile2=%ProgramFiles%\OpalCalc
FileKey1=%AppData%\OpalCalc_prefs|lastSession.txt

[Open-Shell *]
LangSecRef=3021
DetectFile=%LocalAppData%\OpenShell
FileKey1=%LocalAppData%\OpenShell|DataCache.db

[Open Blu-ray to DVD *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Blu-ray to DVD Pro_is1
FileKey1=%ProgramFiles%\Blu-ray to DVD*|*.log;*.txt
FileKey2=%ProgramFiles%\Blu-ray to DVD*\ReadCache|*

[Open Blu-ray/DVD Ripper *]
LangSecRef=3023
Detect1=HKCU\Software\OpenCloner\BDRipper
Detect2=HKCU\Software\OpenCloner\DVDRipper
FileKey1=%AppData%\Open * Ripper|O*R_LOG_FILE.txt
FileKey2=%AppData%\Open * Ripper\ReadCache|*|REMOVESELF

[Open Freely *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Open Freely
FileKey1=%ProgramFiles%\Open Freely|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Open Freely\NGEN|*.log|RECURSE

[Open With Arguments *]
LangSecRef=3024
Detect=HKCU\Software\OpenArgs
RegKey1=HKCU\Software\OpenArgs\History

[OpenCloner Blue-Cloner *]
LangSecRef=3023
Detect=HKCU\Software\Blue-cloner
FileKey1=%AppData%\Blue-Cloner|*.log
FileKey2=%AppData%\Blue-Cloner\ReadCache|*|REMOVESELF
FileKey3=%ProgramFiles%\Blue-Cloner|*.log;*.txt

[OpenDNS Updater *]
LangSecRef=3021
Detect=HKCU\Software\OpenDNS Updater
FileKey1=%AppData%\OpenDNS Updater|*.txt

[OpenFire *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Openfire
FileKey1=%ProgramFiles%\Openfire\Logs|*

[OpenOffice.org *]
LangSecRef=3021
Detect1=HKLM\Software\OpenOffice
Detect2=HKLM\Software\OpenOffice.org
FileKey1=%AppData%\OpenOffice*\*\user|*.log*;*.tmp;registration.xml;registrymodifications.xcu|RECURSE
FileKey2=%AppData%\OpenOffice*\*\user\config\imagecache|*
FileKey3=%AppData%\OpenOffice*\*\user\registry\cache|*
FileKey4=%AppData%\OpenOffice*\*\user\registry\data\org\openoffice\Office|Common.xcu;Histories.xcu;Views.xcu;Writer.xcu
FileKey5=%AppData%\OpenOffice*\*\user\registry\data\org\openoffice\ucb|Hierarchy.xcu;Store.xcu
FileKey6=%ProgramFiles%\OpenOffice*\program|*.log|RECURSE
FileKey7=%ProgramFiles%\OpenOffice*\program_old*|*|REMOVESELF
FileKey8=%ProgramFiles%\OpenOffice*\share\uno_packages\cache\uno_packages|*.log;*.tmp;log.txt
FileKey9=%UserProfile%\Desktop\OpenOffice.org * Installation Files|*|REMOVESELF

[OpenRA *]
Section=Games
DetectFile=%UserProfile%\Documents\OpenRA
FileKey1=%UserProfile%\Documents\OpenRA\Logs|*

[OpenRGB *]
LangSecRef=3024
DetectFile=%AppData%\OpenRGB
FileKey1=%AppData%\OpenRGB\logs|*.log

[OpenShot *]
LangSecRef=3023
DetectFile1=%ProgramFiles%\OpenShot Video Editor
DetectFile2=%UserProfile%\.openshot_qt
FileKey1=%ProgramFiles%\OpenShot Video Editor\settings|*.log
FileKey2=%UserProfile%\.openshot_qt|*.log
FileKey3=%UserProfile%\.openshot_qt\*cache|*
FileKey4=%UserProfile%\.openshot_qt\thumbnail|*.png

[OpenVPN *]
LangSecRef=3022
Detect=HKLM\Software\OpenVPN
FileKey1=%ProgramFiles%\OpenVPN\Log|*.log
FileKey2=%UserProfile%\OpenVPN\log|*|RECURSE

[Opera GX Autofill Data & Search Engine Preferences *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|*Web Data
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*Web Data
FileKey3=%AppData%\Opera Software\Opera GX*\_side_profiles\*\AutoFill*|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\AutoFill*|*|REMOVESELF

[Opera GX Autoplay Preferences *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\MEIPreload|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\MEIPreload|*|REMOVESELF

[Opera GX Bookmark Backups *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|Bookmarks.bak
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|Bookmarks.bak

[Opera GX Bookmark Favicons *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|favicons*
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|favicons*

[Opera GX Caches *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|*.ldb;CURRENT;LOCK;MANIFEST-*;Module Info Cache;ServerCertificate;suggestions_cache.json
FileKey2=%AppData%\Opera Software\Opera GX*|*-journal|RECURSE
FileKey3=%AppData%\Opera Software\Opera GX*\*Cache*|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*.ldb;CURRENT;LOCK;MANIFEST-*;Module Info Cache;ServerCertificate;suggestions_cache.json
FileKey5=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*-journal|RECURSE
FileKey6=%AppData%\Opera Software\Opera GX*\_side_profiles\*\*Cache*|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Avatars|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera GX*\_side_profiles\*\blob_storage|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera GX*\_side_profiles\*\BudgetDatabase|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Download Service|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera GX*\_side_profiles\*\File System|*|REMOVESELF
FileKey12=%AppData%\Opera Software\Opera GX*\_side_profiles\*\GCM Store|*|REMOVESELF
FileKey13=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Jump List Icons*|*|REMOVESELF
FileKey14=%AppData%\Opera Software\Opera GX*\_side_profiles\*\JumpListIcons*|*|REMOVESELF
FileKey15=%AppData%\Opera Software\Opera GX*\_side_profiles\*\optimization*|*|REMOVESELF
FileKey16=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Platform Notifications|*|REMOVESELF
FileKey17=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Service Worker|*|REMOVESELF
FileKey18=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Shared Dictionary\cache|*|REMOVESELF
FileKey19=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey20=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey21=%AppData%\Opera Software\Opera GX*\Avatars|*|REMOVESELF
FileKey22=%AppData%\Opera Software\Opera GX*\blob_storage|*|REMOVESELF
FileKey23=%AppData%\Opera Software\Opera GX*\BudgetDatabase|*|REMOVESELF
FileKey24=%AppData%\Opera Software\Opera GX*\Download Service|*|REMOVESELF
FileKey25=%AppData%\Opera Software\Opera GX*\File System|*|REMOVESELF
FileKey26=%AppData%\Opera Software\Opera GX*\GCM Store|*|REMOVESELF
FileKey27=%AppData%\Opera Software\Opera GX*\Jump List Icons*|*|REMOVESELF
FileKey28=%AppData%\Opera Software\Opera GX*\JumpListIcons*|*|REMOVESELF
FileKey29=%AppData%\Opera Software\Opera GX*\optimization*|*|REMOVESELF
FileKey30=%AppData%\Opera Software\Opera GX*\Platform Notifications|*|REMOVESELF
FileKey31=%AppData%\Opera Software\Opera GX*\Service Worker|*|REMOVESELF
FileKey32=%AppData%\Opera Software\Opera GX*\Shared Dictionary\cache|*|REMOVESELF
FileKey33=%AppData%\Opera Software\Opera GX*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey34=%AppData%\Opera Software\Opera GX*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey35=%LocalAppData%\Opera Software\Opera*\*\*Cache*|*|REMOVESELF
FileKey36=%LocalAppData%\Opera Software\Opera*\*Cache*|*|REMOVESELF

[Opera GX Default App Handlers *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|PreferredApps
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|PreferredApps

[Opera GX Download History *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|DownloadMetadata
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|DownloadMetadata
FileKey3=%AppData%\Opera Software\Opera GX*\_side_profiles\*\shared_proto_db|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\shared_proto_db|*|REMOVESELF

[Opera GX DRM Data *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*\WidevineCdm|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera GX*\MediaFoundationCdmStore|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\WidevineCdm|*|REMOVESELF

[Opera GX Extension Cookies *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|Extension Cookies
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|Extension Cookies

[Opera GX Preferences Backups *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|*preferences.backup
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*preferences.backup

[Opera GX Privacy Sandbox *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|*first_party_sets*;BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*first_party_sets*;BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%AppData%\Opera Software\Opera GX*\_side_profiles\*\CookieReadinessList|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\_side_profiles\*\FirstPartySetsPreloaded|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Network|Trust Tokens*
FileKey6=%AppData%\Opera Software\Opera GX*\_side_profiles\*\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera GX*\_side_profiles\*\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera GX*\_side_profiles\*\TrustTokenKeyCommitments|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera GX*\CookieReadinessList|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera GX*\FirstPartySetsPreloaded|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera GX*\Network|Trust Tokens*
FileKey12=%AppData%\Opera Software\Opera GX*\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey13=%AppData%\Opera Software\Opera GX*\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey14=%AppData%\Opera Software\Opera GX*\TrustTokenKeyCommitments|*|REMOVESELF

[Opera GX Progressive Web Apps *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Web Applications|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\Web Applications|*|REMOVESELF

[Opera GX Saved Usernames & Passwords *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|Login Data*
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|Login Data*

[Opera GX Security & Threat Detection *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|DIPS*
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|DIPS*
FileKey3=%AppData%\Opera Software\Opera GX*\_side_profiles\*\CertificateRevocation|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\_side_profiles\*\ClientCertificates|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Crowd Deny|*|REMOVESELF
FileKey6=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Network|TransportSecurity*
FileKey7=%AppData%\Opera Software\Opera GX*\_side_profiles\*\PKIMetadata|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Safe Browsing|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Safe Browsing Network|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera GX*\_side_profiles\*\SafetyTips|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera GX*\_side_profiles\*\SSLErrorAssistant|*|REMOVESELF
FileKey12=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Subresource Filter|*|REMOVESELF
FileKey13=%AppData%\Opera Software\Opera GX*\_side_profiles\*\ZxcvbnData|*|REMOVESELF
FileKey14=%AppData%\Opera Software\Opera GX*\CertificateRevocation|*|REMOVESELF
FileKey15=%AppData%\Opera Software\Opera GX*\ClientCertificates|*|REMOVESELF
FileKey16=%AppData%\Opera Software\Opera GX*\Crowd Deny|*|REMOVESELF
FileKey17=%AppData%\Opera Software\Opera GX*\Network|TransportSecurity*
FileKey18=%AppData%\Opera Software\Opera GX*\PKIMetadata|*|REMOVESELF
FileKey19=%AppData%\Opera Software\Opera GX*\Safe Browsing|*|REMOVESELF
FileKey20=%AppData%\Opera Software\Opera GX*\Safe Browsing Network|*|REMOVESELF
FileKey21=%AppData%\Opera Software\Opera GX*\SafetyTips|*|REMOVESELF
FileKey22=%AppData%\Opera Software\Opera GX*\SSLErrorAssistant|*|REMOVESELF
FileKey23=%AppData%\Opera Software\Opera GX*\Subresource Filter|*|REMOVESELF
FileKey24=%AppData%\Opera Software\Opera GX*\ZxcvbnData|*|REMOVESELF

[Opera GX Shopping Insights *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\chrome_cart_db|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera GX*\_side_profiles\*\coupon_db|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\_side_profiles\*\discount*_db|*|REMOVESELF
FileKey5=%AppData%\Opera Software\Opera GX*\_side_profiles\*\parcel_tracking_db|*|REMOVESELF
FileKey6=%AppData%\Opera Software\Opera GX*\chrome_cart_db|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera GX*\commerce_subscription_db|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera GX*\coupon_db|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera GX*\discount*_db|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera GX*\parcel_tracking_db|*|REMOVESELF

[Opera GX Storage Quota Manager *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|QuotaManager
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|QuotaManager

[Opera GX Sync Data *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Sync Data|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\Sync Data|*|REMOVESELF

[Opera GX Telemetry *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Application|debug.log
FileKey2=%AppData%\Opera Software\Application\SetupMetrics|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera GX*|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%AppData%\Opera Software\Opera GX*|*.pma;LOG;LOG.old|RECURSE
FileKey5=%AppData%\Opera Software\Opera GX*\*BrowserMetrics|*|REMOVESELF
FileKey6=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey7=%AppData%\Opera Software\Opera GX*\_side_profiles\*|*.pma;LOG;LOG.old|RECURSE
FileKey8=%AppData%\Opera Software\Opera GX*\_side_profiles\*\*BrowserMetrics|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Crash Reports|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Crashpad|*|REMOVESELF
FileKey11=%AppData%\Opera Software\Opera GX*\_side_profiles\*\DataSharing|*|REMOVESELF
FileKey12=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Feature Engagement Tracker|*|REMOVESELF
FileKey13=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Local Traces|*|REMOVESELF
FileKey14=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey15=%AppData%\Opera Software\Opera GX*\_side_profiles\*\OriginTrials|*|REMOVESELF
FileKey16=%AppData%\Opera Software\Opera GX*\_side_profiles\*\PersistentOriginTrials|*|REMOVESELF
FileKey17=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Site Characteristics Database|*|REMOVESELF
FileKey18=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Stability|*|REMOVESELF
FileKey19=%AppData%\Opera Software\Opera GX*\_side_profiles\*\VideoDecodeStats|*|REMOVESELF
FileKey20=%AppData%\Opera Software\Opera GX*\_side_profiles\*\WebRTC Logs|*|REMOVESELF
FileKey21=%AppData%\Opera Software\Opera GX*\_side_profiles\*\WebrtcVideoStats|*|REMOVESELF
FileKey22=%AppData%\Opera Software\Opera GX*\Crash Reports|*|REMOVESELF
FileKey23=%AppData%\Opera Software\Opera GX*\Crashpad|*|REMOVESELF
FileKey24=%AppData%\Opera Software\Opera GX*\DataSharing|*|REMOVESELF
FileKey25=%AppData%\Opera Software\Opera GX*\Feature Engagement Tracker|*|REMOVESELF
FileKey26=%AppData%\Opera Software\Opera GX*\Local Traces|*|REMOVESELF
FileKey27=%AppData%\Opera Software\Opera GX*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey28=%AppData%\Opera Software\Opera GX*\OriginTrials|*|REMOVESELF
FileKey29=%AppData%\Opera Software\Opera GX*\PersistentOriginTrials|*|REMOVESELF
FileKey30=%AppData%\Opera Software\Opera GX*\Site Characteristics Database|*|REMOVESELF
FileKey31=%AppData%\Opera Software\Opera GX*\Stability|*|REMOVESELF
FileKey32=%AppData%\Opera Software\Opera GX*\VideoDecodeStats|*|REMOVESELF
FileKey33=%AppData%\Opera Software\Opera GX*\WebRTC Logs|*|REMOVESELF
FileKey34=%AppData%\Opera Software\Opera GX*\WebrtcVideoStats|*|REMOVESELF
FileKey35=%ProgramFiles%\Opera Software\Application|debug.log
FileKey36=%ProgramFiles%\Opera Software\Application\SetupMetrics|*|REMOVESELF

[Opera GX Web Browsing Cookies *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Network|Cookies*;Device Bound Sessions*
FileKey2=%AppData%\Opera Software\Opera GX*\Network|Cookies*;Device Bound Sessions*

[Opera GX Web Browsing History *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Opera GX Web Browsing Session *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Extension State|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Sessions|*|REMOVESELF
FileKey3=%AppData%\Opera Software\Opera GX*\Extension State|*|REMOVESELF
FileKey4=%AppData%\Opera Software\Opera GX*\Sessions|*|REMOVESELF

[Opera GX Web Storage *]
LangSecRef=3035
DetectFile=%AppData%\Opera Software\Opera GX*
FileKey1=%AppData%\Opera Software\Opera GX*\_side_profiles\*\IndexedDB|*|REMOVESELF
FileKey2=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Local Storage\*\Session Storage|*
FileKey4=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%AppData%\Opera Software\Opera GX*\_side_profiles\*\Session Storage|*|REMOVESELF
FileKey8=%AppData%\Opera Software\Opera GX*\_side_profiles\*\WebStorage|*|REMOVESELF
FileKey9=%AppData%\Opera Software\Opera GX*\IndexedDB|*|REMOVESELF
FileKey10=%AppData%\Opera Software\Opera GX*\Local Storage\*\IndexedDB\https*|*
FileKey11=%AppData%\Opera Software\Opera GX*\Local Storage\*\Session Storage|*
FileKey12=%AppData%\Opera Software\Opera GX*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey13=%AppData%\Opera Software\Opera GX*\Local Storage\*\WebStorage|*|RECURSE
FileKey14=%AppData%\Opera Software\Opera GX*\Local Storage\leveldb|*|REMOVESELF
FileKey15=%AppData%\Opera Software\Opera GX*\Session Storage|*|REMOVESELF
FileKey16=%AppData%\Opera Software\Opera GX*\WebStorage|*|REMOVESELF

[OptimumLink *]
LangSecRef=3021
DetectFile=%AppData%\OptimumLink
FileKey1=%AppData%\OptimumLink|TrayLogs*.*

[Oracle Java *]
LangSecRef=3022
Detect1=HKLM\Software\JavaSoft\Java Plug-in
Detect2=HKLM\Software\JavaSoft\Java Runtime Environment
Detect3=HKLM\Software\JavaSoft\Java Web Start
DetectFile=%ProgramData%\Oracle\Java
FileKey1=%AppData%\Sun\Java\Deployment\SystemCache|*|RECURSE
FileKey2=%AppData%\Sun\Java\jre*|*|REMOVESELF
FileKey3=%LocalAppData%\javasharedresources|*
FileKey4=%LocalAppData%\Sun\Java\Deployment\*Cache|*|RECURSE
FileKey5=%ProgramData%\Oracle\Java\.oracle_jre_usage|*
FileKey6=%ProgramData%\Oracle\Java\installcache|*|RECURSE
FileKey7=%ProgramFiles%\Java\jre*|*PATCH.ERR
FileKey8=%ProgramFiles%\Java\jre*\lib\security|*.bak
FileKey9=%SystemDrive%\Users\*\.oracle_jre_usage|*|REMOVESELF
FileKey10=%UserProfile%\AppData\LocalLow\Oracle\Java\jdk*|*|REMOVESELF
FileKey11=%UserProfile%\AppData\LocalLow\Oracle\Java\jre*|*|REMOVESELF
FileKey12=%UserProfile%\AppData\LocalLow\Sun\Java\Deployment\SystemCache|*|RECURSE
FileKey13=%UserProfile%\AppData\LocalLow\Sun\Java\Deployment\tmp|*|RECURSE
FileKey14=%UserProfile%\AppData\LocalLow\Sun\Java\jdk*|*|REMOVESELF
FileKey15=%UserProfile%\AppData\LocalLow\Sun\Java\jre*|*|REMOVESELF
FileKey16=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\*Cache|*|RECURSE
FileKey17=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\*Cache|*|RECURSE

[Oracle VirtualBox *]
LangSecRef=3024
DetectFile=%UserProfile%\.VirtualBox
FileKey1=%ProgramData%\VirtualBox|*.log*
FileKey2=%UserProfile%\.VirtualBox|*.log*
FileKey3=%UserProfile%\VirtualBox VMs\*\Logs|*.log*
FileKey4=%WinDir%\System32\config\systemprofile\AppData\Roaming\VirtualBox|*.log

[Osmos *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\29180
FileKey1=%UserProfile%\Documents\Osmos|osmos.log

[OSO Update *]
LangSecRef=3022
DetectFile=%UserProfile%\CC-Logs
FileKey1=%UserProfile%\CC-Logs\osoupd|*.log

[osu! *]
Section=Games
Detect=HKCU\Software\Osu!
FileKey1=%LocalAppData%\osu!\logs|*
FileKey2=%ProgramFiles%\Osu!|debug-import.txt

[Outer Wilds *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Mobius Digital\Outer Wilds
FileKey1=%UserProfile%\AppData\LocalLow\Mobius Digital\Outer Wilds|*.log

[Outer Wilds Mod Manager *]
Section=Games
DetectFile=%AppData%\OuterWildsModManager\OWML
FileKey1=%AppData%\OuterWildsModManager\OWML\Logs|*
FileKey2=%AppData%\ow-mods\ow-mod-man\data\logs|*|REMOVESELF

[Outlast *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Outlast*
FileKey1=%UserProfile%\Documents\My Games\Outlast*\OLGame\Logs|*

[Outward *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Nine Dots Studio\Outward
FileKey1=%UserProfile%\AppData\LocalLow\Nine Dots Studio\Outward|*log.txt

[Oxygen 14 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Oxygen XML Editor 14
FileKey1=%ProgramFiles%\Oxygen XML Editor 14|*.log;*.properties
FileKey2=%ProgramFiles%\Oxygen XML Editor 14\.install4j|*.log
FileKey3=%ProgramFiles%\Oxygen XML Editor 14\dicts|*.html;*.txt
FileKey4=%ProgramFiles%\Oxygen XML Editor 14\lib|*.txt|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\Oxygen XML Editor 14\.install4j\|files.log

[PACE Eden *]
LangSecRef=3021
DetectFile=%LocalAppData%\PACE\Eden
FileKey1=%LocalAppData%\PACE\Eden\Logs|*|RECURSE
FileKey2=%LocalAppData%\PaceAp\iLok License Manager\Cache\Images|*|RECURSE
FileKey3=%ProgramData%\PACE\Eden\LdLogs|*

[Pacific Storm *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\11250
DetectFile=%ProgramFiles%\Buka\Pacific Storm
FileKey1=%ProgramFiles%\Buka\Pacific Storm|*.log|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Pacific Storm*|*.log|RECURSE

[PageTech PCLReader *]
LangSecRef=3024
Detect=HKLM\SOFTWARE\PageTech
DetectFile=%ProgramData%\PageTech
FileKey1=%ProgramData%\PageTech|*.log

[Painkiller Hell & Damnation *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\214870
FileKey1=%UserProfile%\Documents\My Games\Painkiller Hell and Damnation\PKHDGame\Logs|*

[Paint Shop Pro *]
LangSecRef=3023
Detect=HKCU\Software\Jasc\Paint Shop Pro 6
FileKey1=%ProgramFiles%\Jasc Software Inc\Paint Shop Pro*\Cache|*
RegKey1=HKCU\Software\Jasc\Paint Shop Pro 6\Recent File List

[Paint.NET *]
LangSecRef=3021
Detect=HKCU\Software\Paint.NET
FileKey1=%AppData%\CustomBrushesMini\ThumbCache|*|RECURSE
FileKey2=%LocalAppData%\Paint.NET|*|RECURSE
RegKey1=HKCU\Software\Paint.NET|LastFileDialogDirectory

[PaintTool SAI *]
LangSecRef=3023
DetectFile=%AppData%\SYSTEMAX Software Development\SAI*
FileKey1=%AppData%\SYSTEMAX Software Development\SAI*|recent.txt
FileKey2=%UserProfile%\Documents\SYSTEMAX Software Development\SAI*\error|*.txt

[Pale Moon Autocomplete History *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|formhistory*

[Pale Moon Autofill Data *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|autofill-profiles.json

[Pale Moon Bookmark Backups *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\bookmarkbackups|*

[Pale Moon Bookmark Favicons *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|favicons*

[Pale Moon Caches *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\notificationstore|*
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\security_state|*
FileKey5=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\shader-cache|*
FileKey6=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*\thumbnails|*|REMOVESELF

[Pale Moon Privacy Sandbox *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|credentialstate.sqlite

[Pale Moon Saved Usernames & Passwords *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|key4.db;logins.json

[Pale Moon Synced Tabs *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|synced-tabs.db*

[Pale Moon Telemetry *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon|*.log|RECURSE
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\crashes|*
FileKey5=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\minidumps|*
FileKey7=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\weave\logs|*

[Pale Moon Web Browsing Cookies *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|cookies*

[Pale Moon Web Browsing Session *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|session*.json*

[Pale Moon Web Browsing Session Backups *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\sessionstore-backups|*

[Pale Moon Web Storage *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\storage\default\http*|*|REMOVESELF

[Pale Moon Website Permissions *]
Section=Pale Moon Web Browser
DetectFile=%AppData%\Moonchild Productions\Pale Moon\Profiles
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Palia *]
Section=Games
DetectFile=%LocalAppData%\Palia
FileKey1=%LocalAppData%\Palia\Saved\Logs|*
FileKey2=%LocalAppData%\Palia\Saved\webcache*\*cache*|*|RECURSE

[Paltalk Messenger *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Paltalk Messenger
FileKey1=%AppData%\Paltalk|*|RECURSE

[Panasonic HD Writer *]
LangSecRef=3023
DetectFile=%LocalAppData%\Panasonic\HD Writer*
FileKey1=%LocalAppData%\Panasonic\HD Writer*\Log|*
FileKey2=%ProgramData%\Panasonic\HD Writer*|EventLog.evl|RECURSE

[Panda Antivirus *]
LangSecRef=3024
Detect=HKLM\Software\Panda Security
FileKey1=%ProgramData%\Panda Security\Panda Devices Agent\Logs|*
FileKey2=%ProgramData%\Panda Security\Panda Security Protection|*.log
FileKey3=%ProgramData%\Panda Security\Panda Security Protection\Logs|*
FileKey4=%ProgramData%\Panda Security\Panda Security Protection\SRFRepository|*.bak
FileKey5=%ProgramData%\Panda Security\PSLogs|*.log

[Pandion *]
LangSecRef=3022
Detect=HKCU\Software\Pandion
FileKey1=%AppData%\Pandion\Avatars|*|RECURSE
FileKey2=%AppData%\Pandion\Message Cache|*|RECURSE

[Pandion Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Pandion
FileKey1=%AppData%\Pandion\Profiles|*.buffer;*.log|RECURSE

[Paradox Interactive Launcher *]
Section=Games
DetectFile1=%AppData%\Launcher-main
DetectFile2=%LocalAppData%\Paradox Interactive\Launcher*
FileKey1=%AppData%\Launcher-main|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE
FileKey2=%AppData%\Launcher-main\*Cache|*
FileKey3=%AppData%\Launcher-main\blob_storage|*|RECURSE
FileKey4=%AppData%\Paradox Interactive\launcher-v2\cache|*
FileKey5=%AppData%\Paradox Launcher\Logs|*
FileKey6=%LocalAppData%\Paradox Interactive\Launcher*|*
FileKey7=%LocalAppData%\Paradox Interactive\Launcher*\Chromium-Data|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE
FileKey8=%LocalAppData%\Paradox Interactive\Launcher*\Chromium-Data\*Cache|*|REMOVESELF
FileKey9=%LocalAppData%\Paradox Interactive\Launcher*\Chromium-Data\blob_storage|*|RECURSE
FileKey10=%LocalAppData%\Paradox Interactive\Launcher*\Logs|*
FileKey11=%UserProfile%\Documents\Paradox Interactive\CrashReporter\Logs|*
FileKey12=%UserProfile%\Documents\Paradox Interactive\CrashReporter\ShaderCache\dx*|*|RECURSE

[Paragon Software *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Paragon Software
FileKey1=%ProgramData%\clonehdd|*.log
FileKey2=%ProgramData%\converthfs|*.log
FileKey3=%ProgramData%\createpart|*.log
FileKey4=%ProgramData%\deletepart|*.log
FileKey5=%ProgramData%\explauncher|*.log
FileKey6=%ProgramData%\formatpart|*.log
FileKey7=%ProgramData%\ftw|*.log
FileKey8=%ProgramData%\launcher|*.log
FileKey9=%ProgramData%\logsaver|*.log
FileKey10=%ProgramData%\migrateos|*.log
FileKey11=%ProgramData%\redistpart|*.log
FileKey12=%ProgramData%\vmadjust|*.log
FileKey13=%ProgramData%\vmcreate|*.log
FileKey14=%ProgramData%\wipe|*.log
FileKey15=%ProgramFiles%\Paragon Software\*|*.log;*.txt|RECURSE
FileKey16=%SystemDrive%\Documents and Settings\LocalService|objsrv.log

[Parallel Password Recovery *]
LangSecRef=3024
Detect=HKCU\Software\Parallel Password Recovery
FileKey1=%ProgramFiles%\Parallel Password Recovery|*.log
RegKey1=HKCU\Software\Parallel Password Recovery\Parallel recovery server\1.0|Last stored job
RegKey2=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Last password definition file path
RegKey3=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Last test path
RegKey4=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to password definition file
RegKey5=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to test file
RegKey6=HKLM\Software\Parallel Password Recovery\Parallel recovery server\1.0|Last stored job
RegKey7=HKLM\Software\Parallel Password Recovery\PPR GUI manager\1.0|Last test path
RegKey8=HKLM\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to password definition file
RegKey9=HKLM\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to test file
RegKey10=HKLM\Software\Wow6432Node\Parallel Password Recovery\Parallel recovery server\1.0|Last stored job
RegKey11=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Last password definition file path
RegKey12=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Last test path
RegKey13=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Path to password definition file
RegKey14=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Path to test file

[Paramount Dynamic *]
LangSecRef=3023
DetectFile=%LocalAppData%\Microsoft\Windows\Themes\ParamountDynamic.theme
Warning=This will cause you to redownload the Paramount Dynamic RSS file.
FileKey1=%LocalAppData%\Microsoft\Feeds|http~c~f~fthemeserver~dmicrosoft~dcom~fdefault~daspx~mp*Paramount*

[Paranormal Agency *]
Section=Games
DetectFile=%AppData%\Shape Games\Paranormal_v*
FileKey1=%AppData%\Shame Games\Paranormal_v*\logs|*

[Parsec *]
LangSecRef=3022
DetectFile=%AppData%\Parsec
FileKey1=%AppData%\Parsec|log.txt

[Partner Application *]
LangSecRef=3022
DetectFile=%ProgramData%\Partner
FileKey1=%ProgramData%\Partner|*.log

[Passware Encryption Analyzer *]
LangSecRef=3021
DetectFile1=%AppData%\Passware\EncryptionAnalyzer
DetectFile2=%ProgramFiles%\Passware\Encryption Analyzer*
FileKey1=%AppData%\EncryptionAnalyzer\logs|*
FileKey2=%AppData%\Passware\EncryptionAnalyzer\*|config.json;Network Persistent State
FileKey3=%AppData%\Passware\EncryptionAnalyzer\*\*Cache|*|RECURSE
FileKey4=%AppData%\Passware\EncryptionAnalyzer\*\blob_storage|*|RECURSE
FileKey5=%AppData%\Passware\EncryptionAnalyzer\*\Local Storage\leveldb|*.old;LOG
FileKey6=%AppData%\Passware\EncryptionAnalyzer\*\logs|*
FileKey7=%AppData%\Passware\EncryptionAnalyzer\*\Session Storage|*.old;LOG
FileKey8=%AppData%\PasswareEncryptionAnalyzer\logs|*

[Passware Search Index Examiner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Passware\Search Index Examiner*
FileKey1=%AppData%\Passware\SearchIndexExaminer|Settings.bin

[Patch My PC *]
LangSecRef=3024
DetectFile=%LocalAppData%\Patch_My_PC,_LLC
FileKey1=%LocalAppData%\Patch_My_PC,_LLC|*|RECURSE

[Patch Quest *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Lychee Game Labs\Patch Quest
FileKey1=%UserProfile%\AppData\LocalLow\Lychee Game Labs\Patch Quest|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Lychee Game Labs\Patch Quest\Unity|*|REMOVESELF

[Path of Exile *]
Section=Games
Detect1=HKCU\Software\GrindingGearGames\Path of Exile
Detect2=HKCU\Software\Valve\Steam\Apps\238960
FileKey1=%ProgramFiles%\Grinding Gear Games\Path of Exile\Logs|*
FileKey2=%ProgramFiles%\Steam\steamapps\common\Path of Exile\logs|*
FileKey3=%UserProfile%\Documents\My Games\Path of Exile\Minimap|*

[PAYDAY 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\218620
DetectFile=%LocalAppData%\PAYDAY 2
FileKey1=%LocalAppData%\PAYDAY 2|crash*.txt

[PC Doctor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PC-Doctor For Windows
FileKey1=%ProgramFiles%\PC-Doctor For Windows\Logs|*

[PC Optimizer Pro *]
LangSecRef=3024
DetectFile=%ProgramData%\PC optimizer pro
FileKey1=%ProgramData%\PC Optimizer Pro\Logs|*

[PC TechZone Merlin InstantFeedback *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PC TechZone\Merlin InstantFeedback
FileKey1=%ProgramFiles%\PC TechZone\Merlin InstantFeedback|*.tmp;*Log.txt;seller.txt
FileKey2=%ProgramFiles%\PC TechZone\Merlin InstantFeedback\Logs|*

[PC Trek Advanced Password Recovery Suite *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Advanced Password Recovery Suite
FileKey1=%ProgramFiles%\Advanced Password Recovery Suite|dscnt.exe

[PCMark 10 *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\PCMark 10
FileKey1=%UserProfile%\Documents\PCMark 10|*|REMOVESELF

[PCSX2 *]
Section=Games
DetectFile=%UserProfile%\Documents\PCSX2
FileKey1=%UserProfile%\Documents\PCSX2\logs|*|RECURSE
FileKey2=%UserProfile%\Documents\PCSX2\snaps|*|RECURSE

[PCWinBooster *]
LangSecRef=3024
DetectFile=%AppData%\Soft4Boost\PCWinBooster*
FileKey1=%AppData%\Soft4Boost\Logs|*|RECURSE

[PDF-XChange *]
LangSecRef=3021
Detect1=HKCU\Software\Tracker Software\PDFViewer
Detect2=HKCU\Software\Tracker Software\PDFXEditor
FileKey1=%LocalAppData%\Tracker Software\LiveUpdate\Updates|*
FileKey2=%ProgramData%\PDF-XChange\Updater\InstallPackages|*
FileKey3=%ProgramData%\Tracker Software\PDFXShellExt\Ifilter\Temp|*.tmp
FileKey4=%ProgramData%\Tracker Software\TrackerUpdate|TrackerUpdate.exe.del
FileKey5=%ProgramData%\Tracker Software\TrackerUpdate\Download|*
RegKey1=HKCU\Software\Tracker Software\PDFViewer\Documents\LastOpened

[PDF Annotator *]
LangSecRef=3021
Detect=HKCU\Software\GRAHL\PDFAnnotator
RegKey1=HKCU\Software\GRAHL\PDFAnnotator\3.0\Files\MRUItems
RegKey2=HKCU\Software\GRAHL\PDFAnnotator\4.0\Files\MRUItems

[PDF Architect *]
LangSecRef=3021
DetectFile1=%AppData%\PDF Architect*
DetectFile2=%AppData%\pdfforge_gmbh\PDF_Architect*
FileKey1=%AppData%\PDF Architect*\Logs|*
FileKey2=%AppData%\pdfforge_gmbh\PDF_Architect*\minidump|*.dmp|RECURSE

[PDF Editor 4 *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDF Editor 4
FileKey1=%ProgramFiles%\PDF Editor 4|*.diz;*.log

[PDF Explorer *]
LangSecRef=3021
Detect=HKCU\Software\PDFExplorer
RegKey1=HKCU\Software\PDFExplorer\Options|LastDiskTreeFolder
RegKey2=HKCU\Software\PDFExplorer\Options|ScanGridStartupFolder

[PDF24 Creator *]
LangSecRef=3021
DetectFile=%ProgramFiles%\PDF24
FileKey1=%ProgramFiles%\PDF24|*.log

[PDFCreator *]
LangSecRef=3021
DetectFile=%LocalAppData%\PDFForge\PDFCreator
FileKey1=%AppData%\pdfforge\Images2PDF|Print*-*.log
FileKey2=%AppData%\pdfforge\Images2PDF\Tmp|*.prnt|REMOVESELF
FileKey3=%LocalAppData%\PDFCreator|PDFCreator.log
FileKey4=%LocalAppData%\PDFForge\PDFCreator|PDFCreatorHistory.json
FileKey5=%ProgramFiles%\PDFCreator|SetupLog.txt
RegKey1=HKCU\Software\PDFCreator\Program|LastsaveDirectory

[PDFill PDF Tools *]
LangSecRef=3021
DetectFile=%ProgramFiles%\PlotSoft\PDFill_PDF_Tools
FileKey1=%ProgramFiles%\PlotSoft\PDFill_PDF_Tools\download|gs.zip

[PDFsam *]
LangSecRef=3021
DetectFile1=%AppData%\PDFsam Enhanced*
DetectFile2=%ProgramData%\PDFsam Basic
FileKey1=%AppData%\PDFsam Enhanced*\logs|*.htm
FileKey2=%ProgramData%\PDFsam Basic|*.msi
FileKey3=%ProgramData%\PDFsam Enhanced*\Installation|*.exe;*.msi
FileKey4=%ProgramData%\PDFsam Enhanced*\Installation\logs|*

[PDFStreamDumper *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper
RegKey1=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper\Settings|LastFile
RegKey2=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper\Settings|lastFind
RegKey3=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper\Settings|lastReplace

[PE Module Explorer *]
LangSecRef=3024
Detect=HKCU\Software\Woozle\PE Module Explorer
RegKey1=HKCU\Software\Woozle\PE Module Explorer\Recent Files

[PeaZip *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PeaZip
FileKey1=%ProgramFiles%\PeaZip\res|note.txt|RECURSE

[Peerblock *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Peerblock
FileKey1=%ProgramFiles%\Peerblock|*.bak;*.log;cache.p2b;History.db
FileKey2=%ProgramFiles%\Peerblock\lists|*.list.failed*

[Pegasus Mail *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pegasus Mail
FileKey1=%SystemDrive%\PMAIL\MAIL|SYSLOG.PM
FileKey2=%SystemDrive%\PMAIL\Programs|*.log

[Pelles C *]
LangSecRef=3021
Detect=HKCU\Software\Pelle Orinius\PellesC
RegKey1=HKCU\Software\Pelle Orinius\PellesC\Recent File List
RegKey2=HKCU\Software\Pelle Orinius\PellesC\Recent Project List
RegKey3=HKCU\Software\Pelle Orinius\PellesC\Recent Search List

[Penumbra Black Plague *]
Section=Games
DetectFile=%UserProfile%\Documents\Penumbra*
FileKey1=%UserProfile%\Documents\Penumbra*\*|*.log

[PerfectDisk *]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectDisk
FileKey1=%ProgramData%\Raxco\PerfectDisk\*|*.log;*.txt;PDBootLog

[PerfectKeyboard *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\PerfectKeyboardFiles
FileKey1=%UserProfile%\Documents\PerfectKeyboardFiles\Temp|log.txt

[PerfectRegistry *]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectRegistry
DetectFile=%ProgramFiles%\Raxco\PerfectRegistry
FileKey1=%AppData%\Raxco\PerfectRegistry|*.log;TempHLList.rcp

[PerfectUpdater *]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectUpdater
FileKey1=%AppData%\Raxco\PerfectUpdater|*.log
FileKey2=%AppData%\Raxco\PerfectUpdater\Backup|*
FileKey3=%AppData%\Raxco\PerfectUpdater\Download|*

[Performance Maintainer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PC Starters\Performance Maintainer
FileKey1=%ProgramFiles%\PC Starters\Performance Maintainer\Backups|*|RECURSE
FileKey2=%ProgramFiles%\PC Starters\Performance Maintainer\log*|*|RECURSE

[Pet Pals: Animal Doctor *]
Section=Games
Detect=HKLM\Software\Legacy Interactive\Pet Pals
FileKey1=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor|*.log
FileKey2=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre|*
FileKey3=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\temp|*|REMOVESELF
ExcludeKey1=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\bin\|*
ExcludeKey2=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\lib\|*

[pgAdmin *]
LangSecRef=3024
DetectFile=%AppData%\pgAdmin
FileKey1=%AppData%\pgAdmin|pgadmin*.log

[phase-6 *]
LangSecRef=3021
DetectFile=%UserProfile%\.phase-6
FileKey1=%UserProfile%\.phase-6|window-position.txt
FileKey2=%UserProfile%\.phase-6\logs|phase-6.log

[Phorest *]
LangSecRef=3024
Detect=HKCU\Software\FutureFog\Phorest\Options
RegKey1=HKCU\Software\FutureFog\Phorest\Layout|SelectionHeight
RegKey2=HKCU\Software\FutureFog\Phorest\Layout|SelectionLeft
RegKey3=HKCU\Software\FutureFog\Phorest\Layout|SelectionTop
RegKey4=HKCU\Software\FutureFog\Phorest\Layout|SelectionWidth
RegKey5=HKCU\Software\FutureFog\Phorest\Options|LastUsedFolder

[Photo DVD Slideshow *]
LangSecRef=3023
DetectFile=%AppData%\Photo DVD Slideshow
FileKey1=%AppData%\Photo DVD Slideshow|*.log
FileKey2=%AppData%\Photo DVD Slideshow\PhotosCache|*

[Photo Print Calendar 3.00E Beta *]
LangSecRef=3021
Detect=HKLM\Software\Computer Institute of Japan, Ltd.\Photo Print Calendar from YOKOHAMA Ver.3.00E beta\3.00E beta
FileKey1=%ProgramFiles%\Photo Print Calendar|update.bmp

[Photo Stamp Remover *]
LangSecRef=3023
Detect=HKCU\Software\softorbits\PhotoStampRemover
RegKey1=HKCU\Software\softorbits\PhotoStampRemover|currentFile

[Photo! Editor *]
LangSecRef=3024
Detect=HKCU\Software\VicMan Software\Photo! Editor
FileKey1=%ProgramFiles%\Photo!\Photo! Editor|*.log
RegKey1=HKCU\Software\VicMan Software\Photo! Editor|LastFolder

[PhotoFlare *]
LangSecRef=3023
Detect=HKCU\Software\photoflare.io\PhotoFlare
RegKey1=HKCU\Software\photoflare.io\PhotoFlare|OpenFolder
RegKey2=HKCU\Software\photoflare.io\PhotoFlare|RecentFiles
RegKey3=HKCU\Software\photoflare.io\PhotoFlare|SaveFolder
RegKey4=HKCU\Software\photoflare.io\PhotoFlare|SaveFormat

[PhotoScissors *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\PhotoScissors
RegKey1=HKCU\Software\Teorex\PhotoScissors\Recent File List
RegKey2=HKCU\Software\Teorex\PhotoScissors\RecentFileList

[PhotoZoom Pro *]
LangSecRef=3023
Detect1=HKCU\Software\BenVista\PhotoZoom Pro 6
Detect2=HKCU\Software\BenVista\PhotoZoom Pro 7
Detect3=HKCU\Software\BenVista\PhotoZoom Pro 8
RegKey1=HKCU\Software\BenVista\PhotoZoom Pro 6|FileDir
RegKey2=HKCU\Software\BenVista\PhotoZoom Pro 6\Recent Images
RegKey3=HKCU\Software\BenVista\PhotoZoom Pro 7|FileDir
RegKey4=HKCU\Software\BenVista\PhotoZoom Pro 7\Recent Images
RegKey5=HKCU\Software\BenVista\PhotoZoom Pro 8|FileDir
RegKey6=HKCU\Software\BenVista\PhotoZoom Pro 8\Recent Images

[PHPStorm *]
LangSecRef=3024
DetectFile=%UserProfile%\.WebIde40
FileKey1=%UserProfile%\.WebIde40\LocalHistory|*|RECURSE
FileKey2=%UserProfile%\.WebIde40\Log|*|RECURSE
FileKey3=%UserProfile%\.WebIde40\system\caches|*|RECURSE
FileKey4=%UserProfile%\.WebIde40\tmp|*|RECURSE

[PhraseExpress *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\PhraseExpress
FileKey1=%UserProfile%\Documents\PhraseExpress|*.bak

[PhrozenSoft *]
LangSecRef=3024
DetectFile=%AppData%\PhrozenSoft
FileKey1=%AppData%\PhrozenSoft\PVTUploader|phrzvtu.db

[Phyxion.net Driver Sweeper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Phyxion.net\Driver Sweeper\Logs
FileKey1=%ProgramFiles%\Phyxion.net\Driver Sweeper\Backup|*|RECURSE
FileKey2=%ProgramFiles%\Phyxion.net\Driver Sweeper\Logs|*|RECURSE

[Pi Network *]
LangSecRef=3021
DetectFile=%LocalAppData%\programs\pi-network-desktop
FileKey1=%AppData%\Pi Network|*-journal;*.old;*.tmp;LOG;Network Persistent State;QuotaManager|RECURSE
FileKey2=%AppData%\Pi Network\*Cache|*|RECURSE
FileKey3=%AppData%\Pi Network\blob_storage|*|RECURSE
FileKey4=%AppData%\Pi Network\Crashpad\reports|*.dmp
FileKey5=%AppData%\Pi Network\Logs|*
FileKey6=%AppData%\Pi Network\Pi Network\Logs|*
FileKey7=%AppData%\Pi Network\VideoDecodeStats|*
FileKey8=%LocalAppData%\pi-network-desktop-updater|installer.exe
FileKey9=%LocalAppData%\pi-network-desktop-updater\pending|*Setup*.exe

[PictoQuest *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\NanoPiko\PictoQuest
FileKey1=%UserProfile%\AppData\LocalLow\NanoPiko\PictoQuest|*txt

[PictureTrail Photo Editor *]
LangSecRef=3023
Detect=HKCU\Software\PictureTrail Photo Editor\PictureTrail Photo Editor
RegKey1=HKCU\Software\Local AppWizard-Generated Applications\PictureTrail Photo Editor\Recent File List
RegKey2=HKCU\Software\PictureTrail Photo Editor\PictureTrail Photo Editor\Recent File List

[Pictus *]
LangSecRef=3023
Detect=HKLM\Software\Poppeman\Pictus
DetectFile=%AppData%\Poppeman\Pictus
FileKey1=%AppData%\Poppeman\Pictus|runlog.txt;setup.txt

[PicView *]
LangSecRef=3023
DetectFile=%ProgramFiles%\PicView
FileKey1=%LocalAppData%\Ruben2776\PicView_StrongName_*\*|Recent.txt

[Pidgin *]
LangSecRef=3022
Detect=HKCU\Software\Pidgin
FileKey1=%AppData%\.purple|*.xml~
FileKey2=%UserProfile%|Recently-Used.xbel

[Pidgin Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Pidgin
FileKey1=%AppData%\.purple\logs|*|REMOVESELF

[Pinnacle Studio *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Pinnacle\Studio*
FileKey1=%ProgramFiles%\Pinnacle\Studio*|*.log
FileKey2=%ProgramFiles%\Pinnacle\Studio*\Programs|*.log

[Pioneer Rekordbox *]
LangSecRef=3023
DetectFile=%AppData%\Pioneer\Rekordbox
FileKey1=%AppData%\Pioneer\Rekordbox\Crashes|*.dmp
FileKey2=%AppData%\PioneerLog|*Log.txt
FileKey3=%UserProfile%\Documents\Rekordbox|*log*.txt

[Pipy *]
LangSecRef=3021
DetectFile=%AppData%\Pipy
FileKey1=%AppData%\Pipy\Logs|*

[PixelFlasher *]
LangSecRef=3024
DetectFile=%AppData%\PixelFlasher
FileKey1=%AppData%\PixelFlasher|device_images_history.json
FileKey2=%AppData%\PixelFlasher\logs|*
FileKey3=%AppData%\PixelFlasher\tmp|*

[PixelFlasher Boot Images *]
LangSecRef=3024
DetectFile=%AppData%\PixelFlasher
FileKey1=%AppData%\PixelFlasher\boot_images*\*|*|REMOVESELF

[PixelFlasher Factory Images *]
LangSecRef=3024
DetectFile=%AppData%\PixelFlasher
FileKey1=%AppData%\PixelFlasher\Factory Images\*|*|REMOVESELF

[PKZip *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PKWARE\PKZIPW
FileKey1=%ProgramFiles%\PKWARE\PKZIPW|*.log
RegKey1=HKCU\Software\PKWARE\PKZIP70\History

[Plague Inc: Evolved *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Ndemic Creations\Plague Inc Evolved
FileKey1=%UserProfile%\AppData\LocalLow\Ndemic Creations\Plague Inc Evolved|Player.log

[Planet Horse *]
Section=Games
DetectFile=%ProgramFiles%\Planet Horse
FileKey1=%ProgramFiles%\Planet Horse|output_log.txt|RECURSE

[Planets Under Attack *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\218510
FileKey1=%UserProfile%\Documents\My Games\Planets Under Attack|*.log

[Plantronics Spokes *]
LangSecRef=3023
DetectFile=%LocalAppData%\Plantronics\Spokes3G
FileKey1=%LocalAppData%\Plantronics\Logs|*
FileKey2=%LocalAppData%\Plantronics\Spokes3G\cefcache\*Cache|*

[Plants vs. Zombies *]
Section=Games
DetectFile=%LocalAppData%\PVZCache
FileKey1=%LocalAppData%\PVZCache|*
FileKey2=%ProgramFiles%\Popcap Games\Plants vs Zombies|Install.log
FileKey3=%UserProfile%\Documents\PVZ Battle for Neighborville\CrashDumps|*|RECURSE

[Plarium Play *]
Section=Games
DetectFile=%LocalAppData%\PlariumPlay.log
FileKey1=%LocalAppData%|PlariumPlay.log

[PlayFirst Games *]
Section=Games
DetectFile=%AppData%\PlayFirst
FileKey1=%AppData%\PlayFirst|logfile.txt|RECURSE

[Plex *]
LangSecRef=3023
DetectFile=%LocalAppData%\Plex
FileKey1=%LocalAppData%\Plex\cache|*|RECURSE
FileKey2=%LocalAppData%\Plex\logs|*
FileKey3=%LocalAppData%\Plex\Plex Media Server\Cache|*|RECURSE
FileKey4=%LocalAppData%\Plex\Plex Media Server\logs|*
FileKey5=%LocalAppData%\Plex\QtWebEngine\Default|Visited Links
FileKey6=%LocalAppData%\Plex\QtWebEngine\Default\GPUCache|*

[Plex Media Server *]
LangSecRef=3023
Detect=HKCU\Software\Plex, Inc.\Plex Media Server
FileKey1=%LocalAppData%\Plex Media Server\Cache\PhotoTranscoder|*|RECURSE
FileKey2=%LocalAppData%\Plex Media Server\Crash Reports|*|RECURSE
FileKey3=%LocalAppData%\Plex Media Server\Logs|*|RECURSE
FileKey4=%LocalAppData%\Plex Media Server\Plug-in Support\Caches|*|RECURSE
FileKey5=%LocalAppData%\Plex Media Server\Plug-in Support\Databases|*.db-shm;*.db-wal
FileKey6=%LocalAppData%\Plex Media Server\Updates|*|RECURSE
FileKey7=%LocalAppData%\Plex\Cache\qmlcache|*
FileKey8=%LocalAppData%\Plex\Cache\qtwebengine\Default\Cache|*
FileKey9=%LocalAppData%\Plex\logs|*
FileKey10=%ProgramFiles%\Plex\Plex Media Server|*.log;*.txt|RECURSE
FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Plex Media Server\Logs|*|RECURSE
FileKey12=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Plex Media Server\Logs|*|RECURSE

[PlumChoice Quick Connect *]
LangSecRef=3021
DetectFile=%LocalAppData%\Tific
FileKey1=%LocalAppData%\Tific|*.log|RECURSE

[Plus500 *]
LangSecRef=3021
Detect=HKCU\Software\Plus500
DetectFile=%ProgramFiles%\Plus500
FileKey1=%LocalAppData%\Plus500\Main|*.log*

[Pocket Killbox *]
LangSecRef=3024
Detect=HKCU\Software\KillBox
DetectFile=%SystemDrive%\!Killbox
FileKey1=%SystemDrive%\!Killbox\Logs|*
RegKey1=HKCU\Software\KillBox|LastPath

[Pogo Games *]
Section=Games
DetectFile=%AppData%\Pogo Games
FileKey1=%AppData%\Pogo Games\*\Cache|*|REMOVESELF

[Pointstone Registry Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\Pointstone\Registry Cleaner
FileKey1=%AppData%\Pointstone\Registry Cleaner|*.bak;Statistics.xml
FileKey2=%AppData%\Pointstone\Registry Cleaner\Logs|*.txt

