; Version: 210301
; # of entries: 2,515
;
; Winapp2.ini is fully licensed under the CC-BY-SA-4.0 license agreement. Please refer to our license agreement before using Winapp2.ini: https://github.com/MoscaDotTo/Winapp2/blob/master/License.md
; If you plan on modifying, distributing, and/or hosting Winapp2.ini for your own program or website, please ask first.
;
; You can get the latest Winapp2.ini here: https://github.com/MoscaDotTo/Winapp2
; Any contributions are appreciated. Please refer to our readme to learn to make your own entries here: https://github.com/MoscaDotTo/Winapp2/blob/master/README.md
;
; Is CCleaner taking too long to load with Winapp2.ini? Then download our Winapp2ool and use the trim function to remove unneeded entries in Winapp2.ini: https://github.com/MoscaDotTo/Winapp2/raw/master/winapp2ool/bin/Release/winapp2ool.exe
; The Winapp2ool has its own readme here: https://github.com/MoscaDotTo/Winapp2/blob/master/winapp2ool/Readme.md
;
; Chrome/Chromium based browsers

[ART *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\*|*.tmp|RECURSE
FileKey2=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\*|Preferences.bak

[Blob Storage *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\blob_storage|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\blob_storage|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\blob_storage|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\blob_storage|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\blob_storage|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\blob_storage|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\blob_storage|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\blob_storage|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\blob_storage|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\blob_storage|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\blob_storage|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\blob_storage|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\blob_storage|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\blob_storage|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\blob_storage|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\blob_storage|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\blob_storage|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\blob_storage|*.*|RECURSE

[Bookmarks Backup *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|*Bookmarks.bak
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|*Bookmarks.bak
FileKey3=%LocalAppData%\Amigo\User Data\*|*Bookmarks.bak
FileKey4=%LocalAppData%\CentBrowser\User Data\*|*Bookmarks.bak
FileKey5=%LocalAppData%\Chromium\User Data\*|*Bookmarks.bak
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|*Bookmarks.bak
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|*Bookmarks.bak
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|*Bookmarks.bak
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|*Bookmarks.bak
FileKey10=%LocalAppData%\Flock\User Data\*|*Bookmarks.bak
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|*Bookmarks.bak
FileKey12=%LocalAppData%\Iridium\User Data\*|*Bookmarks.bak
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|*Bookmarks.bak
FileKey14=%LocalAppData%\RockMelt\User Data\*|*Bookmarks.bak
FileKey15=%LocalAppData%\Slimjet\User Data\*|*Bookmarks.bak
FileKey16=%LocalAppData%\Superbird\User Data\*|*Bookmarks.bak
FileKey17=%LocalAppData%\Torch\User Data\*|*Bookmarks.bak
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*Bookmarks.bak

[Browser Exit Codes *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\Amigo
Detect3=HKCU\Software\CentBrowser
Detect4=HKCU\Software\Chromium\PreferenceMACs
Detect5=HKCU\Software\CocCoc\Browser
Detect6=HKCU\Software\Comodo\Dragon
Detect7=HKCU\Software\Epic Privacy Browser
Detect8=HKCU\Software\Iridium
Detect9=HKCU\Software\Slimjet
Detect10=HKCU\Software\Superbird
Detect11=HKCU\Software\Torch
Detect12=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
RegKey1=HKCU\Software\7Star\7Star\BrowserExitCodes
RegKey2=HKCU\Software\Amigo\BrowserExitCodes
RegKey3=HKCU\Software\CentBrowser\BrowserExitCodes
RegKey4=HKCU\Software\Chromium\BrowserExitCodes
RegKey5=HKCU\Software\CocCoc\Browser\BrowserExitCodes
RegKey6=HKCU\Software\Comodo\Dragon\BrowserExitCodes
RegKey7=HKCU\Software\Epic Privacy Browser\BrowserExitCodes
RegKey8=HKCU\Software\Google\Chrome Beta\BrowserExitCodes
RegKey9=HKCU\Software\Google\Chrome Dev\BrowserExitCodes
RegKey10=HKCU\Software\Google\Chrome SxS\BrowserExitCodes
RegKey11=HKCU\Software\Google\Chrome\BrowserExitCodes
RegKey12=HKCU\Software\Iridium\BrowserExitCodes
RegKey13=HKCU\Software\Slimjet\BrowserExitCodes
RegKey14=HKCU\Software\Superbird\BrowserExitCodes
RegKey15=HKCU\Software\Torch\BrowserExitCodes
RegKey16=HKCU\Software\Yandex\YandexBrowser\BrowserExitCodes

[Browser Metrics *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data|BrowserMetrics-spare.pma
FileKey2=%LocalAppData%\7Star\7Star\User Data\BrowserMetrics|*.*|RECURSE
FileKey3=%LocalAppData%\360Browser\Browser\User Data|BrowserMetrics-spare.pma
FileKey4=%LocalAppData%\360Browser\Browser\User Data\BrowserMetrics|*.*|RECURSE
FileKey5=%LocalAppData%\Amigo\User Data|BrowserMetrics-spare.pma
FileKey6=%LocalAppData%\Amigo\User Data\BrowserMetrics|*.*|RECURSE
FileKey7=%LocalAppData%\CentBrowser\User Data|BrowserMetrics-spare.pma
FileKey8=%LocalAppData%\CentBrowser\User Data\BrowserMetrics|*.*|RECURSE
FileKey9=%LocalAppData%\Chromium\User Data|BrowserMetrics-spare.pma
FileKey10=%LocalAppData%\Chromium\User Data\BrowserMetrics|*.*|RECURSE
FileKey11=%LocalAppData%\CocCoc\Browser\User Data|BrowserMetrics-spare.pma
FileKey12=%LocalAppData%\CocCoc\Browser\User Data\BrowserMetrics|*.*|RECURSE
FileKey13=%LocalAppData%\Comodo\Dragon\User Data|BrowserMetrics-spare.pma
FileKey14=%LocalAppData%\Comodo\Dragon\User Data\BrowserMetrics|*.*|RECURSE
FileKey15=%LocalAppData%\Coowon\Coowon\User Data|BrowserMetrics-spare.pma
FileKey16=%LocalAppData%\Coowon\Coowon\User Data\BrowserMetrics|*.*|RECURSE
FileKey17=%LocalAppData%\Epic Privacy Browser\User Data|BrowserMetrics-spare.pma
FileKey18=%LocalAppData%\Epic Privacy Browser\User Data\BrowserMetrics|*.*|RECURSE
FileKey19=%LocalAppData%\Flock\User Data|BrowserMetrics-spare.pma
FileKey20=%LocalAppData%\Flock\User Data\BrowserMetrics|*.*|RECURSE
FileKey21=%LocalAppData%\Google\Chrome*\User Data|BrowserMetrics-spare.pma
FileKey22=%LocalAppData%\Google\Chrome*\User Data\BrowserMetrics|*.*|RECURSE
FileKey23=%LocalAppData%\Iridium\User Data|BrowserMetrics-spare.pma
FileKey24=%LocalAppData%\Iridium\User Data\BrowserMetrics|*.*|RECURSE
FileKey25=%LocalAppData%\MapleStudio\ChromePlus\User Data|BrowserMetrics-spare.pma
FileKey26=%LocalAppData%\MapleStudio\ChromePlus\User Data\BrowserMetrics|*.*|RECURSE
FileKey27=%LocalAppData%\RockMelt\User Data|BrowserMetrics-spare.pma
FileKey28=%LocalAppData%\RockMelt\User Data\BrowserMetrics|*.*|RECURSE
FileKey29=%LocalAppData%\Slimjet\User Data|BrowserMetrics-spare.pma
FileKey30=%LocalAppData%\Slimjet\User Data\BrowserMetrics|*.*|RECURSE
FileKey31=%LocalAppData%\Superbird\User Data|BrowserMetrics-spare.pma
FileKey32=%LocalAppData%\Superbird\User Data\BrowserMetrics|*.*|RECURSE
FileKey33=%LocalAppData%\Torch\User Data|BrowserMetrics-spare.pma
FileKey34=%LocalAppData%\Torch\User Data\BrowserMetrics|*.*|RECURSE
FileKey35=%LocalAppData%\Yandex\YandexBrowser\User Data|BrowserMetrics-spare.pma
FileKey36=%LocalAppData%\Yandex\YandexBrowser\User Data\BrowserMetrics|*.*|RECURSE

[Budget Database *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\BudgetDatabase|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\BudgetDatabase|*.*|RECURSE

[Code Cache *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Code Cache|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Code Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Code Cache|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Code Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Code Cache|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Code Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Code Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Code Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Code Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Code Cache|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Code Cache|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Code Cache|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Code Cache|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Code Cache|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Code Cache|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Code Cache|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Code Cache|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Code Cache|*.*|RECURSE

[Crash Reports *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data|CrashpadMetrics*.pma
FileKey2=%LocalAppData%\7Star\7Star\User Data\Crashpad|metadata
FileKey3=%LocalAppData%\7Star\7Star\User Data\Crashpad\reports|*.*
FileKey4=%LocalAppData%\360Browser\Browser\User Data|CrashpadMetrics*.pma
FileKey5=%LocalAppData%\360Browser\Browser\User Data\Crashpad|metadata
FileKey6=%LocalAppData%\360Browser\Browser\User Data\Crashpad\reports|*.*
FileKey7=%LocalAppData%\Amigo\User Data|CrashpadMetrics*.pma
FileKey8=%LocalAppData%\Amigo\User Data\Crashpad|metadata
FileKey9=%LocalAppData%\Amigo\User Data\Crashpad\reports|*.*
FileKey10=%LocalAppData%\CentBrowser\User Data|CrashpadMetrics*.pma
FileKey11=%LocalAppData%\CentBrowser\User Data\Crashpad|metadata
FileKey12=%LocalAppData%\CentBrowser\User Data\Crashpad\reports|*.*
FileKey13=%LocalAppData%\Chromium\User Data|CrashpadMetrics*.pma
FileKey14=%LocalAppData%\Chromium\User Data\Crashpad|metadata
FileKey15=%LocalAppData%\Chromium\User Data\Crashpad\reports|*.*
FileKey16=%LocalAppData%\CocCoc\Browser\User Data|CrashpadMetrics*.pma
FileKey17=%LocalAppData%\CocCoc\Browser\User Data\Crashpad|metadata
FileKey18=%LocalAppData%\CocCoc\Browser\User Data\Crashpad\reports|*.*
FileKey19=%LocalAppData%\Comodo\Dragon\User Data|CrashpadMetrics*.pma
FileKey20=%LocalAppData%\Comodo\Dragon\User Data\Crashpad|metadata
FileKey21=%LocalAppData%\Comodo\Dragon\User Data\Crashpad\reports|*.*
FileKey22=%LocalAppData%\Coowon\Coowon\User Data|CrashpadMetrics*.pma
FileKey23=%LocalAppData%\Coowon\Coowon\User Data\Crashpad|metadata
FileKey24=%LocalAppData%\Coowon\Coowon\User Data\Crashpad\reports|*.*
FileKey25=%LocalAppData%\Epic Privacy Browser\User Data|CrashpadMetrics*.pma
FileKey26=%LocalAppData%\Epic Privacy Browser\User Data\Crashpad|metadata
FileKey27=%LocalAppData%\Epic Privacy Browser\User Data\Crashpad\reports|*.*
FileKey28=%LocalAppData%\Flock\User Data|CrashpadMetrics*.pma
FileKey29=%LocalAppData%\Flock\User Data\Crashpad|metadata
FileKey30=%LocalAppData%\Flock\User Data\Crashpad\reports|*.*
FileKey31=%LocalAppData%\Google\Chrome*\User Data|CrashpadMetrics*.pma
FileKey32=%LocalAppData%\Google\Chrome*\User Data\Crashpad|metadata
FileKey33=%LocalAppData%\Google\Chrome*\User Data\Crashpad\reports|*.*
FileKey34=%LocalAppData%\Google\CrashReports|*.*
FileKey35=%LocalAppData%\Iridium\User Data|CrashpadMetrics*.pma
FileKey36=%LocalAppData%\Iridium\User Data\Crashpad|metadata
FileKey37=%LocalAppData%\Iridium\User Data\Crashpad\reports|*.*
FileKey38=%LocalAppData%\MapleStudio\ChromePlus\User Data|CrashpadMetrics*.pma
FileKey39=%LocalAppData%\MapleStudio\ChromePlus\User Data\Crashpad|metadata
FileKey40=%LocalAppData%\MapleStudio\ChromePlus\User Data\Crashpad\reports|*.*
FileKey41=%LocalAppData%\RockMelt\User Data|CrashpadMetrics*.pma
FileKey42=%LocalAppData%\RockMelt\User Data\Crashpad|metadata
FileKey43=%LocalAppData%\RockMelt\User Data\Crashpad\reports|*.*
FileKey44=%LocalAppData%\Slimjet\User Data|CrashpadMetrics*.pma
FileKey45=%LocalAppData%\Slimjet\User Data\Crashpad|metadata
FileKey46=%LocalAppData%\Slimjet\User Data\Crashpad\reports|*.*
FileKey47=%LocalAppData%\Superbird\User Data|CrashpadMetrics*.pma
FileKey48=%LocalAppData%\Superbird\User Data\Crashpad|metadata
FileKey49=%LocalAppData%\Superbird\User Data\Crashpad\reports|*.*
FileKey50=%LocalAppData%\Torch\User Data|CrashpadMetrics*.pma
FileKey51=%LocalAppData%\Torch\User Data\Crashpad|metadata
FileKey52=%LocalAppData%\Torch\User Data\Crashpad\reports|*.*
FileKey53=%LocalAppData%\Yandex\YandexBrowser\User Data|CrashpadMetrics*.pma
FileKey54=%LocalAppData%\Yandex\YandexBrowser\User Data\Crashpad|metadata;uploads.log
FileKey55=%LocalAppData%\Yandex\YandexBrowser\User Data\Crashpad\reports|*.*
FileKey56=%ProgramFiles%\Google\CrashReports|*.*

[Data Reduction Proxy *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE

[Download History *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey3=%LocalAppData%\Amigo\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey4=%LocalAppData%\CentBrowser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey5=%LocalAppData%\Chromium\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey10=%LocalAppData%\Flock\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey12=%LocalAppData%\Iridium\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey14=%LocalAppData%\RockMelt\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey15=%LocalAppData%\Slimjet\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey16=%LocalAppData%\Superbird\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey17=%LocalAppData%\Torch\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*

[Extension Cookies *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Extension Cookies
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|Extension Cookies
FileKey3=%LocalAppData%\Amigo\User Data\*|Extension Cookies
FileKey4=%LocalAppData%\CentBrowser\User Data\*|Extension Cookies
FileKey5=%LocalAppData%\Chromium\User Data\*|Extension Cookies
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|Extension Cookies
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|Extension Cookies
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|Extension Cookies
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|Extension Cookies
FileKey10=%LocalAppData%\Flock\User Data\*|Extension Cookies
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|Extension Cookies
FileKey12=%LocalAppData%\Iridium\User Data\*|Extension Cookies
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|Extension Cookies
FileKey14=%LocalAppData%\RockMelt\User Data\*|Extension Cookies
FileKey15=%LocalAppData%\Slimjet\User Data\*|Extension Cookies
FileKey16=%LocalAppData%\Superbird\User Data\*|Extension Cookies
FileKey17=%LocalAppData%\Torch\User Data\*|Extension Cookies
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Extension Cookies

[Feature Engagement Tracker *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Feature Engagement Tracker|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Feature Engagement Tracker|*.*|RECURSE

[Flash Player Cache *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE

[Google Cloud Messaging *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\GCM Store|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\GCM Store|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\GCM Store|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\GCM Store|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\GCM Store|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\GCM Store|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\GCM Store|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\GCM Store|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\GCM Store|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\GCM Store|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\GCM Store|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\GCM Store|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\GCM Store|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\GCM Store|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\GCM Store|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\GCM Store|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\GCM Store|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\GCM Store|*.*|RECURSE

[Jump List Icons *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\JumpListIcons*|*.*|RECURSE

[Logs *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%CommonAppData%\Yandex\YandexBrowser|service_update.log
FileKey2=%LocalAppData%\7Star\7Star\Application|debug.log
FileKey3=%LocalAppData%\7Star\7Star\User Data\*|LOG;LOG.old|RECURSE
FileKey4=%LocalAppData%\360Browser\Browser\Application|debug.log
FileKey5=%LocalAppData%\360Browser\Browser\User Data\*|LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Amigo\Application|debug.log
FileKey7=%LocalAppData%\Amigo\User Data\*|LOG;LOG.old|RECURSE
FileKey8=%LocalAppData%\CentBrowser\Application|debug.log
FileKey9=%LocalAppData%\CentBrowser\User Data\*|LOG;LOG.old|RECURSE
FileKey10=%LocalAppData%\Chromium\Application|debug.log
FileKey11=%LocalAppData%\Chromium\User Data\*|LOG;LOG.old|RECURSE
FileKey12=%LocalAppData%\CocCoc\Browser\Application|debug.log
FileKey13=%LocalAppData%\CocCoc\Browser\User Data\*|LOG;LOG.old|RECURSE
FileKey14=%LocalAppData%\Comodo\Dragon\User Data\*|LOG;LOG.old|RECURSE
FileKey15=%LocalAppData%\Coowon\Coowon\Application|debug.log
FileKey16=%LocalAppData%\Coowon\Coowon\User Data\*|LOG;LOG.old|RECURSE
FileKey17=%LocalAppData%\Epic Privacy Browser\Application|debug.log
FileKey18=%LocalAppData%\Epic Privacy Browser\User Data\*|LOG;LOG.old|RECURSE
FileKey19=%LocalAppData%\Flock\Application|debug.log
FileKey20=%LocalAppData%\Flock\User Data\*|LOG;LOG.old|RECURSE
FileKey21=%LocalAppData%\Google\Chrome Cleanup Tool|*.log
FileKey22=%LocalAppData%\Google\Chrome*\Application|debug.log
FileKey23=%LocalAppData%\Google\Chrome*\User Data\*|LOG;LOG.old|RECURSE
FileKey24=%LocalAppData%\Google\Software Reporter Tool|*.log
FileKey25=%LocalAppData%\Iridium\User Data\*|LOG;LOG.old|RECURSE
FileKey26=%LocalAppData%\MapleStudio\ChromePlus\Application|debug.log
FileKey27=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|LOG;LOG.old|RECURSE
FileKey28=%LocalAppData%\RockMelt\Application|debug.log
FileKey29=%LocalAppData%\RockMelt\User Data\*|LOG;LOG.old|RECURSE
FileKey30=%LocalAppData%\Slimjet\User Data\*|LOG;LOG.old|RECURSE
FileKey31=%LocalAppData%\Superbird\User Data\*|LOG;LOG.old|RECURSE
FileKey32=%LocalAppData%\Torch\Application|debug.log
FileKey33=%LocalAppData%\Torch\User Data\*|LOG;LOG.old|RECURSE
FileKey34=%LocalAppData%\Yandex\YandexBrowser\Application|debug.log
FileKey35=%LocalAppData%\Yandex\YandexBrowser\User Data\*|LOG;LOG.old|RECURSE
FileKey36=%ProgramFiles%\Comodo\Dragon|debug.log
FileKey37=%ProgramFiles%\Google\Chrome*\Application|debug.log
FileKey38=%ProgramFiles%\Iridium|debug.log
FileKey39=%ProgramFiles%\Slimjet|debug.log
FileKey40=%ProgramFiles%\SRWare Iron|debug.log
FileKey41=%ProgramFiles%\SuperBird|debug.log

[Media Playback History *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\Google\Chrome*\User Data\*|Media History

[Network Persistent State *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Network Persistent State
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|Network Persistent State
FileKey3=%LocalAppData%\Amigo\User Data\*|Network Persistent State
FileKey4=%LocalAppData%\CentBrowser\User Data\*|Network Persistent State
FileKey5=%LocalAppData%\Chromium\User Data\*|Network Persistent State
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|Network Persistent State
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|Network Persistent State
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|Network Persistent State
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|Network Persistent State
FileKey10=%LocalAppData%\Flock\User Data\*|Network Persistent State
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|Network Persistent State
FileKey12=%LocalAppData%\Iridium\User Data\*|Network Persistent State
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|Network Persistent State
FileKey14=%LocalAppData%\RockMelt\User Data\*|Network Persistent State
FileKey15=%LocalAppData%\Slimjet\User Data\*|Network Persistent State
FileKey16=%LocalAppData%\Superbird\User Data\*|Network Persistent State
FileKey17=%LocalAppData%\Torch\User Data\*|Network Persistent State
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Network Persistent State

[Platform Notifications *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Platform Notifications|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Platform Notifications|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Platform Notifications|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Platform Notifications|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Platform Notifications|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Platform Notifications|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Platform Notifications|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Platform Notifications|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Platform Notifications|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Platform Notifications|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Platform Notifications|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Platform Notifications|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Platform Notifications|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Platform Notifications|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Platform Notifications|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Platform Notifications|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Platform Notifications|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Platform Notifications|*.*|RECURSE

[PNaCl Translation Cache *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\PnaclTranslationCache|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\PnaclTranslationCache|*.*|RECURSE

[Rollback Journals *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\CocCoc\Browser
Detect6=HKCU\Software\Coowon\Coowon
Detect7=HKCU\Software\Epic Privacy Browser
Detect8=HKCU\Software\Iridium
Detect9=HKCU\Software\Slimjet
Detect10=HKCU\Software\Superbird
FileKey1=%LocalAppData%\7Star\7Star\User Data|*-journal
FileKey2=%LocalAppData%\360Browser\Browser\User Data|*-journal
FileKey3=%LocalAppData%\Amigo\User Data|*-journal
FileKey4=%LocalAppData%\CentBrowser\User Data|*-journal
FileKey5=%LocalAppData%\CocCoc\Browser\User Data|*-journal
FileKey6=%LocalAppData%\Coowon\Coowon\User Data|*-journal
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data|*-journal
FileKey8=%LocalAppData%\Iridium\User Data|*-journal
FileKey9=%LocalAppData%\Slimjet\User Data|*-journal
FileKey10=%LocalAppData%\Superbird\User Data|*-journal

[Search Engines Data *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
Warning=This also removes all AutoFill data ("Saved Form Information").
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Web Data
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|Web Data
FileKey3=%LocalAppData%\Amigo\User Data\*|Web Data
FileKey4=%LocalAppData%\CentBrowser\User Data\*|Web Data
FileKey5=%LocalAppData%\Chromium\User Data\*|Web Data
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|Web Data
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|Web Data
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|Web Data
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|Web Data
FileKey10=%LocalAppData%\Flock\User Data\*|Web Data
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|Web Data
FileKey12=%LocalAppData%\Iridium\User Data\*|Web Data
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|Web Data
FileKey14=%LocalAppData%\RockMelt\User Data\*|Web Data
FileKey15=%LocalAppData%\Slimjet\User Data\*|Web Data
FileKey16=%LocalAppData%\Superbird\User Data\*|Web Data
FileKey17=%LocalAppData%\Torch\User Data\*|Web Data
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Web Data

[Setup Metrics *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Coowon\Coowon
Detect9=HKCU\Software\Epic Privacy Browser
Detect10=HKCU\Software\Flock
Detect11=HKCU\Software\RockMelt
Detect12=HKCU\Software\Torch
Detect13=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\Application\SetupMetrics|*.*|REMOVESELF
FileKey2=%LocalAppData%\360Browser\Browser\Application\SetupMetrics|*.*|REMOVESELF
FileKey3=%LocalAppData%\Amigo\Application\SetupMetrics|*.*|REMOVESELF
FileKey4=%LocalAppData%\CentBrowser\Application\SetupMetrics|*.*|REMOVESELF
FileKey5=%LocalAppData%\Chromium\Application\SetupMetrics|*.*|REMOVESELF
FileKey6=%LocalAppData%\CocCoc\Browser\Application\SetupMetrics|*.*|REMOVESELF
FileKey7=%LocalAppData%\Coowon\Coowon\Application\SetupMetrics|*.*|REMOVESELF
FileKey8=%LocalAppData%\Epic Privacy Browser\Application\SetupMetrics|*.*|REMOVESELF
FileKey9=%LocalAppData%\Flock\Application\SetupMetrics|*.*|REMOVESELF
FileKey10=%LocalAppData%\Google\Chrome*\Application\SetupMetrics|*.*|REMOVESELF
FileKey11=%LocalAppData%\MapleStudio\ChromePlus\Application\SetupMetrics|*.*|REMOVESELF
FileKey12=%LocalAppData%\RockMelt\Application\SetupMetrics|*.*|REMOVESELF
FileKey13=%LocalAppData%\Torch\Application\SetupMetrics|*.*|REMOVESELF
FileKey14=%LocalAppData%\Yandex\YandexBrowser\Application\SetupMetrics|*.*|REMOVESELF
FileKey15=%ProgramFiles%\Google\Chrome*\Application\SetupMetrics|*.*|REMOVESELF

[Shader Cache *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\CocCoc\Browser
Detect6=HKCU\Software\Coowon\Coowon
Detect7=HKCU\Software\Epic Privacy Browser
Detect8=HKCU\Software\Iridium
Detect9=HKCU\Software\Slimjet
Detect10=HKCU\Software\Superbird
FileKey1=%LocalAppData%\7Star\7Star\User Data\*ShaderCache\GPUCache|*.*
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*ShaderCache\GPUCache|*.*
FileKey3=%LocalAppData%\Amigo\User Data\*ShaderCache\GPUCache|*.*
FileKey4=%LocalAppData%\CentBrowser\User Data\*ShaderCache\GPUCache|*.*
FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*ShaderCache\GPUCache|*.*
FileKey6=%LocalAppData%\Coowon\Coowon\User Data\*ShaderCache\GPUCache|*.*
FileKey7=%LocalAppData%\Epic Privacy Browser\User Data\*ShaderCache\GPUCache|*.*
FileKey8=%LocalAppData%\Iridium\User Data\*ShaderCache\GPUCache|*.*
FileKey9=%LocalAppData%\Slimjet\User Data\*ShaderCache\GPUCache|*.*
FileKey10=%LocalAppData%\Superbird\User Data\*ShaderCache\GPUCache|*.*

[Site Characteristics Database *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Site Characteristics Database|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Site Characteristics Database|*.*|RECURSE

[Stability *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\Stability|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\Stability|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\Stability|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\Stability|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\Stability|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\Stability|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\Stability|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\Stability|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\Stability|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\Stability|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\Stability|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\Stability|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\Stability|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\Stability|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\Stability|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\Stability|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\Stability|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\Stability|*.*|RECURSE

[Sync Data *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Sync Data|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Sync Data|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Sync Data|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Sync Data|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Sync Data|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Sync Data|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Sync Data|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Sync Data|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Sync Data|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Sync Data|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Sync Data|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Sync Data|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Sync Data|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Sync Data|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Sync Data|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Sync Data|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Sync Data|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Sync Data|*.*|RECURSE

[Temps *]
LangSecRef=3029
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%ProgramFiles%\Google\Chrome*\Temp|*.*|RECURSE