[Pointstone Total Privacy *]
LangSecRef=3024
Detect=HKCU\Software\Pointstone\Total Privacy
FileKey1=%ProgramFiles%\Pointstone\Total Privacy*|*.txt

[Pok3D *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Pok3d
FileKey1=%AppData%\Pok3d|*.dmp;*.log

[PokerStars *]
Section=Games
DetectFile=%LocalAppData%\PokerStars
FileKey1=%LocalAppData%\PokerStars|*.log.*
FileKey2=%LocalAppData%\PokerStars\ImgCache|*
FileKey3=%ProgramFiles%\PokerStars*|*.log.*

[Polarity *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Polarity
FileKey1=%AppData%\Stanley Lim\Polarity\Cache|*|RECURSE
FileKey2=%AppData%\Stanley Lim\Polarity\Favicon|*
FileKey3=%ProgramFiles%\Polarity|*.log
FileKey4=%UserProfile%\Polarity_Config|downloads_names.ini;downloads_times.ini;downloads_urls.ini;history.ini;history_names.ini;history_times.ini;savedTabs.ini

[Polyball *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\368180
FileKey1=%ProgramFiles%\SteamLibrary\steamapps\common\Polyball\Polyball_Data|output_log.txt

[PolyView *]
LangSecRef=3021
Detect=HKCU\Software\Polybytes\PolyView
RegKey1=HKCU\Software\Polybytes\PolyView\Recent File List

[Popcorn Time *]
LangSecRef=3022
DetectFile=%LocalAppData%\Popcorn*Time*
FileKey1=%LocalAppData%\Popcorn*Time*\*Cache|*|RECURSE
FileKey2=%LocalAppData%\Popcorn*Time*\node_modules\peerflix\node_modules\torrent-stream\node_modules\parse-torrent\node_modules\magnet-uri|*log.txt
FileKey3=%LocalAppData%\Popcorn*Time*\PopcornTime\Cache\QTWebEngine\Default\Cache|*
FileKey4=%LocalAppData%\Popcorn*Time*\QTWebEngine\Default\GPUCache|*
FileKey5=%LocalAppData%\Popcorn*Time*\User Data\*\*Cache|*
FileKey6=%ProgramFiles%\Popcorn*Time*\plugins|plugins.dat.*

[Porcunipine *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Big Green Pillow\Porcunipine
FileKey1=%UserProfile%\AppData\LocalLow\Big Green Pillow\Porcunipine|output_log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Big Green Pillow\Porcunipine\Crashes|*|REMOVESELF
FileKey3=%UserProfile%\AppData\LocalLow\Big Green Pillow\Porcunipine\Unity|*|REMOVESELF

[Portfolio Performance *]
LangSecRef=3021
DetectFile=%LocalAppData%\PortfolioPerformance
FileKey1=%LocalAppData%\PortfolioPerformance\workspace\.metadata|*.lock;*.log

[PortForward.com PortChecker *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\PFPortChecker
RegKey1=HKCU\Software\VB and VBA Program Settings\PFPortChecker\Settings|Port

[PortScan & Stuff *]
LangSecRef=3022
Detect=HKCU\Software\CompSoft\PortScan
RegKey1=HKCU\Software\CompSoft\PortScan|ScanEnd
RegKey2=HKCU\Software\CompSoft\PortScan|ScanStart
RegKey3=HKCU\Software\CompSoft\PortScan\MRUDNSQuery
RegKey4=HKCU\Software\CompSoft\PortScan\MRUDNSServer
RegKey5=HKCU\Software\CompSoft\PortScan\MRUPing
RegKey6=HKCU\Software\CompSoft\PortScan\MRUTraceroute
RegKey7=HKCU\Software\CompSoft\PortScan\MRUWhoIs

[PostBox *]
LangSecRef=3021
DetectFile=%LocalAppData%\PostBox
FileKey1=%AppData%\PostBox|*.log|RECURSE
FileKey2=%AppData%\PostBox\Crash Reports|*|REMOVESELF
FileKey3=%LocalAppData%\PostBox\Profiles\*\Cache|*|REMOVESELF

[Postman *]
LangSecRef=3022
DetectFile=%LocalAppData%\Postman
FileKey1=%AppData%\Postman\*Cache|*
FileKey2=%AppData%\Postman\Logs|*.log
FileKey3=%AppData%\Postman\partitions\postman_shell\GPUCache|*
FileKey4=%AppData%\Postman\partitions\postman_shell\webrtc_event_logs|*
FileKey5=%AppData%\Postman\partitions\postman_user_cookies\webrtc_event_logs|*
FileKey6=%AppData%\Postman\webrtc_event_logs|*
FileKey7=%LocalAppData%\Postman|*.log|RECURSE

[PotPlayer *]
LangSecRef=3023
Detect1=HKCU\Software\Daum\PotPlayerMini
Detect2=HKCU\Software\Daum\PotPlayerMini64
FileKey1=%AppData%\Daum\PotPlayer\Log|*
FileKey2=%LocalAppData%\Daum\PotPlayer\Log|*.xml
FileKey3=%ProgramFiles%\PotPlayer\History|*.txt|REMOVESELF
RegKey1=HKCU\Software\Daum\PotPlayerMini\RememberFiles
RegKey2=HKCU\Software\Daum\PotPlayerMini64\RememberFiles

[PowerENGAGE *]
LangSecRef=3021
DetectFile=%AppData%\PowerENGAGE
FileKey1=%AppData%\PowerENGAGE|*-journal;*.old;LOG
FileKey2=%AppData%\PowerENGAGE\*Cache|*
FileKey3=%AppData%\PowerENGAGE\Logs|*

[PowerISO *]
LangSecRef=3024
Detect=HKCU\Software\PowerISO
FileKey1=%AppData%\PowerISO\Upgrade|*|REMOVESELF
FileKey2=%ProgramFiles%\PowerISO|*.tmp
RegKey1=HKCU\Software\PowerISO\SCDEmu|ImageName0
RegKey2=HKCU\Software\PowerISO\SCDEmu|ImageName1
RegKey3=HKCU\Software\PowerISO\SCDEmu|ImageName2
RegKey4=HKCU\Software\PowerISO\SCDEmu|ImageName3
RegKey5=HKCU\Software\PowerISO\SCDEmu|ImageName4
RegKey6=HKCU\Software\PowerISO\SCDEmu|ImageName5
RegKey7=HKCU\Software\PowerISO\SCDEmu|ImageName6
RegKey8=HKCU\Software\PowerISO\SCDEmu|ImageName7
RegKey9=HKCU\Software\PowerISO\SCDEmu|ImageName8
RegKey10=HKCU\Software\PowerISO\SCDEmu|ImageName9
RegKey11=HKCU\Software\PowerISO\SCDEmu|ImageName10
RegKey12=HKCU\Software\PowerISO\SCDEmu|ImageName11
RegKey13=HKCU\Software\PowerISO\SCDEmu|ImageName12
RegKey14=HKCU\Software\PowerISO\SCDEmu|ImageName13
RegKey15=HKCU\Software\PowerISO\SCDEmu|ImageName14
RegKey16=HKCU\Software\PowerISO\SCDEmu|ImageName15
RegKey17=HKCU\Software\PowerISO\SCDEmu|ImageName16
RegKey18=HKCU\Software\PowerISO\SCDEmu|ImageName17
RegKey19=HKCU\Software\PowerISO\SCDEmu|ImageName18
RegKey20=HKCU\Software\PowerISO\SCDEmu|ImageName19
RegKey21=HKCU\Software\PowerISO\SCDEmu|ImageName20
RegKey22=HKCU\Software\PowerISO\SCDEmu|ImageName21
RegKey23=HKCU\Software\PowerISO\SCDEmu|ImageName22
RegKey24=HKU\S-1-5-18\Software\PowerISO|ExtractPath0
RegKey25=HKU\S-1-5-18\Software\PowerISO|ExtractPath1
RegKey26=HKU\S-1-5-18\Software\PowerISO|ExtractPath2
RegKey27=HKU\S-1-5-18\Software\PowerISO|ExtractPath3
RegKey28=HKU\S-1-5-18\Software\PowerISO|ExtractPath4
RegKey29=HKU\S-1-5-18\Software\PowerISO|ExtractPath5
RegKey30=HKU\S-1-5-18\Software\PowerISO|ExtractPath6
RegKey31=HKU\S-1-5-18\Software\PowerISO|ExtractPath7
RegKey32=HKU\S-1-5-18\Software\PowerISO|Reopen0
RegKey33=HKU\S-1-5-18\Software\PowerISO|Reopen1
RegKey34=HKU\S-1-5-18\Software\PowerISO|Reopen2
RegKey35=HKU\S-1-5-18\Software\PowerISO|Reopen3
RegKey36=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName0
RegKey37=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName1
RegKey38=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName2
RegKey39=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName3
RegKey40=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName4
RegKey41=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName5
RegKey42=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName6
RegKey43=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName7
RegKey44=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName8
RegKey45=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName9
RegKey46=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName10
RegKey47=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName11
RegKey48=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName12
RegKey49=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName13
RegKey50=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName14
RegKey51=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName15
RegKey52=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName16
RegKey53=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName17
RegKey54=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName18
RegKey55=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName19
RegKey56=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName20
RegKey57=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName21
RegKey58=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName22

[PowerPoint Repair Toolbox *]
LangSecRef=3021
DetectFile=%ProgramFiles%\PowerPoint Repair Toolbox
FileKey1=%LocalAppData%\PowerPoint Repair Toolbox|*.log
FileKey2=%LocalAppData%\PowerPoint Repair Toolbox\temp|*|RECURSE
FileKey3=%ProgramFiles%\PowerPoint Repair Toolbox|history.txt

[PowerTerm WebConnect DeskView *]
LangSecRef=3023
DetectFile=%LocalAppData%\Ericom
FileKey1=%LocalAppData%\Ericom\Ptagent|*
FileKey2=%LocalAppData%\Ericom\PtRdp|*

[PowerZip *]
LangSecRef=3024
Detect=HKCU\Software\Trident Software\PowerZip
RegKey1=HKCU\Software\Trident Software\PowerZip\Doc
RegKey2=HKCU\Software\Trident Software\PowerZip\Recent File List

[PPTX Repair Kit *]
LangSecRef=3021
DetectFile=%ProgramFiles%\PPTX Repair Kit
FileKey1=%LocalAppData%\PPTX Repair Kit|*.log
FileKey2=%LocalAppData%\PPTX Repair Kit\temp|*|RECURSE
FileKey3=%ProgramFiles%\PPTX Repair Kit|history.txt

[Predator *]
LangSecRef=3021
Detect=HKLM\Software\Predator-Usb
FileKey1=%ProgramData%\Predator-Usb\PredatorACE\data|*.log

[Presto Transfer Ultimate *]
LangSecRef=3024
Detect=HKCU\Software\Perception\Presto Transfer Ultimate
FileKey1=%AppData%\Presto Transfer Ultimate|lastlog.html

[Prevent Restore *]
LangSecRef=3024
DetectFile=%AppData%\Prevent Restore
FileKey1=%AppData%\Prevent Restore|rreport.txt

[Prince of Persia *]
Section=Games
Detect1=HKLM\Software\Ubisoft\Prince of Persia The Sands of Time
Detect2=HKLM\Software\Ubisoft\Prince of Persia Warrior Within
DetectFile=%ProgramFiles%\Ubisoft\Prince of Persia*
FileKey1=%LocalAppData%\Ubisoft\Prince of Persia*|*.log
FileKey2=%ProgramFiles%\Ubisoft\Prince of Persia*|*.log;POPError.DAT

[priPrinter *]
LangSecRef=3021
Detect=HKLM\Software\Pelikan Software KFT\priPrinter
FileKey1=%AppData%\Pelikan Software KFT\priPrinter|cache_*.dat
FileKey2=%ProgramData%\priPrinter\dumps|*
RegKey1=HKCU\Software\Pelikan Software KFT\priPrinter|lastCleanUp

[Prison Architect *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\233450
FileKey1=%LocalAppData%\Introversion\Prison Architect|debug.txt

[privacy.sexy *]
LangSecRef=3024
DetectFile=%AppData%\privacy.sexy
FileKey1=%AppData%\privacy.sexy|Network Persistent State
FileKey2=%AppData%\privacy.sexy\*Cache|*|RECURSE
FileKey3=%AppData%\privacy.sexy\*Storage|*.old;LOG|RECURSE
FileKey4=%AppData%\privacy.sexy\blob_storage|*|RECURSE
FileKey5=%AppData%\privacy.sexy\logs|*.log
FileKey6=%AppData%\privacy.sexy\privacy.sexy\logs|*
FileKey7=%LocalAppData%\privacy.sexy-updater|*
FileKey8=%LocalAppData%\privacy.sexy-updater\*|*|REMOVESELF

[PrivacyRoot Wipe *]
LangSecRef=3024
Detect=HKLM\Software\privacyroot.com\wipe
DetectFile=%AppData%\Wipe*
FileKey1=%AppData%\Wipe*|apps_sorting.titles;found_apps.paths;StatsDates.txt
FileKey2=%AppData%\Wipe*\AutoExclude|*.txt
FileKey3=%AppData%\Wipe*\Temp\CachedImages|*.png
RegKey1=HKLM\Software\privacyroot.com\wipe|SETUP-EXE

[Private Internet Access VPN *]
LangSecRef=3022
DetectFile=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn
FileKey1=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn|*.log
FileKey2=%ProgramFiles%\pia_manager\log|*
FileKey3=%ProgramFiles%\pia_manager\tmp|*
FileKey4=%UserProfile%|.pia_manager_crash.log

[PrivaZer *]
LangSecRef=3024
Detect=HKCU\Software\PrivaZer
FileKey1=%LocalAppData%\PrivaZer|*.txt

[Privoxy *]
LangSecRef=3022
Detect=HKCU\Software\Privoxy
FileKey1=%ProgramFiles%\Vidalia Bundle\Privoxy|privoxy.log

[Pro PC Cleaner *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\ProPCCleaner
FileKey1=%UserProfile%\Documents\ProPCCleaner|log*.txt

[Procaster *]
LangSecRef=3023
DetectFile=%LocalAppData%\Procaster
FileKey1=%LocalAppData%\Procaster|*.log|RECURSE

[Process Hacker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Process Hacker
FileKey1=%AppData%\Process Hacker\Cache|*|RECURSE
FileKey2=%ProgramFiles%\Process Hacker|processhacker-setup.exe

[Processing *]
LangSecRef=3024
DetectFile=%AppData%\Processing
FileKey1=%AppData%\Processing|recent.txts
FileKey2=%AppData%\Processing\Console|*
FileKey3=%AppData%\Processing\Debug|*

[ProcessLasso *]
LangSecRef=3024
Detect=HKCU\Software\ProcessLasso
FileKey1=%AppData%\ProcessLasso|prolasso.log
FileKey2=%LocalAppData%\ProcessLasso\Logs|*
FileKey3=%ProgramFiles%\Process Lasso|.logtype5

[ProDiscover *]
LangSecRef=3024
Detect=HKLM\Software\Technology Pathways\ProDiscover
RegKey1=HKLM\Software\Technology Pathways\ProDiscover\Recent File List

[ProFantasy Software CC3 View *]
LangSecRef=3023
Detect=HKCU\Software\EvolutionComputing
RegKey1=HKCU\Software\EvolutionComputing\CC3View|1
RegKey2=HKCU\Software\EvolutionComputing\CC3View|2
RegKey3=HKCU\Software\EvolutionComputing\CC3View|3
RegKey4=HKCU\Software\EvolutionComputing\CC3View|4
RegKey5=HKCU\Software\EvolutionComputing\CC3View|WorkingDrawing

[ProgDVB *]
LangSecRef=3023
DetectFile=%ProgramFiles%\ProgDVB
FileKey1=%ProgramFiles%\ProgDVB\Logs|*|RECURSE

[Programmer's Notepad *]
LangSecRef=3024
Detect=HKCU\Software\Echo Software\PN2
FileKey1=%AppData%\Echo Software\PN2|User*.xml
RegKey1=HKCU\Software\Echo Software\PN2\Find|FindText
RegKey2=HKCU\Software\Echo Software\PN2\Find|ReplaceText
RegKey3=HKCU\Software\Echo Software\PN2\MRU
RegKey4=HKCU\Software\Echo Software\PN2\MRUProjects

[Project64 *]
Section=Games
Detect=HKCU\Software\N64 Emulation
DetectFile=%ProgramFiles%\Project64*
FileKey1=%ProgramFiles%\Project64 2.*\Logs|*
RegKey1=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile1
RegKey2=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile2
RegKey3=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile3
RegKey4=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile4
RegKey5=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile5
RegKey6=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile6
RegKey7=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile7
RegKey8=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile8
RegKey9=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile9
RegKey10=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile10

[PropertyList Editor *]
LangSecRef=3024
Detect=HKCU\Software\pledit\PropertyList Editor
RegKey1=HKCU\Software\pledit\PropertyList Editor\Recent File List

[Proteus *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219680
FileKey1=%UserProfile%\Documents\Proteus\logs|*
ExcludeKey1=FILE|%UserProfile%\Documents\Proteus\logs\|rng.txt

[Proton Mail-bridge *]
LangSecRef=3024
DetectFile=%AppData%\protonmail
FileKey1=%AppData%\protonmail\bridge-v3\logs|*.log

[Proton Mail *]
LangSecRef=3024
DetectFile=%LocalAppData%\proton_mail
FileKey1=%AppData%\Proton Mail\Local Storage\leveldb|*.old
FileKey2=%AppData%\Proton Mail\logs|*.log

[Proton VPN *]
LangSecRef=3024
DetectFile=%LocalAppData%\Proton\Proton VPN
FileKey1=%LocalAppData%\Proton\Proton VPN\Logs|*.txt
FileKey2=%ProgramData%\ProtonVPN\Logs|*|REMOVESELF
FileKey3=%ProgramData%\ProtonVPN\UpdaterLogs|*|REMOVESELF

[PS3 Media Server *]
LangSecRef=3023
Detect=HKCU\Software\PS3 Media Server
FileKey1=%ProgramFiles%\PS3 Media Server|*.md;*log|RECURSE

[Psi *]
LangSecRef=3022
Detect=HKCU\Software\psi-im.org\Psi
DetectFile=%LocalAppData%\Psi+
FileKey1=%LocalAppData%\Psi+\Avatars|*|RECURSE
FileKey2=%UserProfile%\PsiData\avatars|*

[Psi Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\psi-im.org\Psi
DetectFile=%LocalAppData%\Psi+
FileKey1=%AppData%\Psi+\profiles\*\history|*|RECURSE
FileKey2=%UserProfile%\PsiData\profiles\*\history|*

[PSoC Designer 5.4 *]
LangSecRef=3021
DetectFile=%AppData%\Cypress_Semiconductor\PSoC_Designer_54
FileKey1=%AppData%\Cypress_Semiconductor\PSoC_Designer_54|debug.log*

[PSPad *]
LangSecRef=3024
DetectFile=%AppData%\PSpad
FileKey1=%AppData%\PSpad|Recent.ini

[PUBG Lite *]
Section=Games
DetectFile=%ProgramFiles%\PUBGLite
FileKey1=%ProgramFiles%\PUBGLite|*.log

[PunkBuster *]
Section=Games
DetectFile=%LocalAppData%\PunkBuster
FileKey1=%LocalAppData%\PunkBuster|pbcl.log|RECURSE
FileKey2=%WinDir%\System32\LogFiles\PunkBuster|*

[Puran Defrag *]
LangSecRef=3024
Detect=HKLM\Software\Puran Software\Puran Defrag
FileKey1=%ProgramFiles%\Puran Defrag|PuranDefrag.html

[Puran Delete Empty Folders *]
LangSecRef=3024
Detect=HKLM\Software\Puran Software\Delete Empty Folders
RegKey1=HKLM\Software\Puran Software\Delete Empty Folders|Drives
RegKey2=HKLM\Software\Wow6432Node\Puran Software\Delete Empty Folders|Drives

[Puran Fix Shortcuts *]
LangSecRef=3024
Detect=HKLM\Software\Puran Software\Fix Shortcuts
RegKey1=HKLM\Software\Puran Software\Fix Shortcuts|Drives
RegKey2=HKLM\Software\Wow6432Node\Puran Software\Fix Shortcuts|Drives

[Pure Networks *]
LangSecRef=3022
Detect=HKCU\Software\Pure Networks
FileKey1=%ProgramData%\Pure Networks\Log|*
FileKey2=%ProgramData%\Pure Networks\Platform|*.bak
FileKey3=%ProgramData%\Pure Networks\Platform\minidumps|*

[PureRa *]
LangSecRef=3024
DetectFile=%SystemDrive%\PureRa.txt
FileKey1=%SystemDrive%|PureRa.txt

[Puritan File Destroyer Elite *]
LangSecRef=3023
Detect=HKCU\Software\Puritan\File Destroyer Elite
FileKey1=%ProgramData%\Puritan\File Destroyer Elite|*.log|RECURSE

[Pushbullet *]
LangSecRef=3022
DetectFile=%AppData%\Pushbullet
FileKey1=%AppData%\Pushbullet\pushbullet|*.log

[PuTTY *]
LangSecRef=3022
DetectFile=%LocalAppData%\NETworkManager\PuTTY*
FileKey1=%LocalAppData%\NETworkManager\PuTTY_Log|*.log

[PySol Fan Club edition *]
Section=Games
DetectFile=%AppData%\PySolFC
FileKey1=%AppData%\PySolFC|comments.dat;statistics.dat
FileKey2=%ProgramFiles%\PySol Fan Club Edition|*.log

[Python *]
LangSecRef=3024
Detect=HKCU\Software\Python
FileKey1=%LocalAppData%\Pip\cache|*|RECURSE
FileKey2=%ProgramFiles%\Python*|*.icns|RECURSE
FileKey3=%SystemDrive%\Python*|*.icns|RECURSE

[qBittorrent *]
LangSecRef=3022
DetectFile=%LocalAppData%\qBittorrent
FileKey1=%LocalAppData%\qBittorrent\cache|*
FileKey2=%LocalAppData%\qBittorrent\logs|*

[Qiqqa *]
LangSecRef=3021
DetectFile=%LocalAppData%\Quantisle\Qiqqa
FileKey1=%LocalAppData%\Quantisle\Qiqqa\Logs|*
FileKey2=%SystemDrive%\Temp|Qiqqa.log

[Qmmp *]
LangSecRef=3023
DetectFile=%UserProfile%\.qmmp
FileKey1=%UserProfile%\.qmmp\cache|*|RECURSE

[QQBrowser Autofill Data & Search Engine Preferences *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|*Web Data
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Tencent\QQBrowser\User Data\AutoFill*|*|REMOVESELF

[QQBrowser Autoplay Preferences *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\MEIPreload|*|REMOVESELF

[QQBrowser Bookmark Backups *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|Bookmarks.bak

[QQBrowser Bookmark Favicons *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%AppData%\Tencent\QQBrowser\BookmarkIcon\files|*|REMOVESELF
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*|favicons*

[QQBrowser Caches *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data|Module Info Cache
FileKey3=%LocalAppData%\Tencent\QQBrowser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Tencent\QQBrowser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Tencent\QQBrowser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Tencent\QQBrowser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Tencent\QQBrowser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Tencent\QQBrowser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Tencent\QQBrowser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Tencent\QQBrowser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Tencent\QQBrowser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Tencent\QQBrowser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Tencent\QQBrowser\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Tencent\QQBrowser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Tencent\QQBrowser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Tencent\QQBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Tencent\QQBrowser\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Tencent\QQBrowser\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Tencent\QQBrowser\User Data\Optimization*|*|REMOVESELF

[QQBrowser Default App Handlers *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|PreferredApps

[QQBrowser Download History *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*\shared_proto_db|*|REMOVESELF

[QQBrowser DRM Data *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\WidevineCdm|*|REMOVESELF

[QQBrowser Extension Cookies *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|Extension Cookies

[QQBrowser Pinned Tabs *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
RegKey1=HKCU\Software\Tencent\QQBrowser\PreferenceMACs\Default|pinned_tabs

[QQBrowser Privacy Sandbox *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Tencent\QQBrowser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Tencent\QQBrowser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Tencent\QQBrowser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Tencent\QQBrowser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Tencent\QQBrowser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Tencent\QQBrowser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[QQBrowser Progressive Web Apps *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\Web Applications|*|REMOVESELF

[QQBrowser Saved Usernames & Passwords *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|Login Data*

[QQBrowser Security & Threat Detection *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|DIPS*
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Tencent\QQBrowser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Tencent\QQBrowser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Tencent\QQBrowser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Tencent\QQBrowser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Tencent\QQBrowser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Tencent\QQBrowser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Tencent\QQBrowser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Tencent\QQBrowser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Tencent\QQBrowser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Tencent\QQBrowser\User Data\ZxcvbnData|*|REMOVESELF

[QQBrowser Shopping Insights *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Tencent\QQBrowser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Tencent\QQBrowser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Tencent\QQBrowser\User Data\*\parcel_tracking_db|*|REMOVESELF

[QQBrowser Storage Quota Manager *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|QuotaManager

[QQBrowser Sync Data *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\Sync Data|*|REMOVESELF

[QQBrowser Telemetry *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%AppData%\Tencent\Logs|*|REMOVESELF
FileKey2=%AppData%\Tencent\QQBrowser\*log|*.log
FileKey3=%LocalAppData%\Tencent\QQBrowser\Application|debug.log
FileKey4=%LocalAppData%\Tencent\QQBrowser\Application\SetupMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\Tencent\QQBrowser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey6=%LocalAppData%\Tencent\QQBrowser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey7=%LocalAppData%\Tencent\QQBrowser\User Data\*|*.log
FileKey8=%LocalAppData%\Tencent\QQBrowser\User Data\*\DataSharing|*|REMOVESELF
FileKey9=%LocalAppData%\Tencent\QQBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey10=%LocalAppData%\Tencent\QQBrowser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey11=%LocalAppData%\Tencent\QQBrowser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey12=%LocalAppData%\Tencent\QQBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey13=%LocalAppData%\Tencent\QQBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey14=%LocalAppData%\Tencent\QQBrowser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey15=%LocalAppData%\Tencent\QQBrowser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey16=%LocalAppData%\Tencent\QQBrowser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey17=%LocalAppData%\Tencent\QQBrowser\User Data\Crash Reports|*|REMOVESELF
FileKey18=%LocalAppData%\Tencent\QQBrowser\User Data\Crashpad|*|REMOVESELF
FileKey19=%LocalAppData%\Tencent\QQBrowser\User Data\Local Traces|*|REMOVESELF
FileKey20=%LocalAppData%\Tencent\QQBrowser\User Data\OriginTrials|*|REMOVESELF
FileKey21=%LocalAppData%\Tencent\QQBrowser\User Data\Stability|*|REMOVESELF
FileKey22=%ProgramFiles%\Tencent\QQBrowser\Application|debug.log
FileKey23=%ProgramFiles%\Tencent\QQBrowser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Tencent\QQBrowser\BlBeacon|failed_count
RegKey2=HKCU\Software\Tencent\QQBrowser\BlBeacon|state
RegKey3=HKCU\Software\Tencent\QQBrowser\Installer|LastChecked
RegKey4=HKCU\Software\Tencent\QQBrowser\StabilityMetrics

[QQBrowser Web Browsing Cookies *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\Network|Cookies*;Device Bound Sessions*

[QQBrowser Web Browsing History *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[QQBrowser Web Browsing Session *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*\Sessions|*|REMOVESELF

[QQBrowser Web Storage *]
Section=Tencent QQBrowser Web Browser
DetectFile=%LocalAppData%\Tencent\QQBrowser\User Data
FileKey1=%LocalAppData%\Tencent\QQBrowser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Tencent\QQBrowser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Tencent\QQBrowser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Tencent\QQBrowser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Tencent\QQBrowser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Tencent\QQBrowser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Tencent\QQBrowser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Tencent\QQBrowser\User Data\*\WebStorage|*|REMOVESELF

[Qt Framework *]
LangSecRef=3021
Detect1=HKCU\Software\QtProject
Detect2=HKCU\Software\Trolltech
DetectFile=%LocalAppData%\cache\qtshadercache*
FileKey1=%LocalAppData%\cache\qtshadercache*|*
RegKey1=HKCU\Software\QtProject\OrganizationDefaults\FileDialog|history
RegKey2=HKCU\Software\QtProject\OrganizationDefaults\FileDialog|lastVisited
RegKey3=HKCU\Software\Trolltech\OrganizationDefaults

[QTranslate *]
LangSecRef=3021
DetectFile=%AppData%\QTranslate
FileKey1=%AppData%\QTranslate|History.json

[QTTabBar *]
LangSecRef=3024
Detect=HKCU\Software\Quizo\QTTabBar
FileKey1=%AppData%\QTTabBar|*.log
RegKey1=HKCU\Software\Quizo\QTTabBar|TabsOnLastClosedWindow
RegKey2=HKCU\Software\Quizo\QTTabBar\Cache
RegKey3=HKCU\Software\Quizo\QTTabBar\RecentFiles
RegKey4=HKCU\Software\Quizo\QTTabBar\RecentlyClosed

[Qualcomm Atheros Driver *]
LangSecRef=3024
Detect=HKLM\Software\Atheros
FileKey1=%CommonProgramFiles%\Atheros|InstallLog.txt
FileKey2=%CommonProgramFiles%\Qualcomm|InstallLog.txt
FileKey3=%CommonProgramFiles%\Qualcomm Atheros|*.log
FileKey4=%LocalAppData%\Atheros\DirectConnect|*.log
FileKey5=%ProgramData%\Atheros|*.log|RECURSE
FileKey6=%ProgramData%\Qualcomm Atheros WiFi Driver Installation|*.Log|RECURSE

[Quest3D *]
LangSecRef=3021
DetectFile=%AppData%\Quest3D
FileKey1=%AppData%\Quest3D\Lumion*|WriteErrorLog

[QuickDic *]
LangSecRef=3021
DetectFile=%ProgramFiles%\QuickDic
FileKey1=%ProgramFiles%\QuickDic|QuickDic.ini

[Quicken WillMaker Plus *]
LangSecRef=3021
DetectFile=%LocalAppData%\Quicken WillMaker Plus*
FileKey1=%LocalAppData%\Quicken WillMaker Plus *|web update log.txt

[QuickFind Autoplay Repair *]
LangSecRef=3024
Detect=HKCU\Software\APR
DetectFile=%ProgramFiles%\Autoplay Repair
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED
RegKey3=HKLM\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED
RegKey4=HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED

[QuickPAR *]
LangSecRef=3024
Detect=HKCU\Software\QuickPar
FileKey1=%LocalAppData%\QuickPar|*

[QuickTime Player *]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.\QuickTime
RegKey1=HKLM\Software\Apple Computer, Inc.\QuickTime\Favorite Movies
RegKey2=HKLM\Software\Apple Computer, Inc.\QuickTime\Recent Movies
RegKey3=HKLM\Software\Wow6432Node\Apple Computer, Inc.\QuickTime\Favorite Movies
RegKey4=HKLM\Software\Wow6432Node\Apple Computer, Inc.\QuickTime\Recent Movies

[Qurb4 *]
LangSecRef=3021
DetectFile=%LocalAppData%\Qurb4
FileKey1=%LocalAppData%\Qurb4|*.log|RECURSE

[qutIM *]
LangSecRef=3022
Detect=HKCU\Software\qutIM
FileKey1=%AppData%\qutIM\avatars\*|*|RECURSE

[qutIM Chat History *]
LangSecRef=3022
Detect=HKCU\Software\qutIM
FileKey1=%AppData%\qutIM\history|*|RECURSE

[QwertyLab RunAsSystem *]
LangSecRef=3024
Detect=HKCU\Software\QwertyLab\RunAsSystem
RegKey1=HKCU\Software\QwertyLab\RunAsSystem\mru

[R-Wipe & Clean *]
LangSecRef=3024
Detect=HKLM\Software\R-TT\RWC
FileKey1=%AppData%\R-TT|*|RECURSE
FileKey2=%SystemDrive%|*.sys.rwc
FileKey3=%WinDir%\SoftwareDistribution|*.log.rwc
ExcludeKey1=PATH|%AppData%\R-TT\RWC\WL\|*

[RadeonPro *]
LangSecRef=3024
DetectFile=%AppData%\RadeonPro
FileKey1=%AppData%\RadeonPro|*.bak*;*.bkp;*.old
FileKey2=%AppData%\RadeonPro\Cache|*|RECURSE
FileKey3=%AppData%\RadeonPro\Temp|*|RECURSE

[Radialix 2 *]
LangSecRef=3021
Detect=HKCU\Software\Radialix
FileKey1=%ProgramFiles%\Radialix 2|*.txt;*.url;*diz

[RadioBOSS *]
LangSecRef=3022
DetectFile=%AppData%\djsoft.net\RadioBOSS*
FileKey1=%AppData%\djsoft.net\RadioBOSS*|*.bak;*log.txt;nowplaying.txt;~tmp
FileKey2=%AppData%\djsoft.net\RadioBOSS*\log|*log.txt
FileKey3=%AppData%\djsoft.net\RadioBOSS*\profile|*.bak
FileKey4=%AppData%\djsoft.net\RadioBOSS*\report|*.csv
FileKey5=%AppData%\djsoft.net\RadioBOSS*\temp|*

[Rage *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\9200
FileKey1=%AppData%\id software\rage|*|RECURSE

[Rainlendar 2 *]
LangSecRef=3021
DetectFile=%UserProfile%\.rainlendar2
FileKey1=%UserProfile%\.rainlendar2|rainlendar2.log
FileKey2=%UserProfile%\.rainlendar2\backups|*|RECURSE

[Rainmeter *]
LangSecRef=3024
Detect=HKLM\Software\Rainmeter
FileKey1=%AppData%\Rainmeter\Updates|*

[Ranch Rush *]
Section=Games
Detect1=HKLM\Software\Big Fish Games\Persistence\Install\F2580T1L1
Detect2=HKLM\Software\Big Fish Games\Persistence\Install\F5659T1L1
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ranch Rush1.0
DetectFile=%ProgramFiles%\Ranch Rush*
FileKey1=%ProgramData%\FreshGames\RanchRush\*|*.log;temp_data.ssp
FileKey2=%ProgramFiles%\Ranch Rush*|*.html;*.nfo

[Raspberry Pi Imager *]
LangSecRef=3024
DetectFile=%LocalAppData%\Raspberry Pi\Imager
FileKey1=%LocalAppData%\Raspberry Pi\Imager\cache|*.cache
FileKey2=%LocalAppData%\Raspberry Pi\Imager\cache\*|*

[RAV Antivirus *]
LangSecRef=3021
DetectFile=%AppData%\rav-antivirus-client
FileKey1=%AppData%\rav-antivirus-client|*.old;LOG;Network Persistent State|RECURSE
FileKey2=%AppData%\rav-antivirus-client\*Cache|*
FileKey3=%AppData%\rav-antivirus-client\blob_storage|*|RECURSE
FileKey4=%AppData%\rav-antivirus-client\Partitions\*|Network Persistent State
FileKey5=%AppData%\rav-antivirus-client\Partitions\*\*Cache|*
FileKey6=%AppData%\rav-antivirus-client\Partitions\*\blob_storage|*|RECURSE

[Rayman Legends *]
Section=Games
DetectFile=%ProgramFiles%\Rayman Legends
FileKey1=%ProgramFiles%\Rayman Legends\_CommonRedist|*|REMOVESELF

[Razer *]
LangSecRef=3024
DetectFile=%ProgramData%\Razer
FileKey1=%LocalAppData%\Razer\*\*Cache|*
FileKey2=%LocalAppData%\Razer\*\Log*|*|RECURSE
FileKey3=%LocalAppData%\Razer\*\Settings|GACache.bin
FileKey4=%ProgramData%\Razer\*|DiagnoseReport*.txt
FileKey5=%ProgramData%\Razer\*\*Cache|*
FileKey6=%ProgramData%\Razer\*\Accounts\*\DataSync|SyncDate.txt
FileKey7=%ProgramData%\Razer\*\Log*|*|RECURSE
FileKey8=%ProgramData%\Razer\*\ProductUpdates\Downloads|*
FileKey9=%ProgramFiles%\Razer\*|*.log

[RCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RCleaner
FileKey1=%ProgramFiles%\RCleaner|log.txt

[Real Network Monitor *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Real Network Monitor
FileKey1=%ProgramFiles%\Real Network Monitor|*.xml

[Realms of Arkania: Blade of Destiny *]
Section=Games
DetectFile=%UserProfile%\Documents\BladeofDestiny
FileKey1=%UserProfile%\Documents\BladeofDestiny\Consolelog|*|RECURSE

[Realore Whiterra Roads of Rome NG *]
Section=Games
DetectFile=%AppData%\Realore Whiterra Roads of Rome NG
FileKey1=%AppData%\Realore Whiterra Roads of Rome NG|log.txt

[RealPlayer *]
LangSecRef=3023
DetectFile=%AppData%\Real\RealPlayer
FileKey1=%AppData%\Real\Real*Player|cookies.txt;ctd.dat;RealPlayer-log.txt;realplayer.ste
FileKey2=%AppData%\Real\Real*Player\History|*
FileKey3=%AppData%\Real\RealPlayer\db|*|RECURSE
FileKey4=%AppData%\Real\RealPlayer\ErrorLogs|*
FileKey5=%AppData%\Real\RealPlayer\Temp|*
FileKey6=%AppData%\Real\RealPlayer\ThumbsCache|*|RECURSE
FileKey7=%AppData%\Real\RealPlayer\WatchFolders|*.log;*_scan*|RECURSE
FileKey8=%AppData%\Real\RPDS\Cache|*|RECURSE
FileKey9=%AppData%\Real\Update|Update-log.txt
FileKey10=%AppData%\Real\Update\Temp|*|RECURSE
FileKey11=%LocalAppData%\Real\RealPlayer|*.db-shm;*.db-wal
FileKey12=%LocalAppData%\Real\RealPlayer\Content\images|*.jpg
FileKey13=%LocalAppData%\Real\RealPlayer\EBWebview|*
FileKey14=%LocalAppData%\Real\RealPlayer\EBWebview\Default\Cache\Cache_Data|*
FileKey15=%LocalAppData%\Real\RealPlayer\EBWebview\Default\Code Cache\js|*
FileKey16=%ProgramData%\Real\RealPlayer|*-log.txt;S-*
FileKey17=%ProgramData%\Real\RPDS\Content\images|*.jpg
FileKey18=%ProgramData%\Real\RPDS\Logs|*.log*
FileKey19=%ProgramData%\Real\Update_OB|RealPlayer-log.txt
FileKey20=%ProgramData%\RPDS\Content\images|*.jpg
FileKey21=%ProgramFiles%\Real\RealPlayer\common|cookies.txt
FileKey22=%ProgramFiles%\Real\RealPlayer\RPDS|install.log
FileKey23=%WinDir%|cdplayer.ini
RegKey1=HKCU\Software\RealNetworks\RealJukebox\1.0\Preferences\WatchFolders
ExcludeKey1=PATH|%AppData%\Real\RealPlayer\WatchFolders\|*scan.out

[Realtek *]
LangSecRef=3024
Detect=HKLM\Software\Realtek
FileKey1=%ProgramData%\Realtek|*.log
FileKey2=%ProgramFiles%\Realtek*|*.*log;*.txt|RECURSE
FileKey3=%ProgramFiles%\Temp|*|REMOVESELF
FileKey4=%SystemDrive%|RHDSetup.log
ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\|InstCtrl.txt
ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\|setupctrl.txt

[Recent Files Scanner *]
LangSecRef=3024
Detect=HKCU\Software\Groupwyse Software\Recent Files Scanner
RegKey1=HKCU\Software\Groupwyse Software\Recent Files Scanner\Paths

[Reckless Racing *]
Section=Games
DetectFile=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Recovery Toolbox for Word *]
LangSecRef=3024
DetectFile=%LocalAppData%\Recovery Toolbox for Word
FileKey1=%LocalAppData%\Recovery Toolbox for Word|*.log

[Recuva *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\Recuva
FileKey1=%ProgramData%\Recuva\BurgerData|ActivityData_*.json
FileKey2=%ProgramFiles%\Recuva|*.log;Recuva_log*.txt
FileKey3=%UserProfile%|Recuva_log*.txt

[Red Button *]
LangSecRef=3024
Detect=HKCU\Software\Pothos\Red Button
RegKey1=HKCU\Software\Pothos\Red Button|LastUpdateCheck

[Reflector *]
LangSecRef=3021
DetectFile=%AppData%\Reflector
FileKey1=%AppData%\Reflector|*.dmp;*.log

[Reg Organizer *]
LangSecRef=3024
Detect=HKCU\Software\ChemTable Software\Reg Organizer
FileKey1=%LocalAppData%\ChemTable Software\Reg Organizer|*.log|RECURSE
FileKey2=%ProgramFiles%\Reg Organizer|*.txt

[RegAlyzer *]
LangSecRef=3024
Detect1=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer
Detect2=HKCU\Software\Safer Networking Limited\RegAlyzer
Detect3=HKLM\Software\Safer Networking Limited\HiveManager
FileKey1=%AppData%\Safer Networking\RegAlyzer|history.sqlite
RegKey1=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|LastKey
RegKey2=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|RemoteListHistory
RegKey3=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|SearchTerm
RegKey4=HKCU\Software\Safer Networking Limited\RegAlyzer|LastKey
RegKey5=HKCU\Software\Safer Networking Limited\RegAlyzer|RemoteListHistory
RegKey6=HKCU\Software\Safer Networking Limited\RegAlyzer|SearchTerm

[RegDoctor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegDoctor
FileKey1=%ProgramFiles%\RegDoctor\Backup|log.txt

[RegHance *]
LangSecRef=3024
Detect=HKCU\Software\Lavasoft\Reghance
RegKey1=HKCU\Software\Lavasoft\Reghance|Last key
RegKey2=HKCU\Software\Lavasoft\Reghance|LastBkmfile
RegKey3=HKCU\Software\Lavasoft\Reghance|Recentkeys
RegKey4=HKCU\Software\Lavasoft\Reghance|Repltext

[RegHunter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Enigma Software Group\RegHunter
FileKey1=%ProgramFiles%\Enigma Software Group\RegHunter\Log|*

[Registrar Registry Manager *]
LangSecRef=3024
Detect=HKCU\Software\Resplendence Sp\Registrar Registry Manager
RegKey1=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|ExportForm.saveDialogExportFilename
RegKey2=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|ExportForm.saveDialogExportInitialDir
RegKey3=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|LastOpenedKey

[Registry Corrector *]
LangSecRef=3024
DetectFile=%AppData%\RegCorrector
FileKey1=%AppData%\RegCorrector|RegCorrector_Undo_*.reg

[Registry Crawler *]
LangSecRef=3024
Detect=HKLM\Software\4Developers\RCrawler
RegKey1=HKLM\Software\4Developers\RCrawler\History
RegKey2=HKLM\Software\4Developers\RCrawler\Settings|LastSearch

[Registry Drill *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easy Desk Utilities\Registry Drill
FileKey1=%ProgramFiles%\Easy Desk Utilities\Registry Drill|*.log
FileKey2=%WinDir%\System32\config|Regdrill Compact.txt

[Registry Finder *]
LangSecRef=3024
DetectFile=%AppData%\RegistryFinder
FileKey1=%AppData%\RegistryFinder|RegCountCache.json
FileKey2=%AppData%\RegistryFinder\UndoHistory|*
FileKey3=%AppData%\RegistryFinder\UnsentCrashReports\Logs|*
FileKey4=%ProgramFiles%\Registry Finder|RegistryFinder.log

[Registry First Aid *]
LangSecRef=3024
Detect=HKCU\Software\KsL Software\RFA
FileKey1=%LocalAppData%\Microsoft\Windows|NTUSER.tmp;UsrClass.tmp
FileKey2=%UserProfile%|NTUSER.tmp;UsrClass.tmp
FileKey3=%WinDir%\ServiceProfiles\*Service|*.tmp*
FileKey4=%WinDir%\System32\config|*.tmp*
FileKey5=%WinDir%\System32\config\systemprofile|*.tmp*
FileKey6=%WinDir%\SysWOW64\config\systemprofile|*.tmp*

[Registry Help Pro *]
LangSecRef=3024
DetectFile=%AppData%\Registry Help Pro
FileKey1=%AppData%\Registry Help Pro|*Log.txt

[Registry Recon *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Arsenal Recon\Registry Recon
FileKey1=%ProgramFiles%\Arsenal Recon\Registry Recon|RegistryRecon.db
FileKey2=%ProgramFiles%\Arsenal Recon\Registry Recon\Log|*.log
FileKey3=%ProgramFiles%\Arsenal Recon\Registry Recon\OutputData|*.log|RECURSE

[Registry Recovery Toolbox *]
LangSecRef=3024
Detect=HKCU\Software\Registry Recovery Toolbox
FileKey1=%LocalAppData%\Recovery Toolbox for Registry|*.log
FileKey2=%LocalAppData%\Registry Recovery Toolbox|*.log
RegKey1=HKCU\Software\Registry Recovery Toolbox\List Source Registry Files Ext

[Registry Winner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Registry Winner
FileKey1=%ProgramFiles%\Registry Winner|*.bak

[RegistryFix *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegistryFix
FileKey1=%ProgramFiles%\RegistryFix\logs|*

[RegScrubVistaXP *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegScrubVistaXP
FileKey1=%ProgramFiles%\RegScrubVistaXP|*.reg;*.rsf;RegEditX.sav

[RegServo *]
LangSecRef=3024
DetectFile=%ProgramData%\regservo
FileKey1=%ProgramData%\regservo\Logs|*|RECURSE

[RegToBat *]
LangSecRef=3024
Detect=HKLM\Software\BlueLife\RegToBat
RegKey1=HKLM\Software\BlueLife\RegToBat|LastRegFile

[RegVac Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegVac Registry Cleaner
FileKey1=%ProgramFiles%\RegVac Registry Cleaner|*.xml;cantremove.txt;Undo*.reg
FileKey2=%WinDir%\System32\RegVac|*|REMOVESELF

[RegWork *]
LangSecRef=3021
DetectFile=%ProgramFiles%\RegWork
FileKey1=%ProgramFiles%\RegWork\Logs|*
FileKey2=%ProgramFiles%\RegWork\Tmp|*

[Reign: Conflict of Nations *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\46380
FileKey1=%LocalAppData%\1C\Reign Conflict of Nations|PSPLog.log

[Remo Repair PowerPoint *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Remo Repair PowerPoint*
FileKey1=%ProgramFiles%\Remo Repair PowerPoint*|*.LOG

[Rename Expert *]
LangSecRef=3024
DetectFile=%AppData%\Rename Expert
FileKey1=%AppData%\Rename Expert\*\Logs|*
FileKey2=%AppData%\Rename Expert\*\Restore|*.xml

[Rename Us *]
LangSecRef=3024
Detect=HKCU\Software\Vitaliy Levchenko\Renamus
RegKey1=HKCU\Software\Vitaliy Levchenko\Renamus\Recent Projects
RegKey2=HKCU\Software\Vitaliy Levchenko\Renamus\Settings|LastFolder

[Renault Media Nav Evolution Toolbox *]
LangSecRef=3021
DetectFile=%AppData%\RenaultAutomotive
FileKey1=%AppData%\RenaultAutomotive\log|*
FileKey2=%AppData%\RenaultAutomotive\tmp|*|RECURSE

[Replay Media Catcher *]
LangSecRef=3022
Detect=HKLM\Software\Applian Technologies\Replay Media Catcher 5
DetectFile=%AppData%\Replay Media Catcher 4
FileKey1=%AppData%\Replay Media Catcher 4|*.log
FileKey2=%AppData%\Replay Media Catcher 4\History|*|REMOVESELF
FileKey3=%LocalAppData%\Replay Media Catcher 5\History|*|REMOVESELF
FileKey4=%LocalAppData%\Replay Media Catcher 5\Temp|*|REMOVESELF
FileKey5=%LocalAppData%\Replay Media Catcher 5\UrlCache|*|REMOVESELF
FileKey6=%ProgramFiles%\Applian Technologies\Replay Media Catcher*|*.html;*.rtf;*.txt

[Resilio Sync *]
LangSecRef=3024
DetectFile1=%AppData%\BitTorrent Sync
DetectFile2=%AppData%\Resilio Sync
FileKey1=%AppData%\BitTorrent Sync|*.log;*.old
FileKey2=%AppData%\Resilio Sync|*.journal;*.journal.zip;*.log;*.old;history.dat

[Resource Hacker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Resource Hacker
FileKey1=%ProgramFiles%\Resource Hacker|reshacker.GID;ResHacker.ini

[Respondus *]
LangSecRef=3021
DetectFile=%LocalAppData%\Respondus
FileKey1=%LocalAppData%\Respondus\Cache|LOG;LOG.old;Network Persistent State;Visited Links|RECURSE
FileKey2=%LocalAppData%\Respondus\Cache\*Cache|*|RECURSE
FileKey3=%LocalAppData%\Respondus\Cache\blob_storage|*|RECURSE

[Restorator 2007 *]
LangSecRef=3021
Detect=HKCU\Software\Bomers\Restorator
RegKey1=HKCU\Software\Bomers\Restorator\Restorator\Current|LastSearchString
RegKey2=HKCU\Software\Bomers\Restorator\Restorator\FindDialog
RegKey3=HKCU\Software\Bomers\Restorator\Restorator\GrabDialog
RegKey4=HKCU\Software\Bomers\Restorator\Restorator\LastFoundFiles
RegKey5=HKCU\Software\Bomers\Restorator\Restorator\MRUList

[Restore Point Creator *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{CC48DE1C-8EC2-43BC-9201-29701CD9AE13}_is1
FileKey1=%ProgramData%|Restore Point Creator.log
FileKey2=%ProgramFiles%\Restore Point Creator|*.log;*.txt

[ResumeMaker *]
LangSecRef=3021
DetectFile=%ProgramData%\Individual Software\ResumeMaker
FileKey1=%ProgramData%\Individual Software\ResumeMaker\R12|*.log

[Reus *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\222730
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Reus|errorReport*.txt

[Revenge of the Titans *]
Section=Games
DetectFile=%UserProfile%\.revenge_of_the_titans_1.80
FileKey1=%UserProfile%\.revenge_of_the_titans_1.80|*.log

[Revo Uninstaller Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\VS Revo Group\Revo Uninstaller*
FileKey1=%LocalAppData%\VS Revo Group\Revo Uninstaller*|RUPBackUpData.ini
FileKey2=%LocalAppData%\VS Revo Group\Revo Uninstaller*\BackupsData|*|RECURSE
FileKey3=%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro|*.bak

[Ride! *]
Section=Games
DetectFile=%ProgramFiles%\Ride!
FileKey1=%ProgramFiles%\Ride!|*.log;*.txt|RECURSE
FileKey2=%ProgramFiles%\Ride!\DirectX9|*|REMOVESELF

[Riding Academy 3D *]
Section=Games
Detect=HKCU\Software\Program-Ace\RidingAcademy3D
FileKey1=%LocalAppData%\Riding Academy 3D\logs|*

[Riding Star 3 *]
Section=Games
Detect=HKLM\Software\DTP\Riding Star 3
FileKey1=%ProgramFiles%\Riding Star 3|INSTALL.LOG;log.txt

[RIFT *]
Section=Games
DetectFile=%UserProfile%\Documents\RIFT
FileKey1=%AppData%\RIFT|*.log
FileKey2=%ProgramFiles%\RIFT|*.log
FileKey3=%Public%\Games\RIFT|*.log
FileKey4=%SystemDrive%\RIFT|*.log
FileKey5=%UserProfile%\Documents\RIFT|*.log

[Rift of the NecroDancer *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Brace Yourself Games\Rift of the NecroDancer*
FileKey1=%UserProfile%\AppData\LocalLow\Brace Yourself Games\Rift of the NecroDancer*|*.log

[RimWorld *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\294100
FileKey1=%UserProfile%\AppData\LocalLow\Ludeon Studios\RimWorld by Ludeon Studios|player.log

[Ring Central *]
LangSecRef=3022
DetectFile=%ProgramData%\RingCentral
FileKey1=%ProgramData%\RingCentral\LogFiles|*

[Riot Client *]
Section=Games
DetectFile=%LocalAppData%\Riot Games\Riot Client
FileKey1=%AppData%\riot-client-ux|*|RECURSE
FileKey2=%LocalAppData%\Riot Games\Riot Client\Crashes\*\reports|*|RECURSE
FileKey3=%LocalAppData%\Riot Games\Riot Client\Data\Cookies|*
FileKey4=%LocalAppData%\Riot Games\Riot Client\Logs|*|RECURSE

[Riot Vanguard *]
Section=Games
DetectFile=%ProgramFiles%\Riot Vanguard
FileKey1=%ProgramFiles%\Riot Vanguard\Logs|*.log

[Rise Of Legends *]
Section=Games
DetectFile=%AppData%\Microsoft\Rise Of Legends
FileKey1=%AppData%\Microsoft\Rise Of Legends\Logs|*
FileKey2=%AppData%\Microsoft\Rise Of Legends\temp|*|RECURSE

[Rise of Nations *]
Section=Games
Detect1=HKCU\Software\Microsoft\Microsoft Games\Rise of Nations
Detect2=HKCU\Software\Microsoft\Microsoft Games\RiseofNationsExpansion
FileKey1=%AppData%\Microsoft Games\Rise of Nations\Logs|*
FileKey2=%ProgramFiles%\Microsoft Games\Rise of Nations\Logs|*

[Rise of the Tomb Raider *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\391220
FileKey1=%UserProfile%\Documents\Rise of the Tomb Raider|*.log

[Rising Hell *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Tahoe Games\Rising Hell
FileKey1=%UserProfile%\AppData\LocalLow\Tahoe Games\Rising Hell|*txt
FileKey2=%UserProfile%\AppData\LocalLow\Tahoe Games\Rising Hell\Unity|*|REMOVESELF

[Risk of Rain 2 *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Hopoo Games, LLC\Risk of Rain 2
FileKey1=%UserProfile%\AppData\LocalLow\Hopoo Games, LLC\Risk of Rain 2|*.log

[Riverbed AirPcap *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Riverbed\AirPcap\driver
FileKey1=%ProgramFiles%\Riverbed\AirPcap\driver|*.log

[Rkill *]
LangSecRef=3024
DetectFile1=%UserProfile%\Desktop\Rkill
DetectFile2=%UserProfile%\Desktop\Rkill.txt
FileKey1=%UserProfile%\Desktop|*rkill*.*
FileKey2=%UserProfile%\Desktop\Rkill|*|REMOVESELF

[Roadkil's Unstoppable Copier *]
LangSecRef=3024
Detect=HKCU\Software\Roadkil
RegKey1=HKCU\Software\Roadkil|Source_Unstp
RegKey2=HKCU\Software\Roadkil|Target_Unstp

[Roblox *]
Section=Games
DetectFile=%LocalAppData%\Roblox
FileKey1=%LocalAppData%\Roblox\Downloads|*|RECURSE
FileKey2=%LocalAppData%\Roblox\Logs|*|RECURSE
FileKey3=%ProgramData%\Roblox\Downloads|*|RECURSE
FileKey4=%UserProfile%\AppData\LocalLow\RbxLogs|*|RECURSE

[RoboBasket3 *]
LangSecRef=3024
DetectFile=%AppData%\RoboBasket3
FileKey1=%AppData%\RoboBasket3|log.database

[Roccat Swarm *]
LangSecRef=3024
DetectFile=%AppData%\ROCCAT\SWARM
FileKey1=%AppData%\ROCCAT\SWARM\change_log|*|REMOVESELF
FileKey2=%AppData%\ROCCAT\SWARM\log|*|RECURSE
FileKey3=%ProgramFiles%\ROCCAT\ROCCAT Swarm|log.txt

[Rochard *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\107800
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Rochard\Rochard_Data|Output_log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Recoil Games\Rochard|journal.txt

[Rock of Ages *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\22230
Detect2=HKLM\Software\ACE Team\Rock of Ages
FileKey1=%ProgramFiles%\ATLUS\Rock of Ages\Prerequisites|*|REMOVESELF
FileKey2=%ProgramFiles%\Steam\steamapps\common\Rock of Ages\Prerequisites|*|REMOVESELF

[Rocket League *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252950
FileKey1=%UserProfile%\Documents\My Games\Rocket League\TAGame\Cache\WebCache|*
FileKey2=%UserProfile%\Documents\My Games\Rocket League\TAGame\Logs|*

[rocksdanister Lively Wallpaper *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy
FileKey1=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\LocalCache\Local\Lively Wallpaper\logs|*
FileKey3=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\LocalCache\Local\Lively Wallpaper\UI|*.txt
FileKey4=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\LocalCache\Local\Lively Wallpaper\WebView2|*|RECURSE
FileKey5=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\Settings|*.log*
FileKey6=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\12030rocksdanister.LivelyWallpaper_97hta09mmv6hy\TempState|*|REMOVESELF

[Rockstar Games Launcher *]
Section=Games
DetectFile=%UserProfile%\Documents\Rockstar Games
FileKey1=%UserProfile%\Documents\Rockstar Games\Launcher|*.log
FileKey2=%UserProfile%\Documents\Rockstar Games\Social Club|*.log

[RoGlass *]
Section=Games
DetectFile=%LocalAppData%\RoGlass
FileKey1=%LocalAppData%\RoGlass|*cache
FileKey2=%LocalAppData%\RoGlass\Logs|*

[Roland Cloud Manager *]
LangSecRef=3023
DetectFile=%AppData%\Roland Cloud\Cloud Manager
FileKey1=%AppData%\Roland Cloud\Cache\WebEngineCache|Visited Links
FileKey2=%AppData%\Roland Cloud\Cache\WebEngineCache\*Cache|*
FileKey3=%AppData%\Roland Cloud\Cache\WebEngineCache\blob_storage|*|RECURSE
FileKey4=%AppData%\Roland Cloud\Cloud Manager|*.log
FileKey5=%AppData%\Roland Cloud\concerto\breakpad\dumps|*.dmp
FileKey6=%AppData%\Roland Cloud\rcmhelper|*.log
FileKey7=%AppData%\Roland Cloud\rcmservice|*.log
FileKey8=%AppData%\Roland Cloud\shared|*.log
FileKey9=%LocalAppData%\Roland Cloud\Cloud Manager*\Cache\QtWebEngine\Default\Cache|*
FileKey10=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default|*-journal;*.old;LOG;QuotaManager;Visited Links|RECURSE
FileKey11=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default\*Cache|*|RECURSE
FileKey12=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default\blob_storage|*|RECURSE
FileKey13=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default\VideoDecodeStats|*

[ROLI Connect *]
LangSecRef=3023
DetectFile=%AppData%\ROLI Connect
FileKey1=%AppData%\ROLI Connect|*-journal;log.log;Network Persistent State
FileKey2=%AppData%\ROLI Connect\*Cache|*|RECURSE
FileKey3=%AppData%\ROLI Connect\__update__|*Setup*.exe
FileKey4=%AppData%\ROLI Connect\Logs|*

[RollBack Rx *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Shield
FileKey1=%ProgramFiles%\Shield|*.log

[ROM With a View - Director's Cut *]
LangSecRef=3023
Detect=HKCU\Software\Moon Valley Software
RegKey1=HKCU\Software\Moon Valley Software\CD Ultra\Recent File List
RegKey2=HKCU\Software\Moon Valley Software\ROM With a View - Director's Cut\Recent File List

[Romain Petges Attribute Changer *]
LangSecRef=3024
Detect1=HKCU\Software\Attribute Changer
Detect2=HKCU\Software\Romain's Software\Attribute Changer
RegKey1=HKCU\Software\Attribute Changer\File Settings|!DTDateMax
RegKey2=HKCU\Software\Attribute Changer\File Settings|!DTDateMin
RegKey3=HKCU\Software\Attribute Changer\File Settings|!DTTimeMax
RegKey4=HKCU\Software\Attribute Changer\File Settings|!DTTimeMin
RegKey5=HKCU\Software\Attribute Changer\File Settings|AccessedValue
RegKey6=HKCU\Software\Attribute Changer\File Settings|CreatedValue
RegKey7=HKCU\Software\Attribute Changer\File Settings|LimitDateMax
RegKey8=HKCU\Software\Attribute Changer\File Settings|LimitDateMin
RegKey9=HKCU\Software\Attribute Changer\File Settings|LimitTimeMax
RegKey10=HKCU\Software\Attribute Changer\File Settings|LimitTimeMin
RegKey11=HKCU\Software\Attribute Changer\File Settings|ModifiedValue
RegKey12=HKCU\Software\Attribute Changer\File Settings|PhotoValue
RegKey13=HKCU\Software\Attribute Changer\File Settings|RandomDateMax
RegKey14=HKCU\Software\Attribute Changer\File Settings|RandomDateMin
RegKey15=HKCU\Software\Attribute Changer\File Settings|RandomTimeMax
RegKey16=HKCU\Software\Attribute Changer\File Settings|RandomTimeMin
RegKey17=HKCU\Software\Attribute Changer\Folder Settings|!DTDateMax
RegKey18=HKCU\Software\Attribute Changer\Folder Settings|!DTDateMin
RegKey19=HKCU\Software\Attribute Changer\Folder Settings|!DTTimeMax
RegKey20=HKCU\Software\Attribute Changer\Folder Settings|!DTTimeMin
RegKey21=HKCU\Software\Attribute Changer\Folder Settings|AccessedValue
RegKey22=HKCU\Software\Attribute Changer\Folder Settings|CreatedValue
RegKey23=HKCU\Software\Attribute Changer\Folder Settings|LimitDateMax
RegKey24=HKCU\Software\Attribute Changer\Folder Settings|LimitDateMin
RegKey25=HKCU\Software\Attribute Changer\Folder Settings|LimitTimeMax
RegKey26=HKCU\Software\Attribute Changer\Folder Settings|LimitTimeMin
RegKey27=HKCU\Software\Attribute Changer\Folder Settings|ModifiedValue
RegKey28=HKCU\Software\Attribute Changer\Folder Settings|RandomDateMax
RegKey29=HKCU\Software\Attribute Changer\Folder Settings|RandomDateMin
RegKey30=HKCU\Software\Attribute Changer\Folder Settings|RandomTimeMax
RegKey31=HKCU\Software\Attribute Changer\Folder Settings|RandomTimeMin
RegKey32=HKCU\Software\Attribute Changer\Global Settings|OtherExport
RegKey33=HKCU\Software\Romain's Software\Attribute Changer\File Settings|AccessedDT
RegKey34=HKCU\Software\Romain's Software\Attribute Changer\File Settings|CreatedDT
RegKey35=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMaxDate
RegKey36=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMaxTime
RegKey37=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMinDate
RegKey38=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMinTime
RegKey39=HKCU\Software\Romain's Software\Attribute Changer\File Settings|ModifiedDT
RegKey40=HKCU\Software\Romain's Software\Attribute Changer\File Settings|PictureDT
RegKey41=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMaxDate
RegKey42=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMaxTime
RegKey43=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMinDate
RegKey44=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMinTime
RegKey45=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RLowerDT
RegKey46=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RUpperDT
RegKey47=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|AccessedDT
RegKey48=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|CreatedDT
RegKey49=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMaxDate
RegKey50=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMaxTime
RegKey51=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMinDate
RegKey52=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMinTime
RegKey53=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|ModifiedDT
RegKey54=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMaxDate
RegKey55=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMaxTime
RegKey56=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMinDate
RegKey57=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMinTime
RegKey58=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RLowerDT
RegKey59=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RUpperDT
RegKey60=HKCU\Software\Romain's Software\Attribute Changer\Global Settings|PFolderFilter

[Router Port Forwarding *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Router Port Forwarding
FileKey1=%ProgramFiles%\Router Port Forwarding\bin\log|*.log

[Roxio *]
LangSecRef=3021
Detect=HKCU\Software\Roxio
FileKey1=%AppData%\Roxio|*.log;*Log.txt
FileKey2=%AppData%\Roxio Burn\Temp|*|RECURSE
FileKey3=%AppData%\Roxio Log Files|*|RECURSE
FileKey4=%AppData%\Roxio\Dragon\3.x\*Logs|*.log
FileKey5=%AppData%\Roxio\Dragon\3.x\DiscInfoCache|*.tmp
FileKey6=%AppData%\Roxio\MediaManager*|ItemThumbnails.dat
FileKey7=%LocalAppData%|rx_*.Cache
FileKey8=%ProgramData%\Roxio|*.log;cardinfo.*
FileKey9=%WinDir%\System32\config\systemprofile\AppData\Roaming\Roxio Log Files|*|RECURSE
FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Roxio Log Files|*|RECURSE

[Roxio Creator Pro *]
LangSecRef=3021
Detect1=HKCU\Software\Roxio\EMC13
Detect2=HKCU\Software\Roxio\EMC14
FileKey1=%UserProfile%\Documents\Roxio\Music Disc Creator|*
RegKey1=HKCU\Software\Roxio\EMC13\VideoUI\RecentFiles\Catalogs
RegKey2=HKCU\Software\Roxio\EMC14\Label Creator\Recent File List
RegKey3=HKCU\Software\Roxio\EMC14\MusicDiscCreator\Directories
RegKey4=HKCU\Software\Roxio\EMC14\MusicDiscCreator\MediaSelector
RegKey5=HKCU\Software\Roxio\EMC14\PhotoSuite\RoxioPhotoSuite\MRUFiles
RegKey6=HKCU\Software\Roxio\EMC14\SoundEdit\Directories
RegKey7=HKCU\Software\Roxio\EMC14\SoundEdit\MediaSelector
RegKey8=HKCU\Software\Roxio\EMC14\SoundEdit\WaveCache
RegKey9=HKCU\Software\Roxio\EMC14\VideoConvert\Directories
RegKey10=HKCU\Software\Roxio\EMC14\VideoConvert\MediaSelector
RegKey11=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Albums
RegKey12=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Catalogs
RegKey13=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\DVD Projects
RegKey14=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Productions
RegKey15=HKLM\Software\Roxio\EMC13\Common SDK\Users
RegKey16=HKLM\Software\Roxio\EMC14\Common SDK\Users
RegKey17=HKLM\Software\Wow6432Node\Roxio\EMC13\Common SDK\Users
RegKey18=HKLM\Software\Wow6432Node\Roxio\EMC14\Common SDK\Users

[RPKG *]
LangSecRef=3024
DetectFile=%LocalAppData%\rpkg
FileKey1=%LocalAppData%\rpkg\db|*.old;LOG

[RssBandit *]
LangSecRef=3022
DetectFile=%AppData%\RssBandit
FileKey1=%AppData%\RssBandit|*.bak;*.log

[rtmpGUI *]
LangSecRef=3024
DetectFile=%UserProfile%\.swfinfo
FileKey1=%UserProfile%|.swfinfo

[Rust *]
Section=Games
DetectFile=%ProgramFiles%\Steam\SteamApps\Common\Rust
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Rust|debug_steamclient.txt;output_log.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Rust\temp|*
FileKey3=%UserProfile%\AppData\LocalLow\Facepunch Studios LTD\Rust\Unity|*|REMOVESELF

[RuTracker Proxy *]
LangSecRef=3022
DetectFile=%AppData%\rto-proxy
FileKey1=%AppData%\rto-proxy|*-journal
FileKey2=%AppData%\rto-proxy\*Cache|*|RECURSE

[SABnzbd *]
LangSecRef=3021
DetectFile=%LocalAppData%\sabnzbd
FileKey1=%LocalAppData%\SABnzbd|*.bak
FileKey2=%LocalAppData%\sabnzbd\admin|history1.db;totals9.sab
FileKey3=%LocalAppData%\sabnzbd\logs|*

[Safe Watch *]
LangSecRef=3022
DetectFile=%UserProfile%\AppData\LocalLow\Safe-Watch-Updater
FileKey1=%UserProfile%\AppData\LocalLow\Safe-Watch-Updater|*.exe

[Sage ACT! *]
LangSecRef=3021
Detect=HKLM\Software\ACT
FileKey1=%ProgramData%\Sage Software, Inc\ACT! by Sage\ActUpdate|*|RECURSE

[Sage Simply Accounting *]
LangSecRef=3021
Detect=HKLM\Software\Sage Software\Simply Accounting
FileKey1=%ProgramData%\Sage Software\Simply Accounting\Download|*|RECURSE

[SageThumbs *]
LangSecRef=3021
DetectFile=%ProgramFiles%\SageThumbs\64\SageThumbs.dll
FileKey1=%LocalAppData%|SageThumbs.*

[SAM Broadcaster *]
LangSecRef=3023
Detect=HKCU\Software\SAMBC
FileKey1=%LocalAppData%\SpacialAudio\SAMBC|*.log|RECURSE
FileKey2=%LocalAppData%\SpacialAudio\SAMBC\backup|*|RECURSE

[Samsung Account *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g
DetectFile2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccountPluginforSa_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey14=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey32=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey34=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\LocalState\logs|*
FileKey67=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\Settings|*.log*
FileKey68=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey69=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccount_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey70=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccountPluginforSa_3c1yjt4zspk6g\AC|*|RECURSE
FileKey71=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccountPluginforSa_3c1yjt4zspk6g\Settings|*.log*
FileKey72=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccountPluginforSa_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey73=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungAccountPluginforSa_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Air Command *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.AirCommand_wyx1vj98g3asy
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.AirCommand_wyx1vj98g3asy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.AirCommand_wyx1vj98g3asy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.AirCommand_wyx1vj98g3asy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.AirCommand_wyx1vj98g3asy\TempState|*|REMOVESELF

[Samsung Bixby *]
LangSecRef=3021
DetectFile1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g
DetectFile2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungIntelligenceVoiceS_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g\LocalState\Microsoft\AppCenter\Errors|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g\LocalState\Samsung\Bixby\Logs|*.log
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.Bixby_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungIntelligenceVoiceS_3c1yjt4zspk6g\AC|*|RECURSE
FileKey8=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungIntelligenceVoiceS_3c1yjt4zspk6g\Settings|*.log*
FileKey9=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungIntelligenceVoiceS_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungIntelligenceVoiceS_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey11=%ProgramData%\Samsung\Intelligence Voice Service\Logs|*

[Samsung Cloud *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g\LocalState|*.logger
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g\LocalState\logs|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungCloudPlatformManag_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Device Care *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPCCleaner_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPCCleaner_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPCCleaner_3c1yjt4zspk6g\RoamingState\Samsung\SamsungDeviceCare\logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPCCleaner_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPCCleaner_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPCCleaner_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Display Manager *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.432392D72213_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.432392D72213_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.432392D72213_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.432392D72213_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.432392D72213_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Find *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungFind_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungFind_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungFind_3c1yjt4zspk6g\LocalState\logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungFind_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungFind_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungFind_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey6=%ProgramData%\Samsung\SamsungFind\log|*

[Samsung Flow *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungFlux_wyx1vj98g3asy
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungFlux_wyx1vj98g3asy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungFlux_wyx1vj98g3asy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungFlux_wyx1vj98g3asy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungFlux_wyx1vj98g3asy\TempState|*|REMOVESELF

[Samsung Galaxy Book Settings *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.GalaxySetting_wyx1vj98g3asy
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.GalaxySetting_wyx1vj98g3asy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.GalaxySetting_wyx1vj98g3asy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.GalaxySetting_wyx1vj98g3asy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.GalaxySetting_wyx1vj98g3asy\TempState|*|REMOVESELF

[Samsung Galaxy Book Smart Switch *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartSwitchforGalaxyBook_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartSwitchforGalaxyBook_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartSwitchforGalaxyBook_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartSwitchforGalaxyBook_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartSwitchforGalaxyBook_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Galaxy Buds *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.GalaxyBuds_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.GalaxyBuds_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.GalaxyBuds_3c1yjt4zspk6g\LocalState\Logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.GalaxyBuds_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.GalaxyBuds_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.GalaxyBuds_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Gallery *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\LocalState|*.xml
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\LocalState\Logs|*|RECURSE
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\LocalState\TempDownloadFilesService|*|RECURSE
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\Settings|*.log*
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey8=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PCGallery_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Game Link *]
Section=Games
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungVSTLink_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungVSTLink_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungVSTLink_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungVSTLink_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungVSTLink_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey5=%ProgramData%\SamsungVST\Log|*

[Samsung HMD Odyssey Control *]
Section=Games
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.OdysseyControl_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.OdysseyControl_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.OdysseyControl_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.OdysseyControl_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.OdysseyControl_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey5=%ProgramFiles%\Samsung\Odyssey Control|*.tmp

[Samsung HMD Odyssey Experience *]
Section=Games
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyExperien_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyExperien_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyExperien_3c1yjt4zspk6g\LocalState|*.bak
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyExperien_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyExperien_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyExperien_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung HMD Odyssey Home *]
Section=Games
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\LocalState|*.xml
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\LocalState\ContentPackage|*.jpg;*.png
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\Settings|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungHMDOdysseyHome_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Internet Autofill Data & Search Engine Preferences *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|*Web Data
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Samsung\Internet\User Data\AutoFill*|*|REMOVESELF

[Samsung Internet Autoplay Preferences *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\MEIPreload|*|REMOVESELF

[Samsung Internet Bookmark Backups *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|Bookmarks.bak

[Samsung Internet Bookmark Favicons *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|favicons*

[Samsung Internet Caches *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Samsung\Internet\User Data|Module Info Cache
FileKey3=%LocalAppData%\Samsung\Internet\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Samsung\Internet\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Samsung\Internet\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Samsung\Internet\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Samsung\Internet\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Samsung\Internet\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Samsung\Internet\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Samsung\Internet\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Samsung\Internet\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Samsung\Internet\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Samsung\Internet\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Samsung\Internet\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Samsung\Internet\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Samsung\Internet\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Samsung\Internet\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Samsung\Internet\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Samsung\Internet\User Data\Optimization*|*|REMOVESELF

[Samsung Internet Default App Handlers *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|PreferredApps

[Samsung Internet Download History *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*\shared_proto_db|*|REMOVESELF

[Samsung Internet DRM Data *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Samsung\Internet\User Data\WidevineCdm|*|REMOVESELF

[Samsung Internet Extension Cookies *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|Extension Cookies

[Samsung Internet Pinned Tabs *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
RegKey1=HKCU\Software\Samsung\Internet\PreferenceMACs\Default|pinned_tabs

[Samsung Internet Privacy Sandbox *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Samsung\Internet\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Samsung\Internet\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Samsung\Internet\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Samsung\Internet\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Samsung\Internet\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Samsung\Internet\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Samsung Internet Progressive Web Apps *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\Web Applications|*|REMOVESELF

[Samsung Internet Saved Usernames & Passwords *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|Login Data*

[Samsung Internet Security & Threat Detection *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|DIPS*
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Samsung\Internet\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Samsung\Internet\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Samsung\Internet\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Samsung\Internet\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Samsung\Internet\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Samsung\Internet\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Samsung\Internet\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Samsung\Internet\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Samsung\Internet\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Samsung\Internet\User Data\ZxcvbnData|*|REMOVESELF

[Samsung Internet Shopping Insights *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Samsung\Internet\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Samsung\Internet\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Samsung\Internet\User Data\*\parcel_tracking_db|*|REMOVESELF

[Samsung Internet Storage Quota Manager *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|QuotaManager

[Samsung Internet Sync Data *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\Sync Data|*|REMOVESELF

[Samsung Internet Telemetry *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\Application|debug.log
FileKey2=%LocalAppData%\Samsung\Internet\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Samsung\Internet\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Samsung\Internet\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Samsung\Internet\User Data\*|*.log
FileKey6=%LocalAppData%\Samsung\Internet\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Samsung\Internet\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Samsung\Internet\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Samsung\Internet\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Samsung\Internet\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Samsung\Internet\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Samsung\Internet\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Samsung\Internet\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Samsung\Internet\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Samsung\Internet\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Samsung\Internet\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Samsung\Internet\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Samsung\Internet\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Samsung\Internet\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Samsung\Internet\Application|debug.log
FileKey21=%ProgramFiles%\Samsung\Internet\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Samsung\Internet\BlBeacon|failed_count
RegKey2=HKCU\Software\Samsung\Internet\BlBeacon|state
RegKey3=HKCU\Software\Samsung\Internet\Installer|LastChecked
RegKey4=HKCU\Software\Samsung\Internet\StabilityMetrics

[Samsung Internet Web Browsing Cookies *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\Network|Cookies*;Device Bound Sessions*

[Samsung Internet Web Browsing History *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Samsung Internet Web Browsing Session *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*\Sessions|*|REMOVESELF

[Samsung Internet Web Storage *]
Section=Samsung Internet Web Browser
DetectFile=%LocalAppData%\Samsung\Internet\User Data
FileKey1=%LocalAppData%\Samsung\Internet\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Samsung\Internet\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Samsung\Internet\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Samsung\Internet\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Samsung\Internet\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Samsung\Internet\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Samsung\Internet\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Samsung\Internet\User Data\*\WebStorage|*|REMOVESELF

[Samsung Kies *]
LangSecRef=3024
Detect1=HKCU\Software\Samsung\Kies2.0
Detect2=HKCU\Software\Samsung\Kies3.0
Detect3=HKLM\Software\SAMSUNG\USB_DRIVER
FileKey1=%AppData%\Samsung\Kies|*.mlca;*.mlme;*.mlpb;*.mlpgb|RECURSE
FileKey2=%AppData%\Samsung\Kies*\BackupHistory|BackupHistory.xml
FileKey3=%ProgramData%\Samsung\Device Error Recovery|*
FileKey4=%ProgramData%\Samsung\Kies|Kiesairmessage.log
FileKey5=%UserProfile%\Documents\Samsung\Kies*\Backup|*|RECURSE
FileKey6=%UserProfile%\Documents\SelfMV|*.log

[Samsung Knox Matrix *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.KnoxMatrixforWindows_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.KnoxMatrixforWindows_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.KnoxMatrixforWindows_3c1yjt4zspk6g\LocalState\KMXAppService|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.KnoxMatrixforWindows_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.KnoxMatrixforWindows_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.KnoxMatrixforWindows_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Link Sharing *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.1412377A9806A_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.1412377A9806A_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.1412377A9806A_3c1yjt4zspk6g\LocalState\MetroLogs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.1412377A9806A_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.1412377A9806A_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.1412377A9806A_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Live Message *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.LiveMessage_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.LiveMessage_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.LiveMessage_3c1yjt4zspk6g\LocalState|*|RECURSE
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.LiveMessage_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.LiveMessage_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.LiveMessage_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Live Wallpaper *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\Sidia.LiveWallpaper_wkpx6gdq8qyz8
FileKey1=%LocalAppData%\Packages\Sidia.LiveWallpaper_wkpx6gdq8qyz8\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Sidia.LiveWallpaper_wkpx6gdq8qyz8\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Sidia.LiveWallpaper_wkpx6gdq8qyz8\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Sidia.LiveWallpaper_wkpx6gdq8qyz8\TempState|*|REMOVESELF
FileKey5=%Package\LiveWallpaperData\Log|*
FileKey6=%Package\LiveWallpaperData\Temporary|*

[Samsung Magician *]
LangSecRef=3024
Detect=HKLM\Software\Samsung Magician
FileKey1=%AppData%\Samsung Magician\Cache\Cache_Data|*|RECURSE
FileKey2=%AppData%\Samsung Magician\Code Cache|*|RECURSE
FileKey3=%AppData%\Samsung Magician\DawnCache|*|RECURSE
FileKey4=%AppData%\Samsung Magician\GPUCache|*|RECURSE
FileKey5=%AppData%\Samsung Magician\Local Storage\leveldb|*.old
FileKey6=%AppData%\Samsung Magician\Network|*
FileKey7=%AppData%\Samsung Magician\Session Storage|*.old
FileKey8=%ProgramData%\Samsung\Backup|*.exe
FileKey9=%ProgramData%\Samsung\Samsung Magician|*.exe|RECURSE
FileKey10=%ProgramData%\Samsung\Samsung Magician\PB|*.txt
FileKey11=%ProgramFiles%\Samsung Magician\Logs|*
FileKey12=%ProgramFiles%\Samsung\Samsung Magician\Log*|*
FileKey13=%ProgramFiles%\Samsung\Samsung Magician\MigrationService|*.log
FileKey14=%ProgramFiles%\Samsung\Samsung Magician\MigrationService\Logs|*
FileKey15=%SystemDrive%\MagicianPerf*|*|REMOVESELF
RegKey1=HKCU\Software\Local AppWizard-Generated Applications\SamsungMagician
ExcludeKey1=FILE|%AppData%\Samsung Magician\|Local State
ExcludeKey2=FILE|%AppData%\Samsung Magician\|Preferences

[Samsung MSSCS *]
LangSecRef=3024
Detect=HKLM\SOFTWARE\SAMSUNG
FileKey1=%ProgramData%\Samsung\MSSCS|*.log

[Samsung Notes *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\LocalState\Logs|*|RECURSE
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\LocalState\RendererCache|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\LocalState\SPenSDK30\cache|*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\LocalState\thumbnail|*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\Settings|*.log*
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\SystemAppData\Helium|*.log*
FileKey8=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungNotes_wyx1vj98g3asy\TempState|*|REMOVESELF

[Samsung Odyssey 3D Hub *]
Section=Games
DetectFile=%LocalAppData%\Odyssey3DHub
FileKey1=%UserProfile%\AppData%\LocalLow\Samsung\Odyssey3DHubUI|*.log

[Samsung Parental Controls *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungParentalControls_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungParentalControls_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungParentalControls_3c1yjt4zspk6g\LocalState\logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungParentalControls_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungParentalControls_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungParentalControls_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey6=%ProgramData%\ParentalControls\Log|*

[Samsung Pass *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPass_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPass_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPass_3c1yjt4zspk6g\LocalState\Logs|*|RECURSE
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPass_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPass_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPass_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung PENUP *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g\LocalState\Logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g\LocalState\SPenSDK30\cache|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PENUP_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Phone *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\LocalState\Logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\LocalState\Reports|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\LocalState\sessionData\*Cache*|*|RECURSE
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\Settings|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPhone_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Printer Experience *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_3c1yjt4zspk6g\LocalState|*.xml
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Private Share *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PrivateShare_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PrivateShare_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PrivateShare_3c1yjt4zspk6g\LocalState\LOGS_PrivateShare|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PrivateShare_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PrivateShare_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.PrivateShare_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Quick Search *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\LocalState\logs|*|RECURSE
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Quick Share *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\LocalState\BuddyProfilePictures|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\LocalState\MetroLogs|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\LocalState\Samsung\*\Logs|*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\Settings|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\TempState|*|REMOVESELF
FileKey8=%ProgramData%\Samsung\QuickShare\ServiceLogs|*

[Samsung Recovery *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungRecovery_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungRecovery_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungRecovery_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungRecovery_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungRecovery_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey5=%ProgramData%\Samsung\Recovery\log|*.log|RECURSE

[Samsung Screen Recorder *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g\RoamingState\Samsung\ScreenRecorder\logs|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungScreenRecording_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Search *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\LocalState\logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungQuickSearch_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Second Screen *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SecondScreen_wyx1vj98g3asy
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SecondScreen_wyx1vj98g3asy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SecondScreen_wyx1vj98g3asy\LocalState\Logger|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SecondScreen_wyx1vj98g3asy\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SecondScreen_wyx1vj98g3asy\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCoLtd.SecondScreen_wyx1vj98g3asy\TempState|*|REMOVESELF

[Samsung Settings *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettings_3c1yjt4zspk6g
DetectFile2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettingsRuntime_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettings_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettings_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettings_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettings_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettingsRuntime_3c1yjt4zspk6g\AC|*|RECURSE
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettingsRuntime_3c1yjt4zspk6g\LocalState|*.log
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettingsRuntime_3c1yjt4zspk6g\Settings|*.log*
FileKey8=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettingsRuntime_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey9=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSettingsRuntime_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey10=%ProgramData%\Samsung|SamsungSettingsSetup.log

[Samsung Smart Switch *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSmartSwitch_3c1yjt4zspk6g
FileKey1=%AppData%\Samsung\SmartSwitchPCtoPC\logs|*
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSmartSwitch_3c1yjt4zspk6g\AC|*|RECURSE
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSmartSwitch_3c1yjt4zspk6g\Settings|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSmartSwitch_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungSmartSwitch_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey6=%ProgramFiles%\Samsung\SmartSwitch\log|*

[Samsung SmartThings *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\AppData\CacheStorage|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState|*cache*.*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView|*.log;*first_party_sets*;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version;Module Info Cache
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView|*-journal;*.pma;LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\*BrowserMetrics|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\*Cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\AutoFill*|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Avatars|*|REMOVESELF
FileKey10=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\CertificateRevocation|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\CookieReadinessList|*|REMOVESELF
FileKey12=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Crash Reports|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Crashpad|*|REMOVESELF
FileKey14=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Crowd Deny|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default|*.ldb;*.log;*Web Data;Bookmarks.bak;BrowsingTopics*;Conversions*;CURRENT;DIPS*;DownloadMetadata;Extension Cookies;favicons*;History*;InterestGroups;LOCK;MANIFEST-*;MediaDeviceSalts;Network Action Predictor*;PreferredApps;PrivateAggregation*;QuotaManager;ServerCertificate;SharedStorage*;shortcuts*;Top Sites*;Visited Links*
FileKey16=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\*Cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\AutoFill*|*|REMOVESELF
FileKey18=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\blob_storage|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\BudgetDatabase|*|REMOVESELF
FileKey20=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\chrome_cart_db|*|REMOVESELF
FileKey21=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\ClientCertificates|*|REMOVESELF
FileKey22=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\commerce_subscription_db|*|REMOVESELF
FileKey23=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\coupon_db|*|REMOVESELF
FileKey24=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\DataSharing|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\discount*_db|*|REMOVESELF
FileKey26=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Download Service|*|REMOVESELF
FileKey27=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Extension State|*|REMOVESELF
FileKey28=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Feature Engagement Tracker|*|REMOVESELF
FileKey29=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\File System|*|REMOVESELF
FileKey30=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\GCM Store|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\JumpListIcons*|*|REMOVESELF
FileKey32=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\MediaFoundationCdmStore|*|REMOVESELF
FileKey33=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Network|Cookies*;Device Bound Sessions*;Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*;TransportSecurity*;Trust Tokens*
FileKey34=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\optimization*|*|REMOVESELF
FileKey35=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\parcel_tracking_db|*|REMOVESELF
FileKey36=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\PersistentOriginTrials|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Platform Notifications|*|REMOVESELF
FileKey38=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Safe Browsing Network|*|REMOVESELF
FileKey39=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Service Worker|*|REMOVESELF
FileKey40=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Sessions|*|REMOVESELF
FileKey41=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Shared Dictionary\cache|*|REMOVESELF
FileKey42=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\shared_proto_db|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Site Characteristics Database|*|REMOVESELF
FileKey44=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey45=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey46=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Sync Data|*|REMOVESELF
FileKey47=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\VideoDecodeStats|*|REMOVESELF
FileKey48=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\Web Applications|*|REMOVESELF
FileKey49=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\WebRTC Logs|*|REMOVESELF
FileKey50=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Default\WebrtcVideoStats|*|REMOVESELF
FileKey51=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\FirstPartySetsPreloaded|*|REMOVESELF
FileKey52=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Local Traces|*|REMOVESELF
FileKey53=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\MEIPreload|*|REMOVESELF
FileKey54=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Optimization*|*|REMOVESELF
FileKey55=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\OriginTrials|*|REMOVESELF
FileKey56=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\PKIMetadata|*|REMOVESELF
FileKey57=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey58=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey59=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Safe Browsing|*|REMOVESELF
FileKey60=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\SafetyTips|*|REMOVESELF
FileKey61=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\SmartScreen|*|REMOVESELF
FileKey62=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\SSLErrorAssistant|*|REMOVESELF
FileKey63=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Stability|*|REMOVESELF
FileKey64=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\Subresource Filter|*|REMOVESELF
FileKey65=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\TrustTokenKeyCommitments|*|REMOVESELF
FileKey66=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\WidevineCdm|*|REMOVESELF
FileKey67=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\EBWebView\ZxcvbnData|*|REMOVESELF
FileKey68=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\LocalState\logs|*
FileKey69=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\Settings|*.log*
FileKey70=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey71=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SmartThingsWindows_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Software Upgrade Assistant *]
LangSecRef=3024
DetectFile=%LocalAppData%\MSU
FileKey1=%LocalAppData%\MSU|*-logs.txt;*.log

[Samsung Studio *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g\LocalState\Logs|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g\LocalState\ProjectThumbs|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungStudio_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Studio Plus *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g\LocalState|_sessionState.xml
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g\LocalState\Projects|*.png
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.StudioPlus_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung teamPL *]
LangSecRef=3021
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.873506AC0B4C_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.873506AC0B4C_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.873506AC0B4C_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.873506AC0B4C_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.873506AC0B4C_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Samsung Update *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g\LocalState\log|*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g\Settings|*.log*
FileKey5=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungUpdate_3c1yjt4zspk6g\TempState|*|REMOVESELF
FileKey7=%ProgramData%\Samsung\SamsungUpdate3\log|*

[Samsung Whiteboard *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungWhiteboard_3c1yjt4zspk6g
FileKey1=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungWhiteboard_3c1yjt4zspk6g\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungWhiteboard_3c1yjt4zspk6g\Settings|*.log*
FileKey3=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungWhiteboard_3c1yjt4zspk6g\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\SAMSUNGELECTRONICSCO.LTD.SamsungWhiteboard_3c1yjt4zspk6g\TempState|*|REMOVESELF

[Sanctum *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\91600
FileKey1=%UserProfile%\Documents\My Games\Sanctum\SanctumGame\Logs|*

[Sandisk Installer *]
LangSecRef=3024
DetectFile=%AppData%\com.sandisk.softwareInstaller
FileKey1=%AppData%\com.sandisk.softwareInstaller\Logs|*|REMOVESELF

[Santa Ride! 2 *]
Section=Games
DetectFile=%ProgramFiles%\Invictus Games\Santa Ride! 2
FileKey1=%ProgramFiles%\Invictus Games\Santa Ride! 2|*.log

[Santa's Rampage *]
Section=Games
DetectFile=%ProgramFiles%\*Santa* Rampage
FileKey1=%ProgramFiles%\*Santa* Rampage|*.diz;*.nfo;*.txt;*.url;dotNetFx40_Full_setup.exe|RECURSE
FileKey2=%ProgramFiles%\*Santa* Rampage\Redist|*|REMOVESELF
FileKey3=%ProgramFiles%\*Santa* Rampage\UDKGame\Logs|*|REMOVESELF
ExcludeKey1=FILE|%ProgramFiles%\*Santa* Rampage\UDKGame\CookedPC\|Manifest.txt
ExcludeKey2=PATH|%ProgramFiles%\*Santa* Rampage\Binaries\Win32\|*
ExcludeKey3=PATH|%ProgramFiles%\*Santa* Rampage\Binaries\Win64\|*
ExcludeKey4=PATH|%ProgramFiles%\*Santa* Rampage\UDKGame\Script\|*

[Sauerbraten *]
Section=Games
DetectFile=%ProgramFiles%\Sauerbraten
FileKey1=%ProgramFiles%\Sauerbraten\packages\base|*.bak|RECURSE
FileKey2=%UserProfile%\Documents\My Games\Crash|*.log
FileKey3=%UserProfile%\Documents\My Games\Sauerbraten|log.txt

[SBCleaner *]
LangSecRef=3024
DetectFile=%ProgramData%\CzechMex LLC\SBCleaner*
FileKey1=%ProgramData%\CzechMex LLC\SBCleaner\Logs|*.LOG
FileKey2=%ProgramData%\CzechMex LLC\SBCleanerFree\Logs|*.LOG

[SBMAV Disk Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\SBMAV Software\Disk Cleaner
FileKey1=%AppData%\SBMAV Disk Cleaner|dcleaner.log
FileKey2=%ProgramFiles%\SBMAV Disk Cleaner|*.rtf

[ScanDefrag *]
LangSecRef=3024
Detect=HKLM\Software\ScanDefrag
FileKey1=%SystemDrive%\ScanDefrag|*.log
FileKey2=%SystemDrive%\ScanDefrag\logs|*.txt

[ScanSnap *]
LangSecRef=3021
Detect=HKCU\Software\PFU\ScanToOffice
DetectFile1=%CommonProgramFiles%\PFU\ScanSnap\ScanToOffice
DetectFile2=%ProgramFiles%\PFU\ScanSnap
FileKey1=%CommonProgramFiles%\PFU\ScanSnap\ScanToOffice|*.log|RECURSE
FileKey2=%LocalAppData%\PFU|*.log|RECURSE
FileKey3=%LocalAppData%\PFU\SSFolderTemp|*|RECURSE
FileKey4=%ProgramFiles%\PFU|*.log|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\PFU|*.log|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\PFU\SSFolderTemp|*|RECURSE
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\PFU|*.log|RECURSE
FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\PFU\SSFolderTemp|*|RECURSE
RegKey1=HKCU\Software\PFU\ScanToOffice\History

[Scooter Software Beyond Compare *]
LangSecRef=3021
DetectFile=%AppData%\Scooter Software\Beyond Compare*
FileKey1=%AppData%\Scooter Software\Beyond Compare*|*.bak
RegKey1=HKCU\Software\Scooter Software\Beyond Compare\Recent

[Screenpresso *]
LangSecRef=3024
DetectFile=%AppData%\Learnpulse\Screenpresso
FileKey1=%AppData%\Learnpulse\Screenpresso|settings.copy.xml
FileKey2=%UserProfile%\Pictures\Screenpresso\Thumbnails|*|RECURSE

[Scribus *]
LangSecRef=3023
DetectFile=%AppData%\Scribus
FileKey1=%AppData%\Scribus\scrapbook\tmp|*|RECURSE

[Scrivener *]
LangSecRef=3021
DetectFile=%LocalAppData%\LiteratureandLatte\Scrivener
FileKey1=%LocalAppData%\LiteratureandLatte\Scrivener\Cache|*|RECURSE
FileKey2=%LocalAppData%\LiteratureandLatte\Scrivener\QtWebEngine\Default|*.old;LOG|RECURSE
FileKey3=%LocalAppData%\LiteratureandLatte\Scrivener\QtWebEngine\Default\GPUCache|*

[ScummVM *]
Section=Games
DetectFile=%AppData%\ScummVM
FileKey1=%AppData%\ScummVM\Logs|*

[SdfBrowser *]
LangSecRef=3024
DetectFile=%AppData%\BokorBéla\SdfBrowser
FileKey1=%AppData%\BokorBéla\SdfBrowser|*.log

[Seagate Dashboard *]
LangSecRef=3024
Detect=HKLM\Software\Seagate\Seagate Dashboard\CurrentVersion
FileKey1=%AppData%\Seagate\Seagate Dashboard\logs|*.log*
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Roaming\Seagate\Seagate Dashboard\logs|SeagateDashboardService*
FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Seagate\Seagate Dashboard\logs|SeagateDashboardService*

[Seagate Premium Recovery Suite *]
LangSecRef=3021
Detect=HKCU\Software\Pixel8\Premium Recovery Suite
FileKey1=%ProgramFiles%\Premium Recovery Suite\Logs|*

[Seagate SeaTools for Windows *]
LangSecRef=3024
Detect=HKLM\Software\SeaToolsforWindows
FileKey1=%ProgramFiles%\Seagate\SeaTools for Windows|*.log

[SeaMonkey Autocomplete History *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|formhistory*

[SeaMonkey Autofill Data *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|autofill-profiles.json

[SeaMonkey Bookmark Backups *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*\bookmarkbackups|*

[SeaMonkey Bookmark Favicons *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|favicons*

[SeaMonkey Caches *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Mozilla\SeaMonkey\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*\notificationstore|*
FileKey4=%AppData%\Mozilla\SeaMonkey\Profiles\*\security_state|*
FileKey5=%AppData%\Mozilla\SeaMonkey\Profiles\*\shader-cache|*
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*\thumbnails|*|REMOVESELF

[SeaMonkey Privacy Sandbox *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|credentialstate.sqlite

[SeaMonkey Saved Usernames & Passwords *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|key4.db;logins.json

[SeaMonkey Synced Tabs *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|synced-tabs.db*

[SeaMonkey Telemetry *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey|*.log|RECURSE
FileKey2=%AppData%\Mozilla\SeaMonkey\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Mozilla\SeaMonkey\Profiles\*\crashes|*
FileKey5=%AppData%\Mozilla\SeaMonkey\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\minidumps|*
FileKey7=%AppData%\Mozilla\SeaMonkey\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Mozilla\SeaMonkey\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Mozilla\SeaMonkey\Profiles\*\weave\logs|*

[SeaMonkey Web Browsing Cookies *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|cookies*

[SeaMonkey Web Browsing Session *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|session*.json*

[SeaMonkey Web Browsing Session Backups *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*\sessionstore-backups|*

[SeaMonkey Web Storage *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Mozilla\SeaMonkey\Profiles\*\storage\default\http*|*|REMOVESELF

[SeaMonkey Website Permissions *]
Section=SeaMonkey Internet Suite
DetectFile=%AppData%\Mozilla\SeaMonkey\Profiles
FileKey1=%AppData%\Mozilla\SeaMonkey\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Second Copy *]
LangSecRef=3024
Detect=HKCU\Software\Centered Systems\Second Copy 2000
DetectFile=%LocalAppData%\Centered Systems\Second Copy
FileKey1=%LocalAppData%\Centered Systems\Second Copy|log*.*
FileKey2=%ProgramFiles%\SecCopy|log*.rtf
RegKey1=HKCU\Software\Centered Systems\Second Copy 2000\MRU

[SecondLife *]
Section=Games
DetectFile=%AppData%\SecondLife
FileKey1=%AppData%\SecondLife\*|*.log;*.txt;screen_last.bmp;url_history.xml|RECURSE
FileKey2=%AppData%\SecondLife\*\Browser_Profile\Cache|*|RECURSE
FileKey3=%AppData%\SecondLife\*\cache|*|RECURSE
FileKey4=%AppData%\SecondLife\cache|*|RECURSE
FileKey5=%AppData%\SecondLife\Logs|*

[SecuKitNXS *]
LangSecRef=3021
DetectFile=%UserProfile%\AppData\LocalLow\KICA\nxClient
FileKey1=%UserProfile%\AppData\LocalLow\KICA\nxClient\Log|*

[SecureCRT *]
LangSecRef=3021
Detect=HKCU\Software\VanDyke\SecureCRT
FileKey1=%AppData%\VanDyke\SecureCRT\Config|Recent File List.ini;Recent Script List.ini

[SecureDownloadManager *]
LangSecRef=3022
Detect=HKCU\Software\e-academy Inc.\SecureDownloadManager
FileKey1=%LocalAppData%\e-academy Inc\SecureDownloadManager|*.log
RegKey1=HKCU\Software\e-academy Inc.\SecureDownloadManager\Recent File list

[Security Task Manager *]
LangSecRef=3024
Detect=HKCU\Software\Neuber GbR\Security Task Manager
RegKey1=HKCU\Software\Neuber GbR\Security Task Manager\Options|HistoryExe
RegKey2=HKCU\Software\Neuber GbR\Security Task Manager\Options|HostKnown

[SecurityXploded Directory Scanner *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\DirectoryScanner
RegKey1=HKCU\Software\SecurityXploded\DirectoryScanner|EndHostAddress
RegKey2=HKCU\Software\SecurityXploded\DirectoryScanner|StartHostAddress

[SecurityXploded FTP Password Kracker *]
LangSecRef=3024
Detect=HKCU\Software\FTP Password Kracker
RegKey1=HKCU\Software\FTP Password Kracker|File
RegKey2=HKCU\Software\FTP Password Kracker|Port
RegKey3=HKCU\Software\FTP Password Kracker|ServerAddress
RegKey4=HKCU\Software\FTP Password Kracker|Username

[SecurityXploded Hash Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\HashKracker
RegKey1=HKCU\Software\SecurityXploded\HashKracker|File
RegKey2=HKCU\Software\SecurityXploded\HashKracker|Hash
RegKey3=HKCU\Software\SecurityXploded\HashKracker|Type

[SecurityXploded LDAP Password Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\LDAPPasswordKracker
RegKey1=HKCU\Software\SecurityXploded\LDAPPasswordKracker|File
RegKey2=HKCU\Software\SecurityXploded\LDAPPasswordKracker|Port
RegKey3=HKCU\Software\SecurityXploded\LDAPPasswordKracker|ServerAddress
RegKey4=HKCU\Software\SecurityXploded\LDAPPasswordKracker|Username

[SecurityXploded LDAP Search *]
LangSecRef=3024
Detect=HKCU\Software\LDAPSearch_Nag
RegKey1=HKCU\Software\LDAPSearch_Nag|BaseDN
RegKey2=HKCU\Software\LDAPSearch_Nag|CertPath
RegKey3=HKCU\Software\LDAPSearch_Nag|IPAddress
RegKey4=HKCU\Software\LDAPSearch_Nag|LoginDN
RegKey5=HKCU\Software\LDAPSearch_Nag|Port

[SecurityXploded Mysql Password Auditor *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\MysqlPasswordAuditor
RegKey1=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|File
RegKey2=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|Port
RegKey3=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|ServerAddress
RegKey4=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|Username

[SecurityXploded Net Database Scanner *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\NetDatabaseScanner
RegKey1=HKCU\Software\SecurityXploded\NetDatabaseScanner|DatabaseType
RegKey2=HKCU\Software\SecurityXploded\NetDatabaseScanner|EndHostAddress
RegKey3=HKCU\Software\SecurityXploded\NetDatabaseScanner|StartHostAddress

[SecurityXploded Router Password Kracker *]
LangSecRef=3024
Detect1=HKCU\Software\RouterPasswordKracker
Detect2=HKCU\Software\SecurityXploded\RouterPasswordDecryptor
RegKey1=HKCU\Software\RouterPasswordKracker|File
RegKey2=HKCU\Software\RouterPasswordKracker|ServerAddress
RegKey3=HKCU\Software\RouterPasswordKracker|Username
RegKey4=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|File
RegKey5=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|ServerAddress
RegKey6=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|Username

[SecurityXploded Salted Hash Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\SaltedHashKracker
RegKey1=HKCU\Software\SecurityXploded\SaltedHashKracker|File
RegKey2=HKCU\Software\SecurityXploded\SaltedHashKracker|Hash
RegKey3=HKCU\Software\SecurityXploded\SaltedHashKracker|Salt
RegKey4=HKCU\Software\SecurityXploded\SaltedHashKracker|Type

[SecurityXploded SSL Certificate Scanner *]
LangSecRef=3024
Detect1=HKCU\Software\SecurityXploded\SSLCertScanner
Detect2=HKCU\Software\SSLCertScanner
RegKey1=HKCU\Software\SecurityXploded\SSLCertScanner|Port
RegKey2=HKCU\Software\SecurityXploded\SSLCertScanner|ServerAddress
RegKey3=HKCU\Software\SSLCertScanner|Port
RegKey4=HKCU\Software\SSLCertScanner|ServerAddress

[SecurityXploded Virus Total Scanner *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\VirusTotalScanner
RegKey1=HKCU\Software\SecurityXploded\VirusTotalScanner|File

[SecurityXploded Wi-Fi Network Monitor *]
LangSecRef=3024
Detect1=HKCU\Software\SecurityXploded\WiFiNetworkMonitor
Detect2=HKCU\Software\WiFi Network Monitor
RegKey1=HKCU\Software\SecurityXploded\WiFiNetworkMonitor|EndHostAddress
RegKey2=HKCU\Software\SecurityXploded\WiFiNetworkMonitor|StartHostAddress
RegKey3=HKCU\Software\WiFi Network Monitor|EndHostAddress
RegKey4=HKCU\Software\WiFi Network Monitor|StartHostAddress

[SecurityXploded Windows Password Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\WindowsPasswordKracker
RegKey1=HKCU\Software\SecurityXploded\WindowsPasswordKracker|File
RegKey2=HKCU\Software\SecurityXploded\WindowsPasswordKracker|Hash