[TLS Certificates *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Origin Bound Certs
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|Origin Bound Certs
FileKey3=%LocalAppData%\Amigo\User Data\*|Origin Bound Certs
FileKey4=%LocalAppData%\CentBrowser\User Data\*|Origin Bound Certs
FileKey5=%LocalAppData%\Chromium\User Data\*|Origin Bound Certs
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|Origin Bound Certs
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|Origin Bound Certs
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|Origin Bound Certs
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|Origin Bound Certs
FileKey10=%LocalAppData%\Flock\User Data\*|Origin Bound Certs
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|Origin Bound Certs
FileKey12=%LocalAppData%\Iridium\User Data\*|Origin Bound Certs
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|Origin Bound Certs
FileKey14=%LocalAppData%\RockMelt\User Data\*|Origin Bound Certs
FileKey15=%LocalAppData%\Slimjet\User Data\*|Origin Bound Certs
FileKey16=%LocalAppData%\Superbird\User Data\*|Origin Bound Certs
FileKey17=%LocalAppData%\Torch\User Data\*|Origin Bound Certs
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Origin Bound Certs

[Update *]
LangSecRef=3029
Detect1=HKCU\Software\CocCoc\Browser
Detect2=HKCU\Software\Epic Privacy Browser
Detect3=HKCU\Software\Torch
FileKey1=%LocalAppData%\CocCoc\Update\Download|*.*|RECURSE
FileKey2=%LocalAppData%\CocCoc\Update\Install|*.*|RECURSE
FileKey3=%LocalAppData%\CocCoc\Update\Offline|*.*|RECURSE
FileKey4=%LocalAppData%\Epic Privacy Browser\Installer\Download|*.*|RECURSE
FileKey5=%LocalAppData%\Epic Privacy Browser\Installer\Install|*.*|RECURSE
FileKey6=%LocalAppData%\Epic Privacy Browser\Installer\Offline|*.*|RECURSE
FileKey7=%LocalAppData%\Torch\Update\Download|*.*|RECURSE
FileKey8=%LocalAppData%\Torch\Update\Install|*.*|RECURSE
FileKey9=%LocalAppData%\Torch\Update\Offline|*.*|RECURSE

[Video Decode Statistics *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\VideoDecodeStats|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\VideoDecodeStats|*.*|RECURSE

[Web Applications *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Web Applications|*.*|RECURSE
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*\Web Applications|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Web Applications|*.*|RECURSE
FileKey4=%LocalAppData%\CentBrowser\User Data\*\Web Applications|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Web Applications|*.*|RECURSE
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Web Applications|*.*|RECURSE
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\Web Applications|*.*|RECURSE
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*\Web Applications|*.*|RECURSE
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Web Applications|*.*|RECURSE
FileKey10=%LocalAppData%\Flock\User Data\*\Web Applications|*.*|RECURSE
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Web Applications|*.*|RECURSE
FileKey12=%LocalAppData%\Iridium\User Data\*\Web Applications|*.*|RECURSE
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\Web Applications|*.*|RECURSE
FileKey14=%LocalAppData%\RockMelt\User Data\*\Web Applications|*.*|RECURSE
FileKey15=%LocalAppData%\Slimjet\User Data\*\Web Applications|*.*|RECURSE
FileKey16=%LocalAppData%\Superbird\User Data\*\Web Applications|*.*|RECURSE
FileKey17=%LocalAppData%\Torch\User Data\*\Web Applications|*.*|RECURSE
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Web Applications|*.*|RECURSE

[WebRTC Identity Storage *]
LangSecRef=3029
Detect1=HKCU\Software\7Star\7Star
Detect2=HKCU\Software\360Browser\Browser
Detect3=HKCU\Software\Amigo
Detect4=HKCU\Software\CentBrowser
Detect5=HKCU\Software\ChromePlus
Detect6=HKCU\Software\Chromium\PreferenceMACs
Detect7=HKCU\Software\CocCoc\Browser
Detect8=HKCU\Software\Comodo\Dragon
Detect9=HKCU\Software\Coowon\Coowon
Detect10=HKCU\Software\Epic Privacy Browser
Detect11=HKCU\Software\Flock
Detect12=HKCU\Software\Iridium
Detect13=HKCU\Software\RockMelt
Detect14=HKCU\Software\Slimjet
Detect15=HKCU\Software\Superbird
Detect16=HKCU\Software\Torch
Detect17=HKCU\Software\Yandex\YandexBrowser
DetectFile=%LocalAppData%\Google\Chrome*
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|WebRTCIdentityStore
FileKey2=%LocalAppData%\360Browser\Browser\User Data\*|WebRTCIdentityStore
FileKey3=%LocalAppData%\Amigo\User Data\*|WebRTCIdentityStore
FileKey4=%LocalAppData%\CentBrowser\User Data\*|WebRTCIdentityStore
FileKey5=%LocalAppData%\Chromium\User Data\*|WebRTCIdentityStore
FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*|WebRTCIdentityStore
FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|WebRTCIdentityStore
FileKey8=%LocalAppData%\Coowon\Coowon\User Data\*|WebRTCIdentityStore
FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|WebRTCIdentityStore
FileKey10=%LocalAppData%\Flock\User Data\*|WebRTCIdentityStore
FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|WebRTCIdentityStore
FileKey12=%LocalAppData%\Iridium\User Data\*|WebRTCIdentityStore
FileKey13=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|WebRTCIdentityStore
FileKey14=%LocalAppData%\RockMelt\User Data\*|WebRTCIdentityStore
FileKey15=%LocalAppData%\Slimjet\User Data\*|WebRTCIdentityStore
FileKey16=%LocalAppData%\Superbird\User Data\*|WebRTCIdentityStore
FileKey17=%LocalAppData%\Torch\User Data\*|WebRTCIdentityStore
FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*|WebRTCIdentityStore

; End of Chrome/Chromium based browsers
; 
; Edge Chromium

[Edge Blob Storage *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\blob_storage|*.*|RECURSE

[Edge Bookmarks Backup *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|*Bookmarks.bak

[Edge Browser Exit Codes *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
RegKey1=HKCU\Software\Microsoft\Edge Beta\BrowserExitCodes
RegKey2=HKCU\Software\Microsoft\Edge Dev\BrowserExitCodes
RegKey3=HKCU\Software\Microsoft\Edge SxS\BrowserExitCodes
RegKey4=HKCU\Software\Microsoft\Edge\BrowserExitCodes

[Edge Browser Helper Object *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalLowAppData%\Microsoft\EdgeBho|*.log

[Edge Browser Metrics *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data|BrowserMetrics-spare.pma
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\BrowserMetrics|*.*|RECURSE

[Edge Budget Database *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\BudgetDatabase|*.*|RECURSE

[Edge Code Cache *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Code Cache|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def\Code Cache|*.*|RECURSE

[Edge Crash Reports *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\CrashReports|*.*
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data|CrashpadMetrics*.pma
FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\Crashpad|metadata
FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\Crashpad\reports|*.*
FileKey5=%ProgramFiles%\Microsoft\CrashReports|*.*

[Edge Data Reduction Proxy *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE

[Edge Download History *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*

[Edge Extension Cookies *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Extension Cookies

[Edge Feature Engagement Tracker *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Feature Engagement Tracker|*.*|RECURSE

[Edge Flash Player Cache *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE

[Edge Flash Player Cookies *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Microsoft\Edge*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\|settings.sol

[Edge Jump List Icons *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\JumpListIcons*|*.*|RECURSE

[Edge Logs *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|LOG;LOG.old|RECURSE
FileKey3=%ProgramFiles%\Microsoft\Edge*\Application|debug.log

[Edge Media Playback History *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Media History

[Edge Network Persistent State *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Network Persistent State
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def|Network Persistent State

[Edge Platform Notifications *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Platform Notifications|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def\Platform Notifications|*.*|RECURSE

[Edge PNaCl Translation Cache *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\PnaclTranslationCache|*.*|RECURSE

[Edge Search Engines Data *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
Warning=This also removes all AutoFill data ("Saved Form Information").
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Web Data

[Edge Setup Metrics *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\Application\SetupMetrics|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Microsoft\Edge*\Application\SetupMetrics|*.*|REMOVESELF

[Edge Site Characteristics Database *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Site Characteristics Database|*.*|RECURSE

[Edge Sync Data *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Sync Data|*.*|RECURSE

[Edge TLS Certificates *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Origin Bound Certs

[Edge Update *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%CommonAppData%\Microsoft\EdgeUpdate\Log|*.log
FileKey2=%LocalAppData%\Microsoft\EdgeUpdate\Download|*.*|RECURSE
FileKey3=%LocalAppData%\Microsoft\EdgeUpdate\Install|*.*|RECURSE
FileKey4=%ProgramFiles%\Microsoft\EdgeUpdate\Download|*.*|RECURSE
FileKey5=%ProgramFiles%\Microsoft\EdgeUpdate\Install|*.*|RECURSE

[Edge Video Decode Statistics *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\VideoDecodeStats|*.*|RECURSE

[Edge Web Applications *]
LangSecRef=3006
DetectFile=%LocalAppData%\Microsoft\Edge*
FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Web Applications|*.*|RECURSE

; End of Edge Chromium
; 
; Vivaldi

[Vivaldi Blob Storage *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\blob_storage|*.*|RECURSE

[Vivaldi Bookmarks Backup *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*|*Bookmarks.bak

[Vivaldi Browser Exit Codes *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
RegKey1=HKCU\Software\Vivaldi\BrowserExitCodes

[Vivaldi Browser Metrics *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data|BrowserMetrics-spare.pma
FileKey2=%LocalAppData%\Vivaldi\User Data\BrowserMetrics|*.*|RECURSE

[Vivaldi Budget Database *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\BudgetDatabase|*.*|RECURSE

[Vivaldi Code Cache *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Code Cache|*.*|RECURSE

[Vivaldi Crash Reports *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data|CrashpadMetrics*.pma
FileKey2=%LocalAppData%\Vivaldi\User Data\Crashpad|metadata
FileKey3=%LocalAppData%\Vivaldi\User Data\Crashpad\reports|*.*

[Vivaldi Data Reduction Proxy *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE

[Vivaldi Download History *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*

[Vivaldi Extension Cookies *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Extension Cookies

[Vivaldi Feature Engagement Tracker *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Feature Engagement Tracker|*.*|RECURSE

[Vivaldi Flash Player Cache *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE

[Vivaldi Flash Player Cookies *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\|settings.sol

[Vivaldi Google Cloud Messaging *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\GCM Store|*.*|RECURSE

[Vivaldi Jump List Icons *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\JumpListIcons*|*.*|RECURSE

[Vivaldi Logs *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\Application|debug.log
FileKey2=%LocalAppData%\Vivaldi\User Data\*|LOG;LOG.old|RECURSE
FileKey3=%ProgramFiles%\Vivaldi\Application|debug.log

[Vivaldi Network Persistent State *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Network Persistent State

[Vivaldi Platform Notifications *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Platform Notifications|*.*|RECURSE

[Vivaldi PNaCl Translation Cache *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\PnaclTranslationCache|*.*|RECURSE

[Vivaldi Search Engines Data *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
Warning=This also removes all AutoFill data ("Saved Form Information").
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Web Data

[Vivaldi Setup Metrics *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\Application\SetupMetrics|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Vivaldi\Application\SetupMetrics|*.*|REMOVESELF

[Vivaldi Site Characteristics Database *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Site Characteristics Database|*.*|RECURSE

[Vivaldi Sync Data *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Sync Data|*.*|RECURSE

[Vivaldi Temps *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\Temp|*.*|RECURSE

[Vivaldi TLS Certificates *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*|Origin Bound Certs

[Vivaldi Video Decode Statistics *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\VideoDecodeStats|*.*|RECURSE

[Vivaldi Web Applications *]
LangSecRef=3033
Detect=HKCU\Software\Vivaldi
FileKey1=%LocalAppData%\Vivaldi\User Data\*\Web Applications|*.*|RECURSE

; End of Vivaldi
; 
; Brave

[Brave Blob Storage *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\blob_storage|*.*|RECURSE

[Brave Bookmarks Backup *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*Bookmarks.bak

[Brave Browser Exit Codes *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
RegKey1=HKCU\Software\BraveSoftware\Brave-Browser\BrowserExitCodes
RegKey2=HKCU\Software\BraveSoftware\Brave-Browser-Beta\BrowserExitCodes
RegKey3=HKCU\Software\BraveSoftware\Brave-Browser-Dev\BrowserExitCodes
RegKey4=HKCU\Software\BraveSoftware\Brave-Browser-Nightly\BrowserExitCodes

[Brave Browser Metrics *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|BrowserMetrics-spare.pma
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\BrowserMetrics|*.*|RECURSE

[Brave Budget Database *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\BudgetDatabase|*.*|RECURSE

[Brave Code Cache *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Code Cache|*.*|RECURSE

[Brave Crash Reports *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|CrashpadMetrics*.pma
FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crashpad|metadata
FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crashpad\reports|*.*
FileKey4=%LocalAppData%\BraveSoftware\CrashReports|*.*
FileKey5=%ProgramFiles%\BraveSoftware\CrashReports|*.*

[Brave Data Reduction Proxy *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\data_reduction_proxy_leveldb|*.*|RECURSE

[Brave Download History *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*

[Brave Extension Cookies *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Extension Cookies

[Brave Feature Engagement Tracker *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Feature Engagement Tracker|*.*|RECURSE

[Brave Flash Player Cache *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE

[Brave Flash Player Cookies *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\|settings.sol

[Brave Jump List Icons *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\JumpListIcons*|*.*|RECURSE

[Brave Logs *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|LOG;LOG.old|RECURSE
FileKey2=%ProgramFiles%\BraveSoftware\Brave-Browser*\Application|debug.log

[Brave Network Persistent State *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Network Persistent State

[Brave Platform Notifications *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Platform Notifications|*.*|RECURSE

[Brave PNaCl Translation Cache *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\PnaclTranslationCache|*.*|RECURSE

[Brave Search Engines Data *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
Warning=This also removes all AutoFill data ("Saved Form Information").
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Web Data

[Brave Setup Metrics *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%ProgramFiles%\BraveSoftware\Brave-Browser*\Application\SetupMetrics|*.*|REMOVESELF

[Brave Site Characteristics Database *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Site Characteristics Database|*.*|RECURSE

[Brave Sync Data *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Sync Data|*.*|RECURSE

[Brave TLS Certificates *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Origin Bound Certs

[Brave Update *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%ProgramFiles%\BraveSoftware\Update\Download|*.*|RECURSE
FileKey2=%ProgramFiles%\BraveSoftware\Update\Install|*.*|RECURSE
FileKey3=%ProgramFiles%\BraveSoftware\Update\Offline|*.*|RECURSE

[Brave Web Applications *]
LangSecRef=3034
Detect=HKCU\Software\BraveSoftware
FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Web Applications|*.*|RECURSE

; End of Brave
; 
; Opera

[Opera *]
LangSecRef=3027
DetectFile=%LocalAppData%\Opera\Opera*
FileKey1=%LocalAppData%\Opera\Opera*\application_cache|*.*|REMOVESELF
FileKey2=%LocalAppData%\Opera\Opera*\icons|*.*|REMOVESELF
FileKey3=%LocalAppData%\Opera\Opera*\logs|*.*|REMOVESELF
FileKey4=%LocalAppData%\Opera\Opera*\temporary_downloads|*.*|REMOVESELF
FileKey5=%LocalAppData%\Opera\Opera*\thumbnails|*.*|REMOVESELF
FileKey6=%LocalAppData%\Opera\Opera*\vps|*.*|REMOVESELF
RegKey1=HKCU\Software\Opera Software|Last CommandLine v2

[Opera 9 Classic *]
LangSecRef=3027
DetectFile=%ProgramFiles%\Opera 9\Opera.exe
FileKey1=%ProgramFiles%\Opera 9\profile|cookies4.dat;vlink4.dat;global.dat
FileKey2=%ProgramFiles%\Opera 9\profile\cache*|*.*

[Opera Blob Storage *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\blob_storage|*.*|RECURSE

[Opera Bookmarks Backup *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|*Bookmarks.bak

[Opera Budget Database *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\BudgetDatabase|*.*|RECURSE

[Opera Code Cache *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\Code Cache|*.*|RECURSE

[Opera Crash Reports *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\Crash Reports|metadata
FileKey2=%AppData%\Opera Software\Opera*\Crash Reports\reports|*.*

[Opera Disabled AutoUpdate *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|ssdfp*.*

[Opera Download History *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*

[Opera Extension Cookies *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|Extension Cookies

[Opera Flash Player Cache *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache|*.*|RECURSE

[Opera Google Cloud Messaging *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\GCM Store|*.*|RECURSE

[Opera Logs *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|LOG;LOG.old|RECURSE
FileKey2=%LocalAppData%\Programs\Opera*|debug.log
FileKey3=%ProgramFiles%\Opera*|debug.log

[Opera Network Persistent State *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|Network Persistent State*

[Opera Platform Notifications *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\Platform Notifications|*.*|RECURSE

[Opera Search Engines Data *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
Warning=This also removes all AutoFill data ("Saved Form Information").
FileKey1=%AppData%\Opera Software\Opera*|Web Data

[Opera Site Characteristics Database *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\Site Characteristics Database|*.*|RECURSE

[Opera Sync Data *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\Sync Data|*.*|RECURSE

[Opera TLS Certificates *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*|Origin Bound Certs

[Opera Video Decode Statistics *]
LangSecRef=3027
Detect=HKCU\Software\Opera Software
FileKey1=%AppData%\Opera Software\Opera*\VideoDecodeStats|*.*|RECURSE

; End of Opera
; 
; Firefox/Mozilla based browsers

[Alternate Services *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|AlternateServices.txt
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|AlternateServices.txt
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|AlternateServices.txt
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|AlternateServices.txt
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|AlternateServices.txt
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|AlternateServices.txt
FileKey7=%AppData%\Waterfox\Profiles\*|AlternateServices.txt

[Bookmark Backups *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*\bookmarkbackups|*.json*
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*\bookmarkbackups|*.json*
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*\bookmarkbackups|*.json*
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\bookmarkbackups|*.json*
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*\bookmarkbackups|*.json*
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\bookmarkbackups|*.json*
FileKey7=%AppData%\Waterfox\Profiles\*\bookmarkbackups|*.json*

[Content Preferences *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|content-prefs.sqlite
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|content-prefs.sqlite
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|content-prefs.sqlite
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|content-prefs.sqlite
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|content-prefs.sqlite
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|content-prefs.sqlite
FileKey7=%AppData%\Waterfox\Profiles\*|content-prefs.sqlite

[Corrupt SQLites *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|*.corrupt|RECURSE
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|*.corrupt|RECURSE
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|*.corrupt|RECURSE
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|*.corrupt|RECURSE
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|*.corrupt|RECURSE
FileKey7=%AppData%\Waterfox\Profiles\*|*.corrupt|RECURSE

[Crash Files *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Crash Reports|*.*|RECURSE
FileKey2=%AppData%\Comodo\IceDragon\Profiles\*\minidumps|*.*
FileKey3=%AppData%\FlashPeak\SlimBrowser\Crash Reports|*.*|RECURSE
FileKey4=%AppData%\FlashPeak\SlimBrowser\Profiles\*\minidumps|*.*
FileKey5=%AppData%\Moonchild Productions\Basilisk\Crash Reports|*.*|RECURSE
FileKey6=%AppData%\Moonchild Productions\Basilisk\Profiles\*\minidumps|*.*
FileKey7=%AppData%\Moonchild Productions\Pale Moon\Crash Reports|*.*|RECURSE
FileKey8=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\minidumps|*.*
FileKey9=%AppData%\Mozilla\Firefox\Crash Reports|*.*|RECURSE
FileKey10=%AppData%\Mozilla\Firefox\Profiles\*\minidumps|*.*
FileKey11=%AppData%\Mozilla\SeaMonkey\Crash Reports|*.*|RECURSE
FileKey12=%AppData%\Mozilla\SeaMonkey\Profiles\*\minidumps|*.*
FileKey13=%AppData%\Waterfox\Crash Reports|*.*|RECURSE
FileKey14=%AppData%\Waterfox\Profiles\*\minidumps|*.*

[DOM Storage *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|webappsstore.sqlite
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|webappsstore.sqlite
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|webappsstore.sqlite
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|webappsstore.sqlite
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|webappsstore.sqlite
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|webappsstore.sqlite
FileKey7=%AppData%\Waterfox\Profiles\*|webappsstore.sqlite

[Indexed Databases *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*\storage\temporary|*.*|RECURSE
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*\storage\temporary|*.*|RECURSE
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*\storage\temporary|*.*|RECURSE
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\storage\temporary|*.*|RECURSE
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*\storage\temporary|*.*|RECURSE
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\storage\temporary|*.*|RECURSE
FileKey7=%AppData%\Waterfox\Profiles\*\storage\temporary|*.*|RECURSE

[Log Files *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon|*.log|RECURSE
FileKey2=%AppData%\Comodo\IceDragon\Profiles\*|TestPilotErrorLog.*
FileKey3=%AppData%\Comodo\IceDragon\Profiles\*\weave\logs|*.*
FileKey4=%AppData%\FlashPeak\SlimBrowser|*.log|RECURSE
FileKey5=%AppData%\FlashPeak\SlimBrowser\Profiles\*|TestPilotErrorLog.*
FileKey6=%AppData%\FlashPeak\SlimBrowser\Profiles\*\weave\logs|*.*
FileKey7=%AppData%\Moonchild Productions\Basilisk|*.log|RECURSE
FileKey8=%AppData%\Moonchild Productions\Basilisk\Profiles\*|TestPilotErrorLog.*
FileKey9=%AppData%\Moonchild Productions\Basilisk\Profiles\*\weave\logs|*.*
FileKey10=%AppData%\Moonchild Productions\Pale Moon|*.log|RECURSE
FileKey11=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|TestPilotErrorLog.*
FileKey12=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\weave\logs|*.*
FileKey13=%AppData%\Mozilla\Firefox|*.log|RECURSE
FileKey14=%AppData%\Mozilla\Firefox\Profiles\*|TestPilotErrorLog.*
FileKey15=%AppData%\Mozilla\Firefox\Profiles\*\weave\logs|*.*
FileKey16=%AppData%\Mozilla\SeaMonkey|*.log|RECURSE
FileKey17=%AppData%\Mozilla\SeaMonkey\Profiles\*|TestPilotErrorLog.*
FileKey18=%AppData%\Mozilla\SeaMonkey\Profiles\*\weave\logs|*.*
FileKey19=%AppData%\Waterfox|*.log|RECURSE
FileKey20=%AppData%\Waterfox\Profiles\*|TestPilotErrorLog.*
FileKey21=%AppData%\Waterfox\Profiles\*\weave\logs|*.*
FileKey22=%CommonAppData%\Mozilla*\logs|*.*
FileKey23=%ProgramFiles%\Basilisk|*.log
FileKey24=%ProgramFiles%\Comodo\IceDragon|*.log
FileKey25=%ProgramFiles%\Firefox*|*.log
FileKey26=%ProgramFiles%\Mozilla Firefox|*.log
FileKey27=%ProgramFiles%\Mozilla Maintenance Service\*logs|*.*
FileKey28=%ProgramFiles%\Pale Moon|*.log
FileKey29=%ProgramFiles%\SeaMonkey|*.log
FileKey30=%ProgramFiles%\SlimBrowser|*.log
FileKey31=%ProgramFiles%\Waterfox|*.log

[Nightly Backups *]
LangSecRef=3026
DetectFile1=%ProgramFiles%\Mozilla\Nightly
DetectFile2=%ProgramFiles%\Nightly
FileKey1=%ProgramFiles%\Mozilla\Nightly.bak|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Nightly.bak|*.*|REMOVESELF

[Profile Lock File *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|parent.lock
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|parent.lock
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|parent.lock
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|parent.lock
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|parent.lock
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|parent.lock
FileKey7=%AppData%\Waterfox\Profiles\*|parent.lock

[Registered Service Workers *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|serviceworker.txt
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|serviceworker.txt
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|serviceworker.txt
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|serviceworker.txt
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|serviceworker.txt
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|serviceworker.txt
FileKey7=%AppData%\Waterfox\Profiles\*|serviceworker.txt

[Storage Usage Statistics *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|storage.sqlite
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|storage.sqlite
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|storage.sqlite
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|storage.sqlite
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|storage.sqlite
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|storage.sqlite
FileKey7=%AppData%\Waterfox\Profiles\*|storage.sqlite

[Stored Push Notifications *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|notificationstore.json
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|notificationstore.json
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|notificationstore.json
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|notificationstore.json
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|notificationstore.json
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|notificationstore.json
FileKey7=%AppData%\Waterfox\Profiles\*|notificationstore.json

[Talkback *]
LangSecRef=3026
DetectFile=%AppData%\Talkback\MozillaOrg
FileKey1=%AppData%\Talkback\MozillaOrg\Firefox*|*.*|RECURSE
FileKey2=%AppData%\Talkback\MozillaOrg\Thunderbird*|*.*|RECURSE
RegKey1=HKLM\Software\FullCircle\TalkBack

[Telemetry *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|Telemetry*.*
FileKey2=%AppData%\Comodo\IceDragon\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey3=%AppData%\Comodo\IceDragon\Profiles\*\saved-telemetry-pings|*.*
FileKey4=%AppData%\FlashPeak\SlimBrowser\Profiles\*|Telemetry*.*
FileKey5=%AppData%\FlashPeak\SlimBrowser\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey6=%AppData%\FlashPeak\SlimBrowser\Profiles\*\saved-telemetry-pings|*.*
FileKey7=%AppData%\Moonchild Productions\Basilisk\Profiles\*|Telemetry*.*
FileKey8=%AppData%\Moonchild Productions\Basilisk\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey9=%AppData%\Moonchild Productions\Basilisk\Profiles\*\saved-telemetry-pings|*.*
FileKey10=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|Telemetry*.*
FileKey11=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey12=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\saved-telemetry-pings|*.*
FileKey13=%AppData%\Mozilla\Firefox\Profiles\*|Telemetry*.*
FileKey14=%AppData%\Mozilla\Firefox\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey15=%AppData%\Mozilla\Firefox\Profiles\*\saved-telemetry-pings|*.*
FileKey16=%AppData%\Mozilla\SeaMonkey\Profiles\*|Telemetry*.*
FileKey17=%AppData%\Mozilla\SeaMonkey\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey18=%AppData%\Mozilla\SeaMonkey\Profiles\*\saved-telemetry-pings|*.*
FileKey19=%AppData%\Waterfox\Profiles\*|Telemetry*.*
FileKey20=%AppData%\Waterfox\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey21=%AppData%\Waterfox\Profiles\*\saved-telemetry-pings|*.*
FileKey22=%LocalAppData%\Comodo\IceDragon\Profiles\*|ShutdownDuration.*
FileKey23=%LocalAppData%\FlashPeak\SlimBrowser\Profiles\*|ShutdownDuration.*
FileKey24=%LocalAppData%\Moonchild Productions\Basilisk\Profiles\*|ShutdownDuration.*
FileKey25=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*|ShutdownDuration.*
FileKey26=%LocalAppData%\Mozilla\Firefox\Profiles\*|ShutdownDuration.*
FileKey27=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*|ShutdownDuration.*
FileKey28=%LocalAppData%\Waterfox\Profiles\*|ShutdownDuration.*

[Temp Files *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%ProgramFiles%\Basilisk|*.tmp|RECURSE
FileKey2=%ProgramFiles%\Comodo\IceDragon|*.tmp|RECURSE
FileKey3=%ProgramFiles%\Firefox*|*.tmp|RECURSE
FileKey4=%ProgramFiles%\Mozilla*|*.tmp|RECURSE
FileKey5=%ProgramFiles%\Pale Moon|*.tmp|RECURSE
FileKey6=%ProgramFiles%\SeaMonkey|*.tmp|RECURSE
FileKey7=%ProgramFiles%\SlimBrowser|*.tmp|RECURSE
FileKey8=%ProgramFiles%\Waterfox|*.tmp|RECURSE

[Tracking Protection Statistics *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*|protections.sqlite
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|protections.sqlite
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*|protections.sqlite
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|protections.sqlite
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*|protections.sqlite
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*|protections.sqlite
FileKey7=%AppData%\Waterfox\Profiles\*|protections.sqlite

[Updates *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%CommonAppData%\Mozilla\updates|*.*|RECURSE
FileKey2=%LocalAppData%\Moonchild Productions\Basilisk\Basilisk|*.*|RECURSE
FileKey3=%LocalAppData%\Moonchild Productions\Pale Moon\Pale Moon|*.*|RECURSE
FileKey4=%LocalAppData%\Mozilla\updates|*.*|RECURSE
FileKey5=%ProgramFiles%\Mozilla Firefox\tobedeleted|*.*
FileKey6=%ProgramFiles%\Mozilla Maintenance Service|*.moz-delete
ExcludeKey1=FILE|%CommonAppData%\Mozilla\updates\*\|update-config.json

[Waterfox Installer *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Waterfox
FileKey1=%AppData%\Waterfox*\Waterfox*\install|*.*|RECURSE

[WebRender Shader Cache *]
LangSecRef=3026
Detect1=HKLM\Software\ComodoGroup\IceDragon
Detect2=HKLM\Software\FlashPeak\SlimBrowser
Detect3=HKLM\Software\Mozilla\Basilisk
Detect4=HKLM\Software\Mozilla\Pale Moon
Detect5=HKLM\Software\Mozilla\SeaMonkey
Detect6=HKLM\Software\Mozilla\Waterfox
DetectFile=%AppData%\Mozilla\Firefox
FileKey1=%AppData%\Comodo\IceDragon\Profiles\*\shader-cache|*.*|RECURSE
FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*\shader-cache|*.*|RECURSE
FileKey3=%AppData%\Moonchild Productions\Basilisk\Profiles\*\shader-cache|*.*|RECURSE
FileKey4=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\shader-cache|*.*|RECURSE
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*\shader-cache|*.*|RECURSE
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\shader-cache|*.*|RECURSE
FileKey7=%AppData%\Waterfox\Profiles\*\shader-cache|*.*|RECURSE

; End of Firefox/Mozilla based browsers
; 
; Thunderbird

[Email Index *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
Warning=This will cause your message index to be deleted, searching emails may be slow until it is rebuilt.
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|global-messages-db.sqlite
FileKey2=%AppData%\FossaMail\Profiles\*|global-messages-db.sqlite
FileKey3=%AppData%\Thunderbird\Profiles\*|global-messages-db.sqlite

[Thunderbird Alternate Services *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|AlternateServices.txt
FileKey2=%AppData%\FossaMail\Profiles\*|AlternateServices.txt
FileKey3=%AppData%\Thunderbird\Profiles\*|AlternateServices.txt

[Thunderbird Corrupt SQLites *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|*.corrupt|RECURSE
FileKey2=%AppData%\FossaMail\Profiles\*|*.corrupt|RECURSE
FileKey3=%AppData%\Thunderbird\Profiles\*|*.corrupt|RECURSE

[Thunderbird Crash Files *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Crash Reports|*.*|RECURSE
FileKey2=%AppData%\Binary Outcast\Interlink\Profiles\*\minidumps|*.*
FileKey3=%AppData%\FossaMail\Crash Reports|*.*|RECURSE
FileKey4=%AppData%\FossaMail\Profiles\*\minidumps|*.*
FileKey5=%AppData%\Thunderbird\Crash Reports|*.*|RECURSE
FileKey6=%AppData%\Thunderbird\Profiles\*\minidumps|*.*

[Thunderbird DOM Storage *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|webappsstore.sqlite
FileKey2=%AppData%\FossaMail\Profiles\*|webappsstore.sqlite
FileKey3=%AppData%\Thunderbird\Profiles\*|webappsstore.sqlite

[Thunderbird Log Files *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|extensions.log;filterlog.html;TestPilotErrorLog.*
FileKey2=%AppData%\FossaMail\Profiles\*|extensions.log;filterlog.html;TestPilotErrorLog.*
FileKey3=%AppData%\Thunderbird\Profiles\*|extensions.log;filterlog.html;TestPilotErrorLog.*
FileKey4=%CommonAppData%\Mozilla*\logs|*.*|RECURSE
FileKey5=%ProgramFiles%\FossaMail|*.log
FileKey6=%ProgramFiles%\Interlink|*.log
FileKey7=%ProgramFiles%\Mozilla Maintenance Service\*logs|*.*
FileKey8=%ProgramFiles%\Mozilla Thunderbird|*.log

[Thunderbird Profile Lock File *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|parent.lock
FileKey2=%AppData%\FossaMail\Profiles\*|parent.lock
FileKey3=%AppData%\Thunderbird\Profiles\*|parent.lock

[Thunderbird Telemetry *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*\saved-telemetry-pings|*.*|RECURSE
FileKey2=%AppData%\FossaMail\Profiles\*\saved-telemetry-pings|*.*|RECURSE
FileKey3=%AppData%\Thunderbird\Profiles\*\saved-telemetry-pings|*.*|RECURSE

[Thunderbird Updates *]
LangSecRef=3030
Detect1=HKLM\Software\Binary Outcast\Interlink
Detect2=HKLM\Software\Mozilla\FossaMail
Detect3=HKLM\Software\Mozilla\Mozilla Thunderbird
FileKey1=%CommonAppData%\Mozilla\updates|*.*|RECURSE
FileKey2=%LocalAppData%\Binary Outcast\updates|*.*|RECURSE
FileKey3=%LocalAppData%\FossaMail\updates|*.*|RECURSE
FileKey4=%LocalAppData%\Thunderbird\updates|*.*|RECURSE
ExcludeKey1=FILE|%CommonAppData%\Mozilla\updates\*\|update-config.json

; End of Thunderbird
; 
; Internet Explorer

[Internet Explorer *]
LangSecRef=3001
Detect=HKCU\Software\Microsoft\Internet Explorer
FileKey1=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*.log;*.txt
FileKey3=%LocalAppData%\Microsoft\Internet Explorer\CacheStorage|*.*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE
FileKey5=%LocalAppData%\Microsoft\Windows\IECompat*Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Microsoft\Windows\INetCache|*.*|RECURSE
FileKey7=%LocalAppData%\Microsoft\Windows\INetCookies|*.*|RECURSE
FileKey8=%LocalAppData%\Microsoft\Windows\WebCache|*.*|RECURSE
FileKey9=%LocalAppData%\Microsoft\Windows\WebCache.old|*.*|REMOVESELF
FileKey10=%LocalAppData%\Packages\windows_ie_ac_*\AC\AppCache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\windows_ie_ac_*\AC\IECompat*Cache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\windows_ie_ac_*\AC\IEDownloadHistory|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\windows_ie_ac_*\AC\INet*|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey16=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey17=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\Emie*List|*.*|RECURSE
FileKey18=%LocalAppData%\Packages\windows_ie_ac_*\AC\PRICache|*.*|RECURSE
FileKey19=%LocalAppData%\Packages\windows_ie_ac_*\AC\Temp|*.*|RECURSE
FileKey20=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\Cache|*.*|RECURSE
FileKey21=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\navigationHistory|*.*|RECURSE
FileKey22=%LocalAppData%\Packages\windows_ie_ac_*\TempState|*.*|RECURSE
FileKey23=%SystemDrive%\Documents and Settings\LocalService*\Cookies|*.*|RECURSE
FileKey24=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\History|*.*|RECURSE
FileKey25=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temporary Internet Files|*.*|RECURSE
FileKey26=%SystemDrive%\Documents and Settings\NetworkService*\Cookies|*.*|RECURSE
FileKey27=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\History|*.*|RECURSE
FileKey28=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temporary Internet Files|*.*|RECURSE
FileKey29=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
FileKey30=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
FileKey31=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
FileKey32=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
FileKey33=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
FileKey34=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
FileKey35=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
FileKey36=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
FileKey37=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
FileKey38=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE
FileKey39=%WinDir%\System32\config\systemprofile\Cookies|*.*|RECURSE
FileKey40=%WinDir%\System32\config\systemprofile\History|*.*|RECURSE
FileKey41=%WinDir%\System32\config\systemprofile\Local Settings\Temporary Internet Files|*.*|RECURSE
FileKey42=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
FileKey43=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
FileKey44=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
FileKey45=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage
RegKey2=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore
RegKey3=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage
RegKey4=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

[Internet Explorer Vault *]
LangSecRef=3001
Detect=HKCU\Software\Microsoft\Internet Explorer
Warning=This will clear the saved passwords in the Windows Mail app.
FileKey1=%LocalAppData%\Microsoft\Vault\*|*.vcrd

; End of Internet Explorer

[.NET Application History *]
LangSecRef=3025
DetectFile=%LocalAppData%\ApplicationHistory
FileKey1=%LocalAppData%\ApplicationHistory|*.*|RECURSE

[.NET Framework *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
FileKey1=%WinDir%\assembly\NativeImages_*\Temp|*.*|RECURSE
FileKey2=%WinDir%\assembly\t*mp|*.*|REMOVESELF
FileKey3=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*.*|RECURSE
FileKey4=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*.*|RECURSE
FileKey5=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*.*|RECURSE
FileKey6=%WinDir%\System32\URTTemp|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps

[.NET Framework Isolated Storage *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
FileKey1=%LocalAppData%\IsolatedStorage|*.*|RECURSE

[.NET Reflector *]
LangSecRef=3021
DetectFile=%LocalAppData%\Red Gate\.NET Reflector 6
FileKey1=%LocalAppData%\Red Gate\.NET Reflector 6|Reflector.cfg
FileKey2=%LocalAppData%\Red Gate\.NET Reflector 6\Cache|*.*|RECURSE

[.Thumbnails *]
LangSecRef=3021
DetectFile=%UserProfile%\.Thumbnails
FileKey1=%UserProfile%\.Thumbnails|*.*|RECURSE

[//N.P.P.D. RUSH// - The Milk of Ultra Violet *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\270090
FileKey1=%LocalAppData%\NPPDRUSH|Web Data*|RECURSE
FileKey2=%LocalAppData%\NPPDRUSH\*Cache|*.*|RECURSE

[1Click DVD Copy Pro *]
LangSecRef=3023
DetectFile=%CommonAppData%\1click dvd copy pro
FileKey1=%CommonAppData%\1click dvd copy pro|*.log

[3 Stars of Destiny *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\278530
FileKey1=%AppData%\3Stars|*.tmp

[3D Builder *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.3DBuilder_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.3DBuilder_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.3DBuilder_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.3DBuilder_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.3DBuilder_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.3DBuilder_*\TempState|*.*|RECURSE

[3D Viewer *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed

[3DMark *]
Section=Games
DetectFile=%Documents%\3DMark
FileKey1=%Documents%\3DMark|*.log
FileKey2=%Documents%\3DMark\Log|*.*|REMOVESELF
FileKey3=%ProgramFiles%\Steam\SteamApps\common\3DMark|*.log|RECURSE

[3SwitcheD *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\206610
FileKey1=%LocalAppData%\3SwitcheD\cache|*.*|RECURSE

[4K Video Downloader *]
LangSecRef=3023
Detect=HKCU\Software\4kdownload.com\4K Video Downloader
FileKey1=%LocalAppData%\4kdownload.com\4K Video Downloader\4K Video Downloader|*.bak;*.log;*.sqlite;*.xml
FileKey2=%LocalAppData%\4kdownload.com\4K Video Downloader\crashdb|*.*|RECURSE
FileKey3=%ProgramFiles%\4KDownload\4KVideoDownloader|*.rtf;*.txt
RegKey1=HKCU\Software\4kdownload.com\4K Video Downloader\Download|downloadedItems
RegKey2=HKCU\Software\4kdownload.com\4K Video Downloader\Download|downloadedItemsDb
RegKey3=HKCU\Software\4kdownload.com\4K Video Downloader\FileWatcher
RegKey4=HKCU\Software\4kdownload.com\4K Video Downloader\Gamification
RegKey5=HKCU\Software\4kdownload.com\4K Video Downloader\Settings|outputPath

[4K YouTube to MP3 *]
LangSecRef=3023
Detect=HKCU\Software\4kdownload.com\4K YouTube to MP3
FileKey1=%LocalAppData%\4kdownload.com\4K YouTube to MP3\4K YouTube to MP3|*.xml
RegKey1=HKCU\Software\4kdownload.com\4K YouTube to MP3\Download|downloadedItems
RegKey2=HKCU\Software\4kdownload.com\4K YouTube to MP3\Settings|outputPath

[4shared Desktop *]
LangSecRef=3022
DetectFile=%AppData%\4shared desktop
FileKey1=%AppData%\4shared desktop|*.log
FileKey2=%AppData%\4shared desktop\*|dhistory.xml

[4Team Sync2 *]
LangSecRef=3022
DetectFile=%AppData%\4Team\Sync2
FileKey1=%AppData%\4Team\Sync2|*.log|RECURSE

[4Team Updater *]
LangSecRef=3022
DetectFile=%AppData%\4Team\4Team-Updater
FileKey1=%AppData%\4Team\4Team-Updater\Logs|*.*

[7z SFX Builder *]
LangSecRef=3024
Detect=HKCU\Software\7z SFX Builder
RegKey1=HKCU\Software\7z SFX Builder\MRU

[10 Years After *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\339240
FileKey1=%ProgramFiles%\Steam\SteamApps\common\10 Years After\10 Years After_Data|output_log.txt

[18 Wheels of Steel *]
Section=Games
Detect=HKCU\Software\ValuSoft
FileKey1=%Documents%\18 WoS*|*.log;*.crash

[32bit Web Browser *]
LangSecRef=3022
DetectFile=%ProgramFiles%\32BITWEB\32BW.exe
FileKey1=%ProgramFiles%\32BITWEB\Data|LastURL.dat;LastURL.da0

[140 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\242820
FileKey1=%ProgramFiles%\Steam\SteamApps\common\140\140_Data|output_log.txt

[337 Wallpaper *]
LangSecRef=3021
DetectFile=%AppData%\337\337 Wallpaper\plusapp.exe
FileKey1=%AppData%\337 Wallpaper\apps\thumb|*.jpg
FileKey2=%AppData%\337 Wallpaper\apps\webcache|*.*|RECURSE
FileKey3=%AppData%\337 Wallpaper\wallpaper|*.jpg

[360 Internet Security *]
LangSecRef=3024
Detect=HKCU\Software\360Safe
FileKey1=%AppData%\360safe\360ScanLog|*.*
FileKey2=%ProgramFiles%\360\360 Internet Security|*.log*|RECURSE
FileKey3=%SystemDrive%\360SANDBOX|*.log*|RECURSE

[1000 Amps *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\205690
FileKey1=%ProgramFiles%\Steam\SteamApps\common\1000 Amps|stdout.txt

[1954 Alcatraz *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\255280
FileKey1=%LocalLowAppData%\Daedalic Entertainment\1954 Alcatraz|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\common\1954 Alcatraz\Alcatraz_Data|output_log.txt

[A-PDF PDF Content Splitter *]
LangSecRef=3021
Detect=HKCU\Software\A-PDF\PDFContentSplitter
RegKey1=HKCU\Software\A-PDF\PDFContentSplitter\Setting|hloadpdfpath
RegKey2=HKCU\Software\A-PDF\PDFContentSplitter\Setting|hSaveallpdfpath
RegKey3=HKCU\Software\A-PDF\PDFContentSplitter\Setting|LastRulename

[A-PDF Watermark *]
LangSecRef=3021
Detect=HKCU\Software\A-PDF\Watermark
RegKey1=HKCU\Software\A-PDF\Watermark\Setting|hdIndir
RegKey2=HKCU\Software\A-PDF\Watermark\Setting|hdoutDir
RegKey3=HKCU\Software\A-PDF\Watermark\Setting|hloadpdfpath
RegKey4=HKCU\Software\A-PDF\Watermark\Setting|hSaveallpdfpath
RegKey5=HKCU\Software\A-PDF\Watermark\Setting|ptlastprinter

[A Hat in Time *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\253230
FileKey1=%ProgramFiles%\Steam\steamapps\common\HatinTime\HatinTimeGame\Logs|*.*

[A58-Easytune6 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\A58-Easytune6
FileKey1=%ProgramFiles%\A58-Easytune6|*.log

[ABBYY FineReader *]
LangSecRef=3021
Detect1=HKCU\Software\ABBYY\FineReader\7.00
Detect2=HKCU\Software\ABBYY\FineReader\8.00
Detect3=HKCU\Software\ABBYY\FineReader\9.00
Detect4=HKCU\Software\ABBYY\FineReader\11.00
Detect5=HKCU\Software\ABBYY\FineReader\12.00
Detect6=HKCU\Software\ABBYY\FineReader\14.00
Detect7=HKCU\Software\ABBYY\FineReader\15
Detect8=HKCU\Software\ABBYY\FineReaderSprint\9.00
Detect9=HKCU\Software\ABBYY\Sprint\5.00
FileKey1=%CommonAppData%\ABBYY\FineReader*\*\Licenses|*.log
FileKey2=%CommonAppData%\ABBYY\FineReader\*\Dumps|*.log
FileKey3=%CommonAppData%\ABBYY\FineReader\*\HotFolder\Dumps|*.log
FileKey4=%CommonAppData%\ABBYY\FineReader\*\PdfToolsCache|FontsCache*.dat
FileKey5=%LocalAppData%\ABBYY\FineReader\*|datafile.bin;SendToWorkFiles.txt
FileKey6=%LocalAppData%\ABBYY\FineReader\*\Bonus.ScreenshotReader\Dumps|*.dmp;*.txt
FileKey7=%LocalAppData%\ABBYY\FineReader\*\Dumps|*.dmp;*.txt
FileKey8=%LocalAppData%\ABBYY\FineReader\*\FineReaderShell|SendToWorkFiles.txt
FileKey9=%LocalAppData%\ABBYY\FineReader\*\FineReaderShell\Dumps|*.dmp;*.txt
FileKey10=%LocalAppData%\ABBYY\ScanManager\*|scantwain.txt;scanwia.txt;*.bmp
FileKey11=%ProgramFiles%\ABBYY FineReader*|*.cnt;*.log
FileKey12=%ProgramFiles%\ABBYY FineReader*\Resource\Cmap|*.lst
FileKey13=%ProgramFiles%\ABBYY FineReader*\Resource\Font|*.lst
FileKey14=%SystemDrive%\temp\FR15|*.*|REMOVESELF
RegKey1=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|LoadImagePath
RegKey2=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|OpenBatchPath
RegKey3=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|SaveImagePath
RegKey4=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|SaveToPath
RegKey5=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey6=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastBatchPath
RegKey7=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastFormatsPage
RegKey8=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastOptionsPage
RegKey9=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|ExportTAPath
RegKey10=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|ImportTAPath
RegKey11=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|LoadImagePath
RegKey12=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|SaveImagePath
RegKey13=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|SaveToPath
RegKey14=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|StandardBatchOptionsPath
RegKey15=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastBatchPath
RegKey16=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastTAScenario
RegKey17=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|ExportTAPath
RegKey18=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|ImportTAPath
RegKey19=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|LoadImagePath
RegKey20=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|SaveImagePath
RegKey21=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|SaveToPath
RegKey22=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastBatchPath
RegKey23=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastTAScenario
RegKey24=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|SaveToPath
RegKey25=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastTAScenario
RegKey26=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastWebFoldersNames
RegKey27=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|BatchDialogsMRU
RegKey28=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|LoadImagePath
RegKey29=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|SaveImagePath
RegKey30=HKCU\Software\ABBYY\FineReader\12.00\Shell\MainFrame\RecentFileList
RegKey31=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader|LaunchCount
RegKey32=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LanguagesMRU
RegKey33=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LastSaveImagePath
RegKey34=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|SaveTablePath
RegKey35=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|SaveTextPath
RegKey36=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell|LaunchCount
RegKey37=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|ExportTAPath
RegKey38=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|ImportTAPath
RegKey39=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath
RegKey40=HKCU\Software\ABBYY\FineReader\14.00\FineUI\Dialogs\FROpenFileDialog|LastFolder
RegKey41=HKCU\Software\ABBYY\FineReader\14.00\FineUpdate|LaunchCount
RegKey42=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer|LaunchCount
RegKey43=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Frame|ImportDataFolder
RegKey44=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Statistics|LastUsedBuyMessages
RegKey45=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentBatchList
RegKey46=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentCompareList
RegKey47=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentPdfList
RegKey48=HKCU\Software\ABBYY\FineReader\14.00\StatisticSender|LaunchCount
RegKey49=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader|LaunchCount
RegKey50=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LanguagesMRU
RegKey51=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastRecognitionLanguage
RegKey52=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastSaveImagePath
RegKey53=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|SaveTablePath
RegKey54=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|SaveTextPath
RegKey55=HKCU\Software\ABBYY\FineReader\15\Comparator\RateUs|RunCount
RegKey56=HKCU\Software\ABBYY\FineReader\15\Comparator\Shell\Options|MRURecognitionLanguages
RegKey57=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|ExportTAPath
RegKey58=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|ImportTAPath
RegKey59=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath
RegKey60=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|WebFolderPath
RegKey61=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Options|LastTAScenario
RegKey62=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Options|LastWebFoldersNames
RegKey63=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Tips|LastGetSocialTips
RegKey64=HKCU\Software\ABBYY\FineReader\15\FineUI\Dialogs\FROpenFileDialog|LastFolder
RegKey65=HKCU\Software\ABBYY\FineReader\15\PDFTransformer|LaunchCount
RegKey66=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\PDFEngine\EraseExtraData|LastDeleteNeedlessExtraData
RegKey67=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Frame|ImportDataFolder
RegKey68=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Frame|Last signature
RegKey69=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Signature|SignatureCertificateLocation
RegKey70=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Signature|SignatureImagePath
RegKey71=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Statistics|LastUsedBuyMessages
RegKey72=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Tips|LastGetSocialTips
RegKey73=HKCU\Software\ABBYY\FineReader\15\Shell\RecentBatchList
RegKey74=HKCU\Software\ABBYY\FineReader\15\Shell\RecentCompareList
RegKey75=HKCU\Software\ABBYY\FineReader\15\Shell\RecentPdfList
RegKey76=HKCU\Software\ABBYY\Sprint\5.00\Options|ExportToFilePath
RegKey77=HKCU\Software\ABBYY\Sprint\5.00\Options|OpenImagePath
RegKey78=HKCU\Software\ABBYY\Sprint\5.00\Options|SaveImagePath

[ABBYY Lingvo *]
Detect=HKCU\Software\ABBYY\Lingvo\15.0
DetectFile=%ProgramFiles%\ABBYY Lingvo x5\Lingvo.exe
FileKey1=%CommonAppData%\ABBYY\Lingvo\*\Licenses|*.log
FileKey2=%ProgramFiles%\ABBYY Lingvo x5|*.log;*.rtf
RegKey1=HKCU\Software\ABBYY\Lingvo\15.0\Dictionaries\FavoriteDirections
RegKey2=HKCU\Software\ABBYY\Lingvo\15.0\View|LastText
RegKey3=HKCU\Software\ABBYY\Lingvo\15.0\X3M|LastActivity

[ABBYY PDFTransformer *]
LangSecRef=3021
Detect1=HKCU\Software\ABBYY\PDFTransformer\3.00
Detect2=HKCU\Software\ABBYY\PDFTransformer\12.00
FileKey1=%CommonAppData%\ABBYY\PDFTransformer\*\Licenses|*.log
FileKey2=%LocalAppData%\ABBYY\PDFTransformer\*|*.log
FileKey3=%LocalAppData%\ABBYY\PDFTransformer\*\FontCache|*.*
FileKey4=%ProgramFiles%\ABBYY PDF Transformer *.0|*.log
FileKey5=%SystemDrive%\Temp\PDFT30|*.*|REMOVESELF
RegKey1=HKCU\Software\ABBYY\PDFTransformer\3.00\Transform|MRURecognitionLanguages
RegKey2=HKCU\Software\ABBYY\PDFTransformer\3.00\Transform|TransformOpenPath
RegKey3=HKCU\Software\ABBYY\PDFTransformer\12.00\Shell\Statistics

[ABBYY ScreenshotReader *]
LangSecRef=3021
Detect1=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00
Detect2=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00
Detect3=HKCU\Software\ABBYY\ScreenshotReader\9.00
DetectFile=%ProgramFiles%\ABBYY Screenshot Reader\ScreenshotReader.exe
FileKey1=%CommonAppData%\ABBYY\*.ScreenshotReader\*|*.xml
FileKey2=%CommonAppData%\ABBYY\*.ScreenshotReader\*\Licenses|*.log
FileKey3=%ProgramFiles%\ABBYY Screenshot Reader|*.log;*.rtf
RegKey1=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|LastSaveImagePath
RegKey2=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|SaveTablePath
RegKey3=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|SaveTextPath
RegKey4=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Advertising
RegKey5=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|LastSaveImagePath
RegKey6=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|SaveTablePath
RegKey7=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|SaveTextPath
RegKey8=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|LastSaveImagePath
RegKey9=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|SaveTablePath
RegKey10=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|SaveTextPath

[Abelssoft GoogleClean *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4281435C-AD1D-4C8A-B9C0-3961C08EF142}_is1
FileKey1=%LocalAppData%\Abelssoft\GoogleClean\log|*.*|REMOVESELF

[abgx360 *]
LangSecRef=3024
Detect=HKCU\Software\abgx360gui
RegKey1=HKCU\Software\abgx360gui\RecentFiles

[Ability Office *]
LangSecRef=3021
Detect=HKCU\Software\Ability 6.0
FileKey1=%Documents%\My Ability Files|*.*|RECURSE
RegKey1=HKCU\Software\Ability 6.0\Ability Database\Recent File List
RegKey2=HKCU\Software\Ability 6.0\Ability PhotoPaint Studio\Recent File List
RegKey3=HKCU\Software\Ability 6.0\Ability PhotoPaint\Recent File List
RegKey4=HKCU\Software\Ability 6.0\Ability Spreadsheet\Recent File List
RegKey5=HKCU\Software\Ability 6.0\Ability Write\Files

[Ableton Live *]
LangSecRef=3023
Detect=HKLM\Software\Propellerhead Software\ReWire\Ableton Live Engine
FileKey1=%AppData%\Ableton\*\Preferences|AsioLog.txt;Indexer.txt;Log.txt|RECURSE
FileKey2=%AppData%\Ableton\Live Reports|Ableton Crash Report*.zip
FileKey3=%AppData%\Ableton\Live Reports\Temp|*.*|REMOVESELF
FileKey4=%AppData%\Ableton\Live Reports\Usage|*.*|REMOVESELF
FileKey5=%CommonAppData%\Ableton\*\Redist|vc*redist*.exe
FileKey6=%ProgramFiles%\Ableton\*\Redist|vc*redist*.exe