[SecurityXploded Windows Spy Keylogger *]
LangSecRef=3024
Detect=HKCU\Software\WinSKApp
RegKey1=HKCU\Software\WinSKApp

[SecuROM Diagnostics Tool *]
Section=Games
Detect=HKCU\Software\SecuROM
DetectFile1=%SystemDrive%\AnalysisLog.sr0
DetectFile2=%UserProfile%\Desktop\AnalysisLog.sr0
FileKey1=%AppData%\SecuROM\UserData|*.bak;*.tmp
FileKey2=%SystemDrive%|AnalysisLog.sr0
FileKey3=%UserProfile%\Desktop|AnalysisLog.sr0

[Send To Toys *]
LangSecRef=3024
Detect=HKCU\Software\Gabriele Ponti\Send To Toys
RegKey1=HKCU\Software\Gabriele Ponti\Send To Toys|LastFolder
RegKey2=HKCU\Software\Gabriele Ponti\Send To Toys|RecentFolders

[Serato DJ *]
LangSecRef=3023
DetectFile=%UserProfile%\Music\_Serato_
FileKey1=%UserProfile%\Music\_Serato_|*.log|RECURSE

[Serious Sam *]
Section=Games
DetectFile1=%ProgramFiles%\Serious Sam*
DetectFile2=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*
FileKey1=%ProgramFiles%\Serious Sam*|*.log
FileKey2=%ProgramFiles%\Serious Sam*\Temp|*
FileKey3=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*|*.log
FileKey4=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*\Log|*|RECURSE
FileKey5=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*\Temp|*

[ServeToMe *]
LangSecRef=3023
DetectFile=%AppData%\ProjectsWithLove\ServeToMe
FileKey1=%AppData%\ProjectsWithLove\ServeToMe\Fontcache|*

[Serviio *]
LangSecRef=3024
Detect=HKLM\Software\Serviio
FileKey1=%ProgramFiles%\Serviio\log|*

[Shareaza *]
LangSecRef=3022
Detect=HKCU\Software\BHO Shareaza
FileKey1=%LocalAppData%\Shareaza\Incomplete|*

[ShareX *]
LangSecRef=3021
DetectFile1=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j
DetectFile2=%ProgramFiles%\ShareX
FileKey1=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j\Settings|*.log*
FileKey5=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\19568ShareX.ShareX_egrzcvs15399j\TempState|*|REMOVESELF
FileKey7=%UserProfile%\Documents\ShareX|History.xml
FileKey8=%UserProfile%\Documents\ShareX\Backup|*Config-*.json
FileKey9=%UserProfile%\Documents\ShareX\Logs|*|RECURSE

[Shatter *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\20820
FileKey1=%ProgramFiles%\Steam\steamapps\common\Shatter|log.txt

[Shattered Horizon *]
Section=Games
DetectFile=%LocalAppData%\Futuremark\Shattered Horizon
FileKey1=%LocalAppData%\Futuremark\Shattered Horizon\cache|*|REMOVESELF
FileKey2=%LocalAppData%\Futuremark\Shattered Horizon\crash_dumps|*

[She and the Light Bearer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\658590
FileKey1=%UserProfile%\AppData\LocalLow\Mojiken\She and the Light Bearer|output_log.txt

[ShellLess *]
LangSecRef=3021
Detect=HKCU\Software\ShellLess1.10b
RegKey1=HKCU\Software\ShellLess1.10b\ShellLess\Recent File List

[Shift Autofill Data & Search Engine Preferences *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|*Web Data
FileKey2=%LocalAppData%\Shift\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Shift\User Data\AutoFill*|*|REMOVESELF

[Shift Autoplay Preferences *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\MEIPreload|*|REMOVESELF

[Shift Bookmark Backups *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|Bookmarks.bak

[Shift Bookmark Favicons *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|favicons*

[Shift Caches *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Shift\User Data|Module Info Cache
FileKey3=%LocalAppData%\Shift\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Shift\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Shift\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Shift\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Shift\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Shift\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Shift\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Shift\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Shift\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Shift\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Shift\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Shift\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Shift\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Shift\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Shift\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Shift\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Shift\User Data\Optimization*|*|REMOVESELF

[Shift Default App Handlers *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|PreferredApps

[Shift Download History *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Shift\User Data\*\shared_proto_db|*|REMOVESELF

[Shift DRM Data *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Shift\User Data\WidevineCdm|*|REMOVESELF

[Shift Extension Cookies *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|Extension Cookies

[Shift Pinned Tabs *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
RegKey1=HKCU\Software\Shift\PreferenceMACs\Default|pinned_tabs

[Shift Privacy Sandbox *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Shift\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Shift\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Shift\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Shift\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Shift\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Shift\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Shift\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Shift Progressive Web Apps *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\Web Applications|*|REMOVESELF

[Shift Saved Usernames & Passwords *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|Login Data*

[Shift Security & Threat Detection *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|DIPS*
FileKey2=%LocalAppData%\Shift\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Shift\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Shift\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Shift\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Shift\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Shift\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Shift\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Shift\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Shift\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Shift\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Shift\User Data\ZxcvbnData|*|REMOVESELF

[Shift Shopping Insights *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Shift\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Shift\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Shift\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Shift\User Data\*\parcel_tracking_db|*|REMOVESELF

[Shift Storage Quota Manager *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|QuotaManager

[Shift Sync Data *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\Sync Data|*|REMOVESELF

[Shift Telemetry *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\Application|debug.log
FileKey2=%LocalAppData%\Shift\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Shift\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Shift\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Shift\User Data\*|*.log
FileKey6=%LocalAppData%\Shift\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Shift\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Shift\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Shift\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Shift\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Shift\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Shift\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Shift\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Shift\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Shift\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Shift\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Shift\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Shift\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Shift\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Shift\Application|debug.log
FileKey21=%ProgramFiles%\Shift\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Shift\BlBeacon|failed_count
RegKey2=HKCU\Software\Shift\BlBeacon|state
RegKey3=HKCU\Software\Shift\Installer|LastChecked
RegKey4=HKCU\Software\Shift\StabilityMetrics

[Shift Web Browsing Cookies *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\Network|Cookies*;Device Bound Sessions*

[Shift Web Browsing History *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Shift Web Browsing Session *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Shift\User Data\*\Sessions|*|REMOVESELF

[Shift Web Storage *]
Section=Shift Web Browser
DetectFile=%LocalAppData%\Shift\User Data
FileKey1=%LocalAppData%\Shift\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Shift\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Shift\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Shift\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Shift\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Shift\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Shift\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Shift\User Data\*\WebStorage|*|REMOVESELF

[Shogun2 *]
Section=Games
DetectFile=%AppData%\The Creative Assembly\Shogun2
FileKey1=%AppData%\The Creative Assembly\Shogun2\*_cache|*
FileKey2=%AppData%\The Creative Assembly\Shogun2\Logs|*
FileKey3=%AppData%\The Creative Assembly\Shogun2\Temp|*

[ShooterGame *]
Section=Games
DetectFile=%LocalAppData%\ShooterGame
FileKey1=%LocalAppData%\ShooterGame\Saved\Logs|*|REMOVESELF
FileKey2=%LocalAppData%\ShooterGame\Saved\WebCache*|*|REMOVESELF

[ShortKeys *]
LangSecRef=3021
Detect=HKCU\Software\Insight Software Solutions\ShortKeys
RegKey1=HKCU\Software\Insight Software Solutions\ShortKeys\MRU

[Should I Remove It? *]
LangSecRef=3024
Detect=HKCU\Software\Reason
FileKey1=%ProgramFiles%\Reason\Should I Remove It|programdata.dat
RegKey1=HKCU\Software\Reason\ShouldIRemoveIt\Cache

[ShrewSoft VPN Client *]
LangSecRef=3022
DetectFile=%ProgramFiles%\ShrewSoft\VPN Client
FileKey1=%ProgramFiles%\ShrewSoft\VPN Client\debug|*.log

[Shuffle Party *]
Section=Games
DetectFile=%LocalAppData%\Packages\Microsoft.ShuffleParty_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ShuffleParty_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ShuffleParty_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.ShuffleParty_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.ShuffleParty_8wekyb3d8bbwe\TempState|*|REMOVESELF

[SideQuest *]
Section=Games
DetectFile=%AppData%\SideQuest
FileKey1=%AppData%\SideQuest|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE
FileKey2=%AppData%\SideQuest\*Cache|*|RECURSE
FileKey3=%AppData%\SideQuest\blob_storage|*|RECURSE
FileKey4=%AppData%\SideQuest\tmp|*
FileKey5=%AppData%\SideQuest\VideoDecodeStats|*|RECURSE
FileKey6=%LocalAppData%\sidequest-updater|installer.exe

[Sigma Autofill Data & Search Engine Preferences *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|*Web Data
FileKey2=%LocalAppData%\Sigma\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Sigma\User Data\AutoFill*|*|REMOVESELF

[Sigma Autoplay Preferences *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\MEIPreload|*|REMOVESELF

[Sigma Bookmark Backups *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|Bookmarks.bak

[Sigma Bookmark Favicons *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|favicons*

[Sigma Caches *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Sigma\User Data|Module Info Cache
FileKey3=%LocalAppData%\Sigma\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Sigma\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Sigma\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Sigma\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Sigma\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Sigma\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Sigma\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Sigma\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Sigma\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Sigma\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Sigma\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Sigma\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Sigma\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Sigma\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Sigma\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Sigma\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Sigma\User Data\Optimization*|*|REMOVESELF

[Sigma Default App Handlers *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|PreferredApps

[Sigma Download History *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Sigma\User Data\*\shared_proto_db|*|REMOVESELF

[Sigma DRM Data *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Sigma\User Data\WidevineCdm|*|REMOVESELF

[Sigma Extension Cookies *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|Extension Cookies

[Sigma Pinned Tabs *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
RegKey1=HKCU\Software\Sigma\PreferenceMACs\Default|pinned_tabs

[Sigma Privacy Sandbox *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Sigma\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Sigma\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Sigma\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Sigma\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Sigma\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Sigma\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Sigma\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Sigma Progressive Web Apps *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\Web Applications|*|REMOVESELF

[Sigma Saved Usernames & Passwords *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|Login Data*

[Sigma Security & Threat Detection *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|DIPS*
FileKey2=%LocalAppData%\Sigma\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Sigma\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Sigma\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Sigma\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Sigma\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Sigma\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Sigma\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Sigma\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Sigma\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Sigma\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Sigma\User Data\ZxcvbnData|*|REMOVESELF

[Sigma Shopping Insights *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Sigma\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Sigma\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Sigma\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Sigma\User Data\*\parcel_tracking_db|*|REMOVESELF

[Sigma Storage Quota Manager *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|QuotaManager

[Sigma Sync Data *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\Sync Data|*|REMOVESELF

[Sigma Telemetry *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\Application|debug.log
FileKey2=%LocalAppData%\Sigma\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Sigma\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Sigma\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Sigma\User Data\*|*.log
FileKey6=%LocalAppData%\Sigma\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Sigma\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Sigma\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Sigma\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Sigma\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Sigma\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Sigma\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Sigma\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Sigma\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Sigma\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Sigma\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Sigma\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Sigma\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Sigma\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Sigma\Application|debug.log
FileKey21=%ProgramFiles%\Sigma\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Sigma\BlBeacon|failed_count
RegKey2=HKCU\Software\Sigma\BlBeacon|state
RegKey3=HKCU\Software\Sigma\Installer|LastChecked
RegKey4=HKCU\Software\Sigma\StabilityMetrics

[Sigma Web Browsing Cookies *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\Network|Cookies*;Device Bound Sessions*

[Sigma Web Browsing History *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Sigma Web Browsing Session *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Sigma\User Data\*\Sessions|*|REMOVESELF

[Sigma Web Storage *]
Section=Sigma Web Browser
DetectFile=%LocalAppData%\Sigma\User Data
FileKey1=%LocalAppData%\Sigma\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Sigma\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Sigma\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Sigma\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Sigma\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Sigma\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Sigma\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Sigma\User Data\*\WebStorage|*|REMOVESELF

[Signal Messenger *]
LangSecRef=3022
DetectFile=%AppData%\Signal
FileKey1=%AppData%\Signal|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE
FileKey2=%AppData%\Signal\*Cache|*|RECURSE
FileKey3=%AppData%\Signal\blob_storage|*|RECURSE
FileKey4=%AppData%\Signal\Crashpad|*|RECURSE
FileKey5=%AppData%\Signal\Logs|*
FileKey6=%AppData%\Signal\Temp|*
FileKey7=%LocalAppData%\Signal-Desktop-Updater|installer.exe

[SignKorea *]
LangSecRef=3021
DetectFile=%UserProfile%\AppData\LocalLow\SignKorea\SKCert*
FileKey1=%UserProfile%\AppData\LocalLow\SignKorea\*\Log|*|RECURSE

[SigParser *]
LangSecRef=3024
DetectFile=%ProgramFiles%\UpdateStar\SigParser
FileKey1=%AppData%\UpdateStar GmbH\SigParser\3.0.4898.22300|*.log

[Silent Hunter III *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\15210
DetectFile=%ProgramFiles%\Ubisoft\SilentHunterIII
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\SilentHunterIII|*.log|RECURSE
FileKey2=%ProgramFiles%\Ubisoft\SilentHunterIII|*.log|RECURSE

[Silhouette Studio *]
LangSecRef=3021
DetectFile=%AppData%\com.aspexsoftware.s*
FileKey1=%AppData%\com.aspexsoftware.Silhouette_Studio\installers|*
FileKey2=%AppData%\com.aspexsoftware.ss_bluetooth|*.bluetooth.txt
FileKey3=%AppData%\com.aspexsoftware.studio_helper|log

[SimCity 4 *]
Section=Games
Detect=HKLM\Software\Maxis\SimCity 4
FileKey1=%ProgramFiles%\Maxis\Exception Reports|*.mdmp;*.txt
FileKey2=%ProgramFiles%\Maxis\HTTPCache|*
FileKey3=%ProgramFiles%\Maxis\SimCity 4 Deluxe|*-log.txt
FileKey4=%ProgramFiles%\Maxis\SimCity 4 Deluxe\Apps|*.txt
FileKey5=%UserProfile%\Documents\SimCity 4\Exception Reports|*.mdmp;*.txt
FileKey6=%UserProfile%\Documents\SimCity 4\HTTPCache|*

[SimCity Societies *]
Section=Games
DetectFile=%UserProfile%\Documents\SimCity Societies
FileKey1=%UserProfile%\Documents\SimCity Societies\Logs|*

[Similarity *]
LangSecRef=3023
DetectFile=%AppData%\Similarity
FileKey1=%AppData%\Similarity|cache.dat
FileKey2=%AppData%\Similarity\logs|*|RECURSE

[SIMS RACER *]
Section=Games
DetectFile1=%ProgramData%\SIMS\RACER
DetectFile2=%ProgramFiles%\SIMS\RACER
DetectFile3=%SystemDrive%\SIMS\RACER
FileKey1=%ProgramData%\SIMS\RACER|QLOG.txt
FileKey2=%ProgramFiles%\SIMS\RACER|QLOG.txt
FileKey3=%SystemDrive%\SIMS\RACER|QLOG.txt

[Sins of a Solar Empire Rebellion *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Ironclad Games\Sins of a Solar Empire Rebellion
FileKey1=%UserProfile%\Documents\My Games\Ironclad Games\Sins of a Solar Empire Rebellion\Cache|*

[SIP Workbench VoIP Protocol Analyzer *]
LangSecRef=3024
Detect=HKCU\Software\BreakPoint\SIP Workbench
RegKey1=HKCU\Software\BreakPoint\SIP Workbench|file1
RegKey2=HKCU\Software\BreakPoint\SIP Workbench|file2
RegKey3=HKCU\Software\BreakPoint\SIP Workbench|file3
RegKey4=HKCU\Software\BreakPoint\SIP Workbench|file4
RegKey5=HKCU\Software\BreakPoint\SIP Workbench|file5
RegKey6=HKCU\Software\BreakPoint\SIP Workbench|file6
RegKey7=HKCU\Software\BreakPoint\SIP Workbench|file7
RegKey8=HKCU\Software\BreakPoint\SIP Workbench|file8
RegKey9=HKCU\Software\BreakPoint\SIP Workbench|file9

[SiSense *]
LangSecRef=3021
DetectFile=%AppData%\SiSense
FileKey1=%AppData%\SiSense\Prism\logs|*
FileKey2=%ProgramData%\SiSense|*log|RECURSE
FileKey3=%ProgramData%\SiSense\Logs|*|RECURSE

[SketchUp Make *]
LangSecRef=3021
Detect=HKCU\Software\SketchUp
DetectFile1=%AppData%\SketchUp\SketchUp*
DetectFile2=%AppData%\Trimble Connect for Sketchup
FileKey1=%AppData%\SketchUp\SketchUp*\SketchUp|~*.tmp
FileKey2=%AppData%\SketchUp\SketchUp*\WebCache|*-journal;*.old;data_*;debug.log;f_*;index;LOG;Visited Links|RECURSE
FileKey3=%AppData%\SketchUp\SketchUp*\WebCache\Cache|*
FileKey4=%AppData%\SketchUp\SketchUp*\WebCache\GPUCache|*
FileKey5=%AppData%\Trimble Connect for Sketchup\Logs|*
FileKey6=%LocalAppData%\SketchUp\SketchUp*\SketchUp|*log-sketchup.txt
RegKey1=HKCU\Software\SketchUp\SketchUp 2013\Recent File List
RegKey2=HKCU\Software\SketchUp\SketchUp 2014\Recent File List
RegKey3=HKCU\Software\SketchUp\SketchUp 2015\Recent File List
RegKey4=HKCU\Software\SketchUp\SketchUp 2016\Recent File List

[Sky Go *]
LangSecRef=3023
DetectFile=%AppData%\Sky\Sky Go
FileKey1=%AppData%\Sky Go|*-journal|RECURSE
FileKey2=%AppData%\Sky Go\GPUCache|*

[Skyrim Script Extender *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Skyrim\SKSE
FileKey1=%UserProfile%\Documents\My Games\Skyrim\SKSE|*.log

[Slack *]
LangSecRef=3021
DetectFile=%AppData%\Slack
FileKey1=%AppData%\Slack\*Cache|*|RECURSE
FileKey2=%AppData%\Slack\logs|*|RECURSE
FileKey3=%AppData%\Slack\Service Worker\*Cache*|*|RECURSE

[Sleeping Dogs *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\202170
FileKey1=%ProgramFiles%\Steam\Steamapps\common\SleepingDogs|Log*.txt

[Sleipnir Autofill Data & Search Engine Preferences *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|*Web Data
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\AutoFill*|*|REMOVESELF
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\AutoFill*|*|REMOVESELF

[Sleipnir Autoplay Preferences *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\MEIPreload|*|REMOVESELF

[Sleipnir Bookmark Backups *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client|favorite*.bak
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\client\backup|favorite*.json
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|Bookmarks.bak

[Sleipnir Bookmark Favicons *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client\favicon|*|REMOVESELF
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|favicons*

[Sleipnir Caches *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client|siteupdates.json
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\client\passconnect\serviceicons|*|REMOVESELF
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\client\sideupdates_image|*|REMOVESELF
FileKey4=%AppData%\Fenrir Inc\Sleipnir5\setting\client\thumbnail|*|REMOVESELF
FileKey5=%AppData%\Fenrir Inc\Sleipnir5\setting\client\url_image|*|REMOVESELF
FileKey6=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer|*-journal|RECURSE
FileKey7=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer|Module Info Cache
FileKey8=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey9=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\*Cache*|*|REMOVESELF
FileKey10=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\blob_storage|*|REMOVESELF
FileKey11=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\BudgetDatabase|*|REMOVESELF
FileKey12=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Download Service|*|REMOVESELF
FileKey13=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\File System|*|REMOVESELF
FileKey14=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\GCM Store|*|REMOVESELF
FileKey15=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\JumpListIcons*|*|REMOVESELF
FileKey16=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\optimization*|*|REMOVESELF
FileKey17=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Platform Notifications|*|REMOVESELF
FileKey18=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Service Worker|*|REMOVESELF
FileKey19=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Shared Dictionary\cache|*|REMOVESELF
FileKey20=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey21=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey22=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*Cache*|*|REMOVESELF
FileKey23=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Avatars|*|REMOVESELF
FileKey24=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Optimization*|*|REMOVESELF
FileKey25=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\headlinereader\temp|*|REMOVESELF

[Sleipnir Default App Handlers *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client|uri-action.json
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|PreferredApps

[Sleipnir Download History *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|DownloadMetadata
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\shared_proto_db|*|REMOVESELF

[Sleipnir DRM Data *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\WidevineCdm|*|REMOVESELF

[Sleipnir Extension Cookies *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|Extension Cookies

[Sleipnir Preferences Backups *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client|user.ini.old

[Sleipnir Privacy Sandbox *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer|*first_party_sets*
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Network|Trust Tokens*
FileKey4=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\CookieReadinessList|*|REMOVESELF
FileKey5=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\TrustTokenKeyCommitments|*|REMOVESELF

[Sleipnir Progressive Web Apps *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Web Applications|*|REMOVESELF

[Sleipnir Saved Usernames & Passwords *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|Login Data*

[Sleipnir Security & Threat Detection *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|DIPS*
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\ClientCertificates|*|REMOVESELF
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Network|TransportSecurity*
FileKey4=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\CertificateRevocation|*|REMOVESELF
FileKey6=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Crowd Deny|*|REMOVESELF
FileKey7=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\PKIMetadata|*|REMOVESELF
FileKey8=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Safe Browsing|*|REMOVESELF
FileKey9=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\SafetyTips|*|REMOVESELF
FileKey10=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\SSLErrorAssistant|*|REMOVESELF
FileKey11=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Subresource Filter|*|REMOVESELF
FileKey12=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\ZxcvbnData|*|REMOVESELF

[Sleipnir Shopping Insights *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\chrome_cart_db|*|REMOVESELF
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\coupon_db|*|REMOVESELF
FileKey4=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\discount*_db|*|REMOVESELF
FileKey5=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\parcel_tracking_db|*|REMOVESELF

[Sleipnir Storage Quota Manager *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|QuotaManager

[Sleipnir Sync Data *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Sync Data|*|REMOVESELF

[Sleipnir Telemetry *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\Application|debug.log
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\Application\SetupMetrics|*|REMOVESELF
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer|*.pma;LOG;LOG.old|RECURSE
FileKey5=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|*.log
FileKey6=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\DataSharing|*|REMOVESELF
FileKey7=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\WebRTC Logs|*|REMOVESELF
FileKey13=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*BrowserMetrics|*|REMOVESELF
FileKey15=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Crash Reports|*|REMOVESELF
FileKey16=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Crashpad|*|REMOVESELF
FileKey17=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Local Traces|*|REMOVESELF
FileKey18=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\OriginTrials|*|REMOVESELF
FileKey19=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Fenrir Inc\Sleipnir5\setting\modules\Application|debug.log
FileKey21=%ProgramFiles%\Fenrir Inc\Sleipnir5\setting\modules\Application\SetupMetrics|*|REMOVESELF

[Sleipnir Web Browsing Cookies *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Network|Cookies*;Device Bound Sessions*

[Sleipnir Web Browsing History *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Sleipnir Web Browsing Session *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client|*tab.json
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Extension State|*|REMOVESELF
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Sessions|*|REMOVESELF

[Sleipnir Web Browsing Session Backups *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\client\backup|tab*

[Sleipnir Web Storage *]
Section=Sleipnir Web Browser
DetectFile=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
FileKey1=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\IndexedDB|*|REMOVESELF
FileKey2=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Local Storage\*\Session Storage|*
FileKey4=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\Session Storage|*|REMOVESELF
FileKey8=%AppData%\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\*\WebStorage|*|REMOVESELF

[Slender: The Arrival *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252330
FileKey1=%ProgramFiles%\Steam\steamapps\common\Slender - The Arrival\Slender - The Arrival_Data|output_log.txt

[Slim PDF Reader *]
LangSecRef=3021
DetectFile=%LocalAppData%\Investintech.com Inc\SPR
FileKey1=%LocalAppData%\Investintech.com Inc\SPR\*|*.log

[Smart Explorer *]
LangSecRef=3021
Detect=HKCU\Software\Smartque\Smart Explorer
RegKey1=HKCU\Software\Smartque\Smart Explorer\Opened Pages
RegKey2=HKCU\Software\Smartque\Smart Explorer\Recent Pages

[Smart Install Maker *]
LangSecRef=3024
Detect=HKCU\Software\InstallBuilders\Smart Install Maker
RegKey1=HKCU\Software\InstallBuilders\Smart Install Maker\Reopen

[Smart PDF Creator Pro *]
LangSecRef=3024
DetectFile=%AppData%\Smart PDF Creator Pro
FileKey1=%AppData%\Smart PDF Creator Pro|Smart PDF Creator Pro_log*.*

[Smart Privacy Protector *]
LangSecRef=3024
Detect=HKCU\Software\Smart Privacy Protector
RegKey1=HKCU\Software\Smart Privacy Protector|SetupName

[SmartDrive-Wiz *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Opoku\SmartDrive-Wiz
FileKey1=%ProgramFiles%\Opoku\SmartDrive-Wiz\Log|*

[SmartFTP *]
LangSecRef=3022
Detect=HKCU\Software\SmartFTP
FileKey1=%AppData%\SmartFTP\Client 2.0\Log|*|RECURSE

[SmartSynchronize *]
LangSecRef=3024
DetectFile=%AppData%\syntevo\SmartSynchronize
FileKey1=%AppData%\syntevo\SmartSynchronize\*\Logs|*

[SMPlayer *]
LangSecRef=3023
DetectFile1=%LocalAppData%\Packages\55144RicardoVillalba.SMPlayerMediaPlayer_0jd1krfsa5x8y
DetectFile2=%UserProfile%\.smplayer
FileKey1=%LocalAppData%\Packages\55144RicardoVillalba.SMPlayerMediaPlayer_0jd1krfsa5x8y\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\55144RicardoVillalba.SMPlayerMediaPlayer_0jd1krfsa5x8y\Settings|*.log*
FileKey3=%LocalAppData%\Packages\55144RicardoVillalba.SMPlayerMediaPlayer_0jd1krfsa5x8y\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\55144RicardoVillalba.SMPlayerMediaPlayer_0jd1krfsa5x8y\TempState|*|REMOVESELF
FileKey5=%UserProfile%\.smplayer\file_settings|*|RECURSE

[Snagit *]
LangSecRef=3021
Detect=HKCU\Software\TechSmith\Snagit
FileKey1=%LocalAppData%\TechSmith\Logs|*.log
FileKey2=%LocalAppData%\TechSmith\Snagit|Tray.bin
FileKey3=%LocalAppData%\TechSmith\Snagit\*\NativeCrashReporting\Reports|*.dmp|RECURSE
FileKey4=%LocalAppData%\TechSmith\Snagit\*\WebView2Cache\EBWebView\*\GPUCache|*|REMOVESELF
FileKey5=%LocalAppData%\TechSmith\Snagit\CrashDumps|*|RECURSE
FileKey6=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico
FileKey7=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico
FileKey8=%LocalAppData%\TechSmith\Snagit\License|*.log
FileKey9=%LocalAppData%\TechSmith\Snagit\Thumbnails|*|RECURSE
FileKey10=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log*
FileKey11=%ProgramData%\TechSmith\Uploader|*.log
FileKey12=%Public%\TechSmith\Snagit\License|*.cache;*.log
FileKey13=%UserProfile%\Documents|SnagitDebug.log
FileKey14=%UserProfile%\Documents\Snagit|*.snagx
FileKey15=%UserProfile%\Documents\Snagit\.metadata|*|RECURSE
RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder
RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder
RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount
RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount
RegKey5=HKCU\Software\TechSmith\Snagit\11|OutputDirLastUsed
RegKey6=HKCU\Software\TechSmith\Snagit\11|VidOutputDirLastUsed
RegKey7=HKCU\Software\TechSmith\Snagit\11\SnagItEditor\Tray|Thumbnailsize
RegKey8=HKCU\Software\TechSmith\Snagit\12|CaptureCount
RegKey9=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount
RegKey10=HKCU\Software\TechSmith\Snagit\12|OutputDirLastUsed
RegKey11=HKCU\Software\TechSmith\Snagit\12|VidOutputDirLastUsed
RegKey12=HKCU\Software\TechSmith\SnagIt\12\Recent Captures
RegKey13=HKCU\Software\TechSmith\SnagIt\12\SnagItEditor\Recent File List
RegKey14=HKCU\Software\TechSmith\Snagit\12\SnagItEditor\Tray|Thumbnailsize
RegKey15=HKCU\Software\TechSmith\Snagit\13|CaptureCount
RegKey16=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount
RegKey17=HKCU\Software\TechSmith\Snagit\13|OutputDirLastUsed
RegKey18=HKCU\Software\TechSmith\Snagit\13|VidOutputDirLastUsed
RegKey19=HKCU\Software\TechSmith\Snagit\13\Recent Captures
RegKey20=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List
RegKey21=HKCU\Software\TechSmith\Snagit\13\SnagItEditor\Tray|Thumbnailsize
RegKey22=HKCU\Software\TechSmith\Snagit\18|CaptureCount
RegKey23=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount
RegKey24=HKCU\Software\TechSmith\Snagit\18|OutputDirLastUsed
RegKey25=HKCU\Software\TechSmith\Snagit\18|VidOutputDirLastUsed
RegKey26=HKCU\Software\TechSmith\Snagit\18\Recent Captures
RegKey27=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List
RegKey28=HKCU\Software\TechSmith\Snagit\18\SnagItEditor\Tray|Thumbnailsize
RegKey29=HKCU\Software\TechSmith\Snagit\19|CaptureCount
RegKey30=HKCU\Software\TechSmith\Snagit\19|CaptureOpenCount
RegKey31=HKCU\Software\TechSmith\Snagit\19|OutputDirLastUsed
RegKey32=HKCU\Software\TechSmith\Snagit\19|VidOutputDirLastUsed
RegKey33=HKCU\Software\TechSmith\Snagit\19\Recent Captures
RegKey34=HKCU\Software\TechSmith\Snagit\19\SnagitEditor\Recent File List
RegKey35=HKCU\Software\TechSmith\Snagit\19\SnagItEditor\Tray|Thumbnailsize
RegKey36=HKCU\Software\TechSmith\Snagit\20|CaptureCount
RegKey37=HKCU\Software\TechSmith\Snagit\20|CaptureOpenCount
RegKey38=HKCU\Software\TechSmith\Snagit\20|OutputDirLastUsed
RegKey39=HKCU\Software\TechSmith\Snagit\20|VidOutputDirLastUsed
RegKey40=HKCU\Software\TechSmith\Snagit\20\Recent Captures
RegKey41=HKCU\Software\TechSmith\Snagit\20\SnagitEditor\Recent File List
RegKey42=HKCU\Software\TechSmith\Snagit\20\SnagItEditor\Tray|Thumbnailsize
RegKey43=HKCU\Software\TechSmith\Snagit\21|CaptureCount
RegKey44=HKCU\Software\TechSmith\Snagit\21|CaptureOpenCount
RegKey45=HKCU\Software\TechSmith\Snagit\21|OutputDirLastUsed
RegKey46=HKCU\Software\TechSmith\Snagit\21|VidOutputDirLastUsed
RegKey47=HKCU\Software\TechSmith\Snagit\21\Recent Captures
RegKey48=HKCU\Software\TechSmith\Snagit\21\SnagitEditor\Recent File List
RegKey49=HKCU\Software\TechSmith\Snagit\21\SnagItEditor\Tray|Thumbnailsize
RegKey50=HKCU\Software\TechSmith\Snagit\22|CaptureCount
RegKey51=HKCU\Software\TechSmith\Snagit\22|CaptureOpenCount
RegKey52=HKCU\Software\TechSmith\Snagit\22|OutputDirLastUsed
RegKey53=HKCU\Software\TechSmith\Snagit\22|VidOutputDirLastUsed
RegKey54=HKCU\Software\TechSmith\Snagit\22\Recent Captures
RegKey55=HKCU\Software\TechSmith\Snagit\22\SnagitEditor\Recent File List
RegKey56=HKCU\Software\TechSmith\Snagit\22\SnagItEditor\Tray|Thumbnailsize

[Snapfish Picture Mover *]
LangSecRef=3023
DetectFile=%AppData%\PictureMover
FileKey1=%AppData%\PictureMover\Log|*

[Sniper: Art of Victory *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\271500
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Sniper Art of Victory\logs|*

[Sniper: Ghost Warrior *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\34830
FileKey1=%UserProfile%\Documents\Sniper - Ghost Warrior\out\logs|*

[Snuggle Truck *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\111100
FileKey1=%ProgramFiles%\Steam\steamapps\common\snuggle truck\Snuggle Truck_Data|output_log.txt

[Sobees *]
LangSecRef=3022
DetectFile=%AppData%\sobees Ltd\Sobees
FileKey1=%AppData%\sobees Ltd\Sobees\tmp\imagecache|*|RECURSE

[Sobolsoft Remove Metadata In Multiple Files Software *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\Sobolsoft\Remove Metadata In Multiple Files Software
RegKey1=HKCU\Software\VB and VBA Program Settings\Sobolsoft\Remove Metadata In Multiple Files Software|Output Folder
RegKey2=HKCU\Software\VB and VBA Program Settings\Sobolsoft\Remove Metadata In Multiple Files Software|Snapshot

[SocialFolders *]
LangSecRef=3022
DetectFile=%LocalAppData%\ftopia\SocialFolders
FileKey1=%LocalAppData%\ftopia\SocialFolders\Cache|*|RECURSE
FileKey2=%LocalAppData%\ftopia\SocialFolders\Dumps|*|RECURSE

[Soda PDF *]
LangSecRef=3021
DetectFile=%AppData%\Soda PDF*
FileKey1=%AppData%\Soda PDF*\Logs|*

[Soda Player *]
LangSecRef=3023
DetectFile=%LocalAppData%\sodaplayer
FileKey1=%AppData%\Soda Player|Cookies*
FileKey2=%AppData%\Soda Player\*Cache|*
FileKey3=%AppData%\Soda Player\acestream\engine|*.log
FileKey4=%AppData%\Soda Player\Local Storage|*
FileKey5=%LocalAppData%\sodaplayer|SquirrelSetup.log
FileKey6=%SystemDrive%\_acestream_cache_|*|REMOVESELF

[Soft Organizer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Soft Organizer
FileKey1=%ProgramFiles%\Soft Organizer|*.txt

[SoftCafe MenuPro *]
LangSecRef=3021
DetectFile=%AppData%\SoftCafe\MenuPro
FileKey1=%AppData%\SoftCafe\MenuPro|*.tmp

[SoftCDN YouTube Downloader *]
LangSecRef=3022
DetectFile=%AppData%\SoftCDN
FileKey1=%AppData%\SoftCDN|*.log

[SoftEther VPN *]
LangSecRef=3022
Detect=HKCU\Software\SoftEther Project\SoftEther VPN
FileKey1=%ProgramFiles%\SoftEther VPN Client|installer.cache
FileKey2=%ProgramFiles%\SoftEther VPN Client\backup.vpn_client.config|*.config
FileKey3=%ProgramFiles%\SoftEther VPN Client\client_log|*
FileKey4=%ProgramFiles%\SoftEther VPN Client\vpn_debug|*

[Softros Process Blocker *]
LangSecRef=3024
Detect=HKLM\Software\Policies\Softros\Process Blocker
FileKey1=%ProgramFiles%\Softros Systems\Process Blocker|*Log.txt

[SoftThinks CD Creator *]
LangSecRef=3021
Detect=HKLM\Software\SoftThinks
FileKey1=%WinDir%\CREATOR|*.log

[Softube Central *]
LangSecRef=3023
DetectFile=%AppData%\Softube*Central
FileKey1=%AppData%\Softube*Central\Logs|*
FileKey2=%AppData%\SoftubeCentral|*-journal;*.old;LOG;log.log;Network Persistent State|RECURSE
FileKey3=%AppData%\SoftubeCentral\*Cache|*|RECURSE
FileKey4=%AppData%\SoftubeCentral\blob_storage|*|RECURSE
FileKey5=%AppData%\SoftubeCentral\Softube Central\Logs|*

[Software Informer *]
LangSecRef=3023
DetectFile=%AppData%\Software Informer
FileKey1=%AppData%\Software Informer\cache\icons|*.tmp

[SoftwareOK BarcodeOK *]
LangSecRef=3024
Detect=HKCU\Software\BarcodeOK ist OK\BarcodeOK
RegKey1=HKCU\Software\BarcodeOK ist OK\BarcodeOK\Recent File List

[Solarix *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\284990
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Solarix\UDKGame\Logs|*

[SolarWinds Wake-On-Lan *]
LangSecRef=3022
Detect=HKCU\Software\VB and VBA Program Settings\Wake-On-Lan
FileKey1=%ProgramData%\SolarWinds\VB\Banners|*.bmp
FileKey2=%ProgramFiles%\SolarWinds\Free Tools\Installs|Wake-On-LAN.LOG
RegKey1=HKCU\Software\VB and VBA Program Settings\Wake-On-Lan\IP Broadcast
RegKey2=HKCU\Software\VB and VBA Program Settings\Wake-On-Lan\MAC Address

[Solid Edge *]
LangSecRef=3021
Detect1=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 109
Detect2=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 110
RegKey1=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 109\MRUex
RegKey2=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 110\MRUex

[SolidWorks *]
LangSecRef=3021
Detect=HKCU\Software\Solidworks
RegKey1=HKCU\Software\Solidworks\SolidWorks 2012\Recent File List
RegKey2=HKCU\Software\SolidWorks\SolidWorks 2013\Recent File List
RegKey3=HKCU\Software\Solidworks\SolidWorks 2014\Recent File List
RegKey4=HKCU\Software\SolidWorks\Solidworks 2015\Recent File List
RegKey5=HKCU\Software\SolidWorks\Solidworks 2016\Recent File List
RegKey6=HKCU\Software\SolidWorks\SOLIDWORKS 2017\Recent File List
RegKey7=HKCU\Software\Solidworks\SOLIDWORKS 2018\Recent File List
RegKey8=HKCU\Software\Solidworks\SOLIDWORKS 2018\Recent Folder List
RegKey9=HKCU\Software\Solidworks\SOLIDWORKS 2019\Recent File List
RegKey10=HKCU\Software\Solidworks\SOLIDWORKS 2019\Recent Folder List
RegKey11=HKCU\Software\SolidWorks\SOLIDWORKS 2020\Recent File List
RegKey12=HKCU\Software\SolidWorks\SOLIDWORKS 2020\Recent Folder List

[Solus *]
Section=Games
DetectFile=%LocalAppData%\Solus
FileKey1=%LocalAppData%\Solus\Saved\Config\CrashReportClient|*|RECURSE
FileKey2=%LocalAppData%\Solus\Saved\Logs|*

[Solvusoft WinSweeper *]
LangSecRef=3024
Detect=HKCU\Software\WinSweeper2
RegKey1=HKCU\Software\WinSweeper2|LastScan

[Solvusoft WinThruster *]
LangSecRef=3024
Detect=HKCU\Software\WinThruster
DetectFile=%AppData%\WinThruster
FileKey1=%AppData%\WinThruster\Backup|*
FileKey2=%AppData%\WinThruster\Log|*
FileKey3=%AppData%\WinThruster\Undo|*
RegKey1=HKCU\Software\WinThruster|InstallerName
RegKey2=HKCU\Software\WinThruster|LastScanDate
RegKey3=HKCU\Software\WinThruster|SizeToClean

[Solway Control3 *]
LangSecRef=3024
Detect=HKCU\Software\SolwaySoftware\Control3
RegKey1=HKCU\Software\SolwaySoftware\Control3|LastUserName
RegKey2=HKCU\Software\SolwaySoftware\Control3|LeftDefDir
RegKey3=HKCU\Software\SolwaySoftware\Control3|MiddleDefDir
RegKey4=HKCU\Software\SolwaySoftware\Control3|RightDefDir

[Solway Disk Investigator *]
LangSecRef=3024
Detect=HKLM\Software\SolwaySoftware\DiskInvestigator
RegKey1=HKLM\Software\SolwaySoftware\DiskInvestigator|Drive

[Solway Password Kernel *]
LangSecRef=3021
Detect=HKCU\Software\SolwaySoftware\PasswordKernel
RegKey1=HKCU\Software\SolwaySoftware\PasswordKernel|LastFile

[SOMA *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\282140
FileKey1=%UserProfile%\Documents\My Games\Soma\Main|*.log

[Sonata *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Sonata
FileKey1=%LocalAppData%\Sonata\temp|*|RECURSE
FileKey2=%ProgramFiles%\Sonata\update|*|RECURSE

[SongKong *]
LangSecRef=3023
DetectFile=%AppData%\SongKong
FileKey1=%AppData%\SongKong\Logs|*|RECURSE

[Sonic Visualiser *]
LangSecRef=3023
Detect=HKCU\Software\sonic-visualiser
DetectFile=%UserProfile%\.Sonic Visualiser
FileKey1=%AppData%\sonic-visualiser\Sonic Visualiser\cache|*
FileKey2=%AppData%\sonic-visualiser\Sonic Visualiser\log|*
FileKey3=%UserProfile%\.Sonic Visualiser\cache|*
RegKey1=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-0
RegKey2=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-1
RegKey3=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-2
RegKey4=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-3
RegKey5=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-4
RegKey6=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-5
RegKey7=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-6
RegKey8=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-7
RegKey9=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-8
RegKey10=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-9
RegKey11=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-10
RegKey12=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-11
RegKey13=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-12
RegKey14=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-13
RegKey15=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-14
RegKey16=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-15
RegKey17=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-16
RegKey18=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-17
RegKey19=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-18
RegKey20=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-19

[Sonique *]
LangSecRef=3023
Detect=HKCU\Software\MediaScience\Sonique
RegKey1=HKCU\Software\MediaScience\Sonique\Play_History
RegKey2=HKCU\Software\MediaScience\Sonique\URL_History

[Sony Magic Update *]
LangSecRef=3024
DetectFile=%AppData%\Sony Corporation\Auto Magic Update Client
FileKey1=%AppData%\Sony Corporation\Auto Magic Update Client|*.log

[Sony Media Go *]
LangSecRef=3021
Detect=HKCU\Software\Sony Corporation\Media Go
FileKey1=%AppData%\Sony\Media Go|*.bkd
FileKey2=%AppData%\Sony\Media Go Installer|*.log
FileKey3=%AppData%\Sony\Media Go\gnsdk|*.log
FileKey4=%LocalAppData%\Sony\ErrorReport|*
FileKey5=%LocalAppData%\Sony\Media Go Video Playback engine\logging|*.cflog

[Sony Media Manager *]
LangSecRef=3023
DetectFile=%AppData%\Sony\Media Manager
FileKey1=%AppData%\Sony\Media Manager|*.log;*log.txt
FileKey2=%AppData%\Sony\Media Manager\Thumbnails|*|RECURSE

[Sony Mobile Emma *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Emma
FileKey1=%ProgramFiles%\Sony Mobile\Emma\log|*
FileKey2=%ProgramFiles%\Sony Mobile\Emma\temp|*
FileKey3=%ProgramFiles%\Sony Mobile\Emma\workspace\.metadata|.log

[Sony Sound Organizer *]
LangSecRef=3024
DetectFile=%AppData%\Sony Corporation\Sound Organizer
FileKey1=%AppData%\Sony Corporation\Sound Organizer|*.log

[Sony VAIO *]
LangSecRef=3024
Detect=HKLM\Software\Sony Corporation
FileKey1=%ProgramData%\Sony Corporation\VAIO *|*.log;Log.txt

[Sony Xperia Companion *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\Sony\Xperia Companion
FileKey1=%UserProfile%\Documents\Sony\Xperia Companion\Autoupdate|*.exe
FileKey2=%UserProfile%\Documents\Sony\Xperia Companion\Cache|*
FileKey3=%UserProfile%\Documents\Sony\Xperia Companion\Logs|*

[Sony Xperia Flashtool *]
LangSecRef=3024
Detect=HKLM\Software\Flashtool
FileKey1=%SystemDrive%\Flashtool|*.log

[Sorcery! Parts 1 and 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\411000
FileKey1=%LocalAppData%\inkle\Sorcery|*.log

[Soulseek *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Soulseek*
FileKey1=%ProgramFiles%\Soulseek*|search.cfg
RegKey1=HKCU\Software\SoulSeek\SoulSeek\Recent File List
RegKey2=HKCU\Software\Soulseek2\config|search

[Soulseek Chat History *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Soulseek*
FileKey1=%LocalAppData%\Soulseek Chat Logs\*|*.log
FileKey2=%LocalAppData%\SoulseekQt\Soulseek Chat Logs|*.log|RECURSE
FileKey3=%ProgramFiles%\Soulseek*\*Chat_Logs|*.txt
FileKey4=%UserProfile%\Documents\Soulseek Chat Logs\Private|*.txt

[SoundMAX *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Analog Devices\SoundMAX
FileKey1=%ProgramFiles%\Analog Devices\SoundMAX|SMax.log*

[Space Engineers *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\244850
FileKey1=%AppData%\SpaceEngineers|*.log

[SpeedFan *]
LangSecRef=3024
Detect=HKCU\Software\SpeedFan
FileKey1=%ProgramFiles%\SpeedFan|debug.nfo;SFLog*.csv
FileKey2=%WinDir%\System32|initdebug.nfo
FileKey3=%WinDir%\SysWOW64|initdebug.nfo

[SpeedRunners *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\207140
FileKey1=%AppData%|SpeedRunnersLog.txt;TargetInvocationLog.txt

[SpeedyComputer *]
LangSecRef=3024
DetectFile=%AppData%\SpeedyComputer
FileKey1=%AppData%\SpeedyComputer\Log|*|RECURSE

[Spider Player *]
LangSecRef=3023
DetectFile=%AppData%\Spider Player
FileKey1=%AppData%\Spider Player|URLHistory.xml

[SpiderOak *]
LangSecRef=3024
DetectFile=%AppData%\SpiderOak
FileKey1=%AppData%\SpiderOak|*.log|RECURSE
FileKey2=%AppData%\SpiderOak\download_cache|*

[Spiral Knights *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\99900
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Spiral Knights|*.log

[Spitfire Audio *]
LangSecRef=3023
DetectFile1=%AppData%\com.spitfireaudio
DetectFile2=%AppData%\Spitfire Audio
FileKey1=%AppData%\com.spitfireaudio|*.log
FileKey2=%AppData%\Spitfire Audio\settings|*.log

[Spitkiss *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Triple Topping Games\Spitkiss
FileKey1=%UserProfile%\AppData\LocalLow\Triple Topping Games\Spitkiss|*txt
FileKey2=%UserProfile%\AppData\LocalLow\Triple Topping Games\Spitkiss\Unity|*|REMOVESELF

[SPlayer *]
LangSecRef=3023
DetectFile=%AppData%\SPlayer
FileKey1=%AppData%\SPlayer|default.mpcpl;local.db

[Splice *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\209790
FileKey1=%ProgramFiles%\Steam\steamapps\common\splice|output_log.txt
FileKey2=%ProgramFiles%\Steam\steamapps\common\Splice\Splice_Data|output_log.txt
FileKey3=%UserProfile%\Documents|GALog.txt

[SpongeBob Diner Dash *]
Section=Games
DetectFile=%ProgramFiles%\SpongeBob Diner Dash
FileKey1=%ProgramFiles%\SpongeBob Diner Dash|logfile.*

[Spooky Mall *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spooky Mall1.0
FileKey1=%ProgramData%\SpookyMall|*.xml_log
FileKey2=%ProgramFiles%\Foxy Games\Spooky Mall|*.log

[SporTV *]
LangSecRef=3021
DetectFile=%LocalAppData%\SporTV
FileKey1=%LocalAppData%\SporTV\Logs|*

[Spotflux *]
LangSecRef=3021
Detect=HKLM\Software\Spotflux
DetectFile=%ProgramFiles%\Spotflux
FileKey1=%AppData%\.spotflux|*.log

[Spotify - Downloaded Songs *]
LangSecRef=3036
DetectFile1=%AppData%\Spotify
DetectFile2=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0
FileKey1=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\LocalState\Spotify\Storage|*|REMOVESELF
FileKey2=%LocalAppData%\Spotify\Storage|*|REMOVESELF

[Spotify *]
LangSecRef=3036
DetectFile1=%AppData%\Spotify
DetectFile2=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0
FileKey1=%AppData%\Spotify|*.log
FileKey2=%AppData%\Spotify\users\*|ad-state-storage.bnk;frequency.pb;local-files.bnk;local_sync_state;watch-sources.bnk
FileKey3=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\LocalCache\Spotify|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\LocalState\Users\*|ad-state-storage.bnk;cached;context_player_state_restore
FileKey6=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Settings|*.log*
FileKey7=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\SystemAppData\Helium|*.log*
FileKey8=%LocalAppData%\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\TempState|*|REMOVESELF
FileKey9=%LocalAppData%\Spotify|*|REMOVESELF
ExcludeKey1=PATH|%LocalAppData%\Spotify\Storage\*\|*

[Spoutcraft *]
Section=Games
DetectFile=%AppData%\.spoutcraft
FileKey1=%AppData%\.spoutcraft|*.log
FileKey2=%AppData%\.spoutcraft\logs|*

[Sprint Hero RUU *]
LangSecRef=3023
DetectFile=%SystemDrive%\ruu_log
FileKey1=%SystemDrive%\ruu_log|*|REMOVESELF

[Spybot AntiBeacon *]
LangSecRef=3024
DetectFile=%LocalAppData%\Safer-Networking Ltd\Spybot*
FileKey1=%LocalAppData%\Safer-Networking Ltd\Spybot*|*.log;Spybot Lab.txt

[Spybot Search and Destroy *]
LangSecRef=3024
Detect1=HKCU\Software\Safer Networking Limited\Spybot - Search & Destroy 2
Detect2=HKLM\Software\Safer Networking Limited\SpybotSnD
FileKey1=%ProgramData%\Spybot - Search & Destroy\Logs|*|RECURSE
FileKey2=%ProgramData%\Spybot - Search & Destroy\System Configuration Snapshots|*|REMOVESELF
FileKey3=%ProgramFiles%\Spybot - Search & Destroy 2\Updates|*|RECURSE
FileKey4=%ProgramFiles%\Spybot - Search & Destroy\Updates|*.zip
FileKey5=%UserProfile%\Documents\ProcAlyzer Dumps|*|REMOVESELF
ExcludeKey1=FILE|%ProgramFiles%\Spybot - Search & Destroy 2\Updates\Downloads\|updates.uid

[Spybot Search and Destroy Backups *]
LangSecRef=3024
Detect=HKLM\Software\Safer Networking Limited\SpybotSnD
FileKey1=%ProgramData%\Spybot - Search & Destroy\Backups|*|RECURSE
FileKey2=%ProgramData%\Spybot - Search & Destroy\Recovery|*|RECURSE
FileKey3=%ProgramData%\Spybot - Search & Destroy\Snapshots*|*|RECURSE
FileKey4=%WinDir%\System32\drivers\etc|hosts.*.backup

[SpyHunter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\EnigmaSoft\SpyHunter
FileKey1=%ProgramFiles%\EnigmaSoft\SpyHunter\Logs|*

[SpyShelter *]
LangSecRef=3024
DetectFile=%AppData%\SpyShelter
FileKey1=%AppData%\SpyShelter|shelter-log.txt

[SpywareBlaster Update File *]
LangSecRef=3024
DetectFile=%ProgramFiles%\SpywareBlaster
FileKey1=%ProgramFiles%\SpywareBlaster|spywareblasterupgrade_latest.exe

[SQL Anywhere 11 *]
LangSecRef=3021
DetectFile=%ProgramData%\SQL Anywhere 11
FileKey1=%ProgramData%\SQL Anywhere 11\Diagnostics|*.crash_log;*.dmp

[SQLite Expert 3 *]
LangSecRef=3024
Detect1=HKCU\Software\SQLite Expert\Personal\3.x
Detect2=HKCU\Software\SQLite Expert\Professional\3.x
RegKey1=HKCU\Software\SQLite Expert\Personal\3.x\DB
RegKey2=HKCU\Software\SQLite Expert\Professional\3.x\DB

[SQLiteMan *]
LangSecRef=3021
Detect=HKCU\Software\yarpen.cz\sqliteman
RegKey1=HKCU\Software\yarpen.cz\sqliteman|lastDatabase

[Squirrel.Windows *]
LangSecRef=3021
DetectFile=%LocalAppData%\SquirrelTemp
FileKey1=%LocalAppData%\SquirrelTemp|*|REMOVESELF

[Star Citizen *]
Section=Games
DetectFile1=%AppData%\rsilauncher
DetectFile2=%LocalAppData%\Star Citizen
FileKey1=%AppData%\RSI Launcher|*|RECURSE
FileKey2=%AppData%\rsilauncher|*.jpg;*.log
FileKey3=%AppData%\rsilauncher\*Cache|*
FileKey4=%AppData%\rsilauncher\*update*|*
FileKey5=%LocalAppData%\Star Citizen|*
FileKey6=%ProgramFiles%\Roberts Space Industries\StarCitizen\LIVE|*.log|RECURSE

[Star Downloader *]
LangSecRef=3021
Detect=HKCU\Software\Star Downloader
FileKey1=%ProgramFiles%\Star Downloader|LastURLs;serverstats.txt
FileKey2=%ProgramFiles%\Star Downloader\Partial Downloads|*|RECURSE

[Star Swarm Stress Test *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\267130
FileKey1=%UserProfile%\Documents\Star Swarm|output*.txt

[Star Trek Online *]
Section=Games
Detect1=HKCU\Software\Cryptic\Star Trek Online
Detect2=HKCU\Software\Valve\Steam\Apps\9900
FileKey1=%ProgramFiles%\Steam\Steamapps\Common\star trek online\Star Trek Online\*\cache|*
FileKey2=%ProgramFiles%\steam\steamapps\common\star trek online\star trek online\*\logs\GameClient|*
FileKey3=%Public%\Games\Cryptic Studios\Star Trek Online\*\Cache|*
FileKey4=%Public%\Games\Cryptic Studios\Star Trek Online\*\Logs\GameClient|*

[Star Wars: Battlefront II *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\6060
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Star Wars BattleFront II|update*.txt

[Star Wars: The Force Unleashed *]
Section=Games
DetectFile=%LocalAppData%\LucasArts\Star Wars The Force Unleashed*
FileKey1=%LocalAppData%\LucasArts\Star Wars The Force Unleashed*|*

[Star Wars: The Old Republic *]
Section=Games
Detect=HKLM\Software\BioWare\Star Wars-The Old Republic
FileKey1=%LocalAppData%\SWTOR\CrashDump\swtor|*
FileKey2=%ProgramFiles%\EA Games\Star Wars - The Old Republic\__Installer|InstallLog.txt
FileKey3=%ProgramFiles%\EA Games\Star Wars - The Old Republic\logs|*
FileKey4=%ProgramFiles%\EA Games\Star Wars - The Old Republic\swtor\retailclient\swtor\logs|*
FileKey5=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\betatest\retailclient\Temp|*.log
FileKey6=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\logs|*.log
FileKey7=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\swtor\retailclient\swtor\logs|*.log
FileKey8=%UserProfile%\Documents|*Install STAR WARS The Old Republic.log

[StarCraft I/II *]
Section=Games
Detect1=HKCU\Software\Blizzard Entertainment\Starcraft
Detect2=HKLM\Software\Blizzard Entertainment\StarCraft II
FileKey1=%AppData%\Blizzard\StarCraft|*Log.txt
FileKey2=%LocalAppData%\Blizzard Entertainment\StarCraft II\BrowserCookies|*-journal;*.old;LOG;Visited Links|RECURSE
FileKey3=%LocalAppData%\Blizzard Entertainment\StarCraft II\BrowserCookies\*Cache|*
FileKey4=%UserProfile%\Documents\StarCraft II\*Logs|*|RECURSE
FileKey5=%UserProfile%\Documents\StarCraft\Errors|*
RegKey1=HKCU\Software\Blizzard Entertainment\StarCraft II Editor\Recent Files

[Stardew Valley *]
Section=Games
DetectFile=%AppData%\StardewValley
FileKey1=%AppData%\StardewValley\ErrorLogs|*.txt

[Stardock Fences *]
LangSecRef=3024
Detect1=HKLM\Software\Stardock\Misc\Fences
Detect2=HKLM\Software\Stardock\Misc\Fences2
DetectFile=%LocalAppData%\Stardock\Fences*
FileKey1=%AppData%\Stardock\Fences\TroubleshootingLog|*.dat;*.txt
FileKey2=%LocalAppData%\Stardock\Fences*|*Log.txt
FileKey3=%ProgramData%\Stardock\Fences*|Cache.dat
FileKey4=%ProgramFiles%\Stardock\Fences|*.txt

[Stardock ObjectDock Plus *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Stardock\ObjectDock Plus
FileKey1=%AppData%\Stardock|*|REMOVESELF
FileKey2=%LocalAppData%\ODUI|*|REMOVESELF
FileKey3=%LocalAppData%\Stardock\ObjectDockPlus|*Backup.ini
FileKey4=%ProgramData%\Stardock|*|RECURSE

[Stardock Start11 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Stardock\Start11
FileKey1=%LocalAppData%\StarDock\Start11|SasLog.txt
FileKey2=%ProgramData%\StarDock\Start11\Update|*.exe

[StarMoney *]
LangSecRef=3021
DetectFile=%ProgramData%\StarMoney*
FileKey1=%ProgramData%\StarMoney *|*.log|RECURSE

[StarOffice *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Sun\StarOffice*
FileKey1=%AppData%\StarOffice*\user\registry\data\org\openoffice\Office|Common.xcu

[Start Menu Reviver *]
LangSecRef=3024
Detect=HKLM\Software\Start Menu Reviver
FileKey1=%ProgramFiles%\ReviverSoft\Start Menu Reviver\Logs|*

[Startup Panic *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Algorock\Startup Panic
FileKey1=%UserProfile%\AppData\LocalLow\Algorock\Startup Panic|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Algorock\Startup Panic\Unity|*|REMOVESELF

[StarVaders *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Pengonauts\StarVaders
FileKey1=%UserProfile%\AppData\LocalLow\Pengonauts\StarVaders|*.log;UnityServicesCachedMetrics
FileKey2=%UserProfile%\AppData\LocalLow\Pengonauts\StarVaders\Unity|*|REMOVESELF

[Staxel *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\405710
FileKey1=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\cache|*
FileKey2=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\cookies|*
FileKey3=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\crashlogs|*

[STDU Explorer *]
LangSecRef=3021
Detect=HKCU\Software\STDUtility\STDUExplorerApp
RegKey1=HKCU\Software\STDUtility\STDUExplorerApp\PathMRUList

[STDU Viewer *]
LangSecRef=3021
DetectFile=%ProgramFiles%\STDU Viewer
FileKey1=%LocalAppData%\STDUViewer|browse.cache;FilesViewerState.xml;STDUSessions.xml
FileKey2=%ProgramFiles%\STDU Viewer|browse.cache;FilesViewerState.xml;STDUSessions.xml

[Steam *]
Section=Games
Detect=HKCU\Software\Valve\Steam
FileKey1=%AppData%\SteamVR\Logs|*|REMOVESELF
FileKey2=%CommonProgramFiles%\Steam|*_log.txt
FileKey3=%LocalAppData%\Steam\htmlcache|*|REMOVESELF
FileKey4=%ProgramData%\Steam\RLD!\*|last.txt
FileKey5=%ProgramFiles%\Steam|*.log;*.old
FileKey6=%ProgramFiles%\Steam\appcache\httpcache|*|REMOVESELF
FileKey7=%ProgramFiles%\Steam\bin\cef\*|debug.log
FileKey8=%ProgramFiles%\Steam\config\*cache|*
FileKey9=%ProgramFiles%\Steam\depotcache|*
FileKey10=%ProgramFiles%\Steam\dumps|*|RECURSE
FileKey11=%ProgramFiles%\Steam\logs|*
FileKey12=%ProgramFiles%\Steam\music\_database|*|RECURSE
FileKey13=%ProgramFiles%\Steam\tenfoot\config\httpcache|*|RECURSE
FileKey14=%ProgramFiles%\Steam\tenfoot\config\images\web|*|RECURSE
FileKey15=%ProgramFiles%\Steam\userdata\*\*|RemoveEmptyFoldersOnly|REMOVESELF
FileKey16=%ProgramFiles%\Steam\userdata\*\*\local|socache.dt
FileKey17=%ProgramFiles%\Steam\userdata\*\*msgcache|*|RECURSE
FileKey18=%ProgramFiles%\Steam\userdata\*\config\*cache|*|RECURSE
FileKey19=%ProgramFiles%\Steam\vr\runtime\logs|*|RECURSE

[Steam Games *]
Section=Games
Detect=HKCU\Software\Valve\Steam
FileKey1=%ProgramFiles%\Steam\steamapps|*.dmp;*.icns;*.log;*.mdmp;*.tmp;.DS_Store;logfile.*|RECURSE
FileKey2=%ProgramFiles%\Steam\steamapps\common\*\*\downloads|*|RECURSE
FileKey3=%ProgramFiles%\Steam\steamapps\common\*\Cache|*|RECURSE
FileKey4=%ProgramFiles%\Steam\steamapps\common\*\config\html|*|RECURSE
FileKey5=%ProgramFiles%\Steam\steamapps\common\*\DebugData|*|RECURSE
FileKey6=%ProgramFiles%\Steam\steamapps\downloading|*|RECURSE
FileKey7=%ProgramFiles%\Steam\steamapps\shadercache|*|RECURSE
FileKey8=%ProgramFiles%\Steam\steamapps\temp|*|RECURSE
FileKey9=%ProgramFiles%\Steam\steamapps\workshop\downloads|*|RECURSE
FileKey10=%ProgramFiles%\Steam\steamapps\workshop\temp|*|RECURSE
ExcludeKey1=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler 1936\Cache\|*
ExcludeKey2=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler Cold War\Cache\|*
ExcludeKey3=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler Ultimate\Cache\|*

[Steam Installers *]
Section=Games
Detect=HKCU\Software\Valve\Steam
Warning=This entry should only be enabled after you have launched each of your installed Steam games at least once. Deleting these files before then may cause Steam to think the game's installation is broken. After the first launch, these files become useless.
FileKey1=%ProgramFiles%\Steam\Steamapps\common|*.cab;*.msp;*.msu;*.vdk;*d3dx11*.cat;*d3dx11*.inf;*inst*.vdf;*NetFx*.*;*pbsvc*.exe;*redist*.exe;*redist.msi*;*setup*.exe;*setup*.msi;*UPlay*Installer*.exe;*vc*red*.exe;*vc*red.msi;ac3filter*.exe;AdbeRdr*.*;bitmap2substance_installer.exe;cmp.bat;d3d*.exe;D3D*Install*.dll;D3D*Install.exe;directx*.exe;dosbox*.tar.gz;DSETUP*.DLL;DSInstaller.exe;EAappInstaller.exe;eadm-installer.exe;eula.*.*;firewallinstallhelper.dll;GamesExplorerIntegrationTool.exe;gameuxinstallhelper.dll;GDFInstall.exe;globdata.ini;install.exe;install.ini;install.res.*.dll;locdata.*.ini;mcpp*.*;Microsoft .NET Framework*.bat;Microsoft .NET Framework*.cmd;Microsoft Visual C++ *.cmd;msxml6.msi;NDP*.exe;oalinst.exe;p4vinst*.exe;perforce*.exe;PhysX*.exe;PhysX*.msi;prompt.bat;PVRTexTool.exe;python*.msi;RGB9RAST*.msi;setupres.*.dll;SPInstaller.exe;umdf.exe;wapres.*.dll;WIC*.exe;Windows*-KB*.exe;windowsdesktop-runtime-*-win-x64.exe;WindowsInstaller*.exe;WMF*Dist*.exe;wmp11-windowsxp-x86-enu.exe;wmpappcompat.exe;XPSEPC*.exe|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\Steam\Steamapps\common\SteamVR\tools\steamvr_room_setup\win64\|steamvr_room_setup.exe

[Steam Packages *]
Section=Games
Detect=HKCU\Software\Valve\Steam
FileKey1=%ProgramFiles%\Steam\package|*.zip.*

[SteamWorld Dig *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252410
FileKey1=%ProgramFiles%\Steam\Steamapps\common\SteamWorld Dig|*.mdmp

[SteamWorld Dig 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\571310
FileKey1=%UserProfile%\Documents\My Games\SteamWorld Dig 2\*|log.txt

[Steed *]
LangSecRef=3022
DetectFile=%ProgramData%\Steed
FileKey1=%ProgramData%\Steed\Logs|*|REMOVESELF

[SteelSeries *]
LangSecRef=3024
DetectFile=%ProgramData%\SteelSeries
FileKey1=%AppData%\SteelSeries-Engine-*-Client|*.old;LOG|RECURSE
FileKey2=%AppData%\SteelSeries-Engine-*-Client\*Cache|*|RECURSE
FileKey3=%AppData%\SteelSeries-Engine-*-Client\blob_storage|*|RECURSE
FileKey4=%ProgramData%\SteelSeries\SteelSeries Engine*\Logs|*|REMOVESELF
FileKey5=%ProgramFiles%\SteelSeries\SteelSeries Engine*|*.log

[Steinberg Cubase *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Steinberg\Cubase*
FileKey1=%ProgramFiles%\Steinberg\Cubase*|*.log

[Stellar Phoenix Registry Manager *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Stellar Phoenix Registry Manager
FileKey1=%SystemDrive%|LogReport.txt

[Stellaris *]
Section=Games
DetectFile=%UserProfile%\Documents\Paradox Interactive\Stellaris
FileKey1=%UserProfile%\Documents\Paradox Interactive\Stellaris\.launcher-cache|*
FileKey2=%UserProfile%\Documents\Paradox Interactive\Stellaris\_backup_*\ShaderCache\dx*|*|REMOVESELF
FileKey3=%UserProfile%\Documents\Paradox Interactive\Stellaris\Cache|*
FileKey4=%UserProfile%\Documents\Paradox Interactive\Stellaris\Crashes|*|REMOVESELF
FileKey5=%UserProfile%\Documents\Paradox Interactive\Stellaris\Dumps|*
FileKey6=%UserProfile%\Documents\Paradox Interactive\Stellaris\Logs|*
FileKey7=%UserProfile%\Documents\Paradox Interactive\Stellaris\Screenshots|*.png
FileKey8=%UserProfile%\Documents\Paradox Interactive\Stellaris\ShaderCache\dx*|*|REMOVESELF

[Stellarium *]
LangSecRef=3021
DetectFile=%AppData%\Stellarium
FileKey1=%AppData%\Stellarium|log.txt
FileKey2=%LocalAppData%\Stellarium\Cache|*|RECURSE
FileKey3=%LocalAppData%\stellarium\stellarium\cache|*|RECURSE

[StepMania *]
Section=Games
DetectFile=%AppData%\StepMania*
FileKey1=%AppData%\Stepmania*\Logs|*

[SterJo NetStalker *]
LangSecRef=3022
DetectFile=%LocalAppData%\SterJo NetStalker
FileKey1=%LocalAppData%\SterJo NetStalker|dscnt.exe;History.sjh
FileKey2=%LocalAppData%\SterJo NetStalker\Logs|*

[STOIK Smart Resizer *]
LangSecRef=3023
Detect1=HKCU\Software\STOIK Smart Resizer 1.0\STOIK Smart Resizer
Detect2=HKCU\Software\STOIK Smart Resizer 2.0\STOIK Smart Resizer
Detect3=HKCU\Software\STOIK Smart Resizer 3.0\STOIK Smart Resizer
RegKey1=HKCU\Software\STOIK Smart Resizer 1.0\STOIK Smart Resizer\Recent File List
RegKey2=HKCU\Software\STOIK Smart Resizer 2.0\STOIK Smart Resizer\Recent File List
RegKey3=HKCU\Software\STOIK Smart Resizer 3.0\STOIK Smart Resizer\Recent File List

[STOIK Video Converter 2 *]
LangSecRef=3023
Detect=HKCU\Software\STOIK
FileKey1=%AppData%\STOIK\videopak2|*.ini

[Stranded Deep *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Beam Team Games\Stranded Deep
FileKey1=%UserProfile%\AppData\LocalLow\Beam Team Games\Stranded Deep|*.log

[Stranglehold *]
Section=Games
DetectFile=%LocalAppData%\Midway\Stranglehold
FileKey1=%LocalAppData%\Midway\Stranglehold|*.log|RECURSE
FileKey2=%LocalAppData%\Midway\Stranglehold\Cache|*|REMOVESELF

[Stream-Cloner *]
LangSecRef=3023
Detect=HKCU\Software\Stream-Cloner
FileKey1=%AppData%\Stream-Cloner|*.log;IeRecentVisit.txt
FileKey2=%AppData%\Stream-Cloner\Cap_images|*|REMOVESELF
FileKey3=%AppData%\Stream-Cloner\thumbs|*|REMOVESELF

[Stremio *]
LangSecRef=3022
DetectFile=%LocalAppData%\Smart Code LTD\Stremio
FileKey1=%AppData%\Stremio\Stremio-Server\Stremio-Cache|*|RECURSE
FileKey2=%LocalAppData%\Smart Code LTD\Stremio\Cache|*|RECURSE
FileKey3=%LocalAppData%\Smart Code LTD\Stremio\QtWebEngine\Default|*-journal;LOG;LOG.old;Origin Bound Certs;QuotaManager;Visited Links|RECURSE
FileKey4=%LocalAppData%\Smart Code LTD\Stremio\QtWebEngine\Default\Service Worker\*Cache*|*|RECURSE

[Stronghold Crusader *]
Section=Games
DetectFile=%ProgramFiles%\Firefly Studios\Stronghold Crusader
FileKey1=%ProgramFiles%\Firefly Studios\Stronghold Crusader\gfx|*log.txt

[StudioLine Photo Basic *]
LangSecRef=3023
Detect=HKCU\Software\StudioLine\StudioLine Photo Basic
DetectFile=%ProgramFiles%\StudioLine Photo Basic
FileKey1=%ProgramData%\H&M System Software\StudioLine Photo Basic 3|*.bak;*.dmp;*.log
RegKey1=HKCU\Software\H&&M System Software\Twain\Recent File List
RegKey2=HKCU\Software\StudioLine\StudioLine Photo Basic\WindowPositions

[SubiT *]
LangSecRef=3023
DetectFile=%AppData%\SubiT
FileKey1=%AppData%\SubiT\settings|crash.log

[Sublime Text Backups *]
LangSecRef=3024
DetectFile=%AppData%\Sublime Text*
FileKey1=%AppData%\Sublime Text 3\Backup|*|REMOVESELF

[Sublime Text Session *]
LangSecRef=3024
DetectFile=%AppData%\Sublime Text*
FileKey1=%AppData%\Sublime Text 2\Settings|*.sublime_session
FileKey2=%AppData%\Sublime Text 3\Local|Session.sublime_session
FileKey3=%AppData%\Sublime Text\Options|*

[Success Story *]
Section=Games
DetectFile=%AppData%\Shape Games\SuccessStory
FileKey1=%AppData%\Shape Games\SuccessStory\logs|*

[SumatraPDF *]
LangSecRef=3024
DetectFile1=%AppData%\SumatraPDF
DetectFile2=%LocalAppData%\SumatraPDF
DetectFile3=%SystemDrive%\PortableApps\SumatraPDFPortable
FileKey1=%AppData%\SumatraPDF\sumatrapdfcache|*
FileKey2=%LocalAppData%\SumatraPDF\sumatrapdfcache|*
FileKey3=%SystemDrive%\PortableApps\SumatraPDFPortable\Data\settings\sumatrapdfcache|*

[Sundered *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Thunder Lotus Games\Sundered
FileKey1=%ProgramFiles%\Steam\Steamapps\common\sundered\sundered_data|*log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Thunder Lotus Games\Sundered|*txt

[SuniSoft Registry Clean Expert *]
LangSecRef=3024
Detect=HKCU\Software\SuniSoft\IncUpdate\Registry Clean Expert
FileKey1=%ProgramFiles%\Registry Clean Expert|fixlog.ini

[SUPERAntiSpyware *]
LangSecRef=3024
Detect1=HKCU\Software\SUPERAntiSpyware.com\SUPERAntiSpyware
Detect2=HKLM\Software\SUPERAntiSpyware.com\SUPERAntiSpyware
FileKey1=%ProgramData%\!SASCORE\AppLogs|*.dmp;*.SDB
FileKey2=%ProgramData%\SUPERAntiSpyware.com\SUPERAntiSpyware\Applogs|*.dmp;*.SDB;*.ZIP
FileKey3=%ProgramFiles%\SUPERAntiSpyware|*.tmp

[SuperEasy Software Driver Updater *]
LangSecRef=3023
Detect=HKLM\Software\SuperEasy Software
FileKey1=%AppData%\SuperEasy Software\Driver Updater|*.log

[Superliminal *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\PillowCastle\Superliminal*
FileKey1=%UserProfile%\AppData\LocalLow\PillowCastle\Superliminal*|*.log

[Supermium Autofill Data & Search Engine Preferences *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|*Web Data
FileKey2=%LocalAppData%\Supermium\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Supermium\User Data\AutoFill*|*|REMOVESELF

[Supermium Autoplay Preferences *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\MEIPreload|*|REMOVESELF

[Supermium Bookmark Backups *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|Bookmarks.bak

[Supermium Bookmark Favicons *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|favicons*

[Supermium Caches *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Supermium\User Data|Module Info Cache
FileKey3=%LocalAppData%\Supermium\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Supermium\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Supermium\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Supermium\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Supermium\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Supermium\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Supermium\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Supermium\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Supermium\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Supermium\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Supermium\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Supermium\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Supermium\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Supermium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Supermium\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Supermium\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Supermium\User Data\Optimization*|*|REMOVESELF

[Supermium Default App Handlers *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|PreferredApps

[Supermium Download History *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Supermium\User Data\*\shared_proto_db|*|REMOVESELF

[Supermium DRM Data *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Supermium\User Data\WidevineCdm|*|REMOVESELF

[Supermium Extension Cookies *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|Extension Cookies

[Supermium Pinned Tabs *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
RegKey1=HKCU\Software\Supermium\PreferenceMACs\Default|pinned_tabs

[Supermium Privacy Sandbox *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Supermium\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Supermium\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Supermium\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Supermium\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Supermium\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Supermium\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Supermium\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Supermium Progressive Web Apps *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\Web Applications|*|REMOVESELF

[Supermium Saved Usernames & Passwords *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|Login Data*

[Supermium Security & Threat Detection *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|DIPS*
FileKey2=%LocalAppData%\Supermium\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Supermium\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Supermium\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Supermium\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Supermium\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Supermium\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Supermium\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Supermium\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Supermium\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Supermium\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Supermium\User Data\ZxcvbnData|*|REMOVESELF

[Supermium Shopping Insights *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Supermium\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Supermium\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Supermium\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Supermium\User Data\*\parcel_tracking_db|*|REMOVESELF

[Supermium Storage Quota Manager *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|QuotaManager

[Supermium Sync Data *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\Sync Data|*|REMOVESELF

[Supermium Telemetry *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\Application|debug.log
FileKey2=%LocalAppData%\Supermium\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Supermium\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Supermium\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Supermium\User Data\*|*.log
FileKey6=%LocalAppData%\Supermium\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Supermium\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Supermium\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Supermium\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Supermium\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Supermium\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Supermium\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Supermium\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Supermium\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Supermium\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Supermium\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Supermium\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Supermium\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Supermium\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Supermium\Application|debug.log
FileKey21=%ProgramFiles%\Supermium\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Supermium\BlBeacon|failed_count
RegKey2=HKCU\Software\Supermium\BlBeacon|state
RegKey3=HKCU\Software\Supermium\Installer|LastChecked
RegKey4=HKCU\Software\Supermium\StabilityMetrics

[Supermium Web Browsing Cookies *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\Network|Cookies*;Device Bound Sessions*

[Supermium Web Browsing History *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Supermium Web Browsing Session *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Supermium\User Data\*\Sessions|*|REMOVESELF

[Supermium Web Storage *]
Section=Supermium Web Browser
DetectFile=%LocalAppData%\Supermium\User Data
FileKey1=%LocalAppData%\Supermium\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Supermium\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Supermium\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Supermium\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Supermium\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Supermium\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Supermium\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Supermium\User Data\*\WebStorage|*|REMOVESELF

[SuperMP3Download *]
LangSecRef=3023
DetectFile=%ProgramFiles%\SuperMp3Download
FileKey1=%ProgramData%\SuperMP3Download|downloadlist.sav
FileKey2=%ProgramData%\SuperMP3Download\Downloading|*|RECURSE

[Superstar Racing *]
Section=Games
DetectFile=%LocalAppData%\Chat Republic Games\Superstar Racing
FileKey1=%LocalAppData%\Chat Republic Games\Superstar Racing|log*.*

[SuperSync *]
LangSecRef=3023
DetectFile=%AppData%\SuperSync
FileKey1=%AppData%\SuperSync\logs|*
FileKey2=%AppData%\SuperSync\tmp|*|RECURSE

[SuperWinMenu *]
LangSecRef=3024
DetectFile=%AppData%\SuperWinMenu
FileKey1=%AppData%\SuperWinMenu|*.lastused

[Surfshark VPN *]
LangSecRef=3022
DetectFile=%AppData%\Surfshark
FileKey1=%AppData%\Surfshark|*.log
FileKey2=%LocalAppData%\Surfshark\EventsCache|*|RECURSE
FileKey3=%ProgramData%\Surfshark|*.log
FileKey4=%ProgramData%\Surfshark\EventsCache|*|RECURSE

[SuuntoLink *]
LangSecRef=3024
DetectFile=%AppData%\SuuntoLink
FileKey1=%AppData%\SuuntoLink|*.dmp;*.log
FileKey2=%AppData%\SuuntoLink\*Cache|*
FileKey3=%AppData%\SuuntoLink\Feedback|*.dmp;*.log
FileKey4=%AppData%\SuuntoLink\Logs|*
FileKey5=%AppData%\SuuntoLink\webrtc_event_logs|*
FileKey6=%LocalAppData%\SuuntoLink|*.log|RECURSE

[Swiff Player *]
LangSecRef=3023
Detect=HKCU\Software\GlobFX Technologies\Swiff Player
RegKey1=HKCU\Software\GlobFX Technologies\Swiff Player\Recent File List

[Swift *]
LangSecRef=3022
Detect=HKCU\Software\Swift
FileKey1=%AppData%\Swift\Avatars|*|RECURSE
FileKey2=%AppData%\Swift\Crashes|*|RECURSE

[Syberfix Helpdesk *]
LangSecRef=3021
DetectFile=%LocalAppData%\Syberfix\UserSaved\Helpdesk*
FileKey1=%LocalAppData%\SyberFix\UserSaved\Helpdesk *|*.log

[Sylpheed *]
LangSecRef=3022
DetectFile=%AppData%\Sylpheed
FileKey1=%AppData%\Sylpheed|*.bak*;*.log

[Symantec Ghost *]
LangSecRef=3024
Detect=HKCU\Software\Symantec\Symantec Ghost
RegKey1=HKCU\Software\Symantec\Symantec Ghost\Explorer\Ghost Explorer\Recent File List

[Symantec SymSilent *]
LangSecRef=3024
DetectFile=%Public%\Symantec\SymSilent
FileKey1=%Public%\Symantec\SymSilent\ccLog|*

[SyncBackFree *]
LangSecRef=3024
Detect=HKCU\Software\2BrightSparks\SyncBackFree
FileKey1=%LocalAppData%\2BrightSparks\SyncBackFree\Logs|*

[Synchronize It! *]
LangSecRef=3021
Detect=HKCU\Software\grigsoft.com\Synchronize It!
RegKey1=HKCU\Software\grigsoft.com\Synchronize It!\Combos
RegKey2=HKCU\Software\grigsoft.com\Synchronize It!\Synchronize It!\Combos

[Syncovery *]
LangSecRef=3024
Detect=HKCU\Software\Syncovery
FileKey1=%ProgramData%\Syncovery\Logs|*.log|RECURSE

[Syncthing *]
LangSecRef=3022
DetectFile=%LocalAppData%\Syncthing
FileKey1=%LocalAppData%\Syncthing|*.log;*.xml.v*
FileKey2=%ProgramFiles%\Syncthing|*.old

[SyncTrayzor *]
LangSecRef=3022
DetectFile=%AppData%\SyncTrayzor
FileKey1=%AppData%\SyncTrayzor|*.old
FileKey2=%AppData%\SyncTrayzor\logs|*|REMOVESELF

[Synergy *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Leikir Studio\Synergy
FileKey1=%UserProfile%\AppData\LocalLow\Leikir Studio\Synergy|*.log

[Synthesia *]
Section=Games
Detect=HKCU\Software\Classes\synthesia
FileKey1=%AppData%\Synthesia|log*.txt;recentSongs.xml

[Sysinternals DebugView *]
LangSecRef=3024
Detect=HKCU\Software\Sysinternals\DbgView
RegKey1=HKCU\Software\Sysinternals\DbgView|Recent

[Sysinternals Process Explorer *]
LangSecRef=3024
Detect1=HKCU\Software\Sysinternals\Process Explorer
Detect2=HKU\.DEFAULT\Software\Sysinternals\Process Explorer
Detect3=HKU\S-1-5-18\Software\Sysinternals\Process Explorer
RegKey1=HKCU\Software\Sysinternals\Process Explorer|SymbolPath
RegKey2=HKU\.DEFAULT\Software\Sysinternals\Process Explorer|SymbolPath
RegKey3=HKU\S-1-5-18\Software\Sysinternals\Process Explorer|SymbolPath

[Sysinternals Process Monitor *]
LangSecRef=3024
Detect=HKCU\Software\Sysinternals\Process Monitor
RegKey1=HKCU\Software\Sysinternals\Process Monitor|Logfile
RegKey2=HKCU\Software\Sysinternals\Process Monitor|SourcePath

[Sysinternals VMMap *]
LangSecRef=3024
Detect=HKCU\Software\Sysinternals\VMMap
RegKey1=HKCU\Software\Sysinternals\VMMap|SourcePath

[Sysinternals ZoomIt *]
LangSecRef=3024
Detect=HKCU\Software\Sysinternals\ZoomIt
RegKey1=HKCU\Software\Sysinternals\ZoomIt|FilePath

[System Driver Installation Files *]
LangSecRef=3025
DetectFile=%SystemDrive%\Drivers
FileKey1=%SystemDrive%\Drivers|*|REMOVESELF

[System Explorer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\System Explorer
FileKey1=%ProgramData%\SystemExplorer\snapshots|*.ses

[System Mechanic *]
LangSecRef=3024
Detect=HKCU\Software\iolo\System Mechanic
FileKey1=%AppData%\iolo\SafetyNet\Temp|*
FileKey2=%AppData%\iolo\System Snapshots Data|*
FileKey3=%AppData%\ioloGovernor\logs|*|REMOVESELF
FileKey4=%ProgramData%\iolo|*.txt;*.xml
FileKey5=%ProgramData%\Iolo Technologies\Logs|*
FileKey6=%ProgramData%\iolo\ACRSummaryFiles|*|REMOVESELF
FileKey7=%ProgramData%\iolo\logs|*|REMOVESELF
FileKey8=%ProgramData%\iolo\TempResources|*|REMOVESELF
FileKey9=%ProgramFiles%\iolo\System Mechanic|*.txt;*.xml
FileKey10=%SystemDrive%\Documents and Settings\LocalService\*\iolo|*|REMOVESELF
FileKey11=%WinDir%\System32\config|iolo App.evt

[System Tray Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\Innovative Solutions\System Tray Cleaner
DetectFile=%ProgramFiles%\Innovative Solutions\System Tray Cleaner
FileKey1=%LocalAppData%\Innovative Solutions\System Tray Cleaner\Process_information_cache|*
FileKey2=%ProgramFiles%\Innovative Solutions\System Tray Cleaner\Process_information_database|*.iscrt
RegKey1=HKCU\Software\Innovative Solutions\System Tray Cleaner\TrayApplications

[SystemScheduler *]
LangSecRef=3024
DetectFile=%ProgramFiles%\SystemScheduler
FileKey1=%ProgramFiles%\SystemScheduler|LogFile.TXT
FileKey2=%ProgramFiles%\SystemScheduler\Events|*

[SystemTools Exporter *]
LangSecRef=3024
Detect=HKCU\Software\SystemTools\Exporter
RegKey1=HKCU\Software\SystemTools\Exporter\Recent File List

[SysTools AD Browser *]
LangSecRef=3024
DetectFile=%ProgramFiles%\SysTools AD Browser
FileKey1=%ProgramFiles%\SysTools AD Browser|Setup Log*.txt

[SysTools PDF Unlocker *]
LangSecRef=3021
DetectFile=%ProgramFiles%\SysTools PDF Unlocker
FileKey1=%ProgramFiles%\SysTools PDF Unlocker|*.log;Setup Log*.txt

[SysTracer *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SysTracer
FileKey1=%ProgramFiles%\SysTracer|SysTracerLog.txt
FileKey2=%ProgramFiles%\SysTracer\tmp|*|REMOVESELF

[Systweak Advanced PC Cleanup *]
LangSecRef=3024
Detect=HKCU\Software\Systweak\Advanced PC Cleanup
DetectFile=%ProgramFiles%\Advanced PC Cleanup
FileKey1=%AppData%\Advanced PC Cleanup|*Log.txt
FileKey2=%ProgramFiles%\Advanced PC Cleanup|*log.txt

[Systweak Advanced System Optimizer 3 *]
LangSecRef=3024
Detect=HKLM\Software\Systweak\ASO3
DetectFile=%ProgramFiles%\Advanced System Optimizer 3
FileKey1=%AppData%\Systweak\ASO3\Driver Updater|*.log
FileKey2=%AppData%\Systweak\ASO3\Registry Cleaner|*.log

[Systweak Advanced System Protector *]
LangSecRef=3024
Detect=HKCU\Software\Systweak\Advanced System Protector
DetectFile=%ProgramFiles%\Advanced System Protector
FileKey1=%AppData%\Systweak\Advanced System Protector|*.log;*log.txt|RECURSE
FileKey2=%AppData%\Systweak\Advanced System Protector\Logs|*.xml

[Systweak RegClean Pro *]
LangSecRef=3024
Detect=HKCU\Software\Systweak\RegClean Pro
DetectFile=%AppData%\Systweak\RegClean Pro
FileKey1=%AppData%\Systweak\RegClean Pro\Version*|*.log;backup*.bin
FileKey2=%AppData%\Systweak\RegClean Pro\Version*\update|*
FileKey3=%ProgramFiles%\RCP|*log.txt

[Tag&Rename *]
LangSecRef=3024
Detect1=HKCU\Software\Softpointer\Tag&Rename
Detect2=HKCU\Software\Softpointer\Tag&Rename2
Detect3=HKCU\Software\Softpointer\Tag&Rename3
RegKey1=HKCU\Software\Softpointer\Tag&Rename\Config|FCurrentFolder
RegKey2=HKCU\Software\Softpointer\Tag&Rename\Config|FHistoryList
RegKey3=HKCU\Software\Softpointer\Tag&Rename2\Config|FCurrentFolder
RegKey4=HKCU\Software\Softpointer\Tag&Rename2\Config|FHistoryList
RegKey5=HKCU\Software\Softpointer\Tag&Rename3\Config|FCurrentFolder
RegKey6=HKCU\Software\Softpointer\Tag&Rename3\Config|FHistoryList
RegKey7=HKCU\Software\Softpointer\Tag&Rename3\Config|FileListHeader

[Task ForceQuit Pro *]
LangSecRef=3024
DetectFile=%ProgramData%\Softorino\Task ForceQuit Pro*
FileKey1=%ProgramData%\Softorino\Task ForceQuit Pro*\Logs|*
FileKey2=%ProgramData%\Softorino\Task ForceQuit Pro*\Update|*

[TAudio Converter *]
LangSecRef=3023
DetectFile=%AppData%\TAC
FileKey1=%AppData%\TAC|log_main.txt

[TDIMon *]
LangSecRef=3024
Detect=HKCU\Software\Systems Internals\Tdimon
RegKey1=HKCU\Software\Systems Internals\Tdimon|Recent

[Team Fortress 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\440
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\download\user_custom|*|RECURSE
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\materials\temp|*.vtf|RECURSE

[TeamLink *]
LangSecRef=3022
DetectFile=%AppData%\Team*Link
FileKey1=%AppData%\Team-Link|*-journal;*.old;LOG;Network Persistent State;QuotaManager;Visited Links|RECURSE
FileKey2=%AppData%\Team-Link\*Cache|*|RECURSE
FileKey3=%AppData%\Team-Link\blob_storage|*|RECURSE
FileKey4=%AppData%\TeamLink\Logs|*
FileKey5=%LocalAppData%\Team-Link-Updater|installer.exe

[TeamSpeak 3 *]
LangSecRef=3022
Detect=HKCU\Software\TeamSpeak 3 Client
FileKey1=%LocalAppData%\TeamSpeak 3 Client\config\logs|*
FileKey2=%ProgramFiles%\TeamSpeak 3 Client\config\logs|*

[TeamSpeak 3 Chats *]
LangSecRef=3022
Detect=HKCU\Software\TeamSpeak 3 Client
FileKey1=%AppData%\TS3Client\chats|*|REMOVESELF

[TeamViewer *]
LangSecRef=3024
Detect=HKCU\Software\TeamViewer
DetectFile1=%AppData%\TeamViewer
DetectFile2=%ProgramFiles%\TeamViewer\Version*
FileKey1=%AppData%\TeamViewer|*.log;*.mdmp
FileKey2=%LocalAppData%\TeamViewer\*Cache|*|RECURSE
FileKey3=%LocalAppData%\TeamViewer\Database|tvchatfilecache.db
FileKey4=%ProgramFiles%\TeamViewer|*.log;*.tmp;Connections_incoming.txt|RECURSE
FileKey5=%ProgramFiles%\TeamViewer\Version*|*.log
FileKey6=%WinDir%\System32|TeamViewer*_Hooks.log
RegKey1=HKCU\Software\TeamViewer\Version5|Last_Machine_Connections
RegKey2=HKCU\Software\TeamViewer\Version5.1|Last_Machine_Connections
RegKey3=HKCU\Software\TeamViewer\Version6|Last_Machine_Connections
RegKey4=HKCU\Software\TeamViewer\Version7|Last_Machine_Connections
RegKey5=HKCU\Software\TeamViewer\Version8|Last_Machine_Connections
RegKey6=HKCU\Software\TeamViewer\Version9|Last_Machine_Connections

[Technic Launcher *]
Section=Games
DetectFile=%AppData%\.technic*
FileKey1=%AppData%\.technic*|*.log;*.old;*.tmp|RECURSE
FileKey2=%AppData%\.technic*\*\logs|*|RECURSE
FileKey3=%AppData%\.technic*\cache|*
FileKey4=%AppData%\.technic*\temp|*|RECURSE

[Technic Launcher Backups *]
Section=Games
DetectFile=%AppData%\.technic*
FileKey1=%AppData%\.technic*\*\Backups|*|RECURSE

[TechSmith DubIt *]
LangSecRef=3023
Detect=HKCU\Software\TechSmith\DubIt
FileKey1=%ProgramFiles%\TechSmith\DubIt|*.gid
RegKey1=HKCU\Software\TechSmith\DubIt\Recent Audio Files
RegKey2=HKCU\Software\TechSmith\DubIt\Recent Video Files

[TEdit *]
Section=Games
DetectFile=%AppData%\TEdit
FileKey1=%AppData%\TEdit\undo|*|RECURSE

[Teeworlds *]
Section=Games
DetectFile=%AppData%\Teeworlds
FileKey1=%AppData%\Teeworlds\dumps|*|REMOVESELF
FileKey2=%AppData%\Teeworlds\tmp|*|REMOVESELF

[Teeworlds Downloads/Maps *]
Section=Games
DetectFile=%AppData%\Teeworlds
FileKey1=%AppData%\Teeworlds\downloaded*|*|REMOVESELF
FileKey2=%AppData%\Teeworlds\maps|*|REMOVESELF

[Telegram Desktop *]
LangSecRef=3022
DetectFile1=%AppData%\Telegram Desktop
DetectFile2=%ProgramFiles%\Telegram Desktop
FileKey1=%AppData%\Telegram Desktop|log*.txt
FileKey2=%AppData%\Telegram Desktop\tdata\dumps|*.dmp
FileKey3=%AppData%\Telegram Desktop\tdata\User_Data\*Cache|*|RECURSE
FileKey4=%AppData%\Telegram Desktop\tupdates\Temp|*|RECURSE
FileKey5=%ProgramFiles%\Telegram Desktop|log*.txt
FileKey6=%ProgramFiles%\Telegram Desktop\tdata\dumps|*.dmp
FileKey7=%ProgramFiles%\Telegram Desktop\tdata\User_Data\*Cache|*|RECURSE
FileKey8=%ProgramFiles%\Telegram Desktop\tupdates\Temp|*|RECURSE

[Telerik Fiddler Everywhere *]
LangSecRef=3024
DetectFile=%AppData%\Fiddler Everywhere
FileKey1=%AppData%\Fiddler Everywhere\Logs|*

[Tencent AndroidServer *]
LangSecRef=3021
DetectFile=%AppData%\Tencent\AndroidServer
FileKey1=%AppData%\Tencent\AndroidServer|*.log.xml

[Tencent QQ *]
LangSecRef=3022
DetectFile=%UserProfile%\Documents\Tencent Files
FileKey1=%ProgramData%\Tencent Files\QQ\Misc|*|RECURSE
FileKey2=%UserProfile%\Documents\Tencent Files|*|RECURSE

[Tencent WeChat *]
LangSecRef=3022
DetectFile1=%AppData%\Tencent\WeChat
DetectFile2=%LocalAppData%\Tencent\BrowsingService
FileKey1=%AppData%\Tencent\Logs|*
FileKey2=%AppData%\Tencent\WeChat\bak|*
FileKey3=%AppData%\Tencent\WeChat\Log|*|RECURSE
FileKey4=%LocalAppData%\Tencent\BrowsingService\TGB_Market|*.log
FileKey5=%LocalAppData%\Tencent\BrowsingService\unkwown|*.log
FileKey6=%LocalAppData%\Tencent\BrowsingService\wechat|*.log

[Tencent WeChat Work *]
LangSecRef=3022
Detect=HKCU\Software\Tencent\WXWork
FileKey1=%AppData%\Tencent\WXWork\Data\*\Cache\File\*|MEMORY.DMP
FileKey2=%AppData%\Tencent\WXWork\Data\*\Cache\Image\*|WXWorkCapture_*.jpg
FileKey3=%AppData%\Tencent\WXWork\Log|*|RECURSE

[TeraCopy *]
LangSecRef=3024
Detect=HKCU\Software\Code Sector\TeraCopy
FileKey1=%AppData%\TeraCopy|FileList.dat;Transfer.log
FileKey2=%AppData%\TeraCopy\History|*
FileKey3=%ProgramFiles%\TeraCopy|FileList.dat;Transfer.log
RegKey1=HKCU\Software\Code Sector\TeraCopy|LastTargetFolder

[Terasology *]
Section=Games
DetectFile=%AppData%\.terasology
FileKey1=%AppData%\.terasology|*.log
FileKey2=%AppData%\.terasology\logs|*|REMOVESELF

[Terminal Studio *]
LangSecRef=3023
DetectFile=%AppData%\Terminal Studio
FileKey1=%AppData%\Terminal Studio|*Log.txt

[Terraria *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105600
FileKey1=%ProgramFiles%\Steam\steamapps\common\terraria|client-crashlog.txt
FileKey2=%UserProfile%\Documents\My Games\Terraria|*.bak|RECURSE

[Tesla Legacy *]
Section=Games
DetectFile=%LocalAppData%\Astar Games\Tesla Legacy
FileKey1=%LocalAppData%\Astar Games\Tesla Legacy|*.log

[TeXnicCenter *]
LangSecRef=3021
Detect1=HKCU\Software\ToolsCenter\TeXnicCenter
Detect2=HKCU\Software\ToolsCenter\TeXnicCenterNT
RegKey1=HKCU\Software\ToolsCenter\TeXnicCenter\Recent File List
RegKey2=HKCU\Software\ToolsCenter\TeXnicCenter\Recent Project List
RegKey3=HKCU\Software\ToolsCenter\TeXnicCenter\Session
RegKey4=HKCU\Software\ToolsCenter\TeXnicCenter\Settings\Options|LastOpenedFolder
RegKey5=HKCU\Software\ToolsCenter\TeXnicCenterNT\Recent File List
RegKey6=HKCU\Software\ToolsCenter\TeXnicCenterNT\Recent Project List
RegKey7=HKCU\Software\ToolsCenter\TeXnicCenterNT\Session
RegKey8=HKCU\Software\ToolsCenter\TeXnicCenterNT\Settings\Options|LastOpenedFolder

[TGCM *]
LangSecRef=3023
DetectFile=%AppData%\TGCMLog
FileKey1=%AppData%\TGCMLog|*log.txt

[TGRMN Software Bulk Rename Utility *]
LangSecRef=3024
Detect=HKCU\Software\TGRMN Software\Bulk Rename Utility
RegKey1=HKCU\Software\TGRMN Software\Bulk Rename Utility\Recent File List
RegKey2=HKCU\Software\TGRMN Software\Bulk Rename Utility\Settings|last_path_selected

[The Bat *]
LangSecRef=3022
Detect=HKCU\Software\RIT\The Bat!
FileKey1=%AppData%\The Bat!\cache|*

[The Binding of Isaac *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\Binding of Isaac*
FileKey1=%UserProfile%\Documents\My Games\Binding of Isaac*|*.dmp;isaacv*.txt;log.txt

[The Clumsys 2: The Butterfly Effect *]
Section=Games
DetectFile=%LocalAppData%\BanzaiInteractive\Clumsys2
FileKey1=%AppData%\BanzaiInteractive\Clumsys2|logfile.txt

[The Creative Assembly Launcher *]
Section=Games
DetectFile=%AppData%\The Creative Assembly\Launcher
FileKey1=%AppData%\The Creative Assembly\Launcher|*.log;*_logs.txt
FileKey2=%AppData%\The Creative Assembly\Launcher\electron|*.old;LOG|RECURSE
FileKey3=%AppData%\The Creative Assembly\Launcher\electron\Cache|*
FileKey4=%AppData%\The Creative Assembly\Launcher\electron\Service Worker\*Cache*|*|RECURSE
FileKey5=%AppData%\The Creative Assembly\Launcher\Logs|*

[The Da Vinci Code *]
Section=Games
DetectFile=%ProgramFiles%\2K Games\The Da Vinci Code
FileKey1=%ProgramFiles%\2K Games\The Da Vinci Code\_bin|*.log

[The Dream Machine *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\94300
FileKey1=%ProgramFiles%\Steam\steamapps\common\The Dream Machine\the_dream_machine.app|*|REMOVESELF

[The Elder Scrolls Online *]
Section=Games
DetectFile=%UserProfile%\Documents\Elder Scrolls Online
FileKey1=%UserProfile%\Documents\Elder Scrolls Online\Errors|*
FileKey2=%UserProfile%\Documents\Elder Scrolls Online\Logs|*

[The Lord of the Rings Online Launcher *]
Section=Games
DetectFile=%LocalAppData%\Turbine\The Lord of the Rings Online\Launcher
FileKey1=%LocalAppData%\The Lord Of The Rings Online|*.log
FileKey2=%LocalAppData%\Turbine|*.log|RECURSE

[The Mighty Quest for Epic Loot *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\239220
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\The Mighty Quest For Epic Loot\CrashReport|*
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\The Mighty Quest For Epic Loot\Log|*

[The Mystery of the Mary Celeste *]
Section=Games
DetectFile=%AppData%\Merscom\The Mystery of the Mary Celeste
FileKey1=%AppData%\Merscom\The Mystery of the Mary Celeste|logfile.txt

[The Outer Worlds *]
Section=Games
DetectFile=%LocalAppData%\Indiana
FileKey1=%LocalAppData%\Indiana\Saved\Logs|*

[The Rise of Atlantis *]
Section=Games
DetectFile1=%ProgramData%\Playrix Entertainment\The Rise of Atlantis
DetectFile2=%ProgramData%\TERMINAL Studio\The Rise of Atlantis
FileKey1=%ProgramData%\Playrix Entertainment\The Rise of Atlantis|log.htm*
FileKey2=%ProgramData%\Terminal Studio\The Rise of Atlantis|log.htm*

[The SemWare Editor Professional *]
LangSecRef=3024
DetectFile=%SystemDrive%\TSEPro
FileKey1=%SystemDrive%\TSEPro|tsefiles.dat;tsehist.dat

[The Sims 3 *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Sims 3
FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims 3|*.log;*.mdmp;xcpt*.txt|RECURSE

[The Sims 3 Cache *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Sims 3
FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims 3|CASPartCache.package;compositorCache.package;scriptCache.package;simCompositorCache.package;socialCache.package
FileKey2=%UserProfile%\Documents\Electronic Arts\The Sims 3\Thumbnails|*
FileKey3=%UserProfile%\Documents\Electronic Arts\The Sims 3\WorldCaches|*

[The Sims 3 DCBackup *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Sims 3
FileKey1=%UserProfile%\Documents\Electronic arts\The sims 3\DCBackup|*.package
ExcludeKey1=FILE|%UserProfile%\Documents\electronic arts\The sims 3\DCBackup\|ccmerged.package

[The Sims 4 *]
Section=Games
DetectFile=%UserProfile%\Documents\Electronic Arts\The Sims 4
FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims 4|*.log;*.txt

[The Sims Medieval *]
Section=Games
Detect=HKLM\Software\Electronic Arts\The Sims Medieval
FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims Medieval|*.log;*.xml|RECURSE

[The Surge *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\378540
FileKey1=%UserProfile%\Documents\The Surge\logs|*.txt

[The Swords of Ditto *]
Section=Games
DetectFile=%LocalAppData%\The_Swords_of_Ditto
FileKey1=%LocalAppData%\The_Swords_of_Ditto|*.log

[The Talos Principle *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\257510
FileKey1=%ProgramFiles%\Steam\steamapps\common\The Talos Principle\Log|*|RECURSE

[The Tiny Bang Story *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\96000
FileKey1=%AppData%\Colibri Games\The Tiny Bang Story|logfile.txt

[The Witcher *]
Section=Games
DetectFile=%LocalAppData%\The Witcher*
FileKey1=%LocalAppData%\The Witcher*\Logs|*
FileKey2=%LocalAppData%\The Witcher*\Temp|*|RECURSE

[The Witcher 3 Backups *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\292030
FileKey1=%UserProfile%\Documents\The Witcher 3|*.bak

[Thomas Was Alone *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\220780
FileKey1=%ProgramFiles%\Steam\Steamapps\common\thomaswasalone\ThomasWasAlone_Data|output_log.txt

[Thorium Autofill Data & Search Engine Preferences *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|*Web Data
FileKey2=%LocalAppData%\Thorium\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Thorium\User Data\AutoFill*|*|REMOVESELF

[Thorium Autoplay Preferences *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\MEIPreload|*|REMOVESELF

[Thorium Bookmark Backups *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|Bookmarks.bak

[Thorium Bookmark Favicons *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|favicons*

[Thorium Caches *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Thorium\User Data|Module Info Cache
FileKey3=%LocalAppData%\Thorium\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Thorium\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Thorium\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Thorium\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Thorium\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Thorium\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Thorium\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Thorium\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Thorium\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Thorium\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Thorium\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Thorium\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Thorium\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Thorium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Thorium\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Thorium\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Thorium\User Data\Optimization*|*|REMOVESELF

[Thorium Default App Handlers *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|PreferredApps

[Thorium Download History *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Thorium\User Data\*\shared_proto_db|*|REMOVESELF

[Thorium DRM Data *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Thorium\User Data\WidevineCdm|*|REMOVESELF

[Thorium Extension Cookies *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|Extension Cookies

[Thorium Pinned Tabs *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
RegKey1=HKCU\Software\Thorium\PreferenceMACs\Default|pinned_tabs