[Ableton Live Cache *]
LangSecRef=3023
Detect=HKLM\Software\Propellerhead Software\ReWire\Ableton Live Engine
FileKey1=%AppData%\Ableton\Cache|*.*|RECURSE

[AbsoluteFTP *]
LangSecRef=3022
Detect=HKCU\Software\Van Dyke Technologies\AbsoluteFTP
RegKey1=HKCU\Software\Van Dyke Technologies\AbsoluteFTP\Recent File List

[AccessData Registry Viewer *]
LangSecRef=3024
Detect=HKCU\Software\AccessData\Registry Viewer
RegKey1=HKCU\Software\AccessData\Registry Viewer\Recent File List

[Accounts Control *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AccountsControl_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.AccountsControl_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.AccountsControl_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.AccountsControl_*\TempState|*.*|RECURSE

[AccurateRip *]
LangSecRef=3023
Detect1=HKCU\Software\AWSoftware\EAC
Detect2=HKCU\Software\AWSoftware\EACU
Detect3=HKCU\Software\Illustrate\dBpowerAMP
FileKey1=%AppData%\AccurateRip\AccurateRipCache|dBAR*.bin

[AccuWeather - Weather for Life *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
FileKey1=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INet*\*|*.*|REMOVESELF
FileKey2=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\TempState|*.*|RECURSE

[ACDSee Photo Studio *]
LangSecRef=3023
Detect1=HKCU\Software\ACD Systems\ACDSee Pro\90
Detect2=HKCU\Software\ACD Systems\ACDSee Professional
Detect3=HKCU\Software\ACD Systems\ACDSee Standard
Detect4=HKCU\Software\ACD Systems\ACDSee Ultimate
Detect5=HKCU\Software\ACD Systems\ACDSee\60
FileKey1=%LocalAppData%\ACD Systems\GeoTag\Cache|*.*|RECURSE
FileKey2=%LocalAppData%\ACD Systems\ICMCache|*.*|RECURSE
FileKey3=%LocalAppData%\ACD Systems\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\ACD Systems\SavedSearches|*.*|RECURSE
RegKey1=HKCU\Software\ACD Systems\ACDSee Pro\90|HistMCFDestFolder
RegKey2=HKCU\Software\ACD Systems\ACDSee Pro\90|HistPaths
RegKey3=HKCU\Software\ACD Systems\ACDSee Pro\90|LastOptionPageName
RegKey4=HKCU\Software\ACD Systems\ACDSee Pro\90|OpenFolder
RegKey5=HKCU\Software\ACD Systems\ACDSee Pro\90\PrintOptions\OutputContactSheet|ContactSheetFN
RegKey6=HKCU\Software\ACD Systems\ACDSee Pro\90\PrintOptions\OutputContactSheet|ImageMapFN
RegKey7=HKCU\Software\ACD Systems\ACDSee Professional\110|HistMCFDestFolder
RegKey8=HKCU\Software\ACD Systems\ACDSee Professional\110|HistPaths
RegKey9=HKCU\Software\ACD Systems\ACDSee Professional\110|LastOptionPageName
RegKey10=HKCU\Software\ACD Systems\ACDSee Professional\110|OnlineHistPaths
RegKey11=HKCU\Software\ACD Systems\ACDSee Professional\110|OpenFolder
RegKey12=HKCU\Software\ACD Systems\ACDSee Professional\120|HistMCFDestFolder
RegKey13=HKCU\Software\ACD Systems\ACDSee Professional\120|HistPaths
RegKey14=HKCU\Software\ACD Systems\ACDSee Professional\120|LastOptionPageName
RegKey15=HKCU\Software\ACD Systems\ACDSee Professional\120|OnlineHistPaths
RegKey16=HKCU\Software\ACD Systems\ACDSee Professional\120|OpenFolder
RegKey17=HKCU\Software\ACD Systems\ACDSee Standard\210|HistMCFDestFolder
RegKey18=HKCU\Software\ACD Systems\ACDSee Standard\210|HistPaths
RegKey19=HKCU\Software\ACD Systems\ACDSee Standard\210|LastOptionPageName
RegKey20=HKCU\Software\ACD Systems\ACDSee Standard\210|OnlineHistPaths
RegKey21=HKCU\Software\ACD Systems\ACDSee Standard\210|OpenFolder
RegKey22=HKCU\Software\ACD Systems\ACDSee Standard\220|HistMCFDestFolder
RegKey23=HKCU\Software\ACD Systems\ACDSee Standard\220|HistPaths
RegKey24=HKCU\Software\ACD Systems\ACDSee Standard\220|LastOptionPageName
RegKey25=HKCU\Software\ACD Systems\ACDSee Standard\220|OnlineHistPaths
RegKey26=HKCU\Software\ACD Systems\ACDSee Standard\220|OpenFolder
RegKey27=HKCU\Software\ACD Systems\ACDSee Ultimate\110|HistMCFDestFolder
RegKey28=HKCU\Software\ACD Systems\ACDSee Ultimate\110|HistPaths
RegKey29=HKCU\Software\ACD Systems\ACDSee Ultimate\110|LastOptionPageName
RegKey30=HKCU\Software\ACD Systems\ACDSee Ultimate\110|OnlineHistPaths
RegKey31=HKCU\Software\ACD Systems\ACDSee Ultimate\110|OpenFolder
RegKey32=HKCU\Software\ACD Systems\ACDSee Ultimate\120|HistMCFDestFolder
RegKey33=HKCU\Software\ACD Systems\ACDSee Ultimate\120|HistPaths
RegKey34=HKCU\Software\ACD Systems\ACDSee Ultimate\120|LastOptionPageName
RegKey35=HKCU\Software\ACD Systems\ACDSee Ultimate\120|OnlineHistPaths
RegKey36=HKCU\Software\ACD Systems\ACDSee Ultimate\120|OpenFolder
RegKey37=HKCU\Software\ACD Systems\ACDSee\60|HistMCFDestFolder
RegKey38=HKCU\Software\ACD Systems\ACDSee\60|HistPaths
RegKey39=HKCU\Software\ACD Systems\ACDSee\60|LastOptionPageName
RegKey40=HKCU\Software\ACD Systems\ACDSee\60|OpenFolder
RegKey41=HKCU\Software\ACD Systems\ACDSee\60\PrintOptions\OutputContactSheet|ContactSheetFN
RegKey42=HKCU\Software\ACD Systems\ACDSee\60\PrintOptions\OutputContactSheet|ImageMapFN
RegKey43=HKCU\Software\ACD Systems\EditLib\Presets\Photo Repair 2|Last Used

[Ace Explorer Browser *]
LangSecRef=3022
Detect=HKCU\Software\Ace Explorer\Ace Explorer
FileKey1=%AppData%\Ace Explorer|recentclose.ini
RegKey1=HKCU\Software\Ace Explorer\Ace Explorer\Recent File List

[Ace of Spades *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\aceofspades
FileKey1=%ProgramFiles%\Steam\steamapps\common\aceofspades\logs|*.*

[Ace Stream *]
LangSecRef=3023
DetectFile=%AppData%\ACEStream
FileKey1=%AppData%\.ACEStream|*.ini
FileKey2=%AppData%\.ACEStream\collected_torrent_files|*.*
FileKey3=%AppData%\ACEStream\engine|*.log
FileKey4=%SystemDrive%\_acestream_cache_|*.*|REMOVESELF

[Ace Utilities *]
LangSecRef=3024
Detect=HKCU\Software\Acelogix\Ace Utilities
FileKey1=%LocalAppData%\Acelogix\Ace Utilities\Backups|*.reg
RegKey1=HKCU\Software\Acelogix\Ace Utilities\Settings|UsageHistory

[Acebyte Utilities *]
LangSecRef=3024
Detect=HKCU\Software\AceBIT
FileKey1=%CommonAppData%\Acebyte\Acebyte Utilities*\Log|*.*|RECURSE

[Acer Arcade Deluxe *]
Section=Games
DetectFile=%LocalAppData%\Acer Arcade Deluxe
FileKey1=%CommonAppData%|ArcadeDexluxe2.log
FileKey2=%LocalAppData%\Acer Arcade Deluxe|*.log

[Acer Care Center *]
LangSecRef=3024
Detect1=HKLM\Software\OEM\AcerCareCenter
Detect2=HKLM\Software\OEM\CareCenter
FileKey1=%CommonAppData%\Acer\CareCenter\DebugLog\SurfaceCheck|log*.txt
FileKey2=%ProgramFiles%\Acer\Care Center\DebugLog|*.log

[Acer eSupport *]
LangSecRef=3024
DetectFile=%SystemDrive%\eSupport\eDriver
FileKey1=%SystemDrive%\eSupport\eDriver\Software|*.log;URLLog.dat|RECURSE

[Acer GameZone *]
Section=Games
DetectFile=%ProgramFiles%\Acer GameZone
FileKey1=%ProgramFiles%\Acer GameZone|*.log|RECURSE

[AcooBrowser *]
LangSecRef=3022
Detect=HKCU\Software\AcooBrowser\Acoo Browser
RegKey1=HKCU\Software\AcooBrowser\Acoo Browser\Recent Document List
RegKey2=HKCU\Software\AcooBrowser\Acoo Browser\Search\History

[Acoustica CD Label Maker *]
LangSecRef=3024
Detect=HKCU\Software\Acoustica\CD Label Maker
FileKey1=%AppData%\Acoustica\CD Label Maker\*\cache|*.*|RECURSE
FileKey2=%AppData%\Acoustica\CD Label Maker\cache|*.*|RECURSE
FileKey3=%AppData%\Acoustica\CD Label Maker\shapes|*.*
FileKey4=%ProgramFiles%\Acoustica CD Label Maker\thumbs|*.*|RECURSE

[Acoustica Premium Edition 6 *]
LangSecRef=3023
Detect=HKCU\Software\Acon Digital\Acoustica Premium Edition 6
RegKey1=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\General|BrowserFolder
RegKey2=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\General|LastAudioDir
RegKey3=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\Recent File List

[Acrok Video Converter Ultimate *]
LangSecRef=3023
Detect=HKCU\Software\Acrok Software\Acrok Video Converter Ultimate
FileKey1=%AppData%\Acrok Software\Blu-ray Plugin\Log|*.log
FileKey2=%AppData%\Acrok\Acrok Video Converter Ultimate|*.dmp
FileKey3=%AppData%\Acrok\Acrok Video Converter Ultimate\log|*.*
FileKey4=%AppData%\Auxre\Blu-ray Plugin|*.log
FileKey5=%UserProfile%\.BDAccess|*.*|RECURSE

[Active Setup Temp Folder *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders
FileKey1=%WinDir%\msdownld.tmp|*.*|REMOVESELF
RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders|Folder
RegKey2=HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders|Folder

[Active@ Disk Image *]
LangSecRef=3024
Detect=HKLM\Software\LSoft Technologies\Active Disk Image
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ Disk Image|*.txt
FileKey2=%ProgramFiles%\LSoft Technologies\Active@ Disk Image\Logs|*.*|RECURSE

[Active@ File Recovery *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C34F36E0-4D8B-42E8-90AD-50C76E1AE282}_is1
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ File Recovery*|Active File Recovery Log.txt;he_log.txt;*.scn;*.xml

[Active@ KillDisk *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0F62EFB8-3C1C-4EE6-B6EF-9593007F9B03}_is1
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|*.log;*.xml

[ActiveSync *]
LangSecRef=3031
DetectFile=%LocalAppData%\Packages\ActiveSync
FileKey1=%LocalAppData%\Packages\ActiveSync\LocalState\DiagOutputDir|*.*

[Activity History *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=You need to run this in Windows Safe Mode. Or stop services "Connected Devices Platform Service" and "Connected Devices Platform User Service_xxxxx" prior to cleaning and restart after cleaning.
FileKey1=%LocalAppData%\ConnectedDevicesPlatform\*|*.db*

[Ad-Aware Antivirus *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Ad-Aware Antivirus\AdAware.exe
FileKey1=%AppData%\Ad-Aware Antivirus\Logs|*.*|RECURSE
FileKey2=%CommonAppData%\Ad-Aware Antivirus\Logs|*.*|RECURSE
FileKey3=%CommonAppData%\Lavasoft\AntiMalware\Events|*.*|RECURSE
FileKey4=%CommonAppData%\Lavasoft\AntiMalware\History|*.*|RECURSE
FileKey5=%CommonAppData%\Lavasoft\AntiMalware\Logs|*.*|RECURSE

[Adaptec's Audio CD *]
LangSecRef=3024
Detect=HKCU\Software\Adaptec
RegKey1=HKCU\Software\Adaptec\AUDIO_CD_INFO

[Adblock Plus for IE *]
LangSecRef=3022
Detect=HKLM\Software\Adblock Plus for IE
DetectFile=%LocalAppData%\Adblock Plus for IE
FileKey1=%LocalAppData%\Adblock Plus for IE|patterns-backup*.ini
FileKey2=%LocalLowAppData%\Adblock Plus for IE|patterns-backup*.ini
FileKey3=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\Application Data\Adblock Plus for IE|patterns-backup*.ini
FileKey4=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Adblock Plus for IE|patterns-backup*.ini

[AdFender *]
LangSecRef=3022
DetectFile=%LocalAppData%\AdFender
FileKey1=%LocalAppData%\AdFender\Log|*.log

[Adobe Acrobat 20XX *]
LangSecRef=3021
Detect1=HKCU\Software\Adobe\Adobe Acrobat\2015
Detect2=HKCU\Software\Adobe\Adobe Acrobat\2017
Detect3=HKCU\Software\Adobe\Adobe Acrobat\2020
RegKey1=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFiles
RegKey2=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFolders
RegKey3=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFiles
RegKey4=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFolders
RegKey5=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFiles
RegKey6=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFolders

[Adobe Acrobat DC *]
LangSecRef=3021
Detect=HKLM\Software\Adobe\Adobe Acrobat\DC
FileKey1=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*.*|RECURSE
FileKey2=%LocalAppData%\Adobe\Acrobat\DC|*.lst;UserCache.bin
FileKey3=%LocalAppData%\Adobe\Acrobat\DC\Cache|*.lst
FileKey4=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*.*|RECURSE
FileKey5=%LocalLowAppData%\Adobe\Acrobat\DC\ConnectorIcons|*.*|RECURSE
FileKey6=%LocalLowAppData%\Adobe\Acrobat\DC\Search|*.*|RECURSE
FileKey7=%LocalLowAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*.*|RECURSE
RegKey1=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConnector\cIconCache
RegKey2=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings
RegKey3=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings
RegKey4=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables
RegKey5=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles
RegKey6=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders
RegKey7=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList
RegKey8=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars
RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles
RegKey10=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity
RegKey11=HKCU\Software\Adobe\Adobe Synchronizer\DC

[Adobe Acrobat Distiller DC *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Acrobat Distiller\DC
FileKey1=%LocalAppData%\Adobe\Acrobat\Distiller DC|*.log
FileKey2=%LocalAppData%\Adobe\Acrobat\Distiller DC\Cache|*.*
RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl

[Adobe Acrobat Distiller XI *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Acrobat Distiller\11.0
FileKey1=%AppData%\Adobe\Acrobat\Distiller 11|*.log
FileKey2=%AppData%\Adobe\Acrobat\Distiller 11\Cache|*.*
RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl

[Adobe Acrobat XI *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Adobe Acrobat\11.0
FileKey1=%LocalAppData%\Adobe\Acrobat|*.idx|RECURSE
FileKey2=%LocalAppData%\Adobe\Acrobat\11.0|UserCache.bin

[Adobe Air *]
LangSecRef=3024
DetectFile=%LocalAppData%\Adobe\Air
FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\Adobe\AIR\logs|*.*
FileKey2=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Adobe\AIR\logs|*.*

[Adobe Application Manager *]
LangSecRef=3021
Detect1=HKCU\Software\Adobe
Detect2=HKLM\Software\Adobe
FileKey1=%AppData%\Adobe\Acrobat\*\Updater|*.log
FileKey2=%CommonAppData%\Adobe\ARM|*.*|RECURSE
FileKey3=%CommonProgramFiles%\Adobe\Installers|*.log.gz|RECURSE
FileKey4=%LocalAppData%\Adobe\AAMUpdater|*.Log|RECURSE
FileKey5=%LocalAppData%\Adobe\Acrobat\*\Updater|*.log
FileKey6=%LocalAppData%\Adobe\ARM|*.*|RECURSE
FileKey7=%LocalAppData%\Adobe\Updater*|*.log|RECURSE

[Adobe CC *]
LangSecRef=3023
Detect1=HKCU\Software\Adobe\CreativeCloud
Detect2=HKCU\Software\Adobe\Photoshop
FileKey1=%AppData%\Adobe\Adobe Media Encoder\*\logs|*.*|RECURSE
FileKey2=%AppData%\Adobe\Adobe Photoshop CC *\Adobe Photoshop CC * Settings|PSErrorLog.txt;sniffer-*.txt
FileKey3=%AppData%\Adobe\Adobe Photoshop CC *\Adobe Photoshop CC * Settings\CrashLogs|*.*|RECURSE
FileKey4=%AppData%\Adobe\Adobe Photoshop CC *\Adobe Photoshop CC * Settings\web-cache-temp|*.*|RECURSE
FileKey5=%AppData%\Adobe\Adobe Photoshop CC *\Logs|*.*|RECURSE
FileKey6=%AppData%\Adobe\CRLogs|*.*|RECURSE
FileKey7=%AppData%\Adobe\dynamiclinkmanager\*\logs|*.*|RECURSE
FileKey8=%AppData%\Adobe\Extension Manager CC\Log|*.*|RECURSE
FileKey9=%AppData%\Adobe\Extension Manager CC\Temp|*.*|RECURSE
FileKey10=%AppData%\Adobe\LogTransport2CC\Logs|*.*|RECURSE
FileKey11=%AppData%\Adobe\Lumetri\*\logs|*.*|RECURSE
FileKey12=%AppData%\Adobe\Premiere Pro\*|Plugin Loading.log
FileKey13=%AppData%\Adobe\Premiere Pro\*\logs|*.*|RECURSE
FileKey14=%CommonProgramFiles%\Adobe\Installers|CoreSyncInstall.log;Install.log
FileKey15=%Documents%\Adobe|*.log
FileKey16=%Documents%\Adobe\Adobe Media Encoder\*|AMEEncodingErrorLog.txt;AMEEncodingLog.txt
FileKey17=%Documents%\Adobe\Adobe Media Encoder\*\logs|*.*|RECURSE
FileKey18=%Documents%\Adobe\Premiere Pro\*|Plugin Loading.log
RegKey1=HKCU\Software\Adobe\MediaBrowser\MRU

[Adobe Creative Cloud Experience *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Adobe\Adobe Creative Cloud Experience
FileKey1=%CommonProgramFiles%\Adobe\Creative Cloud Libraries|*.log|RECURSE
FileKey2=%ProgramFiles%\Adobe\Adobe Creative Cloud Experience\js\node_modules\table-parser\test\output|*.log

[Adobe Customization Wizard *]
LangSecRef=3021
Detect1=HKCU\Software\Adobe\Adobe Customization Wizard 8
Detect2=HKCU\Software\Adobe\Adobe Customization Wizard 9
Detect3=HKCU\Software\Adobe\Adobe Customization Wizard X
Detect4=HKCU\Software\Adobe\Adobe Customization Wizard XI
RegKey1=HKCU\Software\Adobe\Adobe Customization Wizard 8\Recent File List
RegKey2=HKCU\Software\Adobe\Adobe Customization Wizard 9\Recent File List
RegKey3=HKCU\Software\Adobe\Adobe Customization Wizard X\Recent File List
RegKey4=HKCU\Software\Adobe\Adobe Customization Wizard XI\Recent File List

[Adobe Elements Organizer *]
LangSecRef=3023
Detect=HKCU\Software\Adobe\Elements Organizer
FileKey1=%AppData%\Adobe\amecommand\6.0|Plugin Loading.log
FileKey2=%AppData%\Adobe\CRLogs|*.*|RECURSE
FileKey3=%AppData%\Adobe\Elements Organizer\*|CAHeadlessPlugin Loading.log
FileKey4=%AppData%\Adobe\Elements Organizer\*\Organizer|*.txt;status.dat
FileKey5=%AppData%\Adobe\Elements Smart Tag Agent\*\Logs|*.log
FileKey6=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey7=%CommonAppData%|StreamingMediaTechnologyLog.txt
FileKey8=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog|face.thumb.9.cache;thumb.5.cache
FileKey9=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\FaceAnalysis|FaceAnalysis.cache
FileKey10=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\WaldoData|waldo.cache
FileKey11=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\Watch Folder|*.txt;*.xml
RegKey1=HKCU\Software\Adobe\Elements Organizer\11.0\CurrentMediaFilePath
RegKey2=HKCU\Software\Adobe\Elements Organizer\13.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Elements Organizer\14.0\CurrentMediaFilePath
RegKey4=HKCU\Software\Adobe\Elements Organizer\15.0\CurrentMediaFilePath
RegKey5=HKCU\Software\Adobe\Elements Organizer\16.0\CurrentMediaFilePath
RegKey6=HKCU\Software\Adobe\Elements Organizer\17.0\CurrentMediaFilePath

[Adobe Flash Player *]
LangSecRef=3023
Detect=HKCU\Software\Macromedia\FlashPlayer
DetectFile=%AppData%\Adobe\Flash Player
FileKey1=%AppData%\Adobe\Flash Player\*Cache|*.*|RECURSE
FileKey2=%WinDir%\System32\Macromed\Flash|FlashInstall*.log;install.log
FileKey3=%WinDir%\SysWOW64\Macromed\Flash|FlashInstall*.log;install.log

[Adobe Media Cache *]
LangSecRef=3023
DetectFile=%AppData%\Adobe\Common\Media Cache
Warning=Do not use this until all your Premiere projects have been completed.
FileKey1=%AppData%\Adobe\Common\* Cache*|*.*|RECURSE
FileKey2=%AppData%\Adobe\Common\Peak Files|*.*|RECURSE

[Adobe Photoshop Elements *]
LangSecRef=3023
Detect=HKCU\Software\Adobe\Photoshop Elements
FileKey1=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey2=%AppData%\Adobe\Photoshop Elements\*\Editor|*.txt
FileKey3=%CommonAppData%\Adobe\Photoshop Elements\File Agent|WatchFolder.3.cache
RegKey1=HKCU\Software\Adobe\Photoshop Elements\11.0\common\settings\Elements MRU
RegKey2=HKCU\Software\Adobe\Photoshop Elements\11.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Photoshop Elements\11.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey4=HKCU\Software\Adobe\Photoshop Elements\13.0\common\settings\Elements MRU
RegKey5=HKCU\Software\Adobe\Photoshop Elements\13.0\CurrentMediaFilePath
RegKey6=HKCU\Software\Adobe\Photoshop Elements\13.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey7=HKCU\Software\Adobe\Photoshop Elements\14.0\common\settings\Elements MRU
RegKey8=HKCU\Software\Adobe\Photoshop Elements\14.0\CurrentMediaFilePath
RegKey9=HKCU\Software\Adobe\Photoshop Elements\14.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey10=HKCU\Software\Adobe\Photoshop Elements\15.0\common\settings\Elements MRU
RegKey11=HKCU\Software\Adobe\Photoshop Elements\15.0\CurrentMediaFilePath
RegKey12=HKCU\Software\Adobe\Photoshop Elements\15.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey13=HKCU\Software\Adobe\Photoshop Elements\16.0\common\settings\Elements MRU
RegKey14=HKCU\Software\Adobe\Photoshop Elements\16.0\CurrentMediaFilePath
RegKey15=HKCU\Software\Adobe\Photoshop Elements\16.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey16=HKCU\Software\Adobe\Photoshop Elements\17.0\common\settings\Elements MRU
RegKey17=HKCU\Software\Adobe\Photoshop Elements\17.0\CurrentMediaFilePath
RegKey18=HKCU\Software\Adobe\Photoshop Elements\17.0\VisitedDirs|STARTUPIMAGEDIRECTORY

[Adobe Premiere Elements *]
LangSecRef=3023
Detect=HKCU\Software\Adobe\Premiere Elements
FileKey1=%AppData%\Adobe\Common\Thumbnail Cache|thumbnailDB
FileKey2=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey3=%AppData%\Adobe\Premiere Elements\*|Plugin Loading.log
FileKey4=%AppData%\Adobe\Premiere Elements\*\logs|*.*|RECURSE
FileKey5=%Documents%\Adobe\Premiere Elements\*|*.log
FileKey6=%Documents%\NewBlueFX\Logs|*.txt
RegKey1=HKCU\Software\Adobe\Premiere Elements\11.0\MRUDocuments
RegKey2=HKCU\Software\Adobe\Premiere Elements\13.0\MRUDocuments
RegKey3=HKCU\Software\Adobe\Premiere Elements\14.0\MRUDocuments
RegKey4=HKCU\Software\Adobe\Premiere Elements\15.0\MRUDocuments
RegKey5=HKCU\Software\Adobe\Premiere Elements\16.0\MRUDocuments
RegKey6=HKCU\Software\Adobe\Premiere Elements\17.0\MRUDocuments

[Adobe Reader 20XX *]
LangSecRef=3021
Detect1=HKCU\Software\Adobe\Acrobat Reader\2015
Detect2=HKCU\Software\Adobe\Acrobat Reader\2017
Detect3=HKCU\Software\Adobe\Acrobat Reader\2020
RegKey1=HKCU\Software\Adobe\Acrobat Reader\2015\AVGeneral\cRecentFiles
RegKey2=HKCU\Software\Adobe\Acrobat Reader\2015\AVGeneral\cRecentFolders
RegKey3=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFiles
RegKey4=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFolders
RegKey5=HKCU\Software\Adobe\Acrobat Reader\2020\AVGeneral\cRecentFiles
RegKey6=HKCU\Software\Adobe\Acrobat Reader\2020\AVGeneral\cRecentFolders

[Adobe Reader DC *]
LangSecRef=3021
Detect=HKLM\Software\Adobe\Acrobat Reader\DC
FileKey1=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*.*|RECURSE
FileKey2=%LocalAppData%\Adobe\Acrobat\DC|IconCacheRdr*.dat;UserCache.bin
FileKey3=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheRdr|*.*|RECURSE
FileKey4=%LocalLowAppData%\Adobe\Acrobat\DC|ReaderMessages
FileKey5=%LocalLowAppData%\Adobe\Acrobat\DC\ConnectorIcons|*.*|RECURSE
FileKey6=%LocalLowAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*.*|RECURSE
RegKey1=HKCU\Software\Adobe\Acrobat Reader\DC\AVConnector\cIconCache
RegKey2=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionFromPDF
RegKey3=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionToPDF
RegKey4=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral|iNumOfAVDocsOpened
RegKey5=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral|iNumReaderLaunches
RegKey6=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cDockables
RegKey7=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentToolsList
RegKey8=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cToolbars
RegKey9=HKCU\Software\Adobe\Acrobat Reader\DC\RememberedViews\cNoCategoryFiles
RegKey10=HKCU\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent
RegKey11=HKCU\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsPrev
RegKey12=HKCU\Software\Adobe\Acrobat Reader\DC\ShareIdentity
RegKey13=HKCU\Software\Adobe\Adobe Synchronizer\DC

[Adobe Reader Touch *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga
FileKey1=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_*\AC\INet*|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\PersistedStorageItemTable\MostRecentlyUsed