[Thorium Privacy Sandbox *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Thorium\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Thorium\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Thorium\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Thorium\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Thorium\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Thorium\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Thorium\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Thorium Progressive Web Apps *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\Web Applications|*|REMOVESELF

[Thorium Saved Usernames & Passwords *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|Login Data*

[Thorium Security & Threat Detection *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|DIPS*
FileKey2=%LocalAppData%\Thorium\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Thorium\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Thorium\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Thorium\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Thorium\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Thorium\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Thorium\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Thorium\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Thorium\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Thorium\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Thorium\User Data\ZxcvbnData|*|REMOVESELF

[Thorium Shopping Insights *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Thorium\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Thorium\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Thorium\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Thorium\User Data\*\parcel_tracking_db|*|REMOVESELF

[Thorium Storage Quota Manager *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|QuotaManager

[Thorium Sync Data *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\Sync Data|*|REMOVESELF

[Thorium Telemetry *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\Application|debug.log
FileKey2=%LocalAppData%\Thorium\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Thorium\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Thorium\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Thorium\User Data\*|*.log
FileKey6=%LocalAppData%\Thorium\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Thorium\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Thorium\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Thorium\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Thorium\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Thorium\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Thorium\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Thorium\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Thorium\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Thorium\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Thorium\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Thorium\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Thorium\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Thorium\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Thorium\Application|debug.log
FileKey21=%ProgramFiles%\Thorium\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Thorium\BlBeacon|failed_count
RegKey2=HKCU\Software\Thorium\BlBeacon|state
RegKey3=HKCU\Software\Thorium\Installer|LastChecked
RegKey4=HKCU\Software\Thorium\StabilityMetrics

[Thorium Web Browsing Cookies *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\Network|Cookies*;Device Bound Sessions*

[Thorium Web Browsing History *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Thorium Web Browsing Session *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Thorium\User Data\*\Sessions|*|REMOVESELF

[Thorium Web Storage *]
Section=Thorium Web Browser
DetectFile=%LocalAppData%\Thorium\User Data
FileKey1=%LocalAppData%\Thorium\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Thorium\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Thorium\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Thorium\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Thorium\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Thorium\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Thorium\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Thorium\User Data\*\WebStorage|*|REMOVESELF

[ThumbsPlus *]
LangSecRef=3023
Detect=HKCU\Software\Cerious Software Inc.
FileKey1=%AppData%\Thumbsplus|*.7z;*.bak;*.dmp;*.exc;*.log;*.png
FileKey2=%ProgramFiles%\Thumbsplus *\Bin|*.log

[TI SmartView *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\TI-SmartView*
FileKey1=%UserProfile%\Documents\TI-SmartView*\logs|*|REMOVESELF

[TIDAL *]
LangSecRef=3023
DetectFile=%AppData%\TIDAL
FileKey1=%AppData%\TIDAL\*Cache|*|RECURSE
FileKey2=%AppData%\TIDAL\CrashDumps|*|RECURSE
FileKey3=%AppData%\TIDAL\Crashpad|*|RECURSE
FileKey4=%AppData%\TIDAL\Logs|*|RECURSE
FileKey5=%LocalAppData%\TIDAL|*.log
FileKey6=%LocalAppData%\TIDAL\app-*|*.log

[TightVNC *]
LangSecRef=3022
DetectFile=%AppData%\TightVNC
FileKey1=%AppData%\TightVNC|*.log

[TikiOne Steam Cleaner *]
LangSecRef=3024
DetectFile=%UserProfile%\.tikione
FileKey1=%UserProfile%\.tikione\log|*

[Time Adjuster *]
LangSecRef=3021
Detect=HKCU\Software\IrekZielinskiSoft\TimeAdjuster
FileKey1=%ProgramFiles%\TimeAdjuster|*.cnt
RegKey1=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR1
RegKey2=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR2
RegKey3=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR3
RegKey4=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR4

[TimeRabbit *]
LangSecRef=3022
DetectFile=%AppData%\TimeRabbit
FileKey1=%AppData%\TimeRabbit\Cache|*|RECURSE

[Timeslips *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Timeslips
FileKey1=%ProgramFiles%\TimeSlips\Data01\logs|*
FileKey2=%ProgramFiles%\Timeslips\logs|*

[Tinseltown Dreams *]
Section=Games
DetectFile=%LocalAppData%\Namco Networks\Tinseltown Dreams
FileKey1=%LocalAppData%\Namco Networks\Tinseltown Dreams|errors*.*;log.txt

[Tipard Total Media Converter *]
LangSecRef=3023
Detect1=HKCU\Software\Tipard Studio\Tipard Total Media Converter
Detect2=HKCU\Software\Tipard Studio\Tipard Total Media Converter Platinum
FileKey1=%LocalAppData%\Tipard Studio\Tipard *|*.txt
RegKey1=HKCU\Software\Tipard Studio\Tipard Total Media Converter Platinum\Edit|LastVideoFilePath
RegKey2=HKCU\Software\Tipard Studio\Tipard Total Media Converter\Edit|LastVideoFilePath

[Tipard Video Converter *]
LangSecRef=3023
Detect1=HKCU\Software\Tipard Studio\Tipard Video Converter
Detect2=HKCU\Software\Tipard Studio\Tipard Video Converter Ultimate
FileKey1=%LocalAppData%\Tipard Studio\Tipard *|*.txt
RegKey1=HKCU\Software\Tipard Studio\Tipard Video Converter Ultimate\Edit|LastVideoFilePath
RegKey2=HKCU\Software\Tipard Studio\Tipard Video Converter\Edit|LastVideoFilePath

[Titan Quest Anniversary Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\475150
DetectFile=%UserProfile%\Documents\My Games\Titan Quest - Immortal Throne
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Titan Quest Anniversary Edition\logs|*
FileKey2=%UserProfile%\Documents\My Games\Titan Quest - Immortal Throne|log.*

[Tixati *]
LangSecRef=3021
DetectFile=%AppData%\tixati
FileKey1=%AppData%\tixati|*.dat.lastloadok.dat;upnp_diagnostic_log.txt

[Tixati Incomplete Pieces *]
LangSecRef=3021
DetectFile=%AppData%\tixati
FileKey1=%AppData%\tixati\incomplete-pieces|*

[TK-Data *]
LangSecRef=3021
DetectFile=%LocalAppData%\tkdata
FileKey1=%LocalAppData%\tkdata|*-journal;*.old;ChromeDWriteFontCache;data_*;f_*;LOG;log.txt;QuotaManager;Visited Links|RECURSE
FileKey2=%LocalAppData%\tkdata\GPUCache|*
FileKey3=%LocalAppData%\tkdata\Logs|*

[Tobit David *]
LangSecRef=3024
Detect=HKCU\Software\Tobit
FileKey1=%SystemDrive%\David\Apps\Dvgrab\Code|*.chk
FileKey2=%SystemDrive%\David\Apps\Postman\Code|*.chk
FileKey3=%SystemDrive%\David\Apps\Webbox\Code|*.log
FileKey4=%SystemDrive%\David\Archive\SYSTEM\DAVID\Errlog|*
FileKey5=%SystemDrive%\David\Archive\SYSTEM\pbxpense\log|*
FileKey6=%SystemDrive%\David\Archive\USER\*\system\trash|*
FileKey7=%SystemDrive%\David\Archive\USER\*\temp|*
FileKey8=%SystemDrive%\David\Code|*.chk;*.log;*.old
FileKey9=%SystemDrive%\David\Code\Database\MSSQL*DAVID\MSSQL\LOG|ERRORLOG*;FDLAUNCHERRORLOG*;log_*.trc;SQL*.LOG*
FileKey10=%SystemDrive%\David\Code\Temp|*
FileKey11=%SystemDrive%\David\Import\System|I*.001
FileKey12=%SystemDrive%\David\Tld\COMMON|*DAVID.LOG
FileKey13=%SystemDrive%\David\Tld\Port\Extra|*.chk

[Tom Clancy's Ghost Recon *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\15300
DetectFile=%ProgramFiles%\Red Storm Entertainment\Ghost Recon
FileKey1=%ProgramFiles%\Red Storm Entertainment\Ghost Recon|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\Ghost Recon|*.log

[Tom Clancy's Rainbow Six 3: Raven Shield *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\19830
DetectFile=%ProgramFiles%\Red Storm Entertainment\RavenShield
FileKey1=%ProgramFiles%\Red Storm Entertainment\RavenShield|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\RavenShield|*.log

[Tom Clancy's Rainbow Six: Vegas 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\15120
DetectFile=%ProgramFiles%\Ubisoft\Tom Clancy's Rainbow Six Vegas 2
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Tom Clancy's Rainbow Six Vegas 2|*.log;CrashReport*.*|RECURSE
FileKey2=%ProgramFiles%\Ubisoft\Tom Clancy's Rainbow Six Vegas 2|*.log;CrashReport*.*|RECURSE

[Tomahawk *]
LangSecRef=3023
Detect=HKCU\Software\Tomahawk
FileKey1=%LocalAppData%\Tomahawk|*.log
FileKey2=%LocalAppData%\Tomahawk\Tomahawk\Cache|*|RECURSE

[Tomahawk PDF+ *]
LangSecRef=3021
Detect=HKCU\Software\NativeWinds\Tomahawk
RegKey1=HKCU\Software\NativeWinds\Tomahawk\MRU

[Tomb Raider *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\203160
FileKey1=%UserProfile%\Documents|TombRaider.log

[Tomboy *]
LangSecRef=3021
DetectFile=%LocalAppData%\Tomboy
FileKey1=%LocalAppData%\Tomboy|*.log
FileKey2=%LocalAppData%\Tomboy\Cache|*|RECURSE

[TomTom *]
LangSecRef=3021
Detect1=HKCU\Software\TomTom
Detect2=HKLM\Software\Classes\tomtomhome
FileKey1=%AppData%\TomTom\HOME\Profiles\*|Log.txt
FileKey2=%LocalAppData%\TomTom\HOME3|Log.txt
FileKey3=%LocalAppData%\TomTom\HOME3\cache|*|RECURSE

[ToniArts EasyCleaner Duplicates *]
LangSecRef=3024
Detect=HKLM\Software\ToniArts\EasyCleaner
FileKey1=%ProgramFiles%\ToniArts\EasyCleaner|Duplicat.*

[Toolbar Cleaner *]
LangSecRef=3024
Detect=HKLM\Software\Toolbar Cleaner
DetectFile=%ProgramFiles%\Toolbar Cleaner
FileKey1=%ProgramFiles%\Toolbar Cleaner|*.txt

[Toolwiz Care *]
LangSecRef=3024
DetectFile=%LocalAppData%\ToolwizCare*
FileKey1=%LocalAppData%\ToolwizCare*\RegCleanBackup|*.reg
FileKey2=%LocalAppData%\ToolwizCare*\RegistryBackup|*

[Toontown Rewritten *]
Section=Games
DetectFile=%ProgramFiles%\ToonTown Rewritten
FileKey1=%ProgramFiles%\ToonTown ReWritten\logs|*

[Topaz Photo AI *]
LangSecRef=3023
Detect=HKCU\SOFTWARE\Topaz Labs LLC\Topaz Photo AI
FileKey1=%ProgramData%\Topaz Labs LLC\Topaz Photo AI\Logs|*|REMOVESELF

[Topaz Video AI *]
LangSecRef=3023
DetectFile=%AppData%\Topaz Labs LLC\Topaz Video AI
FileKey1=%AppData%\Topaz Labs LLC\Topaz Video AI\logs|*|REMOVESELF

[TopStyle 5 *]
LangSecRef=3021
Detect=HKCU\Software\Bradbury\TopStyle\5.0
RegKey1=HKCU\Software\Bradbury\TopStyle\5.0\RecentFiles

[Torchlight *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\41500
Detect2=HKCU\Software\Valve\Steam\Apps\200710
Detect3=HKLM\Software\Runic Games\Torchlight II
DetectFile=%AppData%\Runic Games\Torchlight
FileKey1=%AppData%\Runic Games\Torchlight|*.log
FileKey2=%UserProfile%\Documents\My Games\runic games\torchlight 2|ogre.log
FileKey3=%UserProfile%\Documents\My Games\Runic Games\Torchlight 2\logs|*

[Torrent Search *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Torrent Search
FileKey1=%ProgramFiles%\Torrent Search|*.log

[TortoiseHg *]
LangSecRef=3021
Detect=HKCU\Software\tortoisemerge
FileKey1=%AppData%\TortoiseHg|*.log;*.old

[TortoiseSVN *]
LangSecRef=3024
Detect=HKCU\Software\TortoiseSVN
FileKey1=%AppData%\TortoiseSVN|*
FileKey2=%LocalAppData%\TSVNCache|*
RegKey1=HKCU\Software\TortoiseSVN\History

[Toshiba BluetoothStack *]
LangSecRef=3024
Detect=HKLM\Software\Toshiba\BluetoothStack
FileKey1=%LocalAppData%\Toshiba\BluetoothStack\V1.0\tosOBEX\Temp|*

[Toshiba Book Place *]
LangSecRef=3021
DetectFile=%AppData%\Book Place
FileKey1=%AppData%\Book Place\Cache|*|RECURSE
FileKey2=%AppData%\Book Place\log|*|RECURSE

[Toshiba FlashCards *]
LangSecRef=3021
DetectFile=%LocalAppData%\TOSHIBA\FlashCards
FileKey1=%LocalAppData%\TOSHIBa\FlashCards|log.txt

[Toshiba PC Diagnostic Tool Utility *]
LangSecRef=3024
DetectFile=%AppData%\Toshiba\PCDiag
FileKey1=%AppData%\Toshiba\PCDiag|*|RECURSE
FileKey2=%ProgramFiles%\Toshiba\configfree|*.log

[Total Commander *]
LangSecRef=3024
DetectFile=%LocalAppData%\GHISLER
FileKey1=%LocalAppData%\GHISLER|tcthumbs.*db;treeinfoC.wc

[Total Recorder *]
LangSecRef=3023
Detect=HKCU\Software\HighCriteria\TotalRecorder\Recent File List
RegKey1=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File1
RegKey2=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File2
RegKey3=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File3
RegKey4=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File4
RegKey5=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File5
RegKey6=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File6
RegKey7=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File7
RegKey8=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File8
RegKey9=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File9

[Total Registry *]
LangSecRef=3024
Detect=HKCU\Software\ScorpioSoftware\TotalRegistry
RegKey1=HKCU\Software\ScorpioSoftware\TotalRegistry|LastKey

[Total Uninstall *]
LangSecRef=3024
DetectFile=%ProgramData%\Martau\Total Uninstall*
FileKey1=%ProgramData%\Martau\Total Uninstall*|*.cache;*.Folders|RECURSE
FileKey2=%ProgramFiles%\Total Uninstall*|*.GID;*.rtf;*.txt|RECURSE

[Total Uninstall Backups *]
LangSecRef=3024
DetectFile=%ProgramData%\Martau\Total Uninstall*
FileKey1=%ProgramData%\Martau\Total Uninstall*|*.tlg;*.zip;*.zsns|RECURSE
FileKey2=%ProgramData%\Martau\Total Uninstall*\Analyzed Programs|*

[Touch *]
LangSecRef=3024
Detect=HKCU\Software\Juan M. Aguirregabiria\Touch
RegKey1=HKCU\Software\Juan M. Aguirregabiria\Touch

[Towns *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\221020
FileKey1=%ProgramFiles%\Steam\Steamapps\common\towns|*.log

[TP-Link *]
LangSecRef=3022
DetectFile=%ProgramData%\TP-Link
FileKey1=%LocalAppData%\TP-Link\nsissetup|*.log
FileKey2=%ProgramData%\TP-Link|*.log

[Track Folder Changes *]
LangSecRef=3024
Detect=HKCU\Software\antiufo\TrackFolderChanges
RegKey1=HKCU\Software\antiufo\TrackFolderChanges|LastFolder

[TrackMania Forever *]
Section=Games
DetectFile=%ProgramData%\TrackMania
FileKey1=%ProgramData%\TrackMania\Cache|*
FileKey2=%ProgramData%\TrackMania\Cache\ManiaCode|*

[TrackMania Forever Manialinks *]
Section=Games
DetectFile=%ProgramData%\TrackMania
FileKey1=%ProgramData%\TrackMania\Manialinks|*

[TrackMania Forever Scores *]
Section=Games
DetectFile=%ProgramData%\TrackMania
FileKey1=%ProgramData%\TrackMania\CampaignsScores|*
FileKey2=%ProgramData%\TrackMania\CampaignsScores\General|*
FileKey3=%ProgramData%\TrackMania\CampaignsScores\UnitedRace|*
FileKey4=%ProgramData%\TrackMania\LadderScores|*

[Treesize *]
LangSecRef=3024
DetectFile=%ProgramFiles%\JAM Software\TreeSize *
FileKey1=%AppData%\JAM Software\TreeSize *|GlobalOptions.bak0.xml

[Trend Micro *]
LangSecRef=3023
Detect1=HKCU\Software\Trend Micro
Detect2=HKLM\Software\TrendMicro
DetectFile=%ProgramData%\Trend Micro
FileKey1=%ProgramData%\Trend Micro|*.log
FileKey2=%ProgramFiles%\Trend Micro|*.log;URLLog.dat|RECURSE

[Trend Micro AntiRansomware Tool *]
LangSecRef=3021
DetectFile=%ProgramFiles%\AntiRansomware2.0
FileKey1=%ProgramData%\AntiRansomware|*.log

[Trend Micro HijackThis Backups *]
LangSecRef=3024
Detect=HKLM\Software\TrendMicro\HijackThis
FileKey1=%ProgramFiles%\Trend Micro\HijackThis\backups|*

[Trend Micro RUBotted *]
LangSecRef=3024
Detect=HKLM\Software\TrendMicro\RUBotted
FileKey1=%ProgramData%\Trend Micro\RUBotted\Logs|*|REMOVESELF
FileKey2=%ProgramFiles%\Trend Micro\RUBotted\DebugLogs|*|REMOVESELF

[Tribes: Ascend *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17080
FileKey1=%ProgramData%\Hi-Rez Studios\BrowserCacheTribes\Default\Cache|*|RECURSE
FileKey2=%ProgramFiles%\Steam\steamapps\common\tribes\Binaries\Logs|*
FileKey3=%UserProfile%\Documents\My Games\Tribes Ascend\TribesGame\Logs|*

[Trillian *]
LangSecRef=3022
Detect=HKLM\Software\Clients\IM\Trillian
FileKey1=%AppData%\Trillian\Crash Files|*|RECURSE
FileKey2=%AppData%\Trillian\users\*|buddies.*.xml
FileKey3=%AppData%\Trillian\users\*\cache|*
FileKey4=%AppData%\Trillian\users\*\instantlookup|*
FileKey5=%AppData%\Trillian\users\*\logs|*|RECURSE
FileKey6=%AppData%\Trillian\users\global\skin_cache|*
FileKey7=%ProgramFiles%\Trillian\Crash Files|*|RECURSE
FileKey8=%ProgramFiles%\Trillian\Users\Default\buddyicons|*|RECURSE
FileKey9=%ProgramFiles%\Trillian\Users\Default\instantlookup|*

[Trine *]
Section=Games
DetectFile=%ProgramFiles%\Steam\SteamApps\Common\Trine*
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Trine*\log*|*
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Trine\_enchanted_edition_\log|*

[Triolan DDD++ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Triolan DDD++
FileKey1=%ProgramFiles%\Triolan DDD++\Settings|ddd++_log.sqlite;Recents.xml

[TrojanHunter *]
LangSecRef=3024
Detect=HKCU\Software\TrojanHunter
FileKey1=%ProgramFiles%\TrojanHunter*|Debug.log;DebugLog.txt
FileKey2=%ProgramFiles%\TrojanHunter*\Scan Reports|*

[Tropico *]
Section=Games
Detect1=HKCU\Software\Haemimont Games\Tropico 4
Detect2=HKLM\Software\Haemimont Games\Tropico3
FileKey1=%AppData%\Tropico*\Logs|*|REMOVESELF
FileKey2=%AppData%\Tropico*\ShaderCache|*|REMOVESELF
FileKey3=%ProgramFiles%\Kalypso Media\*|dotnetfx3*.exe
FileKey4=%ProgramFiles%\Kalypso Media\*\DirectXRedist|*|REMOVESELF

[TuneIn Radio *]
LangSecRef=3023
DetectFile1=%AppData%\TuneIn
DetectFile2=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj
FileKey1=%AppData%\TuneIn|*-journal;*.old;LOG;log.log;Network Persistent State;Origin Bound Certs|RECURSE
FileKey2=%AppData%\TuneIn\*Cache|*|RECURSE
FileKey3=%AppData%\TuneIn\blob_storage|*|RECURSE
FileKey4=%AppData%\TuneIn\Logs|*
FileKey5=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj\AC|*|RECURSE
FileKey6=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj\LocalCache\Cache|*|RECURSE
FileKey7=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj\LocalState\_WinStoreSDK_Receipt_Cache|*
FileKey8=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj\Settings|*.log*
FileKey9=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\TuneIn.TuneInRadio_6bhtb546zcxnj\TempState|*|REMOVESELF
FileKey11=%LocalAppData%\TuneIn-Updater|*|RECURSE

[TunnelBear VPN *]
LangSecRef=3022
DetectFile1=%AppData%\TunnelBear
DetectFile2=%ProgramFiles%\TunnelBear
FileKey1=%AppData%\TunnelBear\Logs|*
FileKey2=%ProgramFiles%\TunnelBear|*.log

[Turbo VPN *]
LangSecRef=3022
DetectFile=%LocalAppData%\TurboVPN
FileKey1=%LocalAppData%\TurboVPN\TVDump|*.dmp

[Turnip Boy Commits Tax Evasion *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1205450
FileKey1=%UserProfile%\AppData\LocalLow\Snoozy Kazoo\Turnip Boy Commits Tax Evasion|*.log

[TV-Browser *]
LangSecRef=3021
DetectFile=%ProgramFiles%\TV-Browser
FileKey1=%AppData%\TV-Browser\*|java.searchplugin.SearchPlugin.dat*

[TV_Net *]
LangSecRef=3023
DetectFile=%UserProfile%\AppData\LocalLow\TV_Net
FileKey1=%UserProfile%\AppData\LocalLow\TV_Net\CacheIcons|*|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\TV_Net\Logs|*|RECURSE

[TVersity *]
LangSecRef=3023
Detect=HKLM\Software\TVersity\Media Server
FileKey1=%ProgramFiles%\TVersity Codec Pack|*.exe;*.url
FileKey2=%ProgramFiles%\TVersity\Media Server|*.rtf;*.url;*TVersityCodecPackSetup*
FileKey3=%ProgramFiles%\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE
FileKey4=%WinDir%\System32|*.1;*.2;*.3;tversity.cookies;TVersityMediaServer.log
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\TVersity Media Server|*|REMOVESELF
FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Temp\TVersity Media Server|*|REMOVESELF
ExcludeKey1=FILE|%ProgramFiles%\TVersity Codec Pack\|uninst.exe
ExcludeKey2=FILE|%ProgramFiles%\TVersity\Media Server\|HOWTO Share Media.txt
ExcludeKey3=FILE|%ProgramFiles%\TVersity\Media Server\|version.txt

[Tweaking.com Windows Repair *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Tweaking.com - Windows Repair (All in One)
DetectFile1=%ProgramFiles%\Tweaking.com
DetectFile2=%SystemDrive%\Tweaking.com_Windows_Repair_Logs
FileKey1=%ProgramFiles%\Tweaking.com\Windows Repair (All in One)\Logs|*|REMOVESELF
FileKey2=%SystemDrive%\Tweaking.com_Windows_Repair_Logs|*|REMOVESELF

[TweakNow PowerPack Backups *]
LangSecRef=3024
Detect=HKCU\Software\TweakNow PowerPack
FileKey1=%ProgramFiles%\TweakNow PowerPack\Backup|*

[Twinkle Tray *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze
FileKey1=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze\LocalCache\Roaming\twinkle-tray-appx|*.log
FileKey3=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze\LocalCache\Roaming\twinkle-tray-appx\*cache*|*|RECURSE
FileKey4=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze\Settings|*.log*
FileKey5=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\38002AlexanderFrangos.TwinkleTray_m7qx9dzpwqaze\TempState|*|REMOVESELF

[Twitch *]
Section=Games
DetectFile=%AppData%\Twitch
FileKey1=%AppData%\Twitch|updater.log
FileKey2=%AppData%\Twitch\Electron|cookies*
FileKey3=%AppData%\Twitch\Electron\*cache|*|REMOVESELF
FileKey4=%AppData%\Twitch\Electron\local storage|*
FileKey5=%AppData%\Twitch\Games\Dumps|*|REMOVESELF
FileKey6=%AppData%\Twitch\logs\*|*.json;*.log|REMOVESELF

[Twitter *]
LangSecRef=3022
DetectFile=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm
FileKey1=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm\AppData\Indexed DB|*.log
FileKey3=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm\LocalState|*|RECURSE
FileKey4=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm\Settings|*.log*
FileKey5=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\9E2F88E3.TWITTER_wgeqdkkx372wm\TempState|*|REMOVESELF

[Two Worlds Epic Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1930
FileKey1=%UserProfile%\Documents\TwoWorlds Files\FontsCache|*.tmp

[Tzip *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Tzip
FileKey1=%ProgramFiles%\Tzip|*.temp

[Ubisoft Connect *]
Section=Games
DetectFile=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher
FileKey1=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher|*.log;*log.txt;Installed_files.txt;version.txt
FileKey2=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\assets|*
FileKey3=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\http*|*|RECURSE
FileKey4=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Logs|*

[Ubisoft Connect Installers *]
Section=Games
DetectFile=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher
Warning=Make sure to launch all of your installed UPlay games at least once before running this, or they may not launch properly.
FileKey1=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\Installers|*|REMOVESELF

[UC Autofill Data & Search Engine Preferences *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|*Web Data
FileKey2=%LocalAppData%\UC\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\UC\User Data\AutoFill*|*|REMOVESELF

[UC Autoplay Preferences *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\MEIPreload|*|REMOVESELF

[UC Bookmark Backups *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|Bookmarks.bak

[UC Bookmark Favicons *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|favicons*

[UC Caches *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\UC\User Data|Module Info Cache
FileKey3=%LocalAppData%\UC\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\UC\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\UC\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\UC\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\UC\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\UC\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\UC\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\UC\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\UC\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\UC\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\UC\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\UC\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\UC\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\UC\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\UC\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\UC\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\UC\User Data\Optimization*|*|REMOVESELF

[UC Default App Handlers *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|PreferredApps

[UC Download History *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\UC\User Data\*\shared_proto_db|*|REMOVESELF

[UC DRM Data *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\UC\User Data\WidevineCdm|*|REMOVESELF

[UC Extension Cookies *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|Extension Cookies

[UC Pinned Tabs *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
RegKey1=HKCU\Software\UC\PreferenceMACs\Default|pinned_tabs

[UC Privacy Sandbox *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data|*first_party_sets*
FileKey2=%LocalAppData%\UC\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\UC\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\UC\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\UC\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\UC\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\UC\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\UC\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[UC Progressive Web Apps *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\Web Applications|*|REMOVESELF

[UC Saved Usernames & Passwords *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|Login Data*

[UC Security & Threat Detection *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|DIPS*
FileKey2=%LocalAppData%\UC\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\UC\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\UC\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\UC\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\UC\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\UC\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\UC\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\UC\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\UC\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\UC\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\UC\User Data\ZxcvbnData|*|REMOVESELF

[UC Shopping Insights *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\UC\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\UC\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\UC\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\UC\User Data\*\parcel_tracking_db|*|REMOVESELF

[UC Storage Quota Manager *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|QuotaManager

[UC Sync Data *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\Sync Data|*|REMOVESELF

[UC Telemetry *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\Application|debug.log
FileKey2=%LocalAppData%\UC\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\UC\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\UC\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\UC\User Data\*|*.log
FileKey6=%LocalAppData%\UC\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\UC\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\UC\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\UC\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\UC\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\UC\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\UC\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\UC\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\UC\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\UC\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\UC\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\UC\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\UC\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\UC\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\UC\Application|debug.log
FileKey21=%ProgramFiles%\UC\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\UC\BlBeacon|failed_count
RegKey2=HKCU\Software\UC\BlBeacon|state
RegKey3=HKCU\Software\UC\Installer|LastChecked
RegKey4=HKCU\Software\UC\StabilityMetrics

[UC Web Browsing Cookies *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\Network|Cookies*;Device Bound Sessions*

[UC Web Browsing History *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[UC Web Browsing Session *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\UC\User Data\*\Sessions|*|REMOVESELF

[UC Web Storage *]
Section=UC Web Browser
DetectFile=%LocalAppData%\UC\User Data
FileKey1=%LocalAppData%\UC\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\UC\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\UC\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\UC\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\UC\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\UC\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\UC\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\UC\User Data\*\WebStorage|*|REMOVESELF

[Ulaa Autofill Data & Search Engine Preferences *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|*Web Data
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data\AutoFill*|*|REMOVESELF

[Ulaa Autoplay Preferences *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\MEIPreload|*|REMOVESELF

[Ulaa Bookmark Backups *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|Bookmarks.bak

[Ulaa Bookmark Favicons *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|favicons*

[Ulaa Caches *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data|Module Info Cache
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Zoho\Ulaa\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Zoho\Ulaa\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Zoho\Ulaa\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Zoho\Ulaa\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Zoho\Ulaa\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Zoho\Ulaa\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Zoho\Ulaa\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Zoho\Ulaa\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Zoho\Ulaa\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Zoho\Ulaa\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Zoho\Ulaa\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Zoho\Ulaa\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Zoho\Ulaa\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Zoho\Ulaa\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Zoho\Ulaa\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Zoho\Ulaa\User Data\Optimization*|*|REMOVESELF

[Ulaa Default App Handlers *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|PreferredApps

[Ulaa Download History *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*\shared_proto_db|*|REMOVESELF

[Ulaa DRM Data *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\WidevineCdm|*|REMOVESELF

[Ulaa Extension Cookies *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|Extension Cookies

[Ulaa Pinned Tabs *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
RegKey1=HKCU\Software\Zoho\Ulaa\PreferenceMACs\Default|pinned_tabs

[Ulaa Privacy Sandbox *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Zoho\Ulaa\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Zoho\Ulaa\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Zoho\Ulaa\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Zoho\Ulaa\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Zoho\Ulaa\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Ulaa Progressive Web Apps *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\Web Applications|*|REMOVESELF

[Ulaa Saved Usernames & Passwords *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|Login Data*

[Ulaa Security & Threat Detection *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|DIPS*
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Zoho\Ulaa\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Zoho\Ulaa\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Zoho\Ulaa\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Zoho\Ulaa\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Zoho\Ulaa\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Zoho\Ulaa\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Zoho\Ulaa\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Zoho\Ulaa\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Zoho\Ulaa\User Data\ZxcvbnData|*|REMOVESELF

[Ulaa Shopping Insights *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Zoho\Ulaa\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Zoho\Ulaa\User Data\*\parcel_tracking_db|*|REMOVESELF

[Ulaa Storage Quota Manager *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|QuotaManager

[Ulaa Sync Data *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\Sync Data|*|REMOVESELF

[Ulaa Telemetry *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\Application|debug.log
FileKey2=%LocalAppData%\Zoho\Ulaa\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Zoho\Ulaa\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Zoho\Ulaa\User Data\*|*.log
FileKey6=%LocalAppData%\Zoho\Ulaa\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Zoho\Ulaa\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Zoho\Ulaa\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Zoho\Ulaa\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Zoho\Ulaa\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Zoho\Ulaa\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Zoho\Ulaa\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Zoho\Ulaa\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Zoho\Ulaa\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Zoho\Ulaa\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Zoho\Ulaa\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Zoho\Ulaa\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Zoho\Ulaa\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Zoho\Ulaa\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Zoho\Ulaa\Application|debug.log
FileKey21=%ProgramFiles%\Zoho\Ulaa\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Zoho\Ulaa\BlBeacon|failed_count
RegKey2=HKCU\Software\Zoho\Ulaa\BlBeacon|state
RegKey3=HKCU\Software\Zoho\Ulaa\Installer|LastChecked
RegKey4=HKCU\Software\Zoho\Ulaa\StabilityMetrics

[Ulaa Web Browsing Cookies *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\Network|Cookies*;Device Bound Sessions*

[Ulaa Web Browsing History *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Ulaa Web Browsing Session *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*\Sessions|*|REMOVESELF

[Ulaa Web Storage *]
Section=Ulaa Web Browser
DetectFile=%LocalAppData%\Zoho\Ulaa\User Data
FileKey1=%LocalAppData%\Zoho\Ulaa\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Zoho\Ulaa\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Zoho\Ulaa\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Zoho\Ulaa\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Zoho\Ulaa\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Zoho\Ulaa\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Zoho\Ulaa\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Zoho\Ulaa\User Data\*\WebStorage|*|REMOVESELF

[UltraCompare *]
LangSecRef=3021
Detect=HKCU\Software\IDM Computer Solutions\UltraCompare Pro
FileKey1=%AppData%\IDMComp\Common\Logs|*|RECURSE
FileKey2=%AppData%\IDMComp\UltraCompare\Cloud Services\Logs|*.log

[UltraDefrag *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraDefrag
DetectFile1=%SystemDrive%\PortableApps\UltraDefragPortable
DetectFile2=%WinDir%\UltraDefrag
FileKey1=%ProgramFiles%\UltraDefrag\logs|*
FileKey2=%SystemDrive%|fraglist.luar
FileKey3=%SystemDrive%\PortableApps\UltraDefragPortable\Data|UltraDefragPortable.log
FileKey4=%WinDir%\UltraDefrag\logs|*.log

[UltraEdit *]
LangSecRef=3021
Detect=HKCU\Software\IDM Computer Solutions\UltraEdit
FileKey1=%AppData%\IDMComp\Common\Logs|*|RECURSE
FileKey2=%AppData%\IDMComp\UltraEdit\autorec|*|RECURSE
FileKey3=%AppData%\IDMComp\UltraEdit\EBWebView|*|RECURSE
FileKey4=%ProgramFiles%\IDM Computer Solutions\UltraEdit|*.txt

[UltraISO *]
LangSecRef=3024
Detect=HKCU\Software\EasyBoot Systems
FileKey1=%ProgramFiles%\UltraISO\backup|*|REMOVESELF
RegKey1=HKCU\Software\EasyBoot Systems\UltraISO\5.0|LogFile
RegKey2=HKCU\Software\EasyBoot Systems\UltraISO\5.0|OpenFolder

[Ultratron *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219190
FileKey1=%UserProfile%\.ultratron*|*.log

[UMPlayer *]
LangSecRef=3023
DetectFile=%UserProfile%\.umplayer
FileKey1=%SystemDrive%\MININT|*.log|RECURSE
FileKey2=%UserProfile%\.umplayer\file_settings|*|RECURSE

[Unchecky *]
LangSecRef=3024
Detect=HKCU\Software\Unchecky
FileKey1=%ProgramData%\Unchecky|*.log;uclogfile*.bin

[UnHackMe *]
LangSecRef=3024
Detect=HKLM\Software\Greatis
FileKey1=%ProgramFiles%\UnHackMe|*.err;*.log;*.txt|RECURSE
FileKey2=%UserProfile%\Documents\RegRun2|*.txt

[Unicenta Open POS *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Unicentaopos*
FileKey1=%ProgramFiles%\Unicentaopos*|*.log

[Unified Remote *]
LangSecRef=3023
Detect=HKCU\Software\Unified Remote
FileKey1=%AppData%\Unified Remote\Logs|*

[UniGetUI *]
LangSecRef=3024
DetectFile=%LocalAppData%\UniGetUI
FileKey1=%LocalAppData%\UniGetUI\chocolatey\logs|*.log

[Unigine Heaven DX11 Benchmark *]
LangSecRef=3021
DetectFile=%UserProfile%\Unigine Heaven
FileKey1=%UserProfile%\Unigine Heaven|*.cache;log.html
FileKey2=%UserProfile%\Unigine Heaven\save|*|REMOVESELF

[Uninstall Tool *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool_is1
FileKey1=%ProgramFiles%\Uninstall Tool|*.dmp

[Universal Extractor *]
LangSecRef=3024
Detect=HKCU\Software\UniExtract
RegKey1=HKCU\Software\UniExtract\Directory
RegKey2=HKCU\Software\UniExtract\File

[Universal Viewer *]
LangSecRef=3024
DetectFile=%AppData%\ATViewer
FileKey1=%AppData%\ATViewer|ViewerHistory.ini

[Universal Windows Platform *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_8wekyb3d8bbwe
DetectFile3=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Microsoft\Internet Explorer|*.log;*.txt|RECURSE
FileKey2=%LocalAppData%\Microsoft\Internet Explorer\CacheStorage|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\Internet Explorer\DOMStore|*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Internet Explorer\Recovery|*|RECURSE
FileKey5=%LocalAppData%\Microsoft\Windows\INet*|*|RECURSE
FileKey6=%LocalAppData%\Microsoft\Windows\PRICache|*|RECURSE
FileKey7=%LocalAppData%\Microsoft\Windows\WebCache|*|RECURSE
FileKey8=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0*|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState|*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings|*.log*
FileKey13=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey14=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey15=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_8wekyb3d8bbwe\AC|*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_8wekyb3d8bbwe\Settings|*.log*
FileKey17=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey18=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe\AC|*|RECURSE
FileKey20=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey21=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey22=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe\Settings|*.log*
FileKey23=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey24=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey25=%UserProfile%\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore|*|REMOVESELF
FileKey26=%UserProfile%\AppData\LocalLow\webviewdata\2\EBWebView\Crashpad\reports|*
FileKey27=%UserProfile%\AppData\LocalLow\webviewdata\2\EBWebView\Crashpad\temp|*
FileKey28=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\History|*|RECURSE
FileKey29=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\INet*|*|RECURSE
FileKey30=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer|*.log
FileKey31=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*|RECURSE
FileKey32=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INet*|*|RECURSE
FileKey33=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*|RECURSE
FileKey34=%WinDir%\System32\config\systemprofile\Cookies|*|RECURSE
FileKey35=%WinDir%\System32\config\systemprofile\History|*|RECURSE
FileKey36=%WinDir%\System32\config\systemprofile\Local Settings\Temporary Internet Files|*|RECURSE
FileKey37=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History|*|RECURSE
FileKey38=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INet*|*|RECURSE
FileKey39=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*|RECURSE
RegKey1=HKCU\Software\Microsoft\Internet Explorer\DOMStorage
RegKey2=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage
RegKey3=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete
RegKey4=HKCU\Software\Microsoft\Phone\ShellUI\WindowSizing
RegKey5=HKCU\Software\Microsoft\UserData\UninstallTimes
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\|pinning.db
ExcludeKey2=FILE|%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\|settings.json

[Universe Sandbox *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Giant Army\Universe Sandbox*
FileKey1=%UserProfile%\AppData\LocalLow\Giant Army\Universe Sandbox*|*log.txt;history.json

[Unlocker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Unlocker
FileKey1=%ProgramFiles%\Unlocker|Unlocker-List.txt

[Unreal Tournament: Game of the Year *]
Section=Games
DetectFile=%ProgramFiles%\GOG.com\Unreal Tournament GOTY
FileKey1=%ProgramFiles%\GOG.com\Unreal Tournament GOTY\Logs|*
FileKey2=%ProgramFiles%\GOG.com\Unreal Tournament GOTY\System|*.log

[UPX Shell *]
LangSecRef=3024
Detect=HKCU\Software\ION Tek\UPX Shell
RegKey1=HKCU\Software\ION Tek\UPX Shell\3.x|History

[USB Disk Security *]
LangSecRef=3024
DetectFile=%ProgramFiles%\USB Disk Security
FileKey1=%AppData%\Zbshareware Lab|*|REMOVESELF

[USB Redirector *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{FB9376AC-5253-42a5-AC0A-D306F32FFAD2}
FileKey1=%ProgramFiles%\USB Redirector|*.log;*.txt

[USB Safely Remove *]
LangSecRef=3024
Detect=HKCU\Software\SafelyRemove
FileKey1=%AppData%\USBSafelyRemove|*.txt
FileKey2=%AppData%\USBSRService|*.txt
FileKey3=%ProgramData%\USBSRService|*.txt
FileKey4=%ProgramFiles%\USB Safely Remove|*.DIZ;*.rtf;*.url

[UsbFix *]
LangSecRef=3023
Detect=HKCU\Software\UsbFix
FileKey1=%SystemDrive%\UsbFix\Log|*|REMOVESELF
FileKey2=%SystemDrive%\UsbFix\Quarantine|*|REMOVESELF
FileKey3=%UserProfile%\Desktop|UsbFix_Report.txt
RegKey1=HKCU\Software\UsbFix\LastReport

[UserBenchmark *]
LangSecRef=3024
DetectFile1=%AppData%\UserBenchmark
DetectFile2=%ProgramFiles%\User Benchmark
FileKey1=%AppData%\UserBenchmark\User|*.log*
FileKey2=%SystemDrive%\UserBenchmark|*|REMOVESELF

[uTorrent *]
LangSecRef=3022
Detect=HKCU\Software\BitTorrent\uTorrent
FileKey1=%AppData%\utorrent|*.bad;*.benc;*.dmp;*.log;*.older;*ipfilter.bak;updates.dat
FileKey2=%AppData%\utorrent\updates|*.exe
FileKey3=%LocalAppData%\BitTorrentHelper|*.log
FileKey4=%LocalAppData%\BitTorrentHelper\crashdumps|*|RECURSE
FileKey5=%ProgramFiles%\uTorrent|*.old;*.tmp
FileKey6=%UserProfile%\AppData\LocalLow\uTorrent|uTorrent_*
FileKey7=%UserProfile%\AppData\LocalLow\uTorrentBar\Logs|*
RegKey1=HKCU\Software\BitTorrent|computerID

[uTorrent Web *]
LangSecRef=3022
DetectFile=%AppData%\uTorrent Web
FileKey1=%AppData%\uTorrent Web|*.bak;*.log*
FileKey2=%AppData%\uTorrent Web\crashdumps|*|RECURSE

[UVI Portal *]
LangSecRef=3023
DetectFile=%AppData%\UVI Portal*
FileKey1=%AppData%\UVI Portal|*.log
FileKey2=%AppData%\UVIPortalCache|UVI Portal.bin

[V - The File Viewer *]
LangSecRef=3024
Detect=HKCU\Software\Prineas\FileViewer
FileKey1=%AppData%\V|*.log
RegKey1=HKCU\Software\Prineas\FileViewer\History
RegKey2=HKCU\Software\Prineas\FileViewer\PathC
RegKey3=HKCU\Software\Prineas\FileViewer\QathH
RegKey4=HKCU\Software\Prineas\FileViewer\VCurrentPath
RegKey5=HKCU\Software\Prineas\FileViewer\VCurrentPath1

[V-Ray *]
LangSecRef=3021
DetectFile=%AppData%\ChaosGroup\V-Ray For *
FileKey1=%AppData%\ChaosGroup\Cloud\Client|*.log
FileKey2=%AppData%\ChaosGroup\V-Ray For Revit*\Logs|*
FileKey3=%AppData%\ChaosGroup\V-Ray For Revit*\neui4fevit|*-journal;*.log;*.old;LOG;Network Persistent State|RECURSE
FileKey4=%AppData%\ChaosGroup\V-Ray For Revit*\neui4fevit\*Cache|*|RECURSE
FileKey5=%AppData%\ChaosGroup\V-Ray For Revit*\neui4fevit\blob_storage|*|RECURSE
FileKey6=%AppData%\ChaosGroup\V-Ray For SketchUp|*.log;telemetry.json
FileKey7=%LocalAppData%\ChaosGroup\Telemetry|*.log

[V&V Messenger Chat History *]
LangSecRef=3022
DetectFile=%AppData%\AJabber
FileKey1=%AppData%\AJabber\*\Contacts|*|RECURSE

[Valfaris *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Steel Mantis\Valfaris
FileKey1=%UserProfile%\AppData\LocalLow\Steel Mantis\Unity|*|REMOVESELF
FileKey2=%UserProfile%\AppData\LocalLow\Steel Mantis\Valfaris|*txt

[Valorant *]
Section=Games
DetectFile=%LocalAppData%\VALORANT
FileKey1=%LocalAppData%\VALORANT\Saved\Crashes|*
FileKey2=%LocalAppData%\VALORANT\Saved\Logs|*.log

[Vampire Survivors *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1794680
FileKey1=%AppData%\Vampire_Survivors|Network Persistent State
FileKey2=%AppData%\Vampire_Survivors\*Cache|*|RECURSE
FileKey3=%AppData%\Vampire_Survivors\*Storage|*.old;LOG|RECURSE
FileKey4=%AppData%\Vampire_Survivors\blob_storage|*|RECURSE
FileKey5=%AppData%\Vampire_Survivors\logs|*.log
FileKey6=%UserProfile%\AppData\LocalLow\poncle\Vampire Survivors|*.log
FileKey7=%UserProfile%\AppData\LocalLow\poncle\Vampire Survivors\backtrace|*|RECURSE
FileKey8=%UserProfile%\AppData\LocalLow\poncle\Vampire Survivors\Unity|*|REMOVESELF

[Vbs2Exe *]
LangSecRef=3024
Detect=HKCU\Software\enkeladress\vbs2exe
DetectFile=%ProgramFiles%\Vbs2Exe
FileKey1=%ProgramFiles%\Vbs2Exe|recentlist.rlt

[VCW VicMan's Photo Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\VCW VicMan's Photo Editor
FileKey1=%ProgramFiles%\VCW VicMan's Photo Editor|recent.ini

[VDownloader *]
LangSecRef=3023
DetectFile=%AppData%\VDownloader
FileKey1=%AppData%\VDownloader|completedTasks.xml

[Venis IX *]
LangSecRef=3021
Detect=HKCU\Software\Spaceblue\Venis IX
RegKey1=HKCU\Software\Spaceblue\Venis IX\FileHistory

[Ventrilo Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Ventrilo
FileKey1=%AppData%\ventrilo\chatlogs|*|REMOVESELF

[VeryPDF OCR to Any Converter *]
LangSecRef=3021
Detect=HKCU\Software\VietUnicode\VeryPDF OCR to Any Converter3
RegKey1=HKCU\Software\VietUnicode\VeryPDF OCR to Any Converter3|MruList

[VeryPDF PDF Manual Splitter *]
LangSecRef=3021
Detect=HKCU\Software\VeryPDF PDF Manual Splitter
RegKey1=HKCU\Software\VeryPDF PDF Manual Splitter\pdfms\Recent File List

[VHD Attach *]
LangSecRef=3024
Detect=HKCU\Software\Josip Medved\VHD Attach
FileKey1=%ProgramFiles%\Josip Medved\VHD Attach|*.InstallLog
RegKey1=HKCU\Software\Josip Medved\VHD Attach|LastSize
RegKey2=HKCU\Software\Josip Medved\VHD Attach\RecentFiles

[VicMan Web Photo Album *]
LangSecRef=3023
Detect=HKCU\Software\VicMan Software\Web Photo Album
DetectFile=%ProgramFiles%\Web Photo Album
FileKey1=%ProgramFiles%\Web Photo Album|*.log
RegKey1=HKCU\Software\VicMan Software\Web Photo Album|RecentFile0
RegKey2=HKCU\Software\VicMan Software\Web Photo Album|RecentFile1
RegKey3=HKCU\Software\VicMan Software\Web Photo Album|RecentFile2
RegKey4=HKCU\Software\VicMan Software\Web Photo Album|RecentFile3
RegKey5=HKCU\Software\VicMan Software\Web Photo Album|RecentFile4

[Viddly YouTube Downloader *]
LangSecRef=3022
DetectFile=%AppData%\Viddly Inc\Viddly YouTube Downloader
FileKey1=%AppData%\Viddly Inc\Viddly YouTube Downloader|log.txt
FileKey2=%LocalAppData%\Viddly YouTube Downloader|*.log

[Video Thumbnails Maker *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Video Thumbnails Maker
FileKey1=%ProgramFiles%\Video Thumbnails Maker|*.log;*_bkp.exe
FileKey2=%ProgramFiles%\Video Thumbnails Maker\Logs|*

[Videoder *]
LangSecRef=3023
DetectFile=%AppData%\Videoder
FileKey1=%AppData%\Videoder|*.log
FileKey2=%AppData%\Videoder\*Cache|*

[VideoGet *]
LangSecRef=3022
Detect=HKCU\Software\Nuclear Coffee\VideoGet
FileKey1=%ProgramFiles%\VideoGet\Temp|*

[VideoMach *]
LangSecRef=3023
Detect=HKCU\Software\Gromada\VideoMach
FileKey1=%UserProfile%\Documents|VideoMach_Log.txt

[Vidmore Screen Recorder *]
LangSecRef=3023
DetectFile=%LocalAppData%\Vidmore\Vidmore Screen Recorder
FileKey1=%LocalAppData%\Vidmore\Vidmore Screen Recorder\Logs|*

[Vim *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vim
FileKey1=%UserProfile%|_viminfo

[Vindictus *]
Section=Games
Detect=HKLM\Software\Nexon\Vindictus
DetectFile=%SystemDrive%\Nexon\Vindictus EU\en-EU
FileKey1=%ProgramData%\NexonEU\601|*.log
FileKey2=%SystemDrive%\Nexon\Vindictus EU\en-EU|*.log;*.tmp
FileKey3=%SystemDrive%\Nexon\Vindictus EU\en-EU\HShield|*.log
FileKey4=%UserProfile%\Documents\Vindictus EU\Report Error|*.log;*.mdmp

[Violett *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\257830
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Violett|crash.dmp;error.log;output_log.txt;report.ini|RECURSE

[Virtual Clone Drive *]
LangSecRef=3021
Detect=HKLM\Software\Elaborate Bytes\VirtualCloneDrive
RegKey1=HKCU\Software\Elaborate Bytes\VirtualCloneDrive\LRU
RegKey2=HKLM\Software\Elaborate Bytes\VirtualCloneDrive\0

[VirtualDJ *]
LangSecRef=3023
Detect=HKCU\Software\VirtualDJ
FileKey1=%UserProfile%\Documents\VirtualDJ|Crashguard report.txt
FileKey2=%UserProfile%\Documents\VirtualDJ\Cache|*|RECURSE
FileKey3=%UserProfile%\Documents\VirtualDJ\History|*

[VirtualDJ Tracklist *]
LangSecRef=3023
Detect=HKCU\Software\VirtualDJ
FileKey1=%UserProfile%\Documents\VirtualDJ\TrackListing|*

[VirtualDub *]
LangSecRef=3023
Detect=HKCU\Software\VirtualDub.org\VirtualDub
RegKey1=HKCU\Software\VirtualDub.org\VirtualDub\MRU List
RegKey2=HKCU\Software\VirtualDub.org\VirtualDub\Saved filespecs

[VirtualDubMod *]
LangSecRef=3023
Detect=HKCU\Software\Freeware\VirtualDubMod
RegKey1=HKCU\Software\Freeware\VirtualDubMod\MRU List

[VirtualFDD *]
LangSecRef=3024
Detect=HKCU\Software\Korbos\VirtualFDD
RegKey1=HKCU\Software\Korbos\VirtualFDD\Recent File List

[VirtuaWin *]
LangSecRef=3021
DetectFile=%AppData%\VirtuaWin
FileKey1=%AppData%\VirtuaWin|virtuawin.log

[Visual Watermark *]
LangSecRef=3023
DetectFile=%LocalAppData%\Visual Watermark*
FileKey1=%LocalAppData%\Visual Watermark Common\Temp|*

[Vit Registry Fix *]
LangSecRef=3024
Detect=HKCU\Software\VITSOFT\Vit Registry Fix
FileKey1=%ProgramFiles%\VITSOFT\Vit Registry Fix\Backup|BackupREG_*.Vreg

[Vizzed Retro Game Room *]
LangSecRef=3023
DetectFile=%UserProfile%\AppData\LocalLow\VizzedRgr
FileKey1=%UserProfile%\AppData\LocalLow\VizzedRgr\Downloads|*|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\VizzedRgr\Roms|*|RECURSE