[Adobe Reader XI *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Acrobat Reader\11.0
RegKey1=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionFromPDF
RegKey2=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionToPDF
RegKey3=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cDockables
RegKey4=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFolders
RegKey5=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cToolbars
RegKey6=HKCU\Software\Adobe\Acrobat Reader\11.0\RememberedViews\cNoCategoryFiles
RegKey7=HKCU\Software\Adobe\Adobe Synchronizer\11.0

[Advanced Browser *]
LangSecRef=3022
DetectFile=%AppData%\Advanced Browser
FileKey1=%AppData%\Advanced Browser|keywords.dat;pages.dat;recents.dat

[Advanced Registry Doctor *]
LangSecRef=3021
Detect=HKLM\Software\Elcor Software\Advanced Registry Doctor
DetectFile=%ProgramFiles%\Advanced Registry Doctor\AdvRegDocPro.exe
FileKey1=%ProgramFiles%\Advanced Registry Doctor|*.log;*.tmp
FileKey2=%ProgramFiles%\Advanced Registry Doctor\Undo|history_*.dat

[Advanced Renamer 3 *]
LangSecRef=3024
DetectFile=%AppData%\Hulubulu\Advanced Renamer 3
FileKey1=%AppData%\Hulubulu\Advanced Renamer 3\Data\UndoLists|*.*

[Advanced System Optimizer 3 *]
LangSecRef=3024
Detect=HKLM\Software\Systweak\ASO3
DetectFile=%ProgramFiles%\Advanced System Optimizer 3\ASO3.exe
FileKey1=%AppData%\Systweak\ASO3\Driver Updater|*.log
FileKey2=%AppData%\Systweak\ASO3\Registry Cleaner|*.log

[Advanced System Protector *]
LangSecRef=3024
Detect=HKCU\Software\Systweak\Advanced System Protector
DetectFile=%ProgramFiles%\Advanced System Protector\AdvancedSystemProtector.exe
FileKey1=%AppData%\Systweak\Advanced System Protector|*log.txt;*.log|RECURSE
FileKey2=%AppData%\Systweak\Advanced System Protector\Logs|*.xml

[Advanced Uninstaller *]
LangSecRef=3024
Detect1=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\9
Detect2=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\10
RegKey1=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\9\compress|listHistoryText
RegKey2=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\10\compress|listHistoryText

[Adware-Removal-Tool *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Adware-Removal-Tool\ARTP*.exe
FileKey1=%ProgramFiles%\Adware-Removal-Tool\Quarantine|*.*|RECURSE
FileKey2=%ProgramFiles%\Adware-Removal-Tool\Reports|*.txt
FileKey3=%ProgramFiles%\Adware-Removal-Tool\scanlogs|*.txt

[AdwCleaner *]
LangSecRef=3024
Detect=HKLM\Software\AdwCleaner
DetectFile=%SystemDrive%\AdwCleaner
FileKey1=%SystemDrive%|AdwCleaner*.txt
FileKey2=%SystemDrive%\AdwCleaner|*.txt|RECURSE
FileKey3=%SystemDrive%\AdwCleaner\Logs|*.log
RegKey1=HKLM\Software\AdwCleaner|DeleteCount
RegKey2=HKLM\Software\AdwCleaner|SearchCount
RegKey3=HKLM\Software\Wow6432Node\AdwCleaner|DeleteCount
RegKey4=HKLM\Software\Wow6432Node\AdwCleaner|SearchCount

[Aegisub *]
LangSecRef=3023
Detect=HKLM\Software\Aegisub
FileKey1=%AppData%\Aegisub|mru.json
FileKey2=%AppData%\Aegisub\crashdumps|*.*|REMOVESELF
FileKey3=%AppData%\Aegisub\log|*.*|REMOVESELF
FileKey4=%AppData%\Aegisub\recovered|*.*|REMOVESELF
FileKey5=%LocalAppData%\Aegisub\ffms2cache|*.*|REMOVESELF
FileKey6=%ProgramFiles%\Aegisub|*.txt

[Aegisub Backups *]
LangSecRef=3023
Detect=HKLM\Software\Aegisub
Warning=Aegisub automatically saves a backup copy of each script you open. This will delete them.
FileKey1=%AppData%\Aegisub\autoback|*.*|REMOVESELF
FileKey2=%AppData%\Aegisub\autosave|*.*|REMOVESELF

[Age of Conan *]
Section=Games
Detect=HKLM\Software\Funcom\Age of Conan
FileKey1=%ProgramFiles%\Funcom\Age of Conan|patcher.log;chrome_debug.log;MiniDump.dmp;CrashLog.txt;ConanPatcher.exe.0.tmp;AgeOfConan.log
FileKey2=%ProgramFiles%\Funcom\Age of Conan\OldLogs|*.*

[Age of Empires *]
Section=Games
Detect1=HKLM\Software\Microsoft\Games\Age of Empires
Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires
Detect3=HKLM\Software\Microsoft\microsoft games\age of empires 3
FileKey1=%Documents%\My Games\Age of Empires 3|*.txt
FileKey2=%Documents%\My Games\Age of Empires 3\RM|*.dmp.txt
FileKey3=%Documents%\My Games\Age of Mythology|*.txt
RegKey1=HKLM\Software\Microsoft\Games\Age of Empires\1.00|Zone
RegKey2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires|Zone
RegKey3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Expansion\1.0|Zone
RegKey4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires II: The Conquerors Expansion\1.0|Zone
RegKey5=HKLM\Software\Microsoft\Microsoft Games\Age of Empires\2.0|Zone

[Age of Empires Online *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105430
FileKey1=%ProgramFiles%\Steam\steamapps\common\Age Of Empires Online|PatchLog.txt;PatchLogDetail.txt

[Age of Oracles: Tara's Journey *]
Section=Games
DetectFile=%CommonAppData%\JollyBear\Age of Oracles Taras Journey
FileKey1=%CommonAppData%\JollyBear\Age of Oracles Taras Journey|error.*

[Age of Wonders II *]
Section=Games
DetectFile=%ProgramFiles%\Age of Wonders II
FileKey1=%ProgramFiles%\Age of Wonders II|*aow2Log.txt
FileKey2=%ProgramFiles%\Age of Wonders II\Resource\FX\Spell|*.lnk

[Age of Wonders: Shadow Magic *]
Section=Games
DetectFile=%ProgramFiles%\Age of Wonders II
FileKey1=%ProgramFiles%\Age of Wonders Shadow Magic|*aowsmLog.txt
FileKey2=%ProgramFiles%\Age of Wonders Shadow Magic\Resource\Maps|*.bak

[Agnitum Outpost Firewall Pro *]
LangSecRef=3022
Detect1=HKCU\Software\Agnitum\Outpost Firewall Pro
Detect2=HKLM\Software\Agnitum\Outpost Firewall
FileKey1=%CommonAppData%\Agnitum\Security Suite\Feedback\Logs|*.*
FileKey2=%ProgramFiles%\Agnitum\Outpost Firewall|op_data.mdb
FileKey3=%ProgramFiles%\Agnitum\Outpost Firewall Pro\log|*.*
RegKey1=HKCU\Software\Agnitum\Outpost Firewall Pro\Recent File List

[Agnitum Outpost Security Suite *]
LangSecRef=3021
Detect=HKLM\Software\Agnitum\Security Suite
FileKey1=%ProgramFiles%\Agnitum\Outpost Security Suite Pro\log|*.log

[Agomo *]
LangSecRef=3024
DetectFile=%CommonAppData%\Piriform\Agomo
FileKey1=%CommonAppData%\Piriform\Agomo\Logs|*.*
FileKey2=%ProgramFiles%\Agomo\Logs|*.*
FileKey3=%ProgramFiles%\Agomo\tmp_update|*.*

[AHA Dialer *]
LangSecRef=3022
Detect=HKLM\System\CurrentControlSet\Services\HWDeviceService.exe
DetectFile=%CommonAppData%\DatacardService\DataCardMonitor.exe
FileKey1=%CommonAppData%\DatacardService\log|*.*

[AI Roboform *]
LangSecRef=3022
Detect=HKCU\Software\Siber Systems
FileKey1=%AppData%\RoboForm\_*mirrors_|*.*|RECURSE
FileKey2=%Documents%\My RoboForm Data|mru.rfo;cache.rfo|RECURSE
FileKey3=%Documents%\My RoboForm Data\_gsdata_|*.log;*.gss;*.gsl|RECURSE
RegKey1=HKCU\Software\Siber Systems|_InstallerDir
RegKey2=HKCU\Software\Siber Systems\RoboForm\Query-MRU

[AIDA64 *]
LangSecRef=3021
Detect=HKCU\Software\FinalWire\AIDA64
FileKey1=%Documents%\AIDA64 Reports|*.*|REMOVESELF

[Aignes Website-Watcher *]
LangSecRef=3023
Detect=HKCU\Software\aignes\wswatch
FileKey1=%AppData%\aignes\WebSite-Watcher\config\favicons|*.*
FileKey2=%AppData%\aignes\website-watcher\config\log|*.*
FileKey3=%AppData%\aignes\WebSite-Watcher\config\settings|*.cfg_bak*
FileKey4=%AppData%\aignes\website-watcher\config\temp|*.*

[Aignes Website-Watcher AutoBackups *]
LangSecRef=3023
Detect=HKCU\Software\aignes\wswatch
Warning=This will delete your AutoBackup of your site.
FileKey1=%AppData%\aignes\website-watcher\config\autobackup|*.*

[Aignes Website-Watcher Bookmarks *]
LangSecRef=3023
Detect=HKCU\Software\aignes\wswatch
FileKey1=%AppData%\aignes\website-watcher\bookmarks|*.*

[Aimersoft DRM Media Converter *]
LangSecRef=3023
Detect=HKLM\Software\Aimersoft\351
FileKey1=%ProgramFiles%\Aimersoft\DRM Media Converter\Log|*.*|REMOVESELF

[Aimersoft Helper Compact *]
LangSecRef=3023
Detect=HKLM\Software\Aimersoft\Aimersoft Helper Compact
FileKey1=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact|ProductUpdateLists.xml;ASHelper.exe_temp;ASHelperSetup.exe_temp
FileKey2=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\DATADICT|*.*|RECURSE
FileKey3=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\Log|*.*|RECURSE
FileKey4=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\Temp|*.*|RECURSE

[Aimersoft Video Converter *]
LangSecRef=3023
Detect1=HKLM\Software\Aimersoft\Aimersoft Video Converter
Detect2=HKLM\Software\Aimersoft\Aimersoft Video Converter Ultimate
FileKey1=%CommonAppData%\Aimersoft\ProductFeatures\*Logs|*.*|RECURSE
FileKey2=%CommonAppData%\Aimersoft\RemoteLogs\*Logs|*.*|RECURSE
FileKey3=%Documents%\Aimersoft MediaServer\log|*.*|RECURSE
FileKey4=%ProgramFiles%\Aimersoft\Video Converter*\TempThumbDir|*.*|RECURSE
FileKey5=%Public%\Documents\Aimersoft|*.*|REMOVESELF

[Aimersoft Video Editor *]
LangSecRef=3023
Detect=HKLM\Software\Aimersoft\Aimersoft Video Editor
FileKey1=%CommonAppData%\Aimersoft\ProductFeatures\*Logs|*.*|RECURSE
FileKey2=%CommonAppData%\Aimersoft\RemoteLogs\*Logs|*.*|RECURSE
FileKey3=%ProgramFiles%\Aimersoft\Video Editor\log|*.*|RECURSE
FileKey4=%Public%\Documents\Aimersoft|*.*|REMOVESELF

[AIMP *]
LangSecRef=3023
DetectFile1=%ProgramFiles%\AIMP Classic\cAIMP.exe
DetectFile2=%ProgramFiles%\AIMP\AIMP.exe
DetectFile3=%ProgramFiles%\AIMP2\AIMP2.exe
FileKey1=%AppData%\AIMP|*.bak
FileKey2=%ProgramFiles%\AIMP*\!Backup|*.*|REMOVESELF
FileKey3=%ProgramFiles%\AIMP*\Data|*.bak|RECURSE

[AirBuccaneers *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\223630
FileKey1=%ProgramFiles%\Steam\Steamapps\common\AirBuccaneers\abu_data|output_log.txt
FileKey2=%ProgramFiles%\Steam\Steamapps\common\AirBuccaneers\logs|*.*

[AirDC++ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\AirDC++\AirDC.exe
FileKey1=%AppData%\AirDC++|Recents.xml
FileKey2=%AppData%\AirDC++\FileLists|*.*
FileKey3=%AppData%\AirDC++\Logs|*.*
FileKey4=%LocalAppData%\AirDC++|Recents.xml
FileKey5=%LocalAppData%\AirDC++\FileLists|*.*
FileKey6=%LocalAppData%\AirDC++\Logs|*.*
FileKey7=%ProgramFiles%\AirDC++\Logs|*.*
FileKey8=%ProgramFiles%\AirDC++\Settings|Recents.xml
FileKey9=%ProgramFiles%\AirDC++\Settings\FileLists|*.*
FileKey10=%ProgramFiles%\AirDC++\Settings\Logs|*.*

[AirPcap *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Riverbed\AirPcap\driver
FileKey1=%ProgramFiles%\Riverbed\AirPcap\driver|*.log

[AirStrike 3D *]
Section=Games
DetectFile=%ProgramFiles%\Blimb Entertainment\AIRSTRIKE3D
FileKey1=%ProgramFiles%\Blimb Entertainment\AIRSTRIKE3D|*.log

[Aiseesoft Media Converter Ultimate *]
LangSecRef=3023
Detect=HKCU\Software\Aiseesoft Studio\Aiseesoft Media Converter Ultimate
FileKey1=%LocalAppData%\Aiseesoft Studio\Aiseesoft Media Converter Ultimate|*.txt
RegKey1=HKCU\Software\Aiseesoft Studio\Aiseesoft Media Converter Ultimate\Edit|LastVideoFilePath

[Alarms & Clock *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsAlarms_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\LocalState|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\TempState|*.*|RECURSE

[AlbumPlayer *]
LangSecRef=3023
DetectFile=%AppData%\AlbumPlayer
FileKey1=%SystemDrive%\AlbumPlayerData\Logging|*.*|RECURSE

[AlbumPlayer Cache *]
LangSecRef=3023
DetectFile=%AppData%\AlbumPlayer
FileKey1=%SystemDrive%\AlbumPlayerData\Cache|*.*|RECURSE

[Alcohol 52% *]
LangSecRef=3023
Detect=HKCU\Software\Alcohol Soft
RegKey1=HKCU\Software\Alcohol Soft\Alcohol 52%\Basic|Image File Path
RegKey2=HKCU\Software\Alcohol Soft\Alcohol 52%\Images
RegKey3=HKCU\Software\Alcohol Soft\Alcohol 52%\Options\Image Making Wizard|ImageName

[Alibaba *]
LangSecRef=3021
DetectFile=%LocalAppData%\Alibaba\AliSetup
FileKey1=%LocalAppData%\Alibaba\AliSetup\*|*.log

[Alien Swarm *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\630
FileKey1=%ProgramFiles%\Steam\steamapps\common\alien swarm\swarm|tilegen_log.txt

[Aliens: Colonial Marines *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Aliens: Colonial Marines_is1
FileKey1=%Documents%\My Games\Aliens Colonial Marines\PecanGame\Logs|*.*

[All in One Runtimes *]
LangSecRef=3024
DetectFile1=%SystemDrive%\AiO-Files
DetectFile2=%SystemDrive%\AiOLog.txt
FileKey1=%SystemDrive%|AiOLog.txt
FileKey2=%SystemDrive%\AiO-Files|*.*|RECURSE

[All Office Converter *]
LangSecRef=3021
DetectFile=%ProgramFiles%\All Office Converter Platinum
FileKey1=%ProgramFiles%\All Office Converter Platinum|Eventlog.txt

[All Zombies Must Die! *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\All Zombies Must Die!_is1
FileKey1=%Documents%\My Games\UnrealEngine3\Bzb2Game\Logs|*.*

[All Zombies Must Die! Installers *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\All Zombies Must Die!_is1
FileKey1=%ProgramFiles%\Doublesix Games\All Zombies Must Die!\Prerequisites|*.*|REMOVESELF

[AllDup *]
LangSecRef=3024
DetectFile=%AppData%\AllDup
FileKey1=%AppData%\AllDup|*.log

[Alternate File Shredder *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Alternate File Shredder_is1
FileKey1=%AppData%\Alternate\FileShredder|FileShredderLog*.txt

[Always Right Backups *]
LangSecRef=3024
Detect=HKCU\Software\AlwaysRight
FileKey1=%ProgramFiles%\Superhunter\Always Right\*Backup|*.*

[Alwin 6 *]
LangSecRef=3023
DetectFile=%SystemDrive%\alwin6
FileKey1=%SystemDrive%\alwin6\postgresql\9.0\data\pg_log|*.*

[AM-DeadLink *]
LangSecRef=3022
Detect=HKCU\Software\aignes\deadlink
FileKey1=%AppData%\aignes\AM-DeadLink|deadlink.log

[Amaya *]
LangSecRef=3022
DetectFile=%UserProfile%\amaya
FileKey1=%UserProfile%\amaya|list_url_utf8.dat
FileKey2=%UserProfile%\amaya\*|*.*|REMOVESELF

[Amazing World *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\293500
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Amazing World\AmazingWorld_Data|output_log.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Amazing World\Cache|*.*|REMOVESELF

[Amazon Cloud Player *]
LangSecRef=3024
DetectFile=%LocalAppData%\Amazon Cloud Player
FileKey1=%LocalAppData%\Amazon Cloud Player\Logs|*.*

[Amazon Downloader *]
LangSecRef=3024
DetectFile=%Documents%\Amazon Downloader Logs
FileKey1=%Documents%\Amazon Downloader Logs|*.*|RECURSE

[Amazon Kindle for PC Session *]
LangSecRef=3023
Detect=HKCU\Software\Amazon\Kindle
RegKey1=HKCU\Software\Amazon\Kindle\User Settings|last_getitems_date
RegKey2=HKCU\Software\Amazon\Kindle\User Settings|last_syncmetadata_date
RegKey3=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate0
RegKey4=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate1
RegKey5=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate2
RegKey6=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate3
RegKey7=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate4
RegKey8=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate5
RegKey9=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate6
RegKey10=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate7
RegKey11=HKCU\Software\Amazon\Kindle\User Settings|OpenBook

[Amazon MP3 Downloader *]
LangSecRef=3023
Detect1=HKCR\Amazon.AmazonMP3DownloaderPlugin
Detect2=HKCR\Software\Amazon\MP3 Downloader
FileKey1=%Documents%\Amazon MP3\Logs|*.*|REMOVESELF
FileKey2=%LocalAppData%\Program Files\Amazon\MP3 Downloader|InstallerLog.txt

[AMD/ATI *]
LangSecRef=3024
Detect1=HKLM\Software\AMD
Detect2=HKLM\Software\ATI
Detect3=HKLM\Software\ATI Technologies
DetectFile=%ProgramFiles%\ATI Technologies\ATI.ACE
FileKey1=%CommonAppData%\AMD\Fuel|*.txt
FileKey2=%CommonAppData%\AMD\KDB|*.log
FileKey3=%LocalAppData%\AMD\*Cache|*.*|RECURSE
FileKey4=%LocalAppData%\AMD\Fuel|ClientProxyLog*.*
FileKey5=%LocalAppData%\ATI\ACE|*.txt
FileKey6=%LocalAppData%\Packages\*\AC\*\AMD\DxCache|*.*
FileKey7=%LocalAppData%\Packages\*\AC\AMD\DxCache|*.*
FileKey8=%LocalLowAppData%\AMD\DxCache|*.*
FileKey9=%ProgramFiles%\AMD\amdkmpfd|*.*|REMOVESELF
FileKey10=%ProgramFiles%\AMD\CIM\Log|*.log;*.txt
FileKey11=%ProgramFiles%\AMD\CIM\Reports|*.xml;*.xsl
FileKey12=%ProgramFiles%\AMD\OverDrive|*.log
FileKey13=%ProgramFiles%\ATI Technologies|*.log|RECURSE
FileKey14=%ProgramFiles%\ATI Technologies|cccutil64.txt
FileKey15=%ProgramFiles%\ATI\CIM\Reports|*.*
FileKey16=%SystemDrive%\AMD|*.*|REMOVESELF
FileKey17=%SystemDrive%\ATI|*.*|REMOVESELF
FileKey18=%UserProfile%|AMD_Chipset_Drivers.log;ChipsetExtraction.log;Device_ID.log
FileKey19=%WinDir%\System32|CCCInstall*.log
FileKey20=%WinDir%\SysWOW64|CCCInstall*.log

[America's Army 2 *]
Section=Games
DetectFile=%ProgramFiles%\USArmy\America's Army 2
FileKey1=%LocalAppData%\AA2DeployClient|debug*.*
FileKey2=%ProgramFiles%\USArmy\America's Army 2|*.log|RECURSE

[AMID EVIL *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\673130
FileKey1=%LocalAppData%\AmidEvil\Saved\Logs|*.*

[Amigabit Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Amigabit\Registry Cleaner\RegistryCleaner.exe
FileKey1=%ProgramFiles%\Amigabit\Registry Cleaner\Purchase|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Amigabit\Registry Cleaner\Update|update.log

[Amnesia: The Dark Descent *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\57300
FileKey1=%Documents%\Amnesia|*.log|RECURSE

[AMP Font Viewer *]
LangSecRef=3024
Detect=HKCU\Software\AMP Soft\Font Viewer
RegKey1=HKCU\Software\AMP Soft\Font Viewer|Default copy folder
RegKey2=HKCU\Software\AMP Soft\Font Viewer|Last file operarion folder
RegKey3=HKCU\Software\AMP Soft\Font Viewer|Not installed tab path

[Amsn *]
LangSecRef=3022
Detect=HKCU\Software\aMSN
FileKey1=%ProgramFiles%\amsn\scripts\amsn_received|*.incomplete
FileKey2=%UserProfile%\amsn\*\FT\cache|*.*
FileKey3=%UserProfile%\amsn\*\logs\*|*.log
FileKey4=%UserProfile%\amsn\*\winks\cache\tmp|*.*
FileKey5=%UserProfile%\amsn\displaypic\cache|*.*

[AMYUNI PDF Converter *]
LangSecRef=3021
DetectFile=%CommonAppData%\Package Cache\3DBECED19CFC2819A7E0BE14463CF18FC8720D91\amyuni_pdfconverter_5_00
FileKey1=%CommonAppData%\Package Cache\3DBECED19CFC2819A7E0BE14463CF18FC8720D91\amyuni_pdfconverter_5_00|*.log|RECURSE

[And Yet It Moves *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\18700
FileKey1=%AppData%\Broken Rules\And Yet It Moves Steam|console.log

[Android Notifier Desktop *]
LangSecRef=3022
DetectFile=%UserProfile%\.android\android-notifier-desktop
FileKey1=%UserProfile%\.android\android-notifier-desktop|android-notifier-desktop.*

[Android SDK Tools *]
LangSecRef=3023
Detect=HKLM\Software\Android SDK Tools
FileKey1=%AppData%\Android\android-sdk\temp|*.*|REMOVESELF
FileKey2=%UserProfile%\.android\cache|*.*|REMOVESELF

[Android Studio *]
LangSecRef=3021
Detect=HKCU\Software\Android Open Source Project\Emulator
FileKey1=%UserProfile%\.AndroidStudio2.3\system\log|*.*|REMOVESELF
FileKey2=%UserProfile%\.AndroidStudio2.3\system\tmp|*.*
FileKey3=%UserProfile%\.gradle|*.log|RECURSE

[Anfibia Switch *]
LangSecRef=3021
Detect=HKCU\Software\Anfibia Switch
FileKey1=%CommonAppData%\Anfibia Switch|*.log|RECURSE

[Angry Birds Space *]
DetectOS=6.2|6.3
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\1ED5AEA5.AngryBirdsSpace_p2gbknwb5d8r2
FileKey1=%LocalAppData%\Packages\*.AngryBirdsSpace_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.AngryBirdsSpace_*\AC\Microsoft\CryptnetUrlCache\*|*.*

[Angry Birds Star Wars *]
DetectOS=6.2|6.3
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\1ED5AEA5.AngryBirdsBlack_p2gbknwb5d8r2
FileKey1=%LocalAppData%\Packages\*.AngryBirdsBlack_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.AngryBirdsBlack_*\AC\Microsoft\CryptnetUrlCache\*|*.*

[Anim8or *]
LangSecRef=3021
Detect=HKCU\Software\Silicon Valley Software\Anim8or
RegKey1=HKCU\Software\Silicon Valley Software\Anim8or|File1
RegKey2=HKCU\Software\Silicon Valley Software\Anim8or|File2
RegKey3=HKCU\Software\Silicon Valley Software\Anim8or|File3
RegKey4=HKCU\Software\Silicon Valley Software\Anim8or|File4

[Anki Backups *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Anki\Anki.exe
FileKey1=%AppData%\.anki\backups|*.*

[Annie's Millions *]
Section=Games
DetectFile=%AppData%\PoBros\Annies Millions
FileKey1=%AppData%\PoBros\Annies Millions|logfile.txt

[ANNO 2070 *]
Section=Games
DetectFile=%AppData%\Ubisoft\ANNO 2070
FileKey1=%AppData%\Ubisoft\ANNO 2070\Cache|*.*|REMOVESELF
FileKey2=%AppData%\Ubisoft\ANNO 2070\Logs|*.log;*.dmp|RECURSE

[Anomos *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Anomos\ANOMOS.exe
FileKey1=%AppData%\.anomos|logfile.txt

[Antichamber *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105430
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Antichamber\UDKGame\Logs|*.*

[Anvisoft Cloud System Booster *]
LangSecRef=3024
Detect=HKLM\Software\Anvisoft\Cloud System Booster
FileKey1=%LocalAppData%\Anvisoft\Anvi Slim Toolbar\FFToobar\tmp|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Anvisoft\Cloud System Booster|*.log;*.txt
FileKey3=%ProgramFiles%\Anvisoft\Cloud System Booster\logs|*.*
FileKey4=%ProgramFiles%\Anvisoft\Cloud System Booster\reports|*.*
FileKey5=%ProgramFiles%\Anvisoft\Cloud System Booster\VLog|*.*

[AnvSoft Any Audio Converter *]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft\Any Audio Converter
FileKey1=%AppData%\AnvSoft\Any Audio Converter|*.log

[AnvSoft Any DVD Converter *]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft\Any DVD Converter Professional
FileKey1=%AppData%\AnvSoft\Any DVD Converter Professional|*.log

[AnvSoft Any DVD Converter Database *]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft\Any DVD Converter Professional
FileKey1=%AppData%\AnvSoft\Any DVD Converter Professional|*.db

[AnvSoft Any Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft\Any Video Converter
FileKey1=%AppData%\AnvSoft\Any Video Converter|*.log;history*.db|RECURSE
FileKey2=%AppData%\AnvSoft\Any Video Converter\thumbs|*.*|RECURSE

[AnyDesk *]
LangSecRef=3024
DetectFile=%AppData%\AnyDesk
FileKey1=%AppData%\AnyDesk|ad.trace

[AnyDVD *]
LangSecRef=3023
Detect=HKCU\Software\SlySoft\AnyDVD
FileKey1=%Documents%\AnyDVD_logs|*.*|REMOVESELF

[AOL *]
LangSecRef=3022
Detect=HKCU\Software\America Online
FileKey1=%AppData%\AOL\C_AOL*|*.tmp|RECURSE
FileKey2=%CommonAppData%\AOL Downloads|*.*|RECURSE
FileKey3=%CommonAppData%\AOL\C_AOL*|*.tmp|RECURSE
FileKey4=%CommonAppData%\AOL\C_AOL*\bart|*.*|RECURSE
FileKey5=%CommonAppData%\AOL\C_AOL*\spool|*.*|RECURSE

[AOMEI Backupper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AOMEI Backupper
FileKey1=%CommonAppData%\AomeiBR|brlog.xml
FileKey2=%ProgramFiles%\AOMEI Backupper\AOMEI Image Deploy\log|*.*
FileKey3=%ProgramFiles%\AOMEI Backupper\log|*.*

[AOMEI Dynamic Disk Manager *]
LangSecRef=3024
DetectFile=%ProgramFiles%\AOMEI DDM Pro Edition\DDM.exe
FileKey1=%ProgramFiles%\AOMEI DDM Pro Edition\log|*.*

[AOMEI Partition Assistant *]
LangSecRef=3024
Detect=HKCU\Software\Partition Assistant
FileKey1=%ProgramFiles%\AOMEI Partition Assistant\log|*.log

[APC PowerChute Personal Edition *]
LangSecRef=3024
Detect=HKCU\Software\APC\PowerChute Personal Edition
FileKey1=%ProgramFiles%\APC\PowerChute Personal Edition|PCPELog.txt
FileKey2=%WinDir%\System32|PCPELog.txt
FileKey3=%WinDir%\SysWOW64|PCPELog.txt

[ApexDC++ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\ApexDC++\ApexDC.exe
FileKey1=%AppData%\ApexDC++|files.xml.bz2;FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey2=%AppData%\ApexDC++\FileLists|*.*
FileKey3=%AppData%\ApexDC++\Logs|*.*
FileKey4=%LocalAppData%\ApexDC++|files.xml.bz2;FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey5=%LocalAppData%\ApexDC++\FileLists|*.*
FileKey6=%LocalAppData%\ApexDC++\Logs|*.*
FileKey7=%ProgramFiles%\ApexDC++\Logs|*.*
FileKey8=%ProgramFiles%\ApexDC++\Settings|files.xml.bz2;FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey9=%ProgramFiles%\ApexDC++\Settings\FileLists|*.*
FileKey10=%ProgramFiles%\ApexDC++\Settings\Logs|*.*

[ApHeMo *]
LangSecRef=3022
Detect=HKCU\Software\KC Softwares\ApHeMo
FileKey1=%AppData%\KC Softwares\ApHeMo|*.log;error.*

[App Compat Cache *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
RegKey1=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|AppCompatCache
RegKey2=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|CacheMainSdb
RegKey3=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|SdbTime

[Apple MLang Font Cache Data *]
LangSecRef=3023
DetectFile1=%WinDir%\System32\mlfcache.dat
DetectFile2=%WinDir%\SysWOW64\mlfcache.dat
FileKey1=%WinDir%\System32|mlfcache.dat
FileKey2=%WinDir%\SysWOW64|mlfcache.dat

[Appupdater *]
LangSecRef=3024
DetectFile=%AppData%\Appupdater
FileKey1=%AppData%\Appupdater|appupdaterw.log
FileKey2=%CommonAppData%\Appupdater|*.log

[AQQ *]
LangSecRef=3022
Detect1=HKCU\Software\MyPortal\AQQ
Detect2=HKCU\Software\Wapster\AQQ
FileKey1=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\*Avatars|*.*
FileKey2=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\*Avatars|*.*

[AQQ Cache *]
LangSecRef=3022
Detect1=HKCU\Software\MyPortal\AQQ
Detect2=HKCU\Software\Wapster\AQQ
FileKey1=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\*Cache|*.*
FileKey2=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\*Cache|*.*

[AQQ Chat History *]
LangSecRef=3022
Detect1=HKCU\Software\MyPortal\AQQ
Detect2=HKCU\Software\Wapster\AQQ
FileKey1=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\Archive|*.DC2
FileKey2=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\Temp|*.*
FileKey3=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\Archive|*.DC2
FileKey4=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\Temp|*.*

[Arasan Chess *]
Section=Games
Detect=HKCU\Software\Arasan\Arasan
RegKey1=HKCU\Software\Arasan\Arasan\Recent File List

[Arcane Worlds *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\269610
FileKey1=%AppData%\ArcaneWorlds|log.txt

[ArcSoft MediaConverter *]
LangSecRef=3023
Detect=HKLM\Software\arcsoft\mediaconverter
FileKey1=%AppData%\ArcSoft\ArcSoft MediaConverter\*|saved.proj
FileKey2=%AppData%\ArcSoft\log|*.log

[Ares *]
LangSecRef=3022
Detect=HKCU\Software\Ares
RegKey1=HKCU\Software\Ares|GUI.LastChatRoomBrowse
RegKey2=HKCU\Software\Ares|GUI.LastSearch

[Argus Monitor *]
LangSecRef=3024
Detect=HKCU\Software\Argotronic\Argus Monitor
FileKey1=%Documents%|ArgusMonitor_EventLog.txt;ArgusMonitor_CSVLog.csv
FileKey2=%ProgramFiles%|ArgusMonitor_EventLog.txt;ArgusMonitor_CSVLog.csv

[ARO *]
LangSecRef=3024
Detect1=HKCU\Software\Sammsoft\ARO\Version 2011
Detect2=HKCU\Software\Sammsoft\ARO\Version 2013
FileKey1=%AppData%\Sammsoft\ARO\Version *\Logs|*.txt

[ASCOMP Cleaning Suite Professional *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ASCOMP Software\Cleaning Suite\csuite.exe
FileKey1=%AppData%\ASCOMP Software\Cleaning Suite|*.log
FileKey2=%AppData%\ASCOMP Software\Cleaning Suite\Restore|*.*|RECURSE

[Ashampoo Burning Studio *]
LangSecRef=3021
Detect1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5
Detect2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6
Detect3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7
Detect4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8
Detect5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12
Detect6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14
Detect7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15
Detect8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16
Detect9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18
Detect10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19
Detect11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20
Detect12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21
Detect13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22
Detect14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007
Detect15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009
Detect16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016
Detect17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017
Detect18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018
Detect19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019
FileKey1=%AppData%\Ashampoo|*.log;*.txt;*.xml|RECURSE
FileKey2=%LocalAppData%\Ashampoo\BaNT|*.*|RECURSE
RegKey1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Burn Image Project\SelectImage
RegKey2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\AddDialog
RegKey3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\DumpImage
RegKey4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Unknown Project\AddDialog
RegKey5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Burn Image Project\SelectImage
RegKey6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Data Disc Project\AddDialog
RegKey7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Unknown Project\AddDialog
RegKey8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Burn Image Project\SelectImage
RegKey9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Data Disc Project\AddDialog
RegKey10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Unknown Project\AddDialog
RegKey11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Data Disc Project\AddDialog
RegKey12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\tempFiles
RegKey14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\tempFiles
RegKey16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Backup Project\BackupOptions|CustomLocation
RegKey18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\BrowseImageFile|ImagePath
RegKey20=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey21=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey22=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SelectImage|ImagePath
RegKey23=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\DumpImage|ImagePath
RegKey24=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey25=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\MoviesPage|Path
RegKey26=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey27=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Logs
RegKey28=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\tempFiles
RegKey29=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Unknown Project
RegKey30=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey31=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey32=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey33=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey34=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Backup Project\BackupOptions|CustomLocation
RegKey35=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey36=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\BrowseImageFile|ImagePath
RegKey37=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey38=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey39=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SelectImage|ImagePath
RegKey40=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\DumpImage|ImagePath
RegKey41=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey42=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\MoviesPage|Path
RegKey43=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey44=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Logs
RegKey45=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\tempFiles
RegKey46=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Unknown Project
RegKey47=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey48=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey49=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey50=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey51=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Backup Project\BackupOptions|CustomLocation
RegKey52=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey53=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\BrowseImageFile|ImagePath
RegKey54=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey55=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey56=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SelectImage|ImagePath
RegKey57=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\DumpImage|ImagePath
RegKey58=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey59=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\MoviesPage|Path
RegKey60=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey61=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Logs
RegKey62=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\tempFiles
RegKey63=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Unknown Project
RegKey64=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey65=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey66=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey67=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey68=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Backup Project\BackupOptions|CustomLocation
RegKey69=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey70=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Browse Image Project\BrowseImageFile|ImagePath
RegKey71=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey72=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey73=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Burn Image Project\SelectImage|ImagePath
RegKey74=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Data Disc Project\DumpImage|ImagePath
RegKey75=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey76=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\DVD-Video Disc Project\MoviesPage|Path
RegKey77=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey78=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Logs
RegKey79=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\tempFiles
RegKey80=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Unknown Project
RegKey81=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey82=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey83=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey84=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey85=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Backup Project\BackupOptions|CustomLocation
RegKey86=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey87=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Browse Image Project\BrowseImageFile|ImagePath
RegKey88=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey89=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey90=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Burn Image Project\SelectImage|ImagePath
RegKey91=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Data Disc Project\DumpImage|ImagePath
RegKey92=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey93=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\DVD-Video Disc Project\MoviesPage|Path
RegKey94=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey95=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Logs
RegKey96=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\tempFiles
RegKey97=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Unknown Project
RegKey98=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey99=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey100=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey101=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Burn Image Project\AddDialog
RegKey102=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Data Disc Project\AddDialog
RegKey103=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Dump Image Project\DumpImage
RegKey104=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Unknown Project\AddDialog
RegKey105=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey106=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Backup Project\BackupOptions|CustomLocation
RegKey107=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\BrowseImageFile|ImagePath
RegKey108=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey109=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey110=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SelectImage|ImagePath
RegKey111=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\DumpImage|ImagePath
RegKey112=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey113=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Logs
RegKey114=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\tempFiles
RegKey115=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Unknown Project
RegKey116=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey117=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey118=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey119=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey120=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Backup Project\BackupOptions|CustomLocation
RegKey121=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\BrowseImageFile|ImagePath
RegKey122=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey123=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey124=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SelectImage|ImagePath
RegKey125=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\DumpImage|ImagePath
RegKey126=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey127=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Logs
RegKey128=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\tempFiles
RegKey129=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Unknown Project
RegKey130=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey131=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey132=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey133=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey134=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Backup Project\BackupOptions|CustomLocation
RegKey135=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Browse Image Project\BrowseImageFile|ImagePath
RegKey136=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey137=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey138=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Burn Image Project\SelectImage|ImagePath
RegKey139=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Data Disc Project\DumpImage|ImagePath
RegKey140=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey141=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Logs
RegKey142=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\tempFiles
RegKey143=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Unknown Project
RegKey144=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey145=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey146=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey147=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey148=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Backup Project\BackupOptions|CustomLocation
RegKey149=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Browse Image Project\BrowseImageFile|ImagePath
RegKey150=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey151=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey152=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Burn Image Project\SelectImage|ImagePath
RegKey153=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Data Disc Project\DumpImage|ImagePath
RegKey154=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey155=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Logs
RegKey156=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\tempFiles
RegKey157=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Unknown Project
RegKey158=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey159=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey160=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath

[Ashampoo PDF Pro *]
LangSecRef=3021
Detect1=HKCU\Software\Ashampoo\Ashampoo PDF
Detect2=HKCU\Software\Ashampoo\Ashampoo PDF Pro 2
FileKey1=%LocalAppData%\Ashampoo PDF\*|lastFileOpenned.txt
RegKey1=HKCU\Software\Ashampoo\Ashampoo PDF\Find Replace
RegKey2=HKCU\Software\Ashampoo\Ashampoo PDF\Recent File List

[Ashampoo Snap *]
LangSecRef=3024
Detect1=HKCU\Software\Ashampoo\Ashampoo Snap 7
Detect2=HKCU\Software\Ashampoo\Ashampoo Snap 8
Detect3=HKCU\Software\Ashampoo\Ashampoo Snap 9
Detect4=HKCU\Software\Ashampoo\Ashampoo Snap 10
Detect5=HKCU\Software\Ashampoo\Ashampoo Snap 11
Detect6=HKCU\Software\Ashampoo\Ashampoo Snap 2017
Detect7=HKCU\Software\Ashampoo\Ashampoo Snap 2018
FileKey1=%AppData%\Ashampoo|*.log;*.txt;*.xml|RECURSE
FileKey2=%LocalAppData%\Ashampoo\BaNT|*.*|RECURSE
FileKey3=%ProgramFiles%\Ashampoo\Ashampoo Snap *|_NLogMsg.txt

[Ashampoo Snap AutoSaves *]
LangSecRef=3024
Detect1=HKCU\Software\Ashampoo\Ashampoo Snap 7
Detect2=HKCU\Software\Ashampoo\Ashampoo Snap 8
Detect3=HKCU\Software\Ashampoo\Ashampoo Snap 9
Detect4=HKCU\Software\Ashampoo\Ashampoo Snap 10
FileKey1=%Pictures%\Ashampoo Snap *\_SNAPDOC|*.*|RECURSE

[Ashes of the Singularity *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\507490
FileKey1=%LocalAppData%\Ashes of the Singularity\Stardock\Tachyon|*.txt

[Ashley Jones and the Heart of Egypt *]
Section=Games
DetectFile=%CommonAppData%\Fenomen Games\Ashley Jones - The Heart Of Egypt
FileKey1=%CommonAppData%\Fenomen Games\Ashley Jones - The Heart Of Egypt|*.log

[AstroGrep *]
LangSecRef=3024
Detect=HKCU\Software\AstroGrep
FileKey1=%AppData%\AstroGrep|AstroGrep.general.config
FileKey2=%AppData%\AstroGrep\Log|*.log

[ASUS Logs *]
LangSecRef=3024
Detect=HKLM\Software\ASUS\SmartCore
DetectFile1=%AppData%\ASUS WebStorage
DetectFile2=%CommonAppData%\Asus
DetectFile3=%ProgramFiles%\ASUS\AI Suite
FileKey1=%AppData%\*WebStorage\Logs|*.*
FileKey2=%CommonAppData%\Asus\*|*.log|RECURSE
FileKey3=%ProgramFiles%\ASUS\*|*.log;*log*.txt;*.tmp|RECURSE
FileKey4=%SystemDrive%|wifi.log
ExcludeKey1=FILE|%CommonAppData%\Asus\*\|install.log

[Athentech Perfectly Clear *]
LangSecRef=3021
Detect=HKLM\Software\Athentech
FileKey1=%LocalAppData%\cache\Athentech|*.*|REMOVESELF

[Atheros Driver *]
LangSecRef=3024
Detect=HKLM\Software\Atheros
FileKey1=%CommonAppData%\Atheros|*.log|RECURSE
FileKey2=%CommonAppData%\Qualcomm Atheros WiFi Driver Installation|*.Log|RECURSE
FileKey3=%CommonProgramFiles%\Atheros|InstallLog.txt
FileKey4=%CommonProgramFiles%\Qualcomm|InstallLog.txt
FileKey5=%CommonProgramFiles%\Qualcomm Atheros|*.log

[Atomic Cleaner 3 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Atomicware\AtomicCleaner3\atomiccleaner3.exe
FileKey1=%LocalAppData%\Atomicware\AtomicCleaner3|*.log;*.tmp;info_messages.txt
FileKey2=%LocalAppData%\Atomicware\AtomicCleaner3\logs|*.txt

[AtomTime Pro *]
LangSecRef=3024
Detect=HKLM\Software\NaissanInnovations\AtomTime
FileKey1=%ProgramFiles%\AtomTime Pro|*.log

[Attribute Changer *]
LangSecRef=3024
Detect1=HKCU\Software\Attribute Changer
Detect2=HKCU\Software\Romain's Software\Attribute Changer
RegKey1=HKCU\Software\Attribute Changer\File Settings|!DTDateMax
RegKey2=HKCU\Software\Attribute Changer\File Settings|!DTDateMin
RegKey3=HKCU\Software\Attribute Changer\File Settings|!DTTimeMax
RegKey4=HKCU\Software\Attribute Changer\File Settings|!DTTimeMin
RegKey5=HKCU\Software\Attribute Changer\File Settings|AccessedValue
RegKey6=HKCU\Software\Attribute Changer\File Settings|CreatedValue
RegKey7=HKCU\Software\Attribute Changer\File Settings|LimitDateMax
RegKey8=HKCU\Software\Attribute Changer\File Settings|LimitDateMin
RegKey9=HKCU\Software\Attribute Changer\File Settings|LimitTimeMax
RegKey10=HKCU\Software\Attribute Changer\File Settings|LimitTimeMin
RegKey11=HKCU\Software\Attribute Changer\File Settings|ModifiedValue
RegKey12=HKCU\Software\Attribute Changer\File Settings|PhotoValue
RegKey13=HKCU\Software\Attribute Changer\File Settings|RandomDateMax
RegKey14=HKCU\Software\Attribute Changer\File Settings|RandomDateMin
RegKey15=HKCU\Software\Attribute Changer\File Settings|RandomTimeMax
RegKey16=HKCU\Software\Attribute Changer\File Settings|RandomTimeMin
RegKey17=HKCU\Software\Attribute Changer\Folder Settings|!DTDateMax
RegKey18=HKCU\Software\Attribute Changer\Folder Settings|!DTDateMin
RegKey19=HKCU\Software\Attribute Changer\Folder Settings|!DTTimeMax
RegKey20=HKCU\Software\Attribute Changer\Folder Settings|!DTTimeMin
RegKey21=HKCU\Software\Attribute Changer\Folder Settings|AccessedValue
RegKey22=HKCU\Software\Attribute Changer\Folder Settings|CreatedValue
RegKey23=HKCU\Software\Attribute Changer\Folder Settings|LimitDateMax
RegKey24=HKCU\Software\Attribute Changer\Folder Settings|LimitDateMin
RegKey25=HKCU\Software\Attribute Changer\Folder Settings|LimitTimeMax
RegKey26=HKCU\Software\Attribute Changer\Folder Settings|LimitTimeMin
RegKey27=HKCU\Software\Attribute Changer\Folder Settings|ModifiedValue
RegKey28=HKCU\Software\Attribute Changer\Folder Settings|RandomDateMax
RegKey29=HKCU\Software\Attribute Changer\Folder Settings|RandomDateMin
RegKey30=HKCU\Software\Attribute Changer\Folder Settings|RandomTimeMax
RegKey31=HKCU\Software\Attribute Changer\Folder Settings|RandomTimeMin
RegKey32=HKCU\Software\Attribute Changer\Global Settings|OtherExport
RegKey33=HKCU\Software\Romain's Software\Attribute Changer\File Settings|AccessedDT
RegKey34=HKCU\Software\Romain's Software\Attribute Changer\File Settings|CreatedDT
RegKey35=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMaxDate
RegKey36=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMaxTime
RegKey37=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMinDate
RegKey38=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMinTime
RegKey39=HKCU\Software\Romain's Software\Attribute Changer\File Settings|ModifiedDT
RegKey40=HKCU\Software\Romain's Software\Attribute Changer\File Settings|PictureDT
RegKey41=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMaxDate
RegKey42=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMaxTime
RegKey43=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMinDate
RegKey44=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMinTime
RegKey45=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RLowerDT
RegKey46=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RUpperDT
RegKey47=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|AccessedDT
RegKey48=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|CreatedDT
RegKey49=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMaxDate
RegKey50=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMaxTime
RegKey51=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMinDate
RegKey52=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMinTime
RegKey53=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|ModifiedDT
RegKey54=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMaxDate
RegKey55=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMaxTime
RegKey56=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMinDate
RegKey57=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMinTime
RegKey58=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RLowerDT
RegKey59=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RUpperDT
RegKey60=HKCU\Software\Romain's Software\Attribute Changer\Global Settings|PFolderFilter

[Audacity *]
LangSecRef=3023
Detect=HKCU\Software\Audacity
RegKey1=HKCU\Software\Audacity\Audacity|DefaultOpenPath

[Audials 10 *]
LangSecRef=3023
Detect=HKLM\Software\RapidSolution\Audials_2013
FileKey1=%CommonAppData%\RapidSolution\Audials_2013\ChildMSILogs|*.txt
FileKey2=%LocalAppData%\RapidSolution\Audials_2013\Log|*.log;*.txt|RECURSE
FileKey3=%LocalAppData%\RapidSolution\Audials_Software\RapidSolution\Audials_2013\Log|*.log;*.txt|RECURSE

[Audio Sliders *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Audio Sliders
FileKey1=%ProgramFiles%\Audio Sliders|*.log

[Audio/Video Stats *]
DetectOS=|5.1
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%|DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[AudioGrail *]
LangSecRef=3023
Detect=HKCU\Software\KC Softwares\AudioGrail
FileKey1=%AppData%\KC Softwares\AudioGrail|ag.sel;AudioGrail.log

[Aurigma Image Uploader *]
LangSecRef=3023
Detect=HKCU\Software\Aurigma\ImageUploader
FileKey1=%LocalAppData%|recently-used.xbel
RegKey1=HKCU\Software\Aurigma\ImageUploader\Image Uploader 5.0|LastVisitedAsString2
RegKey2=HKCU\Software\Aurigma\ImageUploader\Image Uploader 5.0|LastVisitedAsStringHash

[Auslogics BoostSpeed *]
LangSecRef=3024
Detect=HKCU\Software\Auslogics\BoostSpeed
FileKey1=%AppData%\Auslogics|*.htm;*.html;*.log;*.rsc;*.sta;*.xml|RECURSE
FileKey2=%CommonAppData%\Auslogics\BoostSpeed\*.x|*.err;*.htm;*.html;*.log;*.rsc;*.sta;*.xml|RECURSE
FileKey3=%ProgramFiles%\Auslogics\Auslogics BoostSpeed|rdboot.log
RegKey1=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsFailed
RegKey2=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsFound
RegKey3=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsRemoved
RegKey4=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.LastScan
RegKey5=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey6=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey7=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey8=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.LastScan
RegKey9=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.DateTimeHi
RegKey10=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.DateTimeLo
RegKey11=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.FailedToRemove
RegKey12=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.Found
RegKey13=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.Removed
RegKey14=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.DisksList.SelectedDrives
RegKey15=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DateTime
RegKey16=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DisksList
RegKey17=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.FilesCount
RegKey18=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey19=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey20=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey21=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey22=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.LastScan
RegKey23=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.DisksList.SelectedDrives
RegKey24=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DateTime
RegKey25=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DisksList
RegKey26=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.FilesCount
RegKey27=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey28=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey29=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey30=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey31=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.LastScan

[Auslogics Disk Defrag *]
LangSecRef=3024
Detect1=HKLM\Software\Auslogics\Disk Defrag
Detect2=HKLM\Software\Auslogics\Disk Defrag Portable
Detect3=HKLM\Software\Auslogics\Disk Defrag Professional
FileKey1=%CommonAppData%\Auslogics\Disk Defrag*\*\*Reports|*.*|RECURSE
FileKey2=%ProgramFiles%\Auslogics\Disk Defrag Professional|ndefrg.log

[Auslogics Duplicate File Finder *]
LangSecRef=3024
Detect=HKLM\Software\Auslogics\Duplicate File Finder\7.x
RegKey1=HKLM\Software\Wow6432Node\Auslogics\Duplicate File Finder\7.x\Settings|DuplicateFileFinder.CheckDrives

[Auslogics Registry Cleaner *]
LangSecRef=3024
Detect1=HKCU\Software\Auslogics\Registry Cleaner
Detect2=HKLM\Software\Auslogics\Registry Cleaner\3.x
Detect3=HKLM\Software\Auslogics\Registry Cleaner\4.x
Detect4=HKLM\Software\Auslogics\Registry Cleaner\5.X
Warning=This will reset your scan results.
FileKey1=%AppData%\Auslogics|*.htm;*.html;*.log;*.rsc;*.sta;*.xml|RECURSE
FileKey2=%CommonAppData%\Auslogics\Registry Cleaner\*.x|*.htm;*.html;*.log|RECURSE
RegKey1=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey2=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey3=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey4=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.LastScan
RegKey5=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey6=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey7=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey8=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey9=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.LastScan
RegKey10=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey11=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey12=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey13=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey14=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.LastScan
RegKey15=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey16=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey17=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey18=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey19=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.LastScan
RegKey20=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey21=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey22=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey23=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey24=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.LastScan
RegKey25=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey26=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey27=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey28=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey29=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.LastScan
RegKey30=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFailed
RegKey31=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFound
RegKey32=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemoved
RegKey33=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal
RegKey34=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.LastScan

[Auslogics Registry Defrag *]
LangSecRef=3024
Detect1=HKCU\Software\Auslogics\Registry Defrag
Detect2=HKLM\Software\Auslogics\Registry Defrag
FileKey1=%AppData%\Auslogics\Registry Defrag\Logs|*.*
FileKey2=%AppData%\Auslogics\Registry Defrag\Reports|*.*
FileKey3=%CommonAppData%\Auslogics\Registry Defrag\*.x\DeliveredAction|*.tmp
FileKey4=%CommonAppData%\Auslogics\Registry Defrag\*.x\Reports|*.*

[Auslogics System Information *]
LangSecRef=3024
Detect=HKCU\Software\Auslogics\System Information
FileKey1=%AppData%\Auslogics\System Information|*.*

[AuthHost *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windows.authhost.sso_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\TempState|*.*|RECURSE

[Auto BCC for MS Outlook *]
LangSecRef=3021
DetectFile=%AppData%\Add-in Express\Auto BCC For Microsoft Outlook
FileKey1=%AppData%\Add-in Express\Auto BCC For Microsoft Outlook|*.log

[Auto Text Expander *]
LangSecRef=3021
DetectFile=%AppData%\Winsome Technologies\Auto Text Expander 1.0
FileKey1=%AppData%\Winsome Technologies\Auto Text Expander 1.0|*.log

[Autobahn *]
LangSecRef=3021
DetectFile=%UserProfile%\.autobahn
FileKey1=%UserProfile%\.autobahn|autobahn-log*.*