[VLC Media Player *]
LangSecRef=3023
DetectFile1=%AppData%\vlc
DetectFile2=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a
FileKey1=%AppData%\vlc|*.cache-3;ml.xspf.tmp*;vlc-qt-interface.ini.*
FileKey2=%AppData%\vlc\art|*|RECURSE
FileKey3=%AppData%\vlc\crashdump*|*
FileKey4=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a\AC|*|RECURSE
FileKey5=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a\LocalState|*log.txt
FileKey6=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a\LocalState\videoThumbs|*
FileKey7=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a\Settings|*.log*
FileKey8=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a\SystemAppData\Helium|*.log*
FileKey9=%LocalAppData%\Packages\VideoLAN.VLC_paz6r1rewnh0a\TempState|*|REMOVESELF
FileKey10=%ProgramFiles%\Videolan\VLC\plugins|plugins.dat.*

[VMware Personal Desktop Virtualization *]
LangSecRef=3024
Detect1=HKLM\Software\VMware, Inc.\VMware Player
Detect2=HKLM\Software\VMware, Inc.\VMware Workstation
DetectFile=%UserProfile%\Documents\Virtual Machines
FileKey1=%LocalAppData%\VMware|*.log
FileKey2=%LocalAppData%\VMware\VMware vCenter Converter Standalone Client\Logs|*.gz;*.log
FileKey3=%LocalAppData%\VMware\wdm\Logs|*
FileKey4=%ProgramData%\VMware\hostd|*.gz;*.log|RECURSE
FileKey5=%ProgramData%\VMware\Installer|*|REMOVESELF
FileKey6=%ProgramData%\VMware\logs|*.log|RECURSE
FileKey7=%ProgramData%\VMware\VMware vCenter Converter Standalone|*.gz;*.log;*.zip|RECURSE
FileKey8=%UserProfile%\Documents\*Virtual Machines|*.log|RECURSE

[VNCViewer *]
LangSecRef=3024
Detect=HKU\.DEFAULT\Software\ORL\VNCviewer
FileKey1=%LocalAppData%\RealVNC|*.log
RegKey1=HKCU\Software\RealVNC\vncviewer\MRU
RegKey2=HKU\.DEFAULT\Software\ORL\VNCviewer\MRU

[Vodafone *]
LangSecRef=3022
Detect=HKCU\Software\Vodafone
FileKey1=%AppData%\Vodafone\Vodafone Mobile*\Log|*
FileKey2=%AppData%\Vodafone\Vodafone Mobile*\Temp|*
FileKey3=%ProgramData%\Vodafone\Log|*
FileKey4=%ProgramFiles%\Vodafone\Vodafone Mobile Broadband\Bin|SwiHpAux.log
FileKey5=%WinDir%|ModemLog_*.txt

[VoiCenter *]
LangSecRef=3022
DetectFile=%LocalAppData%\VoiCenter
FileKey1=%LocalAppData%\VoiCenter\Logs|*

[VoipBuster *]
LangSecRef=3022
DetectFile=%AppData%\VoipBuster
FileKey1=%AppData%\VoipBuster|*.log
FileKey2=%WinDir%\System32|VoipBuster*.log
FileKey3=%WinDir%\SysWOW64|VoipBuster*.log

[Volkswagen DiscoverCare *]
LangSecRef=3021
DetectFile=%UserProfile%\DiscoverCare
FileKey1=%UserProfile%\DiscoverCare\Data|DiscoverCare.log

[Vortex *]
Section=Games
DetectFile=%AppData%\Vortex
FileKey1=%AppData%\Vortex|*.log;*.tmp;Network Persistent State
FileKey2=%AppData%\Vortex\*Cache|*|REMOVESELF
FileKey3=%AppData%\Vortex\*Storage|*.old;LOG|RECURSE
FileKey4=%AppData%\Vortex\blob_storage|*|RECURSE
FileKey5=%AppData%\Vortex\Crashpad\reports|*|REMOVESELF
FileKey6=%AppData%\Vortex\logs|*.log
FileKey7=%AppData%\Vortex\temp|*|REMOVESELF
FileKey8=%LocalAppData%\Vortex-Updater|*
FileKey9=%LocalAppData%\Vortex-Updater\*|*|REMOVESELF
FileKey10=%UserProfile%\AppData\LocalLow\MCC\Config|ModManifest.txt|REMOVESELF

[VS Logon Screen Customizer *]
LangSecRef=3024
Detect=HKCU\Software\LOKIBIT.COM\VSLogonScreenCustomizer
RegKey1=HKCU\Software\LOKIBIT.COM\VSLogonScreenCustomizer|LastInputDir

[VSO *]
LangSecRef=3023
Detect=HKCU\Software\VSO
FileKey1=%AppData%|ezplay.log;pcouffin.log
FileKey2=%AppData%\VSO|*.log|REMOVESELF
FileKey3=%ProgramData%\VSO|*.cache;*.crashlist;*.log;*.vsothumb|RECURSE
FileKey4=%ProgramData%\VSO\vsothumbs|*|REMOVESELF
FileKey5=%UserProfile%|timestamp.txt
FileKey6=%UserProfile%\Documents\PcSetup|*.log|REMOVESELF

[VSO Batcher *]
LangSecRef=3023
Detect=HKCU\Software\VSO\VSO Batcher
FileKey1=%AppData%\Vso\VSO Batcher\1|*|RECURSE
RegKey1=HKCU\Software\VSO\VSO Batcher\1|VideoFilesLastFlder

[VSO Blindwrite *]
LangSecRef=3021
Detect=HKCU\Software\VSO\Blindwrite
FileKey1=%ProgramData%\VSO\Blindwrite\*|*.log|REMOVESELF

[VSO Converter *]
LangSecRef=3023
Detect1=HKCU\Software\VSO\Blu-ray Converter Ultimate
Detect2=HKCU\Software\VSO\DVD Converter Ultimate
Detect3=HKCU\Software\VSO\VSO Video Converter
FileKey1=%ProgramData%\VSO\*Converter*\*\Log|*.crashlist;*.log|REMOVESELF
FileKey2=%ProgramFiles%\VSO\*Converter*\*|*.txt
RegKey1=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|BDMVInputFolders
RegKey2=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|ISOInputFolders
RegKey3=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|MediaLabel
RegKey4=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_audio
RegKey5=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_bluray
RegKey6=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_dvd
RegKey7=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_iso
RegKey8=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_subtitle
RegKey9=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_video
RegKey10=HKCU\Software\VSO\DVD Converter Ultimate\2|BDMVInputFolders
RegKey11=HKCU\Software\VSO\DVD Converter Ultimate\2|ISOInputFolders
RegKey12=HKCU\Software\VSO\DVD Converter Ultimate\2|MediaLabel
RegKey13=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_audio
RegKey14=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_bluray
RegKey15=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_dvd
RegKey16=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_iso
RegKey17=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_subtitle
RegKey18=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_video
RegKey19=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_audio
RegKey20=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_bluray
RegKey21=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_dvd
RegKey22=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_iso
RegKey23=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_subtitle
RegKey24=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_video

[VSO ConvertXToDVD *]
LangSecRef=3023
Detect=HKCU\Software\VSO\ConvertXtoDVD
FileKey1=%ProgramFiles%\VSO\ConvertX\*|*.log;*.rtf

[VSO Downloader *]
LangSecRef=3023
Detect=HKCU\Software\VSO\VSO Downloader
FileKey1=%AppData%\VSO\VSO Downloader\*\items|*.item|RECURSE
FileKey2=%ProgramData%\VSO\VSO Downloader\*\items|*.item|RECURSE
FileKey3=%ProgramData%\VSO\VSO Downloader\*\log|*.log

[VSO Media Player *]
LangSecRef=3023
Detect=HKCU\Software\VSO\VSO Media Player
FileKey1=%AppData%\VSO\VSO Media Player\1|autoresume.xml
FileKey2=%ProgramData%\VSO\VSO Media Player\1\log|*.crashlist;*.log
RegKey1=HKCU\Software\VSO\VSO Media Player\1\RecentlyOpenedFiles

[VueScan *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\VueScan
DetectFile2=%SystemDrive%\VueScan
FileKey1=%ProgramFiles%\VueScan|*.log|RECURSE
FileKey2=%SystemDrive%\VueScan|*.log|RECURSE

[Vuze *]
LangSecRef=3022
Detect=HKCU\Software\Azureus
FileKey1=%AppData%\Azureus|ipfilter.cache
FileKey2=%AppData%\Azureus\plugins\advancedstatistics|*.txt
FileKey3=%AppData%\Azureus\plugins\dasu\reports|*
FileKey4=%AppData%\Azureus\plugins\progressbar|*.txt
FileKey5=%AppData%\Azureus\torrents|*.tmp
FileKey6=%ProgramFiles%\Vuze|*.log|RECURSE

[W3C Amaya *]
LangSecRef=3022
DetectFile=%UserProfile%\amaya
FileKey1=%UserProfile%\amaya|list_url_utf8.dat
FileKey2=%UserProfile%\amaya\*|*|REMOVESELF

[Wacom *]
LangSecRef=3023
Detect=HKCU\Software\Wacom
FileKey1=%AppData%\WTablet|*.bak
FileKey2=%SystemDrive%\Wacom\Logs|*

[Wanted Weapons of Fate *]
Section=Games
DetectFile=%LocalAppData%\wanted
FileKey1=%LocalAppData%\wanted|crash*.txt

[War Thunder *]
Section=Games
Detect1=HKCU\Software\Gaijin\WarThunder
Detect2=HKCU\Software\Valve\Steam\Apps\236390
FileKey1=%ProgramFiles%\Steam\SteamApps\common\War Thunder\.launcher_log|*.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\common\War Thunder\_debuginfo|*.clog
FileKey3=%ProgramFiles%\War Thunder\.launcher_log|*.txt
FileKey4=%ProgramFiles%\War Thunder\_debuginfo|*.clog

[Warcraft III *]
Section=Games
DetectFile=%ProgramFiles%\Warcraft III
FileKey1=%ProgramFiles%\Warcraft III|*.html;*.log
FileKey2=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt
ExcludeKey1=PATH|%ProgramFiles%\Warcraft III\|CustomKey*.txt

[Warcraft III Backups *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Warcraft III
FileKey1=%ProgramFiles%\Warcraft III|*.bak;*.old|RECURSE

[Warframe *]
Section=Games
Detect=HKCU\Software\Digital Extremes\Warframe
FileKey1=%LocalAppData%\Warframe|*.log

[Wargaming.net GameCenter *]
Section=Games
DetectFile=%ProgramFiles%\Wargaming.net\GameCenter
FileKey1=%ProgramFiles%\Wargaming.net\GameCenter|*.bak
FileKey2=%ProgramFiles%\Wargaming.net\GameCenter\Cache|*|RECURSE
FileKey3=%ProgramFiles%\Wargaming.net\GameCenter\Logs|*

[Wargaming.net World of Tanks *]
Section=Games
DetectFile=%AppData%\Wargaming.net\WorldofTanks
FileKey1=%AppData%\Wargaming.net\WorldofTanks\*_Cache|*|RECURSE
FileKey2=%AppData%\Wargaming.net\WorldofTanks\Profile\Cef_Cache|Visited Links
FileKey3=%AppData%\Wargaming.net\WorldofTanks\Profile\Cef_Cache\blob_storage|*|RECURSE
FileKey4=%AppData%\Wargaming.net\WorldofTanks\Profile\Cef_Cache\Code Cache|*|RECURSE

[Warhammer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\4570
DetectFile=%AppData%\The Creative Assembly\Warhammer*
FileKey1=%AppData%\The Creative Assembly\Warhammer*\Logs|*
FileKey2=%AppData%\The Creative Assembly\Warhammer*\Temp|*.temp
FileKey3=%ProgramFiles%\Steam\steamapps\common\Dawn of War Gold\Logfiles|*

[Waterfox Autocomplete History *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|formhistory*

[Waterfox Autofill Data *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|autofill-profiles.json

[Waterfox Bookmark Backups *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*\bookmarkbackups|*

[Waterfox Bookmark Favicons *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|favicons*

[Waterfox Caches *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Waterfox\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Waterfox\Profiles\*\notificationstore|*
FileKey4=%AppData%\Waterfox\Profiles\*\security_state|*
FileKey5=%AppData%\Waterfox\Profiles\*\shader-cache|*
FileKey6=%AppData%\Waterfox\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Waterfox\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Waterfox\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Waterfox\Profiles\*\thumbnails|*|REMOVESELF

[Waterfox Privacy Sandbox *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|credentialstate.sqlite

[Waterfox Saved Usernames & Passwords *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|key4.db;logins.json

[Waterfox Synced Tabs *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|synced-tabs.db*

[Waterfox Telemetry *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox|*.log|RECURSE
FileKey2=%AppData%\Waterfox\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Waterfox\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Waterfox\Profiles\*\crashes|*
FileKey5=%AppData%\Waterfox\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Waterfox\Profiles\*\minidumps|*
FileKey7=%AppData%\Waterfox\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Waterfox\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Waterfox\Profiles\*\weave\logs|*

[Waterfox Web Browsing Cookies *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|cookies*

[Waterfox Web Browsing Session *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|session*.json*

[Waterfox Web Browsing Session Backups *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*\sessionstore-backups|*

[Waterfox Web Storage *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Waterfox\Profiles\*\storage\default\http*|*|REMOVESELF

[Waterfox Website Permissions *]
Section=Waterfox Web Browser
DetectFile=%AppData%\Waterfox\Profiles
FileKey1=%AppData%\Waterfox\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Watto Studios Game Extractor *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Game Extractor
FileKey1=%ProgramFiles%\Game Extractor\extract|*
FileKey2=%ProgramFiles%\Game Extractor\logs|*
FileKey3=%ProgramFiles%\Game Extractor\previews|*
FileKey4=%ProgramFiles%\Game Extractor\temp|*

[Wave Systems Corp *]
LangSecRef=3021
DetectFile=%AppData%\Wave Systems Corp
FileKey1=%AppData%\Wave Systems Corp|DSM_AM.*
FileKey2=%LocalAppData%\Wave Systems Corp\WCLIENTDLL|errors.txt
FileKey3=%ProgramData%\Wave Systems Corp|*.log|RECURSE

[Wavebox Autofill Data & Search Engine Preferences *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|*Web Data
FileKey2=%LocalAppData%\Waveboxapp\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Waveboxapp\User Data\AutoFill*|*|REMOVESELF

[Wavebox Autoplay Preferences *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\MEIPreload|*|REMOVESELF

[Wavebox Bookmark Backups *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|Bookmarks.bak

[Wavebox Bookmark Favicons *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|favicons*

[Wavebox Caches *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Waveboxapp\User Data|Module Info Cache
FileKey3=%LocalAppData%\Waveboxapp\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate
FileKey4=%LocalAppData%\Waveboxapp\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Waveboxapp\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Waveboxapp\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Waveboxapp\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Waveboxapp\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Waveboxapp\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Waveboxapp\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Waveboxapp\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Waveboxapp\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Waveboxapp\User Data\*\Service Worker|*|REMOVESELF
FileKey14=%LocalAppData%\Waveboxapp\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey15=%LocalAppData%\Waveboxapp\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey16=%LocalAppData%\Waveboxapp\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey17=%LocalAppData%\Waveboxapp\User Data\*Cache*|*|REMOVESELF
FileKey18=%LocalAppData%\Waveboxapp\User Data\Avatars|*|REMOVESELF
FileKey19=%LocalAppData%\Waveboxapp\User Data\Optimization*|*|REMOVESELF

[Wavebox Default App Handlers *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|PreferredApps

[Wavebox Download History *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Waveboxapp\User Data\*\shared_proto_db|*|REMOVESELF

[Wavebox DRM Data *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey2=%LocalAppData%\Waveboxapp\User Data\WidevineCdm|*|REMOVESELF

[Wavebox Extension Cookies *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|Extension Cookies

[Wavebox Pinned Tabs *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
RegKey1=HKCU\Software\WaveboxApp\PreferenceMACs\Default|pinned_tabs

[Wavebox Privacy Sandbox *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Waveboxapp\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Waveboxapp\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Waveboxapp\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Waveboxapp\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Waveboxapp\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Waveboxapp\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Waveboxapp\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Wavebox Progressive Web Apps *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\Web Applications|*|REMOVESELF

[Wavebox Saved Usernames & Passwords *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|Login Data*

[Wavebox Security & Threat Detection *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|DIPS*
FileKey2=%LocalAppData%\Waveboxapp\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Waveboxapp\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Waveboxapp\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Waveboxapp\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Waveboxapp\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Waveboxapp\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Waveboxapp\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Waveboxapp\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Waveboxapp\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Waveboxapp\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Waveboxapp\User Data\ZxcvbnData|*|REMOVESELF

[Wavebox Shopping Insights *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Waveboxapp\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Waveboxapp\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Waveboxapp\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Waveboxapp\User Data\*\parcel_tracking_db|*|REMOVESELF

[Wavebox Storage Quota Manager *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|QuotaManager

[Wavebox Sync Data *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\Sync Data|*|REMOVESELF

[Wavebox Telemetry *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\Application|debug.log
FileKey2=%LocalAppData%\Waveboxapp\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Waveboxapp\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Waveboxapp\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Waveboxapp\User Data\*|*.log
FileKey6=%LocalAppData%\Waveboxapp\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Waveboxapp\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Waveboxapp\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Waveboxapp\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Waveboxapp\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Waveboxapp\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Waveboxapp\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Waveboxapp\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Waveboxapp\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Waveboxapp\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Waveboxapp\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Waveboxapp\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Waveboxapp\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Waveboxapp\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Waveboxapp\Application|debug.log
FileKey21=%ProgramFiles%\Waveboxapp\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\WaveboxApp\BlBeacon|failed_count
RegKey2=HKCU\Software\WaveboxApp\BlBeacon|state
RegKey3=HKCU\Software\WaveboxApp\Installer|LastChecked
RegKey4=HKCU\Software\WaveboxApp\StabilityMetrics

[Wavebox Web Browsing Cookies *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\Network|Cookies*;Device Bound Sessions*

[Wavebox Web Browsing History *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*|History*;Network Action Predictor*;shortcuts*;Top Sites*;Visited Links*

[Wavebox Web Browsing Session *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Waveboxapp\User Data\*\Sessions|*|REMOVESELF

[Wavebox Web Storage *]
Section=Wavebox Web Browser
DetectFile=%LocalAppData%\Waveboxapp\User Data
FileKey1=%LocalAppData%\Waveboxapp\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Waveboxapp\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Waveboxapp\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Waveboxapp\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Waveboxapp\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Waveboxapp\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Waveboxapp\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Waveboxapp\User Data\*\WebStorage|*|REMOVESELF

[Waves Audio *]
LangSecRef=3023
DetectFile=%AppData%\Waves Audio
FileKey1=%AppData%\Waves Audio\Caches|*|RECURSE
FileKey2=%AppData%\Waves Audio\Waves Central\logs|*|RECURSE
FileKey3=%LocalAppData%\Waves Audio\logs|*.log*
FileKey4=%LocalAppData%\Waves Audio\Waves Central\Cache\QtWebEngine\Default\Cache|*

[Wavosaur *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Wavosaur
FileKey1=%ProgramFiles%\Wavosaur|wavosaur.log

[Weather Watcher Live *]
LangSecRef=3021
Detect=HKCU\Software\VB and VBA Program Settings\Weather Watcher Live
FileKey1=%AppData%\WeatherWatcherLive|WeatherWatcherLive.log
FileKey2=%AppData%\WeatherWatcherLive\LatestChanges|*
FileKey3=%AppData%\WeatherWatcherLive\Temp|*

[WebP Codec *]
LangSecRef=3023
DetectFile=%ProgramFiles%\WebP Codec
FileKey1=%ProgramFiles%\WebP Codec\Example Files|*|REMOVESELF

[Webroot SecureAnywhere *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\Webroot
DetectFile2=%UserProfile%\AppData\LocalLow\Webroot
FileKey1=%AppData%\Local\Temp\lptmp*|*|REMOVESELF
FileKey2=%LocalAppData%\lptmp*|*|REMOVESELF
FileKey3=%ProgramData%\WRData|WRLog.log

[WebTorrent *]
LangSecRef=3022
DetectFile=%AppData%\WebTorrent
FileKey1=%AppData%\WebTorrent\*Cache|*
FileKey2=%LocalAppData%\WebTorrent|*.log

[West of Loathing *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\597220
FileKey1=%UserProfile%\AppData\LocalLow\Asymmetric Software\West of Loathing|*output_log.txt
FileKey2=%UserProfile%\AppData\LocalLow\Asymmetric Software\West of Loathing\Crashes|*

[Western Digital Dashboard *]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Western Digital\SSD Dashboard
FileKey1=%LocalAppData%\Western Digital\Dashboard\cache\QtWebEngine\Default\Cache|*|RECURSE
FileKey2=%LocalAppData%\Western Digital\Dashboard\QtWebEngine\Default|*.old
FileKey3=%LocalAppData%\Western Digital\Dashboard\QtWebEngine\Default\GPUCache|*|RECURSE
FileKey4=%ProgramFiles%\Western Digital\SSD Dashboard|dashboard.log

[Western Digital SmartWare *]
LangSecRef=3024
DetectFile=%ProgramData%\Western Digital
FileKey1=%AppData%\Western Digital\WD SmartWare\Logs|*
FileKey2=%LocalAppData%\Western Digital\WD SmartWare|*log.txt
FileKey3=%ProgramData%\Western Digital\Logs\WD *\*|*.log
FileKey4=%ProgramData%\Western Digital\Logs\WD Firmware Updater|*|REMOVESELF
FileKey5=%ProgramData%\Western Digital\WD SmartWare|*.log
FileKey6=%ProgramData%\Western Digital\WDFME|*
FileKey7=%Public%\Documents\Downloads\WD_SmartWare_Installer_*|*|REMOVESELF

[WhatPulse *]
LangSecRef=3021
Detect=HKCU\Software\WhatPulse
FileKey1=%AppData%\WhatPulse|*.bak;*.log

[WhatsApp *]
LangSecRef=3022
DetectFile=%LocalAppData%\WhatsApp
FileKey1=%AppData%\WhatsApp|*.log*;*_log.txt;Network Persistent State;QuotaManager
FileKey2=%AppData%\WhatsApp|*-journal;*.old;LOG|RECURSE
FileKey3=%AppData%\WhatsApp\*Cache|*|RECURSE
FileKey4=%AppData%\WhatsApp\blob_storage|*|RECURSE
FileKey5=%AppData%\WhatsApp\Crashpad\Reports|*
FileKey6=%AppData%\WhatsApp\Logs|*
FileKey7=%AppData%\WhatsApp\Service Worker\*Cache*|*|RECURSE
FileKey8=%AppData%\WhatsApp\VideoDecodeStats|*
FileKey9=%LocalAppData%\WhatsApp|*.log
FileKey10=%LocalAppData%\WhatsApp\app-*|*.log
FileKey11=%LocalAppData%\WhatsApp\packages\SquirrelTemp|*|REMOVESELF

[wherewhere App Installer (Mobile) *]
LangSecRef=3024
DetectFile=%LocalAppData%\Packages\18184wherewhere.AndroidAppInstaller_4v4sx105x6y4r
FileKey1=%LocalAppData%\Packages\18184wherewhere.AndroidAppInstaller_4v4sx105x6y4r\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\18184wherewhere.AndroidAppInstaller_4v4sx105x6y4r\LocalState\MetroLogs|*
FileKey3=%LocalAppData%\Packages\18184wherewhere.AndroidAppInstaller_4v4sx105x6y4r\Settings|*.log*
FileKey4=%LocalAppData%\Packages\18184wherewhere.AndroidAppInstaller_4v4sx105x6y4r\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\18184wherewhere.AndroidAppInstaller_4v4sx105x6y4r\TempState|*|REMOVESELF

[Who Pressed Mute On Uncle Marcus *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Wales Interactive\Who Pressed Mute On Uncle Marcus
FileKey1=%UserProfile%\AppData\LocalLow\Wales Interactive\Who Pressed Mute On Uncle Marcus|*.log
FileKey2=%UserProfile%\AppData\LocalLow\Wales Interactive\Who Pressed Mute On Uncle Marcus_\Unity|*|REMOVESELF

[Whoer VPN *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Whoer
FileKey1=%ProgramFiles%\Whoer|log.txt

[Who's On My WiFi *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{010D45A1-093D-4534-8147-4E10E80F81CC}_is1
FileKey1=%ProgramFiles%\IO3O LLC\Who Is On My Wifi\logs|*

[WhySoSlow *]
LangSecRef=3024
Detect=HKCU\Software\Resplendence Sp\WhySoSlow
FileKey1=%LocalAppData%\Resplendence|WhySoSlowLog.txt

[WildTangent *]
LangSecRef=3021
DetectFile=%AppData%\WildTangent
FileKey1=%AppData%\WildTangent\Logs|*

[Win Movie Maker *]
LangSecRef=3023
DetectFile=%AppData%\VideoWinSoft
FileKey1=%AppData%\VideoWinSoft|format_his.db
FileKey2=%AppData%\VideoWinSoft\logs|*|RECURSE

[WinAce *]
LangSecRef=3024
Detect=HKU\.DEFAULT\Software\e-merge\WinAce\2.0
DetectFile=%ProgramFiles%\WinAce
FileKey1=%ProgramFiles%\WinAce|*.cnt;*.log
RegKey1=HKU\.DEFAULT\Software\e-merge\WinAce\2.0\MRU Items

[Winaero Tweaker *]
LangSecRef=3024
Detect=HKCU\Software\Winaero.com\Winaero Tweaker
RegKey1=HKCU\Software\Winaero.com\Winaero Tweaker|SetupDir

[Winamp *]
LangSecRef=3023
Detect1=HKCU\Software\Streamripper
Detect2=HKCU\Software\Winamp
FileKey1=%AppData%\Streamripper|*|REMOVESELF
FileKey2=%AppData%\Winamp\Plugins|*.dmp;*.log;feedback.ini;report.zip
FileKey3=%AppData%\Winamp\Plugins\ml|ml_pmp_device_*.ini;recent.dat;recent.idx
FileKey4=%ProgramFiles%\Winamp|*log.txt
FileKey5=%ProgramFiles%\Winamp\Plugins|*.log
FileKey6=%ProgramFiles%\Winamp\Plugins\ml|ml_pmp_device_*.ini;recent.dat;recent.idx

[Winamp Current Playlist *]
LangSecRef=3023
Detect=HKCU\Software\Winamp
FileKey1=%AppData%\Winamp|Winamp.m3u;Winamp.m3u8

[Winamp Playlist Undo Plug-in *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Winamp\Plugins\gen_undo.dll
FileKey1=%AppData%\Winamp\Plugins|undo.gul
FileKey2=%AppData%\Winamp\Plugins\gen_undo|*.m3u8

[WinAVI Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\ZjSoft\WinAVI
FileKey1=%LocalAppData%\winavi|debug.log

[WinCHM *]
LangSecRef=3021
Detect=HKCU\Software\Softany\WinCHM
RegKey1=HKCU\Software\Softany\WinCHM|RecentFile1
RegKey2=HKCU\Software\Softany\WinCHM|RecentFile2
RegKey3=HKCU\Software\Softany\WinCHM|RecentFile3
RegKey4=HKCU\Software\Softany\WinCHM|RecentFile4
RegKey5=HKCU\Software\Softany\WinCHM|RecentFile5
RegKey6=HKCU\Software\Softany\WinCHM|RecentFile6

[WinDjView *]
LangSecRef=3024
Detect=HKCU\Software\Andrew Zhezherun\WinDjView
RegKey1=HKCU\Software\Andrew Zhezherun\WinDjView\Documents
RegKey2=HKCU\Software\Andrew Zhezherun\WinDjView\Recent File List

[Windows 7 Manager *]
LangSecRef=3024
Detect=HKCU\Software\Yamicsoft\Windows 7 Manager
FileKey1=%ProgramFiles%\Yamicsoft\Windows 7 Manager\DiskAnalyzerXML|*

[Windows Activity History *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=You need to run this in Windows Safe Mode. Or stop services "Connected Devices Platform Service" and "Connected Devices Platform User Service_xxxxx" prior to cleaning and restart after cleaning.
FileKey1=%LocalAppData%\ConnectedDevicesPlatform\*|*.db*

[Windows AutoPlay Devices *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\KnownDevices

[Windows Calculator *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows Camera *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\AppData|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Camera_8wekyb3d8bbwe\SearchHistory

[Windows CD Burning Queue *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning
FileKey1=%LocalAppData%\Microsoft\CD Burning|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\Burn|*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo

[Windows Clock *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows Credential Manager Saved Credentials *]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft\Vault
FileKey1=%LocalAppData%\Microsoft\Vault\*|*.vcrd

[Windows Cryptographic Services *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%UserProfile%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE
FileKey2=%UserProfile%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE
FileKey3=%WinDir%\ServiceProfiles\*\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE
FileKey4=%WinDir%\ServiceProfiles\*\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE
FileKey7=%WinDir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content|*|RECURSE
FileKey8=%WinDir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE
FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE
FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE

[Windows Device Manager *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%WinDir%\INF|INFCACHE.1
FileKey2=%WinDir%\System32\DriverStore|INFCACHE.1

[Windows Error Reporting *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\Windows Error Reporting
FileKey1=%LocalAppData%\CrashDumps|*dmp*
FileKey2=%LocalAppData%\PCHealth\ErrorRep\QSignoff|*
FileKey3=%ProgramData%\Microsoft\Windows\WER\ReportArchive|*|REMOVESELF
FileKey4=%ProgramData%\Microsoft\Windows\WER\Temp|*|RECURSE
FileKey5=%WinDir%\*LOCALAPPDATA*\CrashDumps|*dmp*
FileKey6=%WinDir%\LiveKernelReports|*.dmp|RECURSE
FileKey7=%WinDir%\pchealth\ERRORREP|*|RECURSE
FileKey8=%WinDir%\pchealth\helpctr\DataColl|*.xml
FileKey9=%WinDir%\pchealth\helpctr\OfflineCache|*|RECURSE
FileKey10=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\CrashDumps|*
FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE
FileKey12=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*dmp*
FileKey13=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE
FileKey14=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE
FileKey15=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation
RegKey2=HKLM\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation
RegKey3=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports|LastFullLiveReport
RegKey4=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports\win32k.sys
RegKey5=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports\win32k.sys
RegKey6=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation

[Windows Event Logs *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Windows\Explorer|*.etl
FileKey2=%ProgramData%\Microsoft\Windows\wfp|*.etl
FileKey3=%ProgramData%\USOShared\Logs|*.etl|RECURSE
FileKey4=%ProgramFiles%\CUAssistant\Logs|*.etl
FileKey5=%ProgramFiles%\rempl\Logs|*.etl
FileKey6=%WinDir%\INF|*.etl
FileKey7=%WinDir%\Logs|*.etl|RECURSE
FileKey8=%WinDir%\Panther|*.etl
FileKey9=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs|*|RECURSE
FileKey10=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer|ExplorerStartupLog.etl
FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Packages\Microsoft.GamingServices*\LocalState|*.etl
FileKey12=%WinDir%\System32\Logs|*.etl
FileKey13=%WinDir%\System32\NDF|*.etl
FileKey14=%WinDir%\System32\SleepStudy|*.etl|RECURSE
FileKey15=%WinDir%\System32\WDI\*|*.etl*|RECURSE
FileKey16=%WinDir%\System32\winevt\logs|*
FileKey17=%WinDir%\Temp|*.evt*

[Windows Event Viewer *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Event Viewer|RecentViews
FileKey2=%ProgramData%\Microsoft\Event Viewer\*Logs|*.xml

[Windows Feedback Hub *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\DiagOutputDir|*.txt
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows File Manager *]
LangSecRef=3024
DetectFile1=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy
DetectFile2=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\LocalCache\Local\*|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE
FileKey4=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\LocalCache\LocalLow\Temp|*|RECURSE
FileKey5=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\LocalCache\Roaming\*|*|REMOVESELF
FileKey6=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\LocalCache\Temp|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\LocalState|*.jpg
FileKey8=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\Settings|*.log*
FileKey9=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\FileManager_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey11=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\AC|*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\LocalCache\Local\*|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\LocalCache\LocalLow\Temp|*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\LocalCache\Roaming\*|*|REMOVESELF
FileKey16=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\LocalCache\Temp|*|REMOVESELF
FileKey17=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\Settings|*.log*
FileKey18=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey19=%LocalAppData%\Packages\Microsoft.WindowsFileManager_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows Font Cache *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%LocalAppData%|GDIPFONTCACHEV1.DAT
FileKey2=%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data|*FontCache*.dat
FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local|*FontCache*.dat
FileKey4=%WinDir%\ServiceProfiles\LocalService\AppData\Local\FontCache|*FontCache*.dat
FileKey5=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Fonts|*.tmp

[Windows Game Statistics *]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft Games
FileKey1=%LocalAppData%\Microsoft Games|*.xml*|RECURSE

[Windows Get Help *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe\AC|*|RECURSE
FileKey8=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey9=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey10=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe\Settings|*.log*
FileKey11=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey12=%LocalAppData%\Packages\Windows.ContactSupport_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows Grep *]
LangSecRef=3024
Detect=HKCU\Software\Windows Grep\Windows Grep
RegKey1=HKCU\Software\Windows Grep\Windows Grep\Current Version\Replace Options|Replace String
RegKey2=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Filespecs
RegKey3=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Folders
RegKey4=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Strings

[Windows Image Acquisition *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\WIA
FileKey1=%AppData%\Microsoft\Document Center\UserScanProfiles|*
FileKey2=%LocalAppData%\Microsoft\UserScanProfiles|*
FileKey3=%UserProfile%|Sti_Trace.log
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\WIA

[Windows Installer *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer
FileKey1=%SystemDrive%\Config.msi|*|REMOVESELF
FileKey2=%WinDir%\Installer|*.tmp|RECURSE
FileKey3=%WinDir%\Installer|SourceHash{*};wix{*}.SchedServiceConfig.rmi
FileKey4=%WinDir%\Installer\Config.Msi|*|REMOVESELF
FileKey5=%WinDir%\Installer\MSI*.tmp-|*|REMOVESELF
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local|*.tmp|RECURSE

[Windows Language Libraries *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe
DetectFile3=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe
DetectFile4=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe
DetectFile5=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe
DetectFile6=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe
DetectFile7=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe
DetectFile8=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.VCLibs.110.00.UWPDesktop_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe\AC|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe\Settings|*.log*
FileKey11=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey12=%LocalAppData%\Packages\Microsoft.VCLibs.110.00_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe\AC|*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe\Settings|*.log*
FileKey17=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey18=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.Universal_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey19=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe\AC|*|RECURSE
FileKey20=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey21=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey22=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe\Settings|*.log*
FileKey23=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey24=%LocalAppData%\Packages\Microsoft.VCLibs.120.00.UWPDesktop_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey25=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe\AC|*|RECURSE
FileKey26=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey27=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey28=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe\Settings|*.log*
FileKey29=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey30=%LocalAppData%\Packages\Microsoft.VCLibs.120.00_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey31=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC|*|RECURSE
FileKey32=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey33=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey34=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\Settings|*.log*
FileKey35=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey36=%LocalAppData%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey37=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC|*|RECURSE
FileKey38=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey39=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey40=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\Settings|*.log*
FileKey41=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey42=%LocalAppData%\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey43=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe\AC|*|RECURSE
FileKey44=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe\LocalState\*Cache|*|RECURSE
FileKey45=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey46=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe\Settings|*.log*
FileKey47=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey48=%LocalAppData%\Packages\Microsoft.WinJS.2.0_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey49=%SystemDrive%|eula.*.txt;globdata.ini;install.exe;install.ini;install.res.*.dll;vcredist.bmp;VC_RED.cab;VC_RED.MSI

[Windows Lock Screen *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy
DetectFile2=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.LockApp_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Favicons|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\MobilityExperience\ImageCache|*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\OneSettingsResponseCache|*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache|*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings|*.log*
FileKey14=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey15=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps

[Windows Logs *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%LocalAppData%\ConnectedDevicesPlatform|*.log
FileKey2=%LocalAppData%\Diagnostics|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\Dialer|*.log.txt
FileKey4=%LocalAppData%\Microsoft\msipc\Logs|*
FileKey5=%LocalAppData%\Microsoft\Portable Devices|wpdlog*.sqm
FileKey6=%ProgramData%\Microsoft\Diagnosis\DownloadedSettings|*.json.bk
FileKey7=%ProgramData%\Microsoft\Diagnosis\ETLLogs|*|RECURSE
FileKey8=%ProgramData%\Microsoft\DiagnosticLogCSP|*|RECURSE
FileKey9=%ProgramData%\Microsoft\Network\Downloader|*|RECURSE
FileKey10=%ProgramData%\Microsoft\WDF|*|RECURSE
FileKey11=%ProgramData%\Microsoft\Windows Security Health\Logs|*|RECURSE
FileKey12=%ProgramData%\USOShared\Logs|*|RECURSE
FileKey13=%ProgramData%\Whesvc\sys_perf_summary\sys_perf_input_delays|*
FileKey14=%ProgramFiles%\UNP\*Logs|*
FileKey15=%SystemDrive%|DumpStack.log
FileKey16=%SystemDrive%\PerfLogs\System\Diagnostics|*|RECURSE
FileKey17=%SystemDrive%\PerfLogs\System\Performance|*|RECURSE
FileKey18=%WinDir%|*.log
FileKey19=%WinDir%\AppCompat\Backup|*.json
FileKey20=%WinDir%\AppCompat\pca|*.txt
FileKey21=%WinDir%\AppCompat\Programs|*.txt;*.xml
FileKey22=%WinDir%\AppCompat\Programs\Install|*.txt;*.xml
FileKey23=%WinDir%\debug|*.log|RECURSE
FileKey24=%WinDir%\INF|*.log*
FileKey25=%WinDir%\Logs|*.log|RECURSE
FileKey26=%WinDir%\Logs\CBS|*.cab
FileKey27=%WinDir%\Panther|*.tmp;*GatherPnPList.log;cbs.log;DDACLSys.log;miglog.xml;Migrep.html;setup*.log
FileKey28=%WinDir%\Panther\FastCleanup|*.log
FileKey29=%WinDir%\Panther\Rollback|*.txt
FileKey30=%WinDir%\Panther\UnattendGC|diag*.xml;setup*.log
FileKey31=%WinDir%\repair|setup.log
FileKey32=%WinDir%\security\logs|*|RECURSE
FileKey33=%WinDir%\ServiceProfiles\NetworkService\debug|*.log
FileKey34=%WinDir%\System32\CatRoot|*.tmp
FileKey35=%WinDir%\System32\CatRoot_bak|*|REMOVESELF
FileKey36=%WinDir%\System32\catroot2|*.chk;*.jrs;*.log;*.txt
FileKey37=%WinDir%\System32\config\systemprofile\AppData\Local\DataSharing\Storage|*.log
FileKey38=%WinDir%\System32\LogFiles|*|RECURSE
FileKey39=%WinDir%\System32\sysprep\Panther\IE|*.log;diagerr.xml;diagwrn.xml
FileKey40=%WinDir%\System32\WDI\LogFiles\StartupInfo|*|RECURSE
FileKey41=%WinDir%\Temp|*.log
RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey2=HKLM\Software\Microsoft\Tracing
RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing

[Windows Mail *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows Mail
FileKey1=%LocalAppData%\Microsoft\Windows Mail|*.chk;*.jrs;*.log|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows Mail\Backup\Old|*|REMOVESELF

[Windows Mail and Calendar *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Comms\Unistore\data|AggregateCache.uca
FileKey2=%LocalAppData%\Comms\UnistoreDB|*.jcp;*.jrs;*.jtx
FileKey3=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey5=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState|*.etl;*.jpg;*.log
FileKey6=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\AppData\Local\Office\*\WebServiceCache|*|RECURSE
FileKey7=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Livecomm\*\dbStore\LogFiles|*
FileKey8=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings|*.log*
FileKey9=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SearchHistory

[Windows Media Extensions *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.AV1VideoExtension_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.AVCEncoderVideoExtension_8wekyb3d8bbwe
DetectFile3=%LocalAppData%\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe
DetectFile4=%LocalAppData%\Packages\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe
DetectFile5=%LocalAppData%\Packages\Microsoft.MPEG2VideoExtension_8wekyb3d8bbwe
DetectFile6=%LocalAppData%\Packages\Microsoft.RawImageExtension_8wekyb3d8bbwe
DetectFile7=%LocalAppData%\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe
DetectFile8=%LocalAppData%\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe
DetectFile9=%LocalAppData%\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.*extension*\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.*extension*\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.*extension*\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.*extension*\TempState|*|RECURSE

[Windows Media Player *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe
FileKey1=%LocalAppData%|DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
FileKey2=%LocalAppData%\Microsoft\Media Player\*Cache*|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\Image|*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\PlayReady|*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState|*.db*;*.tmp;AppState.json*
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\*|*.log
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\ImageCache|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\ImageRetrievalFailure|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\ImageStore|*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\navigationHistory|*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\PlayReady|*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings|*.log*
FileKey14=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey15=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory
RegKey2=HKCU\Software\Microsoft\MediaPlayer\Player\Settings|OpenDir
RegKey3=HKCU\Software\Microsoft\MediaPlayer\Preferences|CDRecordPath
RegKey4=HKCU\Software\Microsoft\MediaPlayer\Preferences|MostRecentFileAddOrRemove
RegKey5=HKCU\Software\Microsoft\MediaPlayer\Preferences|ObfuscatedSyncPlaylistsPath
RegKey6=HKCU\Software\Microsoft\MediaPlayer\Services\Bing|CachedIconPath
RegKey7=HKCU\Software\Microsoft\MediaPlayer\Services\Bing|CachedLargeLogoPath
RegKey8=HKCU\Software\Microsoft\MediaPlayer\Setup\FileMoveCache\Source
RegKey9=HKU\.DEFAULT\Software\Microsoft\MediaPlayer\Player\RecentFileList
RegKey10=HKU\S-1-5-18\Software\Microsoft\MediaPlayer\Preferences|ObfuscatedSyncPlaylistsPath

[Windows Metafile Viewer *]
LangSecRef=3023
Detect=HKCU\Software\Metafile Viewer\WMF Viewer
RegKey1=HKCU\Software\Metafile Viewer\WMF Viewer\Recent File List

[Windows Notepad *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Notepad
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\*State|*.bin
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Microsoft\Notepad|iWindowPosDX
RegKey2=HKCU\Software\Microsoft\Notepad|iWindowPosDY
RegKey3=HKCU\Software\Microsoft\Notepad|iWindowPosX
RegKey4=HKCU\Software\Microsoft\Notepad|iWindowPosY
RegKey5=HKCU\Software\Microsoft\Notepad|replaceString
RegKey6=HKCU\Software\Microsoft\Notepad|searchString

[Windows Notifications *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Windows\ActionCenterCache|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\Notifications|WPN*
FileKey3=%LocalAppData%\Microsoft\Windows\Notifications\wpnidm|*|RECURSE
FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications|WPN*
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\wpnidm|*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm
RegKey3=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm

[Windows Package Manager *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir|*
FileKey3=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows Password Reset Audit *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WPRAudit
FileKey1=%UserProfile%\Documents|Splash.htm;WPRF.htm

[Windows Photo Gallery *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows Photo Gallery
RegKey1=HKCU\Software\Microsoft\Windows Photo Gallery\Library\PreviewAssignment\MRU
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|FilenameTemplate
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|RootDirectory
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\DestinationMru
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|FilenameTemplate
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|RootDirectory
RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|FilenameTemplate
RegKey8=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|RootDirectory

[Windows Photo Viewer *]
LangSecRef=3025
DetectFile=%AppData%\Microsoft\Windows Photo Viewer
FileKey1=%AppData%\Microsoft\Windows Photo Viewer|*

[Windows Photos *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState|*.etl;*.jpg;*.log;*.sqlite*;*.xml
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\bici|*.sqm
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTile|*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings|*.log*
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\AC|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\LocalState|*.etl;*.jpg;*.log;*.sqlite*;*.xml
FileKey12=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\LocalState\bici|*.sqm
FileKey13=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\LocalState\PhotosAppTile|*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\Settings|*.log*
FileKey15=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey16=%LocalAppData%\Packages\Microsoft.Windows.Photos_cw5n1h2txyewy\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedPickerData\Microsoft.Windows.Photos_8wekyb3d8bbwe!App\DefaultSaveFileSingle
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp
RegKey3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed
RegKey4=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowsphotos_8wekyb3d8bbwe\SearchHistory

[Windows Power Efficiency Diagnostics *]
LangSecRef=3025
DetectFile=%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics
FileKey1=%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics|*.xml
FileKey2=%WinDir%\System32|battery-report.html;energy-report.html
ExcludeKey1=FILE|%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics\|energy-report-latest.xml

[Windows PowerShell *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\PowerShell
FileKey1=%AppData%\Microsoft\Windows\PowerShell\PSReadline|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\PowerShell|ModuleAnalysisCache*;StartupProfileData*
FileKey3=%LocalAppData%\Microsoft\Windows\PowerShell\CommandAnalysis|*|RECURSE
FileKey4=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*|user.config
FileKey5=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*\AutoSaveFiles|*|RECURSE
FileKey6=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*\AutoSaveInformation|*|RECURSE
FileKey7=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell|ModuleAnalysisCache*;StartupProfileData*

[Windows Printing *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
DetectFile=%LocalAppData%\Packages\Windows.PrintDialog_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey5=%SystemDrive%\spoolerlogs|spooler.xml
FileKey6=%WinDir%\System32\spool|spooler.xml
FileKey7=%WinDir%\System32\Spool\Printers|*

[Windows Program Compatibility Assistant *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant
FileKey1=%WinDir%\appcompat\Programs|*.log*
RegKey1=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
RegKey2=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
RegKey3=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|AppCompatCache
RegKey4=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|CacheMainSdb
RegKey5=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|SdbTime
RegKey6=HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

[Windows Recent Documents *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
RegKey2=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
RegKey3=HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
RegKey4=HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

[Windows Recent Wallpaper Locations *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images|ID0
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images|ID1
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images|ID2
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images|ID3

[Windows Recycle Bin *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%SystemDrive%\$Recycle.Bin|*|RECURSE

[Windows Registry Editor *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
RegKey1=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit|LastKey
RegKey2=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit|LastKey

[Windows Remote Desktop Saved Connections *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Terminal Server Client
FileKey1=%UserProfile%\Documents|default.rdp

[Windows Retail Demo *]
LangSecRef=3025
DetectFile=%ProgramData%\Microsoft\Windows\RetailDemo
FileKey1=%ProgramData%\Microsoft\Windows\RetailDemo|*|REMOVESELF

[Windows Scan *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsScan_8wekyb3d8bbwe\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsScan_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp

[Windows Search *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
DetectFile=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache|*.tmp;*.txt
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey8=%ProgramData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex|*|RECURSE
FileKey9=%UserProfile%\Searches|*.search-ms;*.searchconnector-ms
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Bing_8wekyb3d8bbwe\SearchHistory
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\|SettingsCache.txt

[Windows Settings *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\*Cache|*|RECURSE
FileKey3=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\navigationHistory|*|RECURSE
FileKey4=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings|*.log*
FileKey5=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SearchHistory

[Windows Shell - Folder/Dialog Box View Settings *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
RegKey3=HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
RegKey4=HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
RegKey8=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU
RegKey9=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
RegKey10=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams
RegKey11=HKCU\Software\Microsoft\Windows\Shell\BagMRU
RegKey12=HKCU\Software\Microsoft\Windows\Shell\Bags
RegKey13=HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU
RegKey14=HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags
ExcludeKey1=REG|HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders
ExcludeKey2=REG|HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders
ExcludeKey3=REG|HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop
ExcludeKey4=REG|HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\AllFolders

[Windows Shell - Theme Colors History *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors

[Windows Shell *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
DetectFile1=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy
DetectFile2=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
FileKey1=%LocalAppData%|IconCache.db;IconCache.db.backup
FileKey2=%LocalAppData%\Microsoft\Windows\Explorer|*.db
FileKey3=%LocalAppData%\Microsoft\Windows\Explorer\*CacheToDelete|*.tmp
FileKey4=%LocalAppData%\Packages\InputApp_*\AC|*|RECURSE
FileKey5=%LocalAppData%\Packages\InputApp_*\LocalCache|*|RECURSE
FileKey6=%LocalAppData%\Packages\InputApp_*\Settings|*.log*
FileKey7=%LocalAppData%\Packages\InputApp_*\TempState|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings|*.log*
FileKey11=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey12=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey13=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC|*|RECURSE
FileKey14=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData|*|RECURSE
FileKey15=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey16=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebview|*|RECURSE
FileKey17=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings|*.log*
FileKey18=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey19=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey20=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer|*.db
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer|ScreenshotIndex
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
RegKey5=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
RegKey6=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

[Windows Signature Verification *]
LangSecRef=3025
DetectFile=%WinDir%|SIGVERIF.TXT
FileKey1=%WinDir%|SIGVERIF.TXT

[Windows Snipping Tool *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey8=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\ScreenClip|*
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\AppSnipAndSketchFileSaveSettings|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\DefaultOpenFileSingle|LastLocation

[Windows Start Menu *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH
DetectFile=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState|*|REMOVESELF
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCache
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCacheSMP
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCacheTBP
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC
RegKey6=HKLM\Software\Microsoft\Windows\CurrentVersion\UFH\ARP
RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache
RegKey8=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache

[Windows Subsystems *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
DetectFile=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy
FileKey1=%LocalAppData%\Microsoft\Windows Sidebar\Cache|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\AppCache|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\Windows\SettingSync\metastore|*.jrs
FileKey4=%LocalAppData%\Microsoft\Windows\SettingSync\remotemetastore\*|*.jrs
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC|*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalCache|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\Cache|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings|*.log*
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\TempState|*|REMOVESELF
FileKey11=%ProgramData%\Microsoft\RAC\PublishedData|*.jrs;*.log
FileKey12=%ProgramData%\Microsoft\RAC\StateData|*.jrs;*.log
FileKey13=%ProgramData%\Microsoft\RAC\Temp|*
FileKey14=%ProgramData%\Microsoft\Windows\DeviceMetadataCache\dmrccache.bak|*|REMOVESELF
FileKey15=%ProgramData%\Microsoft\Windows\Sqm\Manifest|*.bin
FileKey16=%ProgramData%\Microsoft\Windows\Sqm\Sessions|*.psqm;*.sqm
FileKey17=%SystemDrive%\Documents and Settings\LocalService\Application Data\PeerNetworking|*|RECURSE
FileKey18=%UserProfile%\Documents\Remote Assistance Logs|*.xml
FileKey19=%WinDir%\$regcmp$|*|REMOVESELF
FileKey20=%WinDir%\ehome|PRDMOWrapper.log
FileKey21=%WinDir%\msdownld.tmp|*|REMOVESELF
FileKey22=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows|qwavecache.dat
FileKey23=%WinDir%\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking|*|RECURSE
FileKey24=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\PeerDist*|*.chk;*.jrs
FileKey25=%WinDir%\System32|PRDMOWrapper.log;qwavecache.dat
FileKey26=%WinDir%\System32\config\systemprofile\AppData\Local|*.tmp
FileKey27=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads|*.tmp
FileKey28=%WinDir%\System32\config\systemprofile\AppData\Local\tw-*.tmp|empty.check|REMOVESELF
FileKey29=%WinDir%\System32\sru|*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
RegKey2=HKCU\Software\Classes\MIME\Database\Content Type
RegKey3=HKCU\Software\Local AppWizard-Generated Applications
RegKey4=HKCU\Software\Microsoft\Keyboard\Native Media Players
RegKey5=HKCU\Software\Microsoft\Windows\Shell\MUICache
RegKey6=HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
RegKey7=HKLM\Software\Microsoft\ESENT\Process
RegKey8=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders|Folder
RegKey9=HKLM\Software\Microsoft\Windows\CurrentVersion\Setup|Installation Sources
RegKey10=HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders|Folder
ExcludeKey1=PATH|%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts\|*.tbacct*

[Windows System Assessment Tool *]
LangSecRef=3025
DetectFile=%WinDir%\Performance\WinSAT
FileKey1=%WinDir%\Performance\WinSAT|*|REMOVESELF

[Windows Task Scheduler *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%\System32\Tasks_Migrated|*|REMOVESELF

[Windows Taskbar *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%AppData%\Microsoft\Windows\Recent|*.URL|RECURSE
FileKey2=%AppData%\Microsoft\Windows\Recent\AutomaticDestinations|*|RECURSE
FileKey3=%AppData%\Microsoft\Windows\Recent\CustomDestinations|*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband|FavoritesChanges
ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\|f01b4d95cf55d32a.automaticDestinations-ms

[Windows Temporary Files *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temp|*|RECURSE
FileKey2=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temp|*|RECURSE
FileKey3=%Temp%|*
FileKey4=%Temp%\*|*|REMOVESELF
FileKey5=%WinDir%\ServiceProfiles\*\AppData\Local\Temp|*|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Temp|*|RECURSE
FileKey7=%WinDir%\System32\config\systemprofile\Local Settings\Temp|*|RECURSE
FileKey8=%WinDir%\SystemTemp|*|RECURSE
FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Temp|*|RECURSE
FileKey10=%WinDir%\TEMP|*|RECURSE

[Windows Update *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Windows\Windows Anytime Upgrade|Upgrade.log
FileKey2=%LocalAppData%\MigWiz|*|REMOVESELF
FileKey3=%ProgramData%\PLUG\Logs|*
FileKey4=%ProgramFiles%\Microsoft Update Health Tools\Logs|*
FileKey5=%ProgramFiles%\WindowsInstallationAssistant\Logs|*
FileKey6=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache|*|RECURSE
FileKey7=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs|*|RECURSE
FileKey8=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State|*.log*
FileKey9=%WinDir%\SoftwareDistribution|*.log
FileKey10=%WinDir%\SoftwareDistribution\DataStore\Logs|*|RECURSE
FileKey11=%WinDir%\System32\MRT\*|*.log|REMOVESELF

[Windows Voice Recorder *]
LangSecRef=3025
DetectFile=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings|*.log*
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState|*|REMOVESELF

[Windows Volume Mixer *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft
RegKey1=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore

[Windows Widgets *]
LangSecRef=3025
DetectFile1=%LocalAppData%\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe
DetectFile2=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\Settings|*.log*
FileKey3=%LocalAppData%\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium|*.log*
FileKey4=%LocalAppData%\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\TempState|*|REMOVESELF
FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\AC|*|RECURSE
FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalCache\Definitions|*
FileKey7=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState|*|RECURSE
FileKey8=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings|*.log*
FileKey9=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium|*.log*
FileKey10=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\TempState|*|REMOVESELF

[Windscribe VPN *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Windscribe
FileKey1=%LocalAppData%\Windscribe\Windscribe|*.log;*log.txt
FileKey2=%ProgramFiles%\Windscribe|*.log
FileKey3=%ProgramFiles%\Windscribe\log|*|RECURSE

[Winemaker Extraordinaire *]
Section=Games
DetectFile=%AppData%\UClick\Winemaker Extraordinaire
FileKey1=%AppData%\UClick\Winemaker Extraordinaire|logfile.txt

[WinExt Registry Fixer *]
LangSecRef=3024
DetectFile=%AppData%\TSS\WERF
FileKey1=%AppData%\TSS\WERF|REG_POINT_*.reg

[WinGate Proxy Server *]
LangSecRef=3021
Detect=HKCU\Software\Qbik Software\GateKeeper
DetectFile=%ProgramFiles%\WinGate
FileKey1=%ProgramFiles%\WinGate|*.log;*Log.txt|RECURSE
FileKey2=%ProgramFiles%\WinGate\Logs\Global|*.idx

[Winget-AutoUpdate *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Winget-AutoUpdate
FileKey1=%ProgramFiles%\Winget-AutoUpdate\logs|*.log

[WinHasher *]
LangSecRef=3024
Detect=HKCU\Software\GPF Comics\WinHasher
RegKey1=HKCU\Software\GPF Comics\WinHasher|LastDirectory

[WinHTTrack *]
LangSecRef=3022
Detect=HKCU\Software\WinHTTrack Website Copier
FileKey1=%ProgramFiles%\WinHTTrack|winhttrack.log
RegKey1=HKCU\Software\WinHTTrack Website Copier\WinHTTrack Website Copier\Recent File List

[WinImage *]
LangSecRef=3024
Detect=HKCU\Software\WinImage
RegKey1=HKCU\Software\WinImage|File1
RegKey2=HKCU\Software\WinImage|File2
RegKey3=HKCU\Software\WinImage|File3
RegKey4=HKCU\Software\WinImage|File4
RegKey5=HKCU\Software\WinImage|File5
RegKey6=HKCU\Software\WinImage|File6
RegKey7=HKCU\Software\WinImage|File7
RegKey8=HKCU\Software\WinImage|File8
RegKey9=HKCU\Software\WinImage|File9
RegKey10=HKCU\Software\WinImage|PathExtract

[winLAME *]
LangSecRef=3023
DetectFile=%LocalAppData%\winLAME
FileKey1=%LocalAppData%\winLAME\CrashDumps|*.mdmp

[WinMerge *]
LangSecRef=3024
Detect=HKCU\Software\Thingamahoochie\WinMerge\Files
RegKey1=HKCU\Software\Thingamahoochie\WinMerge\Files\Ext
RegKey2=HKCU\Software\Thingamahoochie\WinMerge\Files\Left
RegKey3=HKCU\Software\Thingamahoochie\WinMerge\Files\Option
RegKey4=HKCU\Software\Thingamahoochie\WinMerge\Files\Right

[WinMount *]
LangSecRef=3024
Detect=HKCU\Software\WinMount Applications\WinMount
FileKey1=%AppData%\WinMount|*.dat
RegKey1=HKCU\Software\WinMount Applications\WinMount\Recent File List

[WinPcap *]
LangSecRef=3022
Detect=HKLM\Software\WinPcap
FileKey1=%ProgramFiles%\WinPcap|*.log

[WinRAR *]
LangSecRef=3024
Detect=HKCU\Software\WinRAR
FileKey1=%ProgramFiles%\WinRAR|*.diz;*.tmp|RECURSE
RegKey1=HKCU\Software\WinRAR SFX
RegKey2=HKCU\Software\WinRAR\DialogEditHistory
RegKey3=HKCU\Software\WinRAR\General\Info|CommentFile

[WinRemote *]
LangSecRef=3021
DetectFile=%ProgramData%\Banamalon\WinRemoteService
FileKey1=%ProgramData%\Banamalon\WinRemoteService\log|*

[WinSetupFromUSB *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\WinSetupFromUSB
DetectFile2=%SystemDrive%\WinSetupFromUSB
FileKey1=%ProgramFiles%\WinSetupFromUSB|*.log|RECURSE
FileKey2=%SystemDrive%\WinSetupFromUSB|*.log|RECURSE

[Winsome Technologies File Renamer *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\Winsome File Renamer *
FileKey1=%AppData%\Winsome Technologies\Winsome File Renamer *|*.log
FileKey2=%AppData%\Winsome Technologies\Winsome File Renamer *\Logs|*

[Winsome Technologies Find And Replace Tool For Excel *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\Find And Replace Tool For Excel *
FileKey1=%AppData%\Winsome Technologies\Find And Replace Tool For Excel *|*.log
FileKey2=%AppData%\Winsome Technologies\Find And Replace Tool For Excel *\Logs|*

[Winsome Technologies Find And Replace Tool For Word *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\Find And Replace Tool For Word *
FileKey1=%AppData%\Winsome Technologies\Find And Replace Tool For Word *|*.log
FileKey2=%AppData%\Winsome Technologies\Find And Replace Tool For Word *\Logs|*

[Winsome Technologies Image to PDF Converter *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\Image to PDF Converter *
FileKey1=%AppData%\Winsome Technologies\Image to PDF Converter *|*.log
FileKey2=%AppData%\Winsome Technologies\Image to PDF Converter *\Logs|*

[Winsome Technologies PDF Combiner *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\PDF Combiner *
FileKey1=%AppData%\Winsome Technologies\PDF Combiner *|*.log
FileKey2=%AppData%\Winsome Technologies\PDF Combiner *\Logs|*

[Winsome Technologies PDF Security *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\PDF Security *
FileKey1=%AppData%\Winsome Technologies\PDF Security *|*.log
FileKey2=%AppData%\Winsome Technologies\PDF Security *\Logs|*

[Winsome Technologies PDF to Image Converter *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\PDF to Image Converter *
FileKey1=%AppData%\Winsome Technologies\PDF to Image Converter *|*.log
FileKey2=%AppData%\Winsome Technologies\PDF to Image Converter *\Logs|*

[Winsome Technologies Stamp And Number Pro *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\Stamp And Number Pro *
FileKey1=%AppData%\Winsome Technologies\Stamp And Number Pro *|*.log
FileKey2=%AppData%\Winsome Technologies\Stamp And Number Pro *\Logs|*

[Winsome Technologies TIFF PDF Counter *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\TIFF PDF Counter *
FileKey1=%AppData%\Winsome Technologies\TIFF PDF Counter *|*.log
FileKey2=%AppData%\Winsome Technologies\TIFF PDF Counter *\Logs|*

[Winsome Technologies TIFF Splitter *]
LangSecRef=3024
DetectFile=%AppData%\Winsome Technologies\TIFF Splitter *
FileKey1=%AppData%\Winsome Technologies\TIFF Splitter *|*.log
FileKey2=%AppData%\Winsome Technologies\TIFF Splitter *\Logs|*

[WinSysClean *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WinSysClean*
FileKey1=%ProgramFiles%\WinSysClean *|*.log;*scanlog.dat;RegBackup.reg

[WinTK *]
LangSecRef=3024
DetectFile=%UserProfile%\Documents\WinTK
FileKey1=%UserProfile%\Documents\WinTK|ExLog.txt

[WinTools.net *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\Godlike Developers\WinTools.net*
DetectFile2=%ProgramFiles%\WinTools Software\WinTools.net*
FileKey1=%ProgramFiles%\Godlike Developers\WinTools.net*|*.txt;*.url
FileKey2=%ProgramFiles%\Godlike Developers\WinTools.net*\Undo|*.reg|RECURSE
FileKey3=%ProgramFiles%\WinTools Software\WinTools.net*|*.txt
FileKey4=%ProgramFiles%\WinTools Software\WinTools.net*\Undo|*.reg|RECURSE

[WinToUSB *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinToUSB_is1
FileKey1=%ProgramFiles%\WinToUSB\bin|*.log

[WinX DVD Author *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Digiarty\WinX DVD Author*
FileKey1=%ProgramFiles%\Digiarty\WinX DVD Author*\Temp|*

[WinX DVD Ripper Platinum *]
LangSecRef=3023
DetectFile=%AppData%\Digiarty\WinX DVD Ripper Platinum
FileKey1=%AppData%\Digiarty\WinX DVD Ripper Platinum|*.log;*.tmp

[WinX YouTube Downloader *]
LangSecRef=3023
DetectFile1=%AppData%\Digiarty\WinX YouTube Downloader
DetectFile2=%AppData%\WinX YouTube Downloader
FileKey1=%AppData%\Digiarty\WinX YouTube Downloader|*.jpg
FileKey2=%AppData%\WinX YouTube Downloader|Error File.*;log.txt

[WinZip *]
LangSecRef=3024
Detect=HKCU\Software\Nico Mak Computing\WinZip
DetectFile=%LocalAppData%\Nico Mak Computing\WinZip Update Notifier
FileKey1=%LocalAppData%\Nico Mak Computing\WinZip Update Notifier\log|log-*.txt
FileKey2=%LocalAppData%\WinZip\SyncHelper\MRU|WinZip_MRU.roaming
FileKey3=%LocalAppData%\WinZip\WinZip Update Notifier\Log|*
RegKey1=HKCU\Software\Nico Mak Computing\WinZip\Mru

[WinZip Privacy Protector *]
LangSecRef=3024
DetectFile=%LocalAppData%\WinZipPrivacyProtector
FileKey1=%LocalAppData%\WinZipPrivacyProtector|*.log;*.tmp;log.rtf;report.txt;WebCache*.dat;WebCache*.jfm

[WinZip Registry Optimizer *]
LangSecRef=3024
DetectFile1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer
DetectFile2=%ProgramFiles%\WinZip Registry Optimizer
FileKey1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer\*|log*
FileKey2=%ProgramFiles%\WinZip Registry Optimizer\Backups|*

[Wire *]
LangSecRef=3022
DetectFile=%LocalAppData%\wire
FileKey1=%AppData%\Wire\*Cache|*
FileKey2=%AppData%\Wire\Service Worker|*|REMOVESELF

[Wirecast *]
LangSecRef=3023
DetectFile=%AppData%\Wirecast
FileKey1=%AppData%\Wirecast|*.txt

[Wireshark *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Wireshark
FileKey1=%AppData%\Wireshark\plugins\cloudshark\tmp|*
FileKey2=%ProgramFiles%\Wireshark|*Setup*.exe;npcap-*.exe

[Wise Care 365 *]
LangSecRef=3024
Detect=HKLM\Software\WiseCleaner\WiseCare365
FileKey1=%AppData%\Wise Care 365|Errorlog.txt;FailToRemove.dat

[Wise Video/YouTube Downloader *]
LangSecRef=3023
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wise Video Downloader_is1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wise Youtube Downloader_is1
DetectFile1=%ProgramFiles%\Wise\Wise Video Downloader
DetectFile2=%ProgramFiles%\Wise\Wise YouTube Downloader
FileKey1=%AppData%\Wise * Downloader|DownloadList.ini;FileListConfig.ini
FileKey2=%SystemDrive%|urlinfo.txt
FileKey3=%SystemDrive%\ThumbnailCache|*

[WiseVector StopX *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WiseVector
FileKey1=%ProgramFiles%\WiseVector\log|*.log

[Wistron Launch Manager *]
LangSecRef=3024
Detect=HKLM\Software\Wistron Corp\Launch Manager
FileKey1=%ProgramFiles%\Launch Manager|*.log

[Wizards of the Coast *]
Section=Games
DetectFile=%UserProfile%\AppData\LocalLow\Wizards of the Coast
FileKey1=%UserProfile%\AppData\LocalLow\Wizards of the Coast\mtga|*_log.txt

[WM Recorder *]
LangSecRef=3023
DetectFile=%ProgramFiles%\WM Recorder*
FileKey1=%ProgramFiles%\WM Recorder*|log.txt;urls.txt

[Wolfenstein: MP *]
Section=Games
DetectFile=%LocalAppData%\id Software\WolfMP
FileKey1=%LocalAppData%\id Software\WolfMP|*.log|RECURSE

[WolfQuest *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9E6AD6CF-1EFF-43E4-86C4-5C00254C3D8E}
FileKey1=%ProgramFiles%\WolfQuest|*.txt|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\WolfQuest\|Help.txt

[Wondershare *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare
FileKey1=%AppData%\se_tmp*|*|REMOVESELF
FileKey2=%ProgramData%\Wondershare\*\*Log*|*|RECURSE
FileKey3=%ProgramData%\Wondershare\WAF\ProductFeatures\*Logs|*|RECURSE
FileKey4=%Public%\Documents\Wondershare|*|REMOVESELF

[Wondershare AllMyTube *]
LangSecRef=3022
Detect=HKLM\Software\Wondershare\Wondershare AllMyTube
FileKey1=%AppData%\Wondershare AllMyTube|*|RECURSE
FileKey2=%ProgramData%\Wondershare AllMyTube\ConvertedLibPic|*|RECURSE
FileKey3=%ProgramData%\Wondershare Application Common Data\Download|*.bak;*.xml
FileKey4=%ProgramData%\Wondershare Application Common Data\Download\MediaLibPic|*|RECURSE
FileKey5=%ProgramData%\Wondershare Application Common Data\Download\SiteLogo|*|RECURSE
FileKey6=%ProgramData%\Wondershare Application Common Data\Download\TempThumbDir|*|RECURSE
FileKey7=%ProgramData%\Wondershare\AllMyTube|*.bak;*.xml
FileKey8=%ProgramFiles%\Wondershare\AllMyTube\Log|*|RECURSE

[Wondershare Dr.Fone *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Wondershare\Wondershare Dr.Fone
FileKey1=%AppData%\DataEraser_Temp|*|RECURSE
FileKey2=%ProgramData%\Wondershare\dr.fone\iOSTemp|*|RECURSE
FileKey3=%ProgramData%\Wondershare\dr.fone\log|*.log
FileKey4=%ProgramData%\Wondershare\dr.fone\Sparrow|*.bak;*.log
FileKey5=%ProgramData%\Wondershare\dr.fone\ThumbnailCache|*
FileKey6=%ProgramData%\Wondershare\dr.fone\Wondershare_DataEraser_Clean|*|RECURSE
FileKey7=%ProgramData%\Wondershare\DriverInstall|*.log
FileKey8=%ProgramData%\Wondershare\WSRoot|*.tmp
FileKey9=%ProgramData%\WsAppHelper\Dr.Fone|*.log
FileKey10=%ProgramFiles%\Wondershare\dr.fone\ThumbnailCache|*|RECURSE
FileKey11=%ProgramFiles%\Wondershare\MirrorGo\Log|*|RECURSE

[Wondershare DVD Creator *]
LangSecRef=3023
DetectFile=%UserProfile%\Documents\Wondershare DVD Creator
FileKey1=%UserProfile%\Documents\Wondershare DVD Creator\log|log*.txt

[Wondershare Filmora *]
LangSecRef=3023
Detect1=HKLM\Software\Wondershare\Wondershare Filmora
Detect2=HKLM\Software\Wondershare\Wondershare FilmoraPro
FileKey1=%ProgramFiles%\Wondershare\Wondershare Filmora\log|*|RECURSE
FileKey2=%UserProfile%\Documents\Wondershare Filmora\Temp|*|RECURSE

[Wondershare Helper Compact *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\Wondershare Helper Compact
FileKey1=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact|ProductUpdateLists.xml;WSHelper*.exe_temp
FileKey2=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\DATADICT|*|RECURSE
FileKey3=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\Log|*|RECURSE
FileKey4=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\Temp|*|RECURSE

[Wondershare MobileGo *]
LangSecRef=3021
Detect=HKCU\Software\Wondershare\MobileGo
DetectFile=%AppData%\Wondershare\MobileGo for iOS
FileKey1=%AppData%\Wondershare\*Go*|*.log
FileKey2=%AppData%\Wondershare\DataEraser|*.log
FileKey3=%AppData%\Wondershare\Dr.FoneTool\log|*.log
FileKey4=%AppData%\Wondershare\DrFoneAndroidTool\log|*.log
FileKey5=%AppData%\Wondershare\MirrorGo\ImageCache\ADImage|*|RECURSE
FileKey6=%AppData%\Wondershare\MobileGo\DeviceImageCache|*|RECURSE
FileKey7=%AppData%\Wondershare\MobileGo\iOSTemp|*|REMOVESELF
FileKey8=%AppData%\Wondershare\MobileGo\Logs\DeviceConnection|*|RECURSE
FileKey9=%AppData%\Wondershare\MobileTransTool|*.log
FileKey10=%AppData%\Wondershare\WsRoot\Logs|*|RECURSE
FileKey11=%ProgramData%\Wondershare\Dr.FoneTool\Log|*.txt
FileKey12=%ProgramFiles%\Wondershare\MobileGo|*.log

[Wondershare PDF Editor *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\Wondershare PDF Editor
FileKey1=%AppData%\Wondershare\PDF Editor|HistoryDatas.dat
FileKey2=%AppData%\Wondershare\PDF Editor\Log|*.log

[Wondershare Recoverit *]
LangSecRef=3024
DetectFile=%ProgramData%\Wondershare\Recoverit*
FileKey1=%ProgramData%\Wondershare\Recoverit*\dataSDK|*.bak;*.log;tmp
FileKey2=%ProgramData%\Wondershare\Recoverit*\WGPSDK|*.log

[Wondershare Repairit *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Wondershare\Repairit
FileKey1=%ProgramData%\Wondershare\Repairit\*SDK|*.bak;*.log;tmp
FileKey2=%ProgramFiles%\Wondershare\Repairit\log|*

[Wondershare SafeEraser *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\SafeEraser
FileKey1=%AppData%\HMYGSetting|*|REMOVESELF
FileKey2=%AppData%\HYXDevPsnList|*|REMOVESELF
FileKey3=%AppData%\Wondershare\SafeEraser|*.log
FileKey4=%AppData%\Wondershare\SafeEraser\Logs\DeviceConnection|*|RECURSE
FileKey5=%AppData%\Wondershare\SafeEraser\Logs\iOSTemp|*|RECURSE
FileKey6=%ProgramFiles%\Wondershare\SafeEraser\se_tmp_win|*|REMOVESELF
FileKey7=%SystemDrive%\se_tmp|*|REMOVESELF

[Wondershare UniConverter *]
LangSecRef=3023
Detect1=HKLM\Software\Wondershare\Wondershare UniConverter
Detect2=HKLM\Software\Wondershare\Wondershare UniConverter 13
FileKey1=%ProgramData%\Wondershare\UniConverter*\DataTrack|*.bak;*.log;tmp
FileKey2=%ProgramData%\Wondershare\UniConverter*\TempThumbDir|*|RECURSE
FileKey3=%ProgramData%\Wondershare\UniConverter*\UpdatePackge|*|RECURSE
FileKey4=%ProgramFiles%\Wondershare\*UniConverter*\Log|*|RECURSE
FileKey5=%SystemDrive%|logWSVCUUpdateHelper.log
FileKey6=%SystemDrive%\Wondershare UniConverter\Downloaded\temp|*|REMOVESELF

[Wondershare Video Converter *]
LangSecRef=3023
DetectFile1=%ProgramFiles%\Wondershare Video Converter*
DetectFile2=%ProgramFiles%\Wondershare\Video Converter*
FileKey1=%ProgramData%\Wondershare MediaServer|*.txt
FileKey2=%ProgramData%\Wondershare Video Converter*|*.dat.bak
FileKey3=%ProgramData%\Wondershare Video Converter*\Temp*Dir|*|RECURSE
FileKey4=%ProgramFiles%\Wondershare Video Converter*\Log|*|RECURSE
FileKey5=%ProgramFiles%\Wondershare Video Converter*\Temp*Dir|*|RECURSE
FileKey6=%ProgramFiles%\Wondershare\Video Converter*\Log|*|RECURSE
FileKey7=%ProgramFiles%\Wondershare\Video Converter*\Output|Thumbnail.dat
FileKey8=%ProgramFiles%\Wondershare\Video Converter*\Transfer\MultimediaLibs\Log|*
FileKey9=%SystemDrive%|logWSVCUUpdateHelper.log
FileKey10=%UserProfile%\Documents\Wondershare MediaServer\log|*|RECURSE

[Wondershare Video Editor *]
LangSecRef=3023
DetectFile=%ProgramData%\Wondershare Video Editor
FileKey1=%ProgramData%\Wondershare Video Editor\Resources|Favorites.xml

[Wordweb *]
LangSecRef=3021
Detect=HKCU\Software\WordWeb
FileKey1=%AppData%\WordWeb|History.txt

[World of Warcraft *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\World of Warcraft
FileKey1=%ProgramFiles%\World of Warcraft|*.bak;*.old|RECURSE
FileKey2=%ProgramFiles%\World of Warcraft\_*_\Logs|*
FileKey3=%ProgramFiles%\World of Warcraft\Cache|*|REMOVESELF
FileKey4=%ProgramFiles%\World of Warcraft\Errors|*|REMOVESELF
FileKey5=%ProgramFiles%\World of Warcraft\Logs|*
FileKey6=%Public%\games\World of Warcraft|*.bak;*.old|RECURSE
FileKey7=%Public%\Games\World of Warcraft\Cache|*|REMOVESELF
FileKey8=%Public%\Games\World of Warcraft\Errors|*|REMOVESELF
FileKey9=%Public%\Games\World of Warcraft\Logs|*
FileKey10=%SystemDrive%\World of Warcraft|*.bak;*.old|RECURSE
FileKey11=%SystemDrive%\World of Warcraft\Cache|*|REMOVESELF
FileKey12=%SystemDrive%\World of Warcraft\Errors|*|REMOVESELF
FileKey13=%SystemDrive%\World of Warcraft\Logs|*

[WorldWide Telescope *]
LangSecRef=3021
Detect=HKCU\Software\Classes\WorldWideTelescope.wtml
FileKey1=%LocalAppData%\Microsoft\WorldWideTelescope\dem|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\WorldWideTelescope\Imagery|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\WorldWideTelescope\tourcache|*|RECURSE

[Wowhead Client *]
Section=Games
Detect=HKCU\Software\Wowhead\WowHead Client
FileKey1=%ProgramData%\wowhead\wowhead client\cache|*|REMOVESELF
FileKey2=%ProgramData%\wowhead\wowhead client\log|*|REMOVESELF
RegKey1=HKCU\Software\Wowhead\WowHead Client|Statistics

[WS FTP Pro *]
LangSecRef=3022
Detect=HKCU\Software\Ipswitch\WS_FTP
FileKey1=%AppData%\Ipswitch\WS_FTP\Logs|*

[wufuc *]
LangSecRef=3024
DetectFile=%ProgramData%\wufuc
FileKey1=%ProgramData%\wufuc|*.log

[X-NetStat *]
LangSecRef=3024
DetectFile=%AppData%\X-NetStat*
FileKey1=%AppData%\X-NetStat*|*.exe
FileKey2=%AppData%\X-NetStat*\Logs|*

[X-Ways WinHex *]
LangSecRef=3024
DetectFile=%LocalAppData%\X-Ways\WinHex
FileKey1=%LocalAppData%\X-Ways\WinHex|*log.txt

[Xara Photo & Graphic Designer *]
LangSecRef=3023
Detect=HKCU\Software\Xara\Xtreme_SE
FileKey1=%LocalAppData%\Xara\Xtreme\9.2\Backups|*|RECURSE
FileKey2=%LocalAppData%\Xara\Xtreme_SE\6.1\Backups|*.txt
RegKey1=HKCU\Software\Xara\Xtreme\9.2\Options\Recent File List
RegKey2=HKCU\Software\Xara\Xtreme_SE\6.1\Options\Recent File List
RegKey3=HKCU\Software\Xara\Xtreme_SE\6.1\Workspace

[Xara WebDesigner *]
LangSecRef=3024
Detect=HKCU\Software\Xara\WebDesigner
RegKey1=HKCU\Software\Xara\WebDesigner\8.0\Workspace\MDI

[Xara WebDesigner Backups *]
LangSecRef=3024
Detect=HKCU\Software\Xara\WebDesigner
FileKey1=%LocalAppData%\Xara\WebDesigner\*\Backups|*|RECURSE

[XCOM *]
Section=Games
DetectFile=%UserProfile%\Documents\My Games\XCOM*
FileKey1=%UserProfile%\Documents\My Games\XCOM*\XComGame\Logs|*

[Xerox Printer Driver *]
LangSecRef=3021
DetectFile=%ProgramData%\Xerox\PrinterDriver
FileKey1=%ProgramData%\Xerox\PrinterDriver|*.tmp|RECURSE

[Xiaomi *]
LangSecRef=3021
DetectFile=%AppData%\Xiaomi
FileKey1=%AppData%\Xiaomi\account_auth\log|*.log
FileKey2=%AppData%\Xiaomi\miflash_unlock\log|*.log
FileKey3=%AppData%\Xiaomi\miflash_unlock\temp|*.tmp;data_*;f_*
FileKey4=%AppData%\Xiaomi\miflash_unlock_en\log|*.log
FileKey5=%AppData%\Xiaomi\miflash_unlock_en\temp|*.tmp;data_*;f_*
FileKey6=%AppData%\Xiaomi\miphonemanager\cache|*
FileKey7=%AppData%\Xiaomi\miphonemanager\log|*.log|RECURSE
FileKey8=%AppData%\Xiaomi\miusbdriver\log|*.log

[Xilisoft AVI to DVD Converter *]
LangSecRef=3023
DetectFile=%LocalAppData%\Xilisoft\AVI to DVD Converter
FileKey1=%LocalAppData%\Xilisoft\AVI to DVD Converter|log_testing.txt

[Xilisoft Video Converter *]
LangSecRef=3023
Detect1=HKCU\Software\Xilisoft\Video Converter Ultimate
Detect2=HKLM\Software\Xilisoft\Video Converter Platinum
Detect3=HKLM\Software\Xilisoft\Video Converter Standard
Detect4=HKLM\Software\Xilisoft\Video Converter Ultimate
FileKey1=%ProgramData%\Xilisoft\Video Converter*\customdata|settings.old
RegKey1=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_imported_dir
RegKey2=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_openfile_dir
RegKey3=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_openpicture_dir
RegKey4=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_output_dir
RegKey5=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_profile_group
RegKey6=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_profile_url
RegKey7=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|last_snapshot_dir
RegKey8=HKCU\Software\Xilisoft\Video Converter Platinum\Settings|recent_profiles
RegKey9=HKCU\Software\Xilisoft\Video Converter Platinum\Settings\output
RegKey10=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_imported_dir
RegKey11=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_openfile_dir
RegKey12=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_openpicture_dir
RegKey13=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_output_dir
RegKey14=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_profile_group
RegKey15=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_profile_url
RegKey16=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|last_snapshot_dir
RegKey17=HKCU\Software\Xilisoft\video Converter Ultimate\Settings|LastOpenSoundFileFolder
RegKey18=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings|recent_profiles
RegKey19=HKCU\Software\Xilisoft\Video Converter Ultimate\Settings\output

[XMind *]
LangSecRef=3021
DetectFile=%AppData%\XMind
FileKey1=%AppData%\XMind|*.log|RECURSE

[XN Resource Editor *]
LangSecRef=3024
Detect=HKCU\Software\Woozle\XN Resource Editor
RegKey1=HKCU\Software\Woozle\XN Resource Editor\Recent Files

[XnView *]
LangSecRef=3023
Detect1=HKCU\Software\XnView
Detect2=HKLM\Software\XnView
FileKey1=%AppData%\XnView|category.bak;XnView.db
FileKey2=%AppData%\XnView\cache|*.db
FileKey3=%AppData%\XnViewMP|*.db;category.bak
FileKey4=%ProgramFiles%\XnView|category.bak
FileKey5=%ProgramFiles%\XnView\cache|*.db
FileKey6=%ProgramFiles%\XnViewMP|*.db;category.bak
RegKey1=HKCU\Software\XnView\Start|DirName_0
RegKey2=HKCU\Software\XnView\Start|DirName_1
RegKey3=HKCU\Software\XnView\Start|DirName_2
RegKey4=HKCU\Software\XnView\Start|DirName_3
RegKey5=HKCU\Software\XnView\Start|DirName_4
RegKey6=HKCU\Software\XnView\Start|DirName_5
RegKey7=HKCU\Software\XnView\Start|DirName_6
RegKey8=HKCU\Software\XnView\Start|DirName_7
RegKey9=HKCU\Software\XnView\Start|DirName_8
RegKey10=HKCU\Software\XnView\Start|DirName_9
RegKey11=HKCU\Software\XnView\Start|FileName_0
RegKey12=HKCU\Software\XnView\Start|FileName_1
RegKey13=HKCU\Software\XnView\Start|FileName_2
RegKey14=HKCU\Software\XnView\Start|FileName_3
RegKey15=HKCU\Software\XnView\Start|FileName_4
RegKey16=HKCU\Software\XnView\Start|FileName_5
RegKey17=HKCU\Software\XnView\Start|FileName_6
RegKey18=HKCU\Software\XnView\Start|FileName_7
RegKey19=HKCU\Software\XnView\Start|FileName_8
RegKey20=HKCU\Software\XnView\Start|FileName_9
RegKey21=HKCU\Software\XnView\XnViewMP\Start|customPath
RegKey22=HKCU\Software\XnView\XnViewMP\Start|History
RegKey23=HKCU\Software\XnView\XnViewMP\Start|PathBrowser
RegKey24=HKCU\Software\XnView\XnViewMP\Start|RecentFiles
RegKey25=HKCU\Software\XnView\XnViewMP\Strip|list_folder
RegKey26=HKCU\Software\XnView\XnViewMP\Viewer|saveFolder

[XPhone *]
LangSecRef=3021
Detect=HKCU\Software\C4B\Log
FileKey1=%LocalAppData%\C4B\Log|*

[Xplorer2 *]
LangSecRef=3024
Detect1=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings
Detect2=HKCU\Software\ZabaraKatranemia Plc\xplorer2_UC\MainFrame Settings
RegKey1=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings\Folder History
RegKey2=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings\Recent Document List
RegKey3=HKCU\Software\ZabaraKatranemia Plc\xplorer2_UC\MainFrame Settings\Folder History
RegKey4=HKCU\Software\ZabaraKatranemia Plc\xplorer2_UC\MainFrame Settings\Recent Document List

[XPort 360 *]
LangSecRef=3021
DetectFile=%AppData%\Datel\XPort 360
FileKey1=%AppData%\Datel\XPort 360\Temp|*|REMOVESELF

[XPressUpdate *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\XPressUpdate.exe
FileKey1=%CommonProgramFiles%\XpressUpdate|*.log;*old

[XRayz LinkStash *]
LangSecRef=3024
Detect=HKCU\Software\XRayz\LinkStash
RegKey1=HKCU\Software\XRayz\LinkStash\Recent File List

[Xsplit *]
LangSecRef=3023
Detect=HKLM\Software\Splitmedialabs\XSplit
DetectFile=%ProgramFiles%\SplitmediaLabs\XSplit Broadcaster
FileKey1=%AppData%\SplitMediaLabs\XSplit*|*.log|RECURSE
FileKey2=%LocalAppData%\SplitMediaLabs\XSplit\*|bwtestlogs.txt
FileKey3=%ProgramData%\SplitMediaLabs\XSplit\LocalStore\Temp|*
FileKey4=%ProgramData%\SplitMediaLabs\XSplit\Temp|*
FileKey5=%ProgramFiles%\SplitmediaLabs\XSplit Broadcaster\x*|*Log.txt

[XviD *]
LangSecRef=3023
Detect=HKCU\Software\GNU\Xvid
RegKey1=HKCU\Software\GNU\Xvid|stats

[XWidget *]
LangSecRef=3021
DetectFile=%UserProfile%\Documents\XWidget
FileKey1=%UserProfile%\Documents\XWidget\Backup|*|RECURSE
FileKey2=%UserProfile%\Documents\XWidget\Cache|*|RECURSE

[XYplorer *]
LangSecRef=3024
DetectFile=%AppData%\XYplorer
FileKey1=%AppData%\XYplorer|xyerrorlog-*.txt

[YACReader *]
LangSecRef=3021
DetectFile=%LocalAppData%\YACReader\YACReader*
FileKey1=%LocalAppData%\YACReader\YACReader*|yacreader*.log

[Yandex Autofill Data & Search Engine Preferences *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*Web Data;Ya Autofill Data*;Ya Credit Cards*;Ya Passman Data*
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\AutoFill*|*|REMOVESELF
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\AutoFill*|*|REMOVESELF

[Yandex Autoplay Preferences *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\MEIPreload|*|REMOVESELF

[Yandex Bookmark Backups *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Bookmarks.bak

[Yandex Bookmark Favicons *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|favicons*

[Yandex Caches *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data|*-journal|RECURSE
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data|Module Info Cache
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*.ldb;CURRENT;LOCK;MANIFEST-*;ServerCertificate;Tablo*
FileKey4=%LocalAppData%\Yandex\YandexBrowser\User Data\*\*Cache*|*|REMOVESELF
FileKey5=%LocalAppData%\Yandex\YandexBrowser\User Data\*\blob_storage|*|REMOVESELF
FileKey6=%LocalAppData%\Yandex\YandexBrowser\User Data\*\BudgetDatabase|*|REMOVESELF
FileKey7=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Download Service|*|REMOVESELF
FileKey8=%LocalAppData%\Yandex\YandexBrowser\User Data\*\File System|*|REMOVESELF
FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*\GCM Store|*|REMOVESELF
FileKey10=%LocalAppData%\Yandex\YandexBrowser\User Data\*\JumpListIcons*|*|REMOVESELF
FileKey11=%LocalAppData%\Yandex\YandexBrowser\User Data\*\optimization*|*|REMOVESELF
FileKey12=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Platform Notifications|*|REMOVESELF
FileKey13=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Service Value Store|*|REMOVESELF
FileKey14=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Service Worker|*|REMOVESELF
FileKey15=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Shared Dictionary\cache|*|REMOVESELF
FileKey16=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Storage\ext\*\def\*cache*|*|REMOVESELF
FileKey17=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\TabPreviewScreenshots|*|REMOVESELF
FileKey19=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Wallpapers|*|REMOVESELF
FileKey20=%LocalAppData%\Yandex\YandexBrowser\User Data\*Cache*|*|REMOVESELF
FileKey21=%LocalAppData%\Yandex\YandexBrowser\User Data\Avatars|*|REMOVESELF
FileKey22=%LocalAppData%\Yandex\YandexBrowser\User Data\Optimization*|*|REMOVESELF
FileKey23=%LocalAppData%\Yandex\YandexBrowser\User Data\YandexStore|YS_*

[Yandex Default App Handlers *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|PreferredApps

[Yandex Download History *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|DownloadMetadata
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\shared_proto_db|*|REMOVESELF

[Yandex DRM Data *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|CdmStorage.db
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\MediaFoundationCdmStore|*|REMOVESELF
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\WidevineCdm|*|REMOVESELF

[Yandex Extension Cookies *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Extension Cookies

[Yandex NeuroEdit *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Ya Neuroedit Data*

[Yandex Pinned Tabs *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
RegKey1=HKCU\Software\Yandex\YandexBrowser(backup)\PreferenceMACs\Default|pinned_tabs
RegKey2=HKCU\Software\Yandex\YandexBrowser\PreferenceMACs\Default|pinned_tabs

[Yandex Privacy Sandbox *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data|*first_party_sets*
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*|BrowsingTopics*;Conversions*;InterestGroups;MediaDeviceSalts;PrivateAggregation*;SharedStorage*
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Network|Trust Tokens*
FileKey4=%LocalAppData%\Yandex\YandexBrowser\User Data\CookieReadinessList|*|REMOVESELF
FileKey5=%LocalAppData%\Yandex\YandexBrowser\User Data\FirstPartySetsPreloaded|*|REMOVESELF
FileKey6=%LocalAppData%\Yandex\YandexBrowser\User Data\PrivacySandboxAttestationsPreloaded|*|REMOVESELF
FileKey7=%LocalAppData%\Yandex\YandexBrowser\User Data\ProbabilisticRevealTokenRegistry|*|REMOVESELF
FileKey8=%LocalAppData%\Yandex\YandexBrowser\User Data\TrustTokenKeyCommitments|*|REMOVESELF

[Yandex Progressive Web Apps *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Web Applications|*|REMOVESELF

[Yandex Saved Usernames & Passwords *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Login Data*

[Yandex Security & Threat Detection *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|DIPS*
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\ClientCertificates|*|REMOVESELF
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Network|TransportSecurity*
FileKey4=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Safe Browsing Network|*|REMOVESELF
FileKey5=%LocalAppData%\Yandex\YandexBrowser\User Data\CertificateRevocation|*|REMOVESELF
FileKey6=%LocalAppData%\Yandex\YandexBrowser\User Data\Crowd Deny|*|REMOVESELF
FileKey7=%LocalAppData%\Yandex\YandexBrowser\User Data\PKIMetadata|*|REMOVESELF
FileKey8=%LocalAppData%\Yandex\YandexBrowser\User Data\Safe Browsing|*|REMOVESELF
FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\SafetyTips|*|REMOVESELF
FileKey10=%LocalAppData%\Yandex\YandexBrowser\User Data\SSLErrorAssistant|*|REMOVESELF
FileKey11=%LocalAppData%\Yandex\YandexBrowser\User Data\Subresource Filter|*|REMOVESELF
FileKey12=%LocalAppData%\Yandex\YandexBrowser\User Data\ZxcvbnData|*|REMOVESELF

[Yandex Shopping Insights *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*\chrome_cart_db|*|REMOVESELF
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\commerce_subscription_db|*|REMOVESELF
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\*\coupon_db|*|REMOVESELF
FileKey4=%LocalAppData%\Yandex\YandexBrowser\User Data\*\discount*_db|*|REMOVESELF
FileKey5=%LocalAppData%\Yandex\YandexBrowser\User Data\*\parcel_tracking_db|*|REMOVESELF

[Yandex Storage Quota Manager *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|QuotaManager

[Yandex Sync Data *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Sync Data|*|REMOVESELF

[Yandex Telemetry *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\Application|debug.log
FileKey2=%LocalAppData%\Yandex\YandexBrowser\Application\SetupMetrics|*|REMOVESELF
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data|*.log;*_shutdown_ms.txt;Breadcrumbs;BrowsingTopics*;Last Browser;Last Version
FileKey4=%LocalAppData%\Yandex\YandexBrowser\User Data|*.pma;LOG;LOG.old|RECURSE
FileKey5=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*.log;Bookmarks Log*;Passman Logs*;Session Log*;Tabs Log*;update_info.rss;WebApp Logs*;Ya Autofill Logs*
FileKey6=%LocalAppData%\Yandex\YandexBrowser\User Data\*\DataSharing|*|REMOVESELF
FileKey7=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF
FileKey8=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Network|Network Persistent State*;Reporting and NEL*;SCT Auditing Pending Reports*
FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*\PersistentOriginTrials|*|REMOVESELF
FileKey10=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF
FileKey11=%LocalAppData%\Yandex\YandexBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF
FileKey12=%LocalAppData%\Yandex\YandexBrowser\User Data\*\WebRTC Logs|*|REMOVESELF
FileKey13=%LocalAppData%\Yandex\YandexBrowser\User Data\*\WebrtcVideoStats|*|REMOVESELF
FileKey14=%LocalAppData%\Yandex\YandexBrowser\User Data\*BrowserMetrics|*|REMOVESELF
FileKey15=%LocalAppData%\Yandex\YandexBrowser\User Data\Crash Reports|*|REMOVESELF
FileKey16=%LocalAppData%\Yandex\YandexBrowser\User Data\Crashpad|*|REMOVESELF
FileKey17=%LocalAppData%\Yandex\YandexBrowser\User Data\Local Traces|*|REMOVESELF
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\OriginTrials|*|REMOVESELF
FileKey19=%LocalAppData%\Yandex\YandexBrowser\User Data\Stability|*|REMOVESELF
FileKey20=%ProgramFiles%\Yandex\YandexBrowser\Application|debug.log
FileKey21=%ProgramFiles%\Yandex\YandexBrowser\Application\SetupMetrics|*|REMOVESELF
RegKey1=HKCU\Software\Yandex\YandexBrowser(backup)\BlBeacon|failed_count
RegKey2=HKCU\Software\Yandex\YandexBrowser(backup)\BlBeacon|state
RegKey3=HKCU\Software\Yandex\YandexBrowser(backup)\Installer|LastChecked
RegKey4=HKCU\Software\Yandex\YandexBrowser(backup)\StabilityMetrics
RegKey5=HKCU\Software\Yandex\YandexBrowser\BlBeacon|failed_count
RegKey6=HKCU\Software\Yandex\YandexBrowser\BlBeacon|state
RegKey7=HKCU\Software\Yandex\YandexBrowser\Installer|LastChecked
RegKey8=HKCU\Software\Yandex\YandexBrowser\StabilityMetrics

[Yandex Web Browsing Cookies *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Network|Cookies*;Device Bound Sessions*

[Yandex Web Browsing History *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*|History*;Network Action Predictor*;shortcuts*;Tab Lifetime;Top Sites*;Visited Links*

[Yandex Web Browsing Session *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Extension State|*|REMOVESELF
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Sessions|*|REMOVESELF

[Yandex Web Storage *]
Section=Yandex Web Browser
DetectFile=%LocalAppData%\Yandex\YandexBrowser\User Data
FileKey1=%LocalAppData%\Yandex\YandexBrowser\User Data\*\IndexedDB|*|REMOVESELF
FileKey2=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Local Storage\*\IndexedDB\https*|*
FileKey3=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Local Storage\*\Session Storage|*
FileKey4=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Local Storage\*\Storage\ext\*\def\Session Storage|*
FileKey5=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Local Storage\*\WebStorage|*|RECURSE
FileKey6=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Local Storage\leveldb|*|REMOVESELF
FileKey7=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Session Storage|*|REMOVESELF
FileKey8=%LocalAppData%\Yandex\YandexBrowser\User Data\*\WebStorage|*|REMOVESELF

[YouTube-DL *]
LangSecRef=3024
DetectFile=%UserProfile%\.cache\youtube-dl
FileKey1=%UserProfile%\.cache\youtube-dl|*|RECURSE

[YouTubeByClick *]
LangSecRef=3022
DetectFile=%AppData%\YouTubeByClick
FileKey1=%AppData%\YouTubeByClick|History.ytb

[yWriter *]
LangSecRef=3021
DetectFile=%AppData%\Spacejock Software\yWriter*
FileKey1=%AppData%\Spacejock Software\yWriter*|Log.txt
FileKey2=%UserProfile%\Documents\Logs|*.txt
FileKey3=%UserProfile%\Documents\ywriter projects\*ywriter\Logs|*
FileKey4=%UserProfile%\Documents\ywriter projects\*ywriter\ywtemp|*

[Z-VSScopy *]
LangSecRef=3024
DetectFile=%CommonProgramFiles%\Z-Manufaktur\Z-VSScopy
FileKey1=%CommonProgramFiles%\Z-Manufaktur\Z-VSScopy|LogFile.txt

[Zemana AntiMalware *]
LangSecRef=3024
DetectFile=%LocalAppData%\Zemana\Zemana AntiMalware
FileKey1=%LocalAppData%\Zemana\Zemana AntiMalware\reports|*.txt

[Zen Autocomplete History *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|formhistory*

[Zen Autofill Data *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|autofill-profiles.json

[Zen Bookmark Backups *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*\bookmarkbackups|*

[Zen Bookmark Favicons *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|favicons*

[Zen Caches *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\Zen\Profiles\*|AlternateServices.txt;cert9.db;ClientAuthRememberList.txt;notificationstore.json;parent.lock;serviceworker.txt;SiteSecurityServiceState*
FileKey3=%AppData%\Zen\Profiles\*\notificationstore|*
FileKey4=%AppData%\Zen\Profiles\*\security_state|*
FileKey5=%AppData%\Zen\Profiles\*\shader-cache|*
FileKey6=%AppData%\Zen\Profiles\*\storage\temporary|*|RECURSE
FileKey7=%LocalAppData%\Zen\Profiles\*\*cache*|*|REMOVESELF
FileKey8=%LocalAppData%\Zen\Profiles\*\chrome_debugger_profile|*|REMOVESELF
FileKey9=%LocalAppData%\Zen\Profiles\*\thumbnails|*|REMOVESELF

[Zen Privacy Sandbox *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|credentialstate.sqlite

[Zen Saved Usernames & Passwords *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|key4.db;logins.json

[Zen Synced Tabs *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|synced-tabs.db*

[Zen Telemetry *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen|*.log|RECURSE
FileKey2=%AppData%\Zen\Crash Reports|*|REMOVESELF
FileKey3=%AppData%\Zen\Profiles\*|enumerate_devices.txt;protections.sqlite;targeting.snapshot.json;Telemetry.ShutdownTime.txt;times.json
FileKey4=%AppData%\Zen\Profiles\*\crashes|*
FileKey5=%AppData%\Zen\Profiles\*\datareporting|*|REMOVESELF
FileKey6=%AppData%\Zen\Profiles\*\minidumps|*
FileKey7=%AppData%\Zen\Profiles\*\saved-telemetry-pings|*
FileKey8=%AppData%\Zen\Profiles\*\sessionstore-logs|*
FileKey9=%AppData%\Zen\Profiles\*\weave\logs|*

[Zen Web Browsing Cookies *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|cookies*

[Zen Web Browsing Session *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|session*.json*

[Zen Web Browsing Session Backups *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*\sessionstore-backups|*

[Zen Web Storage *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|storage.sqlite;webappsstore.sqlite
FileKey2=%AppData%\Zen\Profiles\*\storage\default\http*|*|REMOVESELF

[Zen Website Permissions *]
Section=Zen Web Browser
DetectFile=%AppData%\Zen\Profiles
FileKey1=%AppData%\Zen\Profiles\*|content-prefs.sqlite;permissions.sqlite

[Zend Studio *]
LangSecRef=3021
Detect=HKCU\Software\Zend\ZendStudio
FileKey1=%ProgramFiles%\Zend\Zend Studio 10.0.0|*.html;*.log|RECURSE
FileKey2=%ProgramFiles%\Zend\Zend Studio 10.0.0\docs|*.txt|REMOVESELF
FileKey3=%ProgramFiles%\Zend\Zend Studio 10.0.0\features|*.html|RECURSE

[ZipGenius *]
LangSecRef=3024
Detect=HKCU\Software\M.Dev Software\ZG5
FileKey1=%AppData%\ZipGenius|mru.dat
RegKey1=HKCU\Software\M.Dev Software\ZG5\MRU Items

[ZoneAlarm Internet *]
LangSecRef=3021
Detect=HKLM\Software\Zone Labs\ZoneAlarm
FileKey1=%WinDir%\Internet Logs|*.dmp;*.log;*.tmp;*.zip

[ZoneIDTrimmer *]
LangSecRef=3021
Detect=HKLM\Software\Gasanov.net\ZoneIDTrimmer
DetectFile=%ProgramFiles%\Gasanov.net\ZoneIDTrimmer
FileKey1=%AppData%\ZoneIDTrimmer\Logs|ZoneIDTrimmer.log

[Zoner Photo Studio *]
LangSecRef=3022
Detect1=HKCU\Software\ZONER\Zoner Photo Studio 15
Detect2=HKCU\Software\ZONER\Zoner Photo Studio 16
Detect3=HKCU\Software\ZONER\Zoner Photo Studio 18
DetectFile=%LocalAppData%\Zoner\ZPS 14
FileKey1=%LocalAppData%\Zoner\OriginalsRepository|*.JPG.info;*.JPG.original|RECURSE
FileKey2=%LocalAppData%\Zoner\ZPS *\Cache|*|RECURSE
FileKey3=%LocalAppData%\Zoner\ZPS *\CEF|*.log
FileKey4=%LocalAppData%\Zoner\ZPS *\ZPSCache.dat|*
FileKey5=%UserProfile%\Pictures|*.uid-zps

[Zoom *]
LangSecRef=3022
DetectFile=%AppData%\Zoom
FileKey1=%AppData%\Zoom|*.txt
FileKey2=%AppData%\Zoom Plugin\checkforupdate|*.msi
FileKey3=%AppData%\Zoom\data|*-journal;*.db-shm;*.db-wal;*.tmp*.db;*.zmdownload;zmonitorlog.bin|RECURSE
FileKey4=%AppData%\Zoom\data\ConfAvatar|*
FileKey5=%AppData%\Zoom\data\PresenterLayoutWallpaper_Thumb|*
FileKey6=%AppData%\Zoom\data\WaitingRoom|*
FileKey7=%AppData%\Zoom\data\WebviewCache|*.old;LOG|RECURSE
FileKey8=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView|Visited Links
FileKey9=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView\*Cache|*|RECURSE
FileKey10=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView\blob_storage|*|RECURSE
FileKey11=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView\Network|Network Persistent State
FileKey12=%AppData%\Zoom\Logs|*|RECURSE
FileKey13=%AppData%\Zoom\Reports|*
FileKey14=%AppData%\Zoom\ZoomDownload|*.exe;*.msi

[Zoosk *]
LangSecRef=3022
DetectFile=%AppData%\com.zoosk.desktop.*
FileKey1=%AppData%\com.zoosk.desktop.*\Local Store|*.log
FileKey2=%AppData%\com.zoosk.desktop.*\Local Store\#SharedObjects|*|RECURSE

[ZX32 ZX Spectrum Emulator *]
LangSecRef=3021
Detect=HKCU\Software\VK\zx32\1.03
RegKey1=HKCU\Software\VK\zx32\1.03\FileMRU

[Zynga Games *]
Section=Games
DetectFile=%LocalAppData%\Zynga
FileKey1=%LocalAppData%\Zynga\Logs|*|RECURSE