[Autodesk AutoCAD *]
LangSecRef=3021
Detect1=HKCU\Software\Autodesk\AutoCAD\R17.0
Detect2=HKCU\Software\Autodesk\AutoCAD\R18.0
Detect3=HKCU\Software\Autodesk\AutoCAD\R18.1
Detect4=HKCU\Software\Autodesk\AutoCAD\R19.0
Detect5=HKCU\Software\Autodesk\AutoCAD\R20.0
Detect6=HKCU\Software\Autodesk\AutoCAD\R23.0
Detect7=HKCU\Software\Autodesk\R19.0
Detect8=HKCU\Software\Autodesk\R22.0
FileKey1=%LocalAppData%\Autodesk\Autocad*\r*\enu|*.log
FileKey2=%LocalAppData%\Autodesk\Autocad*\r*\enu\BrowserCache|data_*;index
FileKey3=%LocalAppData%\Autodesk\Autodesk Desktop App\BrowserCache|data_*;f_*;index
FileKey4=%LocalAppData%\Autodesk\Web Services|*.log
RegKey1=HKCU\Software\Autodesk\AutoCAD\R17.0\ACAD-5001:409\Recent File List
RegKey2=HKCU\Software\Autodesk\AutoCAD\R18.0\ACAD-8001:409\Recent File List
RegKey3=HKCU\Software\Autodesk\AutoCAD\R18.0\ACAD-8001:411\Recent File List
RegKey4=HKCU\Software\Autodesk\AutoCAD\R18.1\ACAD-9000:409\Recent File List
RegKey5=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B000:409\Recent File List
RegKey6=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B001:409\Recent File List
RegKey7=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B004:409\Recent File List
RegKey8=HKCU\Software\Autodesk\AutoCAD\R20.0\ACAD-8001:409\Recent File List
RegKey9=HKCU\Software\Autodesk\AutoCAD\R23.0\ACAD-A001:409\Recent File List
RegKey10=HKCU\Software\Autodesk\R19.0\ACAD-B005:409\Recent File List
RegKey11=HKCU\Software\Autodesk\R22.0\ACAD-1001:409\Recent File List

[Autodesk Design Review MRU *]
LangSecRef=3023
Detect=HKCU\Software\AutoDesk\DWF Common
RegKey1=HKCU\Software\AutoDesk\DWF Common\Preferences\MRUList

[Autodesk Inventor *]
LangSecRef=3021
Detect1=HKCU\Software\Autodesk\Inventor\RegistryVersion19.0
Detect2=HKCU\Software\Autodesk\Inventor\RegistryVersion20.0
Detect3=HKCU\Software\Autodesk\Inventor\RegistryVersion21.0
Detect4=HKCU\Software\Autodesk\Inventor\RegistryVersion22.0
Detect5=HKCU\Software\Autodesk\Inventor\RegistryVersion23.0
Detect6=HKCU\Software\Autodesk\Inventor\RegistryVersion24.0
RegKey1=HKCU\Software\Autodesk\Inventor\RegistryVersion19.0\Recent File List
RegKey2=HKCU\Software\Autodesk\Inventor\RegistryVersion20.0\Recent File List
RegKey3=HKCU\Software\Autodesk\Inventor\RegistryVersion21.0\Recent File List
RegKey4=HKCU\Software\Autodesk\Inventor\RegistryVersion22.0\Recent File List
RegKey5=HKCU\Software\Autodesk\Inventor\RegistryVersion23.0\Recent File List
RegKey6=HKCU\Software\Autodesk\Inventor\RegistryVersion24.0\Recent File List

[AutoIt3 *]
LangSecRef=3021
Detect=HKCU\Software\AutoIt v3
FileKey1=%UserProfile%|SciTE.*
RegKey1=HKCU\Software\AutoIt v3\Aut2Exe|LastExeDir
RegKey2=HKCU\Software\AutoIt v3\Aut2Exe|LastIcon
RegKey3=HKCU\Software\AutoIt v3\Aut2Exe|LastIconDir
RegKey4=HKCU\Software\AutoIt v3\Aut2Exe|LastScriptDir

[AutoPlay Devices *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=This will clear out devices and drives that you've connected to your computer from AutoPlay.
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\KnownDevices

[Autoplay Repair *]
LangSecRef=3024
Detect=HKCU\Software\APR
DetectFile=%ProgramFiles%\Autoplay Repair\Autoplay Repair.exe
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED
RegKey3=HKLM\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED
RegKey4=HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED

[AvaFind *]
LangSecRef=3023
Detect=HKLM\Software\Think Less Do More Services\AVA Find
FileKey1=%AppData%\AvaFind Data|*00.db

[Avant Browser *]
LangSecRef=3022
Detect=HKCU\Software\Avant Browser
FileKey1=%AppData%\Avant Browser|keywords.dat;pages.dat;recents.dat;reopen.dat

[Avast *]
LangSecRef=3024
Detect=HKCU\Software\AVAST Software\Avast
DetectFile=%ProgramFiles%\Alwil Software\Avast*
FileKey1=%CommonAppData%\Alwil Software\Avast*\log|*.*
FileKey2=%CommonAppData%\Alwil Software\Avast*\report|*.txt
FileKey3=%CommonAppData%\AVAST Software\Avast|Log.db;backend.txt
FileKey4=%CommonAppData%\AVAST Software\Avast\backup|*.*|RECURSE
FileKey5=%CommonAppData%\AVAST Software\Avast\log|*.*
FileKey6=%CommonAppData%\AVAST Software\Avast\report|*.txt
FileKey7=%CommonAppData%\AVAST Software\Browser|*.*|RECURSE
FileKey8=%CommonAppData%\AVAST Software\Persistent Data\Avast\Logs|*.log
FileKey9=%ProgramFiles%\Alwil Software\Avast*\Setup|*.log
FileKey10=%ProgramFiles%\AVAST Software\Avast|*.tmp
RegKey1=HKCU\Software\AVAST Software\Avast Browser Cleanup

[Avast EasyPass *]
LangSecRef=3022
DetectFile=%Documents%\My Avast EasyPass Data
FileKey1=%Documents%\My Avast EasyPass Data\Default Profile|mru.rfo;cache.rfo|RECURSE

[AVG *]
LangSecRef=3024
Detect=HKLM\Software\AVG
FileKey1=%AppData%\AVG\Antivirus\log|*.*|RECURSE
FileKey2=%CommonAppData%\AVG\Antivirus|*.old
FileKey3=%CommonAppData%\AVG\Antivirus\GrimeFighter2|*.txt
FileKey4=%CommonAppData%\AVG\Antivirus\log|*.log
FileKey5=%CommonAppData%\AVG\Antivirus\opm|*.*|RECURSE
FileKey6=%CommonAppData%\AVG\Antivirus\report|*.*|RECURSE
FileKey7=%CommonAppData%\Avg\Antivirus\SWCUData\Cache|*.*|RECURSE
FileKey8=%CommonAppData%\Avg\Antivirus\SWCUData\icons|*.*|RECURSE
FileKey9=%CommonAppData%\AVG\Persistent Data\Antivirus\Logs|*.*|RECURSE
FileKey10=%LocalAppData%\AVG\log|*.*|RECURSE
FileKey11=%LocalAppData%\AvgSetupLog|*.*|REMOVESELF
FileKey12=%LocalAppData%\MFAData\logs|*.log;*.log.*
FileKey13=%WinDir%\System32\config\systemprofile\AppData\Local\Avg\log|*.*|RECURSE
FileKey14=%WinDir%\System32\config\systemprofile\AppData\Local\AvgSetupLog|*.*|REMOVESELF
FileKey15=%WinDir%\System32\config\systemprofile\AppData\Local\MFAData\logs|*.*
FileKey16=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg\log|*.*|RECURSE
FileKey17=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\AvgSetupLog|*.*|REMOVESELF
FileKey18=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\MFAData\logs|*.*
RegKey1=HKLM\Software\AVG\Antivirus\PUB-Detected
RegKey2=HKLM\Software\AVG\Antivirus\PUB-Removed
RegKey3=HKLM\Software\Wow6432Node\AVG\Antivirus\PUB-Detected
RegKey4=HKLM\Software\Wow6432Node\AVG\Antivirus\PUB-Removed

[AVG PC TuneUp *]
LangSecRef=3024
Detect1=HKCU\Software\AVG\AWL\RegistryCleaner
Detect2=HKCU\Software\TuneUp
FileKey1=%AppData%\AVG\AWL*\CrashDumps|*.*
FileKey2=%AppData%\TuneUp Software\TuneUp Utilities\CrashDumps|*.*
FileKey3=%CommonAppData%|NTUSER.DAT_tureg_new.LOG1;NTUSER.DAT_tureg_new.LOG2;NTUSER.DAT_tureg_old
FileKey4=%CommonAppData%\TuneUp Software\TuneUp Utilities *|*.log|RECURSE
FileKey5=%LocalAppData%\Avg\AWL*\Log|*.log
FileKey6=%LocalAppData%\Avg\dumps\fmw1|*.*
FileKey7=%LocalAppData%\Avg\Log|*.log;zappapi.log.1|RECURSE
FileKey8=%LocalAppData%\Avg\Log\fmw1|*.*
FileKey9=%LocalAppData%\AvgSetupLog|*.*|REMOVESELF
FileKey10=%LocalAppData%\Microsoft\Windows|USRCLASS.DAT_tureg_new.LOG*;USRCLASS.DAT_tureg_old;NTUSER.DAT_tureg_old
FileKey11=%LocalAppData%\TuneUp Software|*.log|RECURSE
FileKey12=%Public%|NTUSER.DAT_tureg_new.LOG1;NTUSER.DAT_tureg_new.LOG2;NTUSER.DAT_tureg_old
FileKey13=%SystemDrive%\Boot|BCD_tureg_new.LOG*;BCD_tureg_old
FileKey14=%SystemDrive%\Documents and Settings\LocalService*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey15=%SystemDrive%\Documents and Settings\NetworkService*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey16=%SystemDrive%\Users\Default\AppData\Local\Avg\Log\tu16|*.log
FileKey17=%UserProfile%|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey18=%WinDir%\ServiceProfiles\LocalService|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey19=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows|USRCLASS.DAT_tureg_old;USRCLASS.DAT_tureg_new.LOG*
FileKey20=%WinDir%\ServiceProfiles\NetworkService|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey21=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows|USRCLASS.DAT_tureg_old;USRCLASS.DAT_tureg_new.LOG*
FileKey22=%WinDir%\System32\config|COMPONENTS_tureg_new.LOG*;COMPONENTS_tureg_old;DEFAULT_tureg_new.LOG*;DEFAULT_tureg_old;SAM_tureg_new.LOG*;SAM_tureg_old;SECURITY_tureg_new.LOG*;SECURITY_tureg_old;Software_tureg_new.LOG*;Software_tureg_old;SYSTEM_tureg_new.LOG*;SYSTEM_tureg_old;DRIVERS_tureg_new.LOG*;DRIVERS_tureg_old;Software_tureg_new;SYSTEM_tureg_new
FileKey23=%WinDir%\System32\config\systemprofile\AppData\Local\Avg\Log\fmw1|*.log;*.log.lock
FileKey24=%WinDir%\System32\config\systemprofile\AppData\Local\Avg\Log\tu16|*.log;*.log.lock
FileKey25=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg\Log\fmw1|*.log
FileKey26=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg\Log\setup1|*.log
FileKey27=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg\Log\tu16|*.log

[Avi-Mux GUI *]
LangSecRef=3023
DetectFile=%ProgramFiles%\AVIMuxGUI\AVIMux_GUI.exe
FileKey1=%ProgramFiles%\AVIMuxGUI|AVI-Mux GUI - Logfile*.*;*.dmp

[AVI Toolbox *]
LangSecRef=3023
Detect=HKCU\Software\KC Softwares\AVIToolbox
FileKey1=%AppData%\KC Softwares\AVI Toolbox|*.log

[Aviary Photo Editor *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\57AB5DD0.PhotoEditor_6hb943tstq5q8
FileKey1=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\LocalState|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\TempState|*.*|RECURSE

[AVIcodec *]
LangSecRef=3023
Detect=HKLM\Software\AVIcodec
RegKey1=HKLM\Software\AVIcodec|szInitDir

[Avidemux *]
LangSecRef=3023
Detect1=HKLM\Software\Avidemux 2.4
Detect2=HKLM\Software\Avidemux 2.5
Detect3=HKLM\Software\Avidemux 2.6
FileKey1=%AppData%\avidemux|admlog.txt

[Avira AntiVir Desktop *]
LangSecRef=3024
Detect1=HKCU\Software\Avira\Antivirus
Detect2=HKLM\Software\Avira\AntiVir Desktop
FileKey1=%CommonAppData%\Avira\AntiVir*\IPM|*.*|RECURSE
FileKey2=%CommonAppData%\Avira\AntiVir*\REPORTS|*.*
FileKey3=%ProgramFiles%\Avira GmbH|*.log|RECURSE

[Avira Phantom VPN *]
LangSecRef=3024
DetectFile=%CommonAppData%\Avira\VPN
FileKey1=%CommonAppData%\Avira\VPN|*.log

[Avira System Speedup *]
LangSecRef=3024
Detect1=HKLM\Software\Avira\Speedup
Detect2=HKLM\Software\AviraSpeedup
FileKey1=%CommonAppData%\Avira\Launcher\Logfiles|*.log
FileKey2=%CommonAppData%\Avira\SystemSpeedup\Errors|*.*
FileKey3=%CommonAppData%\Avira\SystemSpeedup\Logs|*.*
FileKey4=%LocalAppData%\AviraSpeedup\logs|*.*

[AVS Audio Converter 6 *]
LangSecRef=3023
DetectFile=%AppData%\AVS4YOU\AVSAudioConverter6
FileKey1=%AppData%\AVS4YOU\AVSAudioConverter6|recentfiles.*

[AVS Audio Editor *]
LangSecRef=3023
DetectFile=%AppData%\AVS4YOU\AVSAudioEditor
FileKey1=%AppData%\AVS4YOU\AVSAudioEditor|Recent*.txt

[AVS Registry Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\AVS4YOU\RegistryCleaner
DetectFile=%ProgramFiles%\AVS4YOU\AVSRegistryCleaner\AVSRegistryCleaner.exe
FileKey1=%AppData%\AVS4YOU\AVSRegistryCleaner*\Logs|*.log
FileKey2=%AppData%\AVS4YOU\AVSRegistryCleaner\RollBack|*.*|RECURSE
FileKey3=%ProgramFiles%\AVS4YOU|*.rtf

[Awesomium *]
LangSecRef=3021
DetectFile=%AppData%\Awesomium
FileKey1=%AppData%\Awesomium|*.log
FileKey2=%AppData%\Awesomium\*|Archived History;History;Cookies
FileKey3=%AppData%\Awesomium\*\Cache|*.*|REMOVESELF
FileKey4=%AppData%\Awesomium\*\Local Storage|*.*|REMOVESELF

[Axialis IconWorkshop *]
LangSecRef=3023
Detect=HKCU\Software\Axialis\IconWorkshop
FileKey1=%Documents%\Axialis Librarian\Deleted Items|*.del;*.ii
RegKey1=HKCU\Software\Axialis\IconWorkshop\folders|CurrentExportDirectory
RegKey2=HKCU\Software\Axialis\IconWorkshop\folders|CurrentImportDirectory
RegKey3=HKCU\Software\Axialis\IconWorkshop\folders|CurrentOpenDirectory
RegKey4=HKCU\Software\Axialis\IconWorkshop\rss|MostRecentNewsId
RegKey5=HKCU\Software\Axialis\IconWorkshop\rss|News1
RegKey6=HKCU\Software\Axialis\IconWorkshop\rss|News2
RegKey7=HKCU\Software\Axialis\IconWorkshop\rss|News3
RegKey8=HKCU\Software\Axialis\IconWorkshop\rss|News4
RegKey9=HKCU\Software\Axialis\IconWorkshop\rss|News5
RegKey10=HKCU\Software\Axialis\IconWorkshop\rss|News6
RegKey11=HKCU\Software\Axialis\IconWorkshop\rss|News7
RegKey12=HKCU\Software\Axialis\IconWorkshop\rss|News8
RegKey13=HKCU\Software\Axialis\IconWorkshop\rss|News9
RegKey14=HKCU\Software\Axialis\IconWorkshop\rss|News10
RegKey15=HKCU\Software\Axialis\IconWorkshop\rss|News11
RegKey16=HKCU\Software\Axialis\IconWorkshop\rss|News12
RegKey17=HKCU\Software\Axialis\IconWorkshop\rss|News13
RegKey18=HKCU\Software\Axialis\IconWorkshop\rss|News14
RegKey19=HKCU\Software\Axialis\IconWorkshop\rss|News15
RegKey20=HKCU\Software\Axialis\IconWorkshop\rss|News16
RegKey21=HKCU\Software\Axialis\IconWorkshop\rss|News17
RegKey22=HKCU\Software\Axialis\IconWorkshop\rss|News18
RegKey23=HKCU\Software\Axialis\IconWorkshop\rss|News19
RegKey24=HKCU\Software\Axialis\IconWorkshop\rss|News20
RegKey25=HKCU\Software\Axialis\IconWorkshop\rss|UnreadNews

[AzureWave *]
LangSecRef=3022
DetectFile=%CommonAppData%\AzureWave
FileKey1=%CommonAppData%\AzureWave|*.log

[Babylon *]
LangSecRef=3024
Detect=HKCU\Software\Babylon\Babylon Translator\UserInfo
RegKey1=HKCU\Software\Babylon\Babylon Translator\UserInfo\History

[Backyard Basketball 2004 *]
Section=Games
DetectFile=%ProgramFiles%\Atari\Backyard Basketball 2004
FileKey1=%ProgramFiles%\Atari\Backyard Basketball 2004|*.log

[Bad Piggies *]
Section=Games
DetectFile=%ProgramFiles%\Rovio\Bad Piggies
FileKey1=%ProgramFiles%\Rovio\Bad Piggies\BadPiggies_Data|output_log.txt

[Badlion Client *]
Section=Games
DetectFile=%AppData%\Badlion Client
FileKey1=%AppData%\Badlion Client|*.log
FileKey2=%AppData%\Badlion Client\GPUCache|*.*
FileKey3=%AppData%\Badlion Client\logs\launcher|*.*

[Baidu PC Faster *]
LangSecRef=3024
Detect=HKCU\Software\Baidu Security
FileKey1=%CommonAppData%\Baidu Security\RpData|*.tmp
FileKey2=%Documents%\Baidu Security\Bav\Dump|*.*|REMOVESELF
FileKey3=%Documents%\Baidu Security\PC Faster\*\Dump|*.*|REMOVESELF
FileKey4=%Documents%\Baidu Security\PC Faster\*\log|*.*|REMOVESELF

[Baidu Spark *]
LangSecRef=3021
Detect=HKCU\Software\Baidu
FileKey1=%CommonAppData%\Baidu\Spark\AutoUpdate\updatelog|*.*

[Banished *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\242920
FileKey1=%Documents%\Banished\Save|Crash*.dmp

[Barnes & Noble Desktop Reader *]
LangSecRef=3021
DetectFile=%AppData%\Barnes & Noble\BNDesktopReader
FileKey1=%AppData%\Barnes & Noble\BNDesktopReader\CachedImages|*.*

[BartVPN *]
LangSecRef=3022
DetectFile=%LocalAppData%\BartVPN
FileKey1=%LocalAppData%\BartVPN|*.log

[BATExpert *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\BATExpert
FileKey1=%AppData%\KC Softwares\BATExpert|*.log

[Batman: Arkham Asylum *]
Section=Games
Detect1=HKLM\Software\Eidos Interactive Limited\Batman: Arkham Asylum
Detect2=HKLM\Software\RocksteadyLtd\Batman Arkham Asylum
FileKey1=%Documents%\*\Batman Arkham Asylum*\BmGame|*.log|RECURSE

[Batman: Arkham City *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\57400
Detect2=HKCU\Software\Valve\Steam\Apps\200260
Detect3=HKLM\Software\Warner Bros\Batman Arkham City
FileKey1=%Documents%\WB Games\Batman Arkham City*\BmGame\Logs|*.*

[Batman: Arkham Origins *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\209000
FileKey1=%ProgramFiles%\Steam\steamapps\common\Batman Arkham Origins\SinglePlayer\BMGame\Logs|*.*

[Battle Islands *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\305260
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Battle Islands\BattleIslands_Data|output_log.txt

[Battle.net *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Battle.net
FileKey1=%CommonAppData%\Battle.net|*.log|RECURSE
FileKey2=%CommonAppData%\Battle.net\*\Logs|*.*|RECURSE
FileKey3=%CommonAppData%\Battle.net\Agent\Agent.*\Logs|*.*|RECURSE
FileKey4=%CommonAppData%\Battle.net\Client\Blizzard Launcher.*\Logs|*.*|RECURSE
FileKey5=%CommonAppData%\Battle.net\Setup\*\Logs|*.*
FileKey6=%CommonAppData%\Battle.net\Telemetry|*.*
FileKey7=%LocalAppData%\Battle.net\Errors|*.*
FileKey8=%LocalAppData%\Battle.net\Logs|*.*|RECURSE
FileKey9=%LocalAppData%\Blizzard Entertainment\System Survey|*.log|RECURSE
FileKey10=%LocalAppData%\Blizzard Entertainment\System Survey|log.txt

[Battle.net Cache *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Battle.net
FileKey1=%CommonAppData%\Blizzard Entertainment\Battle.net\Cache|*.*|RECURSE
FileKey2=%LocalAppData%\Battle.net\BrowserCache|*.*|RECURSE
FileKey3=%LocalAppData%\Battle.net\Cache|*.*|RECURSE
FileKey4=%LocalAppData%\Blizzard Entertainment\Battle.net\Cache|*.*|RECURSE

[Battlefield 3 *]
Section=Games
Detect=HKLM\Software\EA Games\Battlefield 3
FileKey1=%ProgramFiles%\Origin Games\Battlefield 3\__Installer|InstallLog.txt

[BB FlashBack/TestAssistant *]
LangSecRef=3023
Detect1=HKLM\Software\Blueberry Software\BB FlashBack Express
Detect2=HKLM\Software\Blueberry Software\BB FlashBack Pro 4
Detect3=HKLM\Software\Blueberry Software\BB FlashBack Standard 4
Detect4=HKLM\Software\Blueberry Software\BB TestAssistant Expert 4
Detect5=HKLM\Software\Blueberry Software\BB TestAssistant Pro 4
FileKey1=%AppData%\Blueberry|ExportToAVIStat.txt;ExportToQTStat.txt;ExportToSWFStat.txt;ExportToWMVStat.txt;* CrashTracking.xml;* UsageTracking.xml;RecorderStat.txt;RecorderStaticStat.txt
FileKey2=%AppData%\LogSys|*.*|REMOVESELF
FileKey3=%CommonProgramFiles%\Blueberry Software|*.log
FileKey4=%ProgramFiles%\Blueberry Software\*|drvinstlog.txt;*.log
FileKey5=%WinDir%\System32\MTSLog|*.*|REMOVESELF

[BeamNG.drive *]
Section=Games
DetectFile=%Documents%\BeamNG.drive
FileKey1=%Documents%\BeamNG.drive|*.log

[Beckhoff TwinCat *]
LangSecRef=3021
Detect=HKCU\Software\Beckhoff
FileKey1=%SystemDrive%\TwinCAT\3.1\Components\TcEventLogger\EventConfigurator|~evtCfgTmp*.html
FileKey2=%UserProfile%|*TwinCat*.log;TC*.log;TF*.log

[Belarc Advisor *]
LangSecRef=3024
Detect=HKCU\Software\Belarc
FileKey1=%ProgramFiles%\Belarc\*Advisor|install.log
FileKey2=%ProgramFiles%\Belarc\*Advisor\System|Progress.Log
FileKey3=%ProgramFiles%\Belarc\*Advisor\System\Security\BelNotify|BelNotify.log;History.log;HistoryHF.log
FileKey4=%ProgramFiles%\Belarc\*Advisor\System\Tmp|*.*

[Benthic PLEdit *]
LangSecRef=3024
Detect=HKCU\Software\Benthic\PLEdit32
FileKey1=%ProgramFiles%\Benthic|*.txt
RegKey1=HKCU\Software\Benthic\PLEdit32\RecentFiles

[BestBuy Software Installer *]
LangSecRef=3024
DetectFile=%CommonAppData%\Best Buy Software Installer
FileKey1=%CommonAppData%\Best Buy Software Installer\Resources\Cache|*.*

[Betrayer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105430
FileKey1=%Documents%\Betrayer\UDKGame\Logs|*.*

[Better Explorer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Better Explorer
FileKey1=%ProgramFiles%\Better Explorer|log.txt

[BetterDiscord *]
LangSecRef=3022
DetectFile=%AppData%\BetterDiscord
FileKey1=%AppData%\BetterDiscord|*.log
FileKey2=%AppData%\BetterDiscord\temp|*.*|REMOVESELF

[Beyond Compare *]
LangSecRef=3021
Detect=HKCU\Software\Scooter Software\Beyond Compare
FileKey1=%AppData%\Scooter Software\Beyond Compare*|*.bak
RegKey1=HKCU\Software\Scooter Software\Beyond Compare\Recent

[Big City Adventure *]
Section=Games
Detect1=HKCU\Software\JollyBear\Big City Adventure San Francisco
Detect2=HKCU\Software\JollyBear\Big City Adventure Sydney
FileKey1=%CommonAppData%\JollyBear\Big City Adventure *|error.*

[Big Fish Games *]
Section=Games
Detect=HKCU\Software\Big Fish Games
FileKey1=%CommonAppData%\Big Fish Games\Game Manager\resources-old|*.*|RECURSE
FileKey2=%CommonAppData%\Big Fish\Game Manager\Addons\BFGameLauncher|*.log|RECURSE
FileKey3=%CommonAppData%\BigFishCache\GameManager\log|*.txt|RECURSE
FileKey4=%CommonAppData%\BigFishGamesCache\GameManager\log|*.*

[Big Fish Games Installers *]
Section=Games
Detect=HKCU\Software\Big Fish Games
FileKey1=%CommonAppData%\BigFishCache|*.exe|RECURSE

[BiglyBT *]
LangSecRef=3022
Detect=HKCU\Software\BiglyBT
FileKey1=%AppData%\BiglyBT|ipfilter.cache
FileKey2=%AppData%\BiglyBT\active|*.bak
FileKey3=%AppData%\BiglyBT\logs|*.*
FileKey4=%AppData%\BiglyBT\tmp|*.*
FileKey5=%ProgramFiles%\BiglyBT|*.log|RECURSE

[Bing Dynamic *]
LangSecRef=3023
DetectFile=%LocalAppData%\Microsoft\Windows\Themes\BingDynamic1.theme
Warning=This will cause you to redownload the Bing Dynamic RSS file.
FileKey1=%LocalAppData%\Microsoft\Feeds|http~c~f~fthemeserver~dmicrosoft~dcom~fdefault~daspx~mp*Bing*

[Bing Finance *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingFinance_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingFinance_*\TempState|*.*|RECURSE

[Bing Food & Drink *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingFoodAndDrink_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingFoodAndDrink_*\LocalState\Cache|*.*|RECURSE

[Bing Health & Fitness *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingHealthAndFitness_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingHealthAndFitness_*\LocalState\Cache|*.*|RECURSE

[Bing Maps *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingMaps_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\CLR_v4.0\NativeImages\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.BingMaps*\LocalState\Bing.Maps|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.BingMaps*\LocalState\MapInstrumentation|*.*
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingMaps_8wekyb3d8bbwe\SearchHistory

[Bing News *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\PRICache|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingNews_*\LocalState\navigationHistory|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe\SearchHistory

[Bing Search *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Bing_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Bing_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Bing_8wekyb3d8bbwe\SearchHistory

[Bing Sports *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingSports_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingSports_*\LocalState\navigationHistory|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.BingSports_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingSports_8wekyb3d8bbwe\SearchHistory

[Bing Travel *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingTravel_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingTravel_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingTravel_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingTravel_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.BingTravel_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingTravel_8wekyb3d8bbwe\SearchHistory

[BioShock Infinite *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\8870
FileKey1=%Documents%\my games\BioShock Infinite\Benchmarks|*.*

[BIT.TRIP *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\63700
Detect2=HKCU\Software\Valve\Steam\Apps\63710
FileKey1=%LocalAppData%\BIT.TRIP *|*.txt

[Bitcoin *]
LangSecRef=3022
Detect1=HKCU\Software\Bitcoin
Detect2=HKCU\Software\Bitcoin Core
Detect3=HKLM\Software\Bitcoin Core
FileKey1=%AppData%\Bitcoin|*.log;*.old

[Bitdefender *]
LangSecRef=3024
Detect1=HKLM\Software\Bitdefender\Bitdefender Internet Security
Detect2=HKLM\Software\Bitdefender\Bitdefender Total Security
Detect3=HKLM\Software\Bitdefender\Bitdefender Total Security 2015
Detect4=HKLM\Software\Softwin\Bitdefender Antivirus
FileKey1=%AppData%\Bitdefender\Desktop\profiles\Logs\*|*.xml
FileKey2=%CommonAppData%\Bitdefender\DTrace|*.log
FileKey3=%ProgramFiles%\Softwin\Bitdefender*\Logs|*.*
FileKey4=%SystemDrive%|bdlog.txt

[BitTorrent *]
LangSecRef=3022
DetectFile1=%AppData%\BitTorrent\BitTorrent.exe
DetectFile2=%ProgramFiles%\BitTorrent\BitTorrent.exe
FileKey1=%AppData%\BitTorrent\ie|*.tmp
FileKey2=%AppData%\BitTorrent\Updates|*.exe
FileKey3=%LocalLowAppData%\BitTorrent|BitTorrent_*

[BitTorrent Incomplete Downloads *]
LangSecRef=3022
Detect=HKCU\Software\BitTorrent
FileKey1=%AppData%\BitTorrent\incomplete|*.*

[BitTorrent Sync *]
LangSecRef=3023
DetectFile=%AppData%\BitTorrent Sync
FileKey1=%AppData%\BitTorrent Sync|*.log;*.old

[BlackBeltPrivacy DarkNet *]
LangSecRef=3023
DetectFile=%LocalAppData%\BlackBeltPrivacy
FileKey1=%LocalAppData%\BlackBeltPrivacy\3rdParty|*.*|RECURSE
FileKey2=%LocalAppData%\BlackBeltPrivacy\darkNet\logs|*.*|RECURSE
FileKey3=%LocalAppData%\BlackBeltPrivacy\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\BlackBeltPrivacy\MicroSip|MicroSIP.log

[BlackBerry AddinSync *]
LangSecRef=3021
DetectFile=%AppData%\Research In Motion\BlackBerry\AddinSync
FileKey1=%AppData%\Research In Motion\BlackBerry\AddinSync|sync.log

[BlackBerry Desktop Software *]
LangSecRef=3023
Detect=HKCU\Software\Research In Motion\BlackBerry
FileKey1=%AppData%|Rim*.log
FileKey2=%AppData%\Research In Motion\BlackBerry Desktop|*.dmp
FileKey3=%LocalAppData%\Research In Motion\BlackBerry*Desktop\*\*|*.backup
FileKey4=%LocalAppData%\Research In Motion\BlackBerry*Desktop\*\*\Log|*.html
FileKey5=%LocalAppData%\Research In Motion\BlackBerry*Desktop\Logs|*.*|REMOVESELF

[BlackBerry Intellisync *]
LangSecRef=3021
DetectFile=%AppData%\Research In Motion\BlackBerry\Intellisync
FileKey1=%AppData%\Research In Motion\BlackBerry\Intellisync|*.log|RECURSE

[Blade Symphony *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225600
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Blade Symphony\workshop_temp|*.*|RECURSE

[Blades of Time *]
Section=Games
DetectFile=%LocalAppData%\BladesOfTime
FileKey1=%LocalAppData%\BladesOfTime\_debuginfo|*.*

[BleachBit *]
LangSecRef=3024
Detect=HKCU\Software\BleachBit
FileKey1=%ProgramFiles%\BleachBit|bleachbit.exe.log

[Blender *]
LangSecRef=3023
Detect=HKLM\Software\BlenderFoundation
FileKey1=%AppData%\Blender Foundation\Blender\*\config|recent-files.txt

[Blood Bowl: Legendary Edition *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\58520
Detect2=HKCU\Software\Valve\TestApp58520
FileKey1=%Documents%\BloodBowlLegendary|BB_LE000.log;CEGUI.log;SystemInfo000.log
FileKey2=%Documents%\BloodBowlLegendary\Cache\3d|*.*|REMOVESELF
FileKey3=%Documents%\BloodBowlLegendary\Cache\DB|*.*|REMOVESELF

[Blue-Cloner *]
LangSecRef=3023
Detect=HKCU\Software\Blue-cloner
FileKey1=%AppData%\Blue-Cloner|*.log
FileKey2=%AppData%\Blue-Cloner\ReadCache|*.*|REMOVESELF
FileKey3=%ProgramFiles%\Blue-Cloner|*.log;*.txt

[BlueGriffon *]
LangSecRef=3021
DetectFile=%LocalAppData%\Disruptive Innovations SARL\BlueGriffon
FileKey1=%LocalAppData%\Disruptive Innovations SARL\BlueGriffon\Profiles\*\Cache|*.*|RECURSE

[BlueSky Interactive *]
LangSecRef=3022
DetectFile=%ProgramFiles%\BlueSky Interactive
FileKey1=%ProgramFiles%\BlueSky Interactive\PTP\Settings|*.tmp

[BlueSprig JetClean *]
LangSecRef=3024
DetectFile=%ProgramFiles%\BlueSprig\JetClean\JetClean.exe
FileKey1=%AppData%\BlueSprig\JetClean\Log|*.*
FileKey2=%ProgramFiles%\BlueSprig\JetClean\Update|*.*|REMOVESELF

[BlueStacks APKs *]
LangSecRef=3021
Detect1=HKCU\Software\BlueStacks
Detect2=HKLM\Software\BlueStacks
FileKey1=%CommonAppData%\BlueStacksSetup|*.apk

[Bluetack Blocklist Manager *]
LangSecRef=3024
Detect=HKCU\Software\Bluetack\Blocklist Manager
FileKey1=%ProgramFiles%\Bluetack\Blocklist Manager\Cache|*.*

[Blumentals Easy GIF Animator *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Easy GIF Animator_is1
FileKey1=%ProgramFiles%\Easy GIF Animator|*.txt|RECURSE

[Blurity *]
LangSecRef=3023
DetectFile=%AppData%\Blurity
FileKey1=%AppData%\Blurity|event.log

[Boinc *]
LangSecRef=3024
Detect=HKCU\Software\Space Sciences Laboratory, U.C. Berkeley\BOINC Manager
FileKey1=%ProgramFiles%\BOINC|stdout*.*;stderr*.*

[Borderlands *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\8980
Detect2=HKCU\Software\Valve\Steam\Apps\49520
Detect3=HKCU\Software\Valve\Steam\Apps\261640
Detect4=HKCU\Software\Valve\Steam\Apps\729040
FileKey1=%Documents%\My Games\Borderlands*\WillowGame\Logs|*.*

[Borland C++ Builder 5.0 *]
LangSecRef=3024
Detect=HKCU\Software\Borland\C++Builder\5.0
RegKey1=HKCU\Software\Borland\C++Builder\5.0\Closed Files
RegKey2=HKCU\Software\Borland\C++Builder\5.0\Closed Projects
RegKey3=HKCU\Software\Borland\C++Builder\5.0\Session

[Borland Delphi 7 *]
LangSecRef=3024
Detect=HKCU\Software\Borland\Delphi\7.0
RegKey1=HKCU\Software\Borland\Delphi\7.0\Closed Files
RegKey2=HKCU\Software\Borland\Delphi\7.0\Closed Projects
RegKey3=HKCU\Software\Borland\Delphi\7.0\Session

[Borland Developer Studio 2006 *]
LangSecRef=3024
Detect=HKCU\Software\Borland\BDS\4.0
RegKey1=HKCU\Software\Borland\BDS\4.0\Closed Files
RegKey2=HKCU\Software\Borland\BDS\4.0\Closed Projects
RegKey3=HKCU\Software\Borland\BDS\4.0\Session

[BOSS *]
Section=Games
DetectFile=%SystemDrive%\BOSS
FileKey1=%SystemDrive%\BOSS\*|BOSSlog.*

[Box *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\134D4F5B.Box_2qk4zy5s3qmee
FileKey1=%LocalAppData%\Packages\134D4F5B.Box_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\134D4F5B.Box_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\134D4F5B.Box_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\134D4F5B.Box_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\134D4F5B.Box_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey6=%LocalAppData%\Packages\134D4F5B.Box_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\134D4F5B.Box_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\134D4F5B.Box_*\LocalState|*.*|RECURSE

[Breevy Backups *]
LangSecRef=3021
DetectFile=%AppData%\Breevy
FileKey1=%AppData%\Breevy\Backups|*.*

[Broadcom Wireless LAN Driver *]
LangSecRef=3021
DetectFile=%SystemDrive%\Drivers\Broadcom Wireless LAN Driver
FileKey1=%SystemDrive%\Drivers\Broadcom Wireless LAN Driver|*.log|RECURSE

[Broforce *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\274190
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Broforce\*\Broforce Logs|*.csv

[Broken Shortcut Fixer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ConsumerSoft\Broken Shortcut Fixer
FileKey1=%ProgramFiles%\ConsumerSoft\Broken Shortcut Fixer|ht.htm

[Brother P-touch *]
LangSecRef=3021
DetectFile=%LocalAppData%\Brother\P-touch Update Software
FileKey1=%LocalAppData%\Brother\P-touch Update Software|*.log

[Brother Printer *]
LangSecRef=3024
Detect=HKLM\Software\Brother
DetectFile=%CommonAppData%\Brother
FileKey1=%CommonAppData%\Brother\BrLog|*.log
FileKey2=%ProgramFiles%\Brother|*.tmp|RECURSE

[Brothers - A Tale of Two Sons *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225080
FileKey1=%Documents%\my games\UnrealEngine3\P13\Logs|*.*

[BrowserSync *]
LangSecRef=3022
DetectFile=%AppData%\BrowserSync
FileKey1=%AppData%\BrowserSync|log.txt

[BSD *]
LangSecRef=3023
DetectFile=%AppData%\BSD
FileKey1=%AppData%\BSD\*\logs|*.*|RECURSE
FileKey2=%AppData%\BSD\MediaWidget\PodCache|*.*|RECURSE

[BSPlayer *]
LangSecRef=3021
Detect1=HKCU\Software\BST\bsplayer
Detect2=HKCU\Software\BST\bsplayerv1
DetectFile1=%ProgramFiles%\BSPlayer\bsplayer.exe
DetectFile2=%ProgramFiles%\Webteh\BSPlayer\bsplayer.exe
FileKey1=%AppData%\BSplayer\AC3 Filter|unreg.log;Changes.txt
FileKey2=%AppData%\BSplayer\cache|*.*
FileKey3=%AppData%\BSplayer\FFDShow|unreg.log
FileKey4=%AppData%\BSplayer\Flash Video (FLV)|unreg.log
FileKey5=%AppData%\BSplayer\Haali media splitter|unreg.log
FileKey6=%AppData%\BSplayer\MPEG*decoder|unreg.log
FileKey7=%AppData%\BSplayer\RealMedia splitter|unreg.log
FileKey8=%ProgramFiles%\BSPlayer|bugreport.txt
FileKey9=%ProgramFiles%\BSPlayer\lang|lang_changes.txt
FileKey10=%ProgramFiles%\Webteh\BSplayerPro|*.jpg
FileKey11=%ProgramFiles%\Webteh\BSplayerPro\cache|*.mpos

[Buchstabenzoo BHV *]
LangSecRef=3021
DetectFile=%AppData%\bhv-gswvs\users
FileKey1=%AppData%\bhv-gswvs\users\*\Buchstabenzoo|*.log

[Bugsplat *]
LangSecRef=3024
Detect=HKCU\Software\Bugsplat
RegKey1=HKCU\Software\Bugsplat\gaspowered\SupremeCommander
RegKey2=HKCU\Software\Bugsplat\lol_beta_riotgames_com\LOL_Public
RegKey3=HKCU\Software\Bugsplat\Pando_win\Pando
RegKey4=HKCU\Software\Bugsplat\Relic\CoH
RegKey5=HKCU\Software\Bugsplat\Relic\RelicDownloader

[Bulk Rename Utility *]
LangSecRef=3024
Detect=HKCU\Software\TGRMN Software\Bulk Rename Utility
RegKey1=HKCU\Software\TGRMN Software\Bulk Rename Utility\Recent File List
RegKey2=HKCU\Software\TGRMN Software\Bulk Rename Utility\Settings|last_path_selected

[Bullzip PDF Printer *]
LangSecRef=3022
DetectFile=%AppData%\PDF Writer\Bullzip PDF Printer
FileKey1=%AppData%\PDF Writer\Bullzip PDF Printer|user.ini

[BumpTop *]
LangSecRef=3021
Detect=HKCU\Software\Bump Technologies, Inc.
FileKey1=%AppData%\Bump Technologies, Inc\BumpTop|*log.txt
FileKey2=%AppData%\Bump Technologies, Inc\BumpTop\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Bump Technologies, Inc\BumpTop\*Cache|*.*|RECURSE
FileKey4=%LocalAppData%\Bump Technologies, Inc\BumpTop\Previous|*.*
FileKey5=%LocalAppData%\Bump Technologies, Inc\BumpTop\Temp|*.*

[BumpTop StickyNotes *]
LangSecRef=3021
Detect=HKCU\Software\Bump Technologies, Inc.
FileKey1=%UserProfile%\Desktop|StickyNote*.txt

[Burger Shop *]
Section=Games
Detect1=HKCU\Software\GoBit\BurgerShop
Detect2=HKCU\Software\GoBit\BurgerShop2
FileKey1=%CommonAppData%\GoBit Games\BurgerShop2\*\cached|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Burger Shop|*.db;*.txt|RECURSE
FileKey3=%ProgramFiles%\Burger Shop\cached|*.*|REMOVESELF
FileKey4=%ProgramFiles%\GoBit Games\Burger Shop 2|*.db;*.txt|RECURSE

[Burn Zombie Burn! *]
Section=Games
Detect=HKLM\Software\Burn Zombie Burn
FileKey1=%ProgramFiles%\P2 Games\Burn Zombie Burn|*.log

[Burn Zombie Burn! .NET Installer *]
Section=Games
Detect=HKLM\Software\Burn Zombie Burn
Warning=Make sure .NET Framework 3.0 is installed before running this.
FileKey1=%ProgramFiles%\P2 Games\Burn Zombie Burn\REQS\NET|*.*|REMOVESELF

[Bus-Simulator 2009 *]
Section=Games
DetectFile=%ProgramFiles%\Bus-Simulator 2009
FileKey1=%ProgramFiles%\Bus-Simulator 2009|*.dmp;*.log|RECURSE

[Business Objects Enterprise 11 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Business Objects\Business Objects Enterprise 11
FileKey1=%ProgramFiles%\Business Objects\Business Objects Enterprise 11\Logging|*.*

[CA Security Center *]
LangSecRef=3021
Detect=HKLM\Software\CA\CAPF
FileKey1=%CommonAppData%\CA|*.log;*.txt|RECURSE
FileKey2=%LocalLowAppData%\CA\Consumer\APH|*.log

[Cached Certification Files *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalLowAppData%\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey2=%LocalLowAppData%\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE
FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey4=%WinDir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE
FileKey5=%WinDir%\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey6=%WinDir%\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE
FileKey7=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey8=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE
FileKey9=%WinDir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey10=%WinDir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE
FileKey11=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey12=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE

[Cached File Extensions *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=This possibly will reset default programs back to default on Windows 8/8.1.
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
RegKey2=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts

[Cached Shell Extensions *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
RegKey2=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

[Calculator *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsCalculator_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\TempState|*.*|RECURSE

[Calendar Magic *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\EuroSoft\Calendar Magic
DetectFile2=%SystemDrive%\EuroSoft\Calendar Magic
FileKey1=%ProgramFiles%\EuroSoft\Calendar Magic|debug.txt
FileKey2=%SystemDrive%\EuroSoft\Calendar Magic|debug.txt

[Calendar Magic Backups *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\EuroSoft\Calendar Magic
DetectFile2=%SystemDrive%\EuroSoft\Calendar Magic
FileKey1=%ProgramFiles%\EuroSoft\Calendar Magic|*.bak
FileKey2=%SystemDrive%\EuroSoft\Calendar Magic|*.bak

[Calibre *]
LangSecRef=3021
DetectFile=%LocalAppData%\calibre-cache\jsbrowser
FileKey1=%LocalAppData%\calibre-cache\jsbrowser\data*|*.*|RECURSE

[Call of Atlantis *]
Section=Games
Detect=HKLM\Software\Playrix\Call of Atlantis
FileKey1=%CommonAppData%\Playrix Entertainment\Call of Atlantis\Log|*.*

[Call of Juarez *]
Section=Games
Detect1=HKLM\Software\Techland\CallOfJuarez
Detect2=HKLM\Software\Techland\CallofJuarez2
FileKey1=%Documents%\Call Of Juarez*\Out\logs|*.log|RECURSE

[Camera *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Camera_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsCamera_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.*Camera_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.*Camera_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.*Camera_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.*Camera_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.*Camera_*\AC\PRICache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.*Camera_*\AC\Temp|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.*Camera_*\TempState|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\LocalCache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\LocalState\AppData|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\LocalState\Cache|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Camera_8wekyb3d8bbwe\SearchHistory

[Cameyo *]
LangSecRef=3021
Detect=HKCU\Software\VOS
FileKey1=%AppData%\VOS|*.*|REMOVESELF
RegKey1=HKCU\Software\VOS

[CamStudio *]
LangSecRef=3023
Detect=HKCU\Software\CamStudioOpenSource for Nick
FileKey1=%Documents%\My CamStudio Temp Files|*.*

[Camtasia *]
LangSecRef=3023
Detect=HKCU\Software\TechSmith\Camtasia Studio
FileKey1=%AppData%\TechSmith\CamtasiaStudio\Logs|*.*|RECURSE
FileKey2=%CommonAppData%\TechSmith\Camtasia Studio *\Library *\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\TechSmith\Camtasia Studio\*\Trackerbird_Files|tblog.log
FileKey4=%LocalAppData%\TechSmith\Logs|*.*|RECURSE
RegKey1=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Recorder\9.0\General|lstLastSaveDir
RegKey2=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|ExportAsZipMru
RegKey3=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|FileSaveAsMru
RegKey4=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|MRUImportFolder
RegKey5=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|MRUOpenProjectFolder
RegKey6=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|RecentRecordingsMru
RegKey7=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Recorder\18.0\General|lstLastSaveDir
RegKey8=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|ExportAsZipMru
RegKey9=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|FileSaveAsMru
RegKey10=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|MRUImportFolder
RegKey11=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|MRUOpenProjectFolder
RegKey12=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|RecentRecordingsMru

[Canon Digital Photo Professional 4 *]
LangSecRef=3021
Detect=HKLM\Software\Canon_Inc_IC\DPP4
DetectFile=%ProgramFiles%\Canon\Digital Photo Professional 4
FileKey1=%AppData%\Canon_Inc_IC\DPP4\Application\Temp|*.*|RECURSE
FileKey2=%AppData%\Canon_Inc_IC\DPP4\DppMWare\Cache|*.*|RECURSE
FileKey3=%AppData%\Canon_Inc_IC\ServiceLog\AutoUpdateService|*.txt
FileKey4=%AppData%\Canon_Inc_IC\ServiceLog\imagebrowserexservice|*.txt
FileKey5=%CommonAppData%\Canon_Inc_IC\UniversalInstaller\ServiceLog|*.TXT

[Canon Inkjet Print Utility *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\34791E63.CanonInkjetPrintUtility_6e5tt8cgb93ep
FileKey1=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*
FileKey3=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\TempState|*.*|RECURSE

[Canon Printer *]
LangSecRef=3021
DetectFile1=%CommonAppData%\CanonBJ\IJPrinter\CNMWindows\drvlog*
DetectFile2=%CommonAppData%\CanonBJ\IJPrinter\CNMWindows\plmlog*
FileKey1=%CommonAppData%\CanonBJ\IJPrinter\CNMWindows|drvlog*.*;plmlog*.*|RECURSE

[Canon Zoom Browser *]
LangSecRef=3021
Detect=HKCU\Software\Canon\ZoomBrowser Ex
DetectFile1=%AppData%\ZoomBrowser EX
DetectFile2=%Pictures%\ZbThumbnail.info
FileKey1=%Pictures%|ZbThumbnail.info|RECURSE

[Caprine *]
LangSecRef=3022
DetectFile=%AppData%\Caprine
FileKey1=%AppData%\Caprine|*-journal;LOG;LOG.old|RECURSE
FileKey2=%AppData%\Caprine|Network Persistent State
FileKey3=%AppData%\Caprine\*Cache|*.*|RECURSE
FileKey4=%AppData%\Caprine\blob_storage|*.*|RECURSE
FileKey5=%AppData%\Caprine\Caprine\logs|*.*
FileKey6=%AppData%\Caprine\logs|*.*
FileKey7=%AppData%\Caprine\Session Storage|*.*|RECURSE
FileKey8=%LocalAppData%\caprine-updater|*.*|RECURSE

[Captcha Brotherhood *]
LangSecRef=3024
DetectFile=%LocalAppData%\Captcha_Brotherhood
FileKey1=%LocalAppData%\Captcha_Brotherhood|solver_logFile.txt;plugin_logFile.txt;solver_captchaLog.txt

[Casper *]
LangSecRef=3024
Detect1=HKCU\Software\Future Systems Solutions\Casper
Detect2=HKCU\Software\Future Systems Solutions\Casper 10
FileKey1=%CommonAppData%\Future Systems Solutions\Casper\Minidump|*.*

[Casual Arts *]
Section=Games
DetectFile=%AppData%\CasualArts
FileKey1=%AppData%\casualArts\*|logfile.*;*.txt|RECURSE
FileKey2=%CommonAppData%\casualArts|*.*|REMOVESELF

[Cave Story+ *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\200900
FileKey1=%ProgramFiles%\Steam\steamapps\common\cave story+|log.txt
FileKey2=%ProgramFiles%\Steam\steamapps\common\cave story+\data|*.DS_STORE|RECURSE

[CC Magic *]
Section=Games
DetectFile=%Documents%\Electronic Arts\CC Magic\Logs
FileKey1=%Documents%\Electronic Arts\CC Magic\Logs|*.log|RECURSE

[CCDump *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CCleaner\CCDump.exe
Warning=This removes files winapp.ini, winsys.ini, winreg.ini and regkeys.output.txt from the CCleaner folder.
FileKey1=%ProgramFiles%\CCleaner|winapp.ini;winreg.ini;winsys.ini;regkeys.output.txt

[CCFinder *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\CCfinder
FileKey1=%LocalAppData%\FlickrNet|responseCache.dat

[CCleaner *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\CCleaner
FileKey1=%ProgramFiles%\CCleaner|*.dmp;*.log;CCleaner_log*.txt
FileKey2=%ProgramFiles%\CCleaner\Setup|*.*|REMOVESELF
FileKey3=%ProgramFiles%\CCleaner\temp_ccupdate|*.*|REMOVESELF
FileKey4=%UserProfile%|CCleaner_log*.txt

[CCleaner Network *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CCleaner Network\Management Server\CCN-MgmtSrv.exe
FileKey1=%CommonAppData%\Gibraltar\Local Logs\CCleaner Network|*.glf
FileKey2=%ProgramFiles%\CCleaner Network\Management Server\Logs|*.log

[CCTV Security *]
LangSecRef=3021
DetectFile=%ProgramFiles%\CCTV Security
FileKey1=%ProgramFiles%\CCTV Security\Log|*.*

[CD-R Diagnostic *]
LangSecRef=3024
Detect=HKCU\Software\CDROM_Productions\CDRDIAG
FileKey1=%Documents%|ERRORLOG.TXT
FileKey2=%ProgramFiles%\CDRDiagnostic|*.cnt
RegKey1=HKCU\Software\CDROM_Productions\CDRDIAG|LastCopyDir
RegKey2=HKCU\Software\CDROM_Productions\CDRDIAG|LastDevice

[CD Burning *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning
Warning=This will wipe all files that are waiting to be burned.
FileKey1=%LocalAppData%\Microsoft\CD Burning|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\Burn|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo

[CDex *]
LangSecRef=3024
Detect=HKLM\Software\CDex
FileKey1=%Music%\CDDB|*.txt

[Centarsia *]
LangSecRef=3021
Detect=HKCU\Software\Centarsia
RegKey1=HKCU\Software\Centarsia|RecentImage0
RegKey2=HKCU\Software\Centarsia|RecentImage1
RegKey3=HKCU\Software\Centarsia|RecentImage2
RegKey4=HKCU\Software\Centarsia|RecentImage3
RegKey5=HKCU\Software\Centarsia|RecentImage4
RegKey6=HKCU\Software\Centarsia|RecentImage5
RegKey7=HKCU\Software\Centarsia|RecentImage6

[Ceville *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\23460
FileKey1=%AppData%|ceville_console_history.txt
FileKey2=%Documents%\Ceville\logs|*.*

[CFE Exam Prep Course *]
LangSecRef=3021
DetectFile=%ProgramFiles%\CFE Exam Prep Course
FileKey1=%AppData%\ACFEExamPrep|*.log
FileKey2=%ProgramFiles%\CFE Exam Prep Course\Log|*.*|RECURSE

[Chameleon *]
LangSecRef=3024
DetectFile=%Documents%\Chameleon Files
FileKey1=%Documents%\Chameleon Files\Cache|*.*|RECURSE
FileKey2=%Documents%\Chameleon Files\Log|*.*|RECURSE

[Champions Online *]
Section=Games
Detect1=HKCU\Software\Cryptic\Champions Online
Detect2=HKCU\Software\Valve\Steam\Apps\9880
FileKey1=%ProgramFiles%\Steam\Steamapps\Common\Champions Online\*\Logs\GameClient|*.*
FileKey2=%ProgramFiles%\Steam\Steamapps\Common\Champions Online\Champions Online\*\Cache|*.*
FileKey3=%Public%\Games\cryptic studios\Champions Online\*\Cache|*.*
FileKey4=%Public%\Games\cryptic studios\Champions Online\*\Logs\GameClient|*.*

[Cheat Engine *]
LangSecRef=3021
Detect=HKCU\Software\Cheat Engine
FileKey1=%ProgramFiles%\Cheat Engine*|*.tmp

[CheatBook *]
LangSecRef=3021
Detect=HKLM\Software\CheatBook
FileKey1=%ProgramFiles%\Cheatbook Database *|*cheatlog.txt;*suchlog.txt

[Chicken Hunter *]
Section=Games
Detect=HKLM\Software\Chicken Hunter
FileKey1=%ProgramFiles%\Chicken Hunter|debug.txt

[Chicken Invaders *]
Section=Games
DetectFile1=%AppData%\InterAction studios\CI3demo
DetectFile2=%CommonAppData%\InterAction studios\CI2rmdemo
DetectFile3=%ProgramFiles%\Chicken*Invaders*
FileKey1=%AppData%\InterAction studios|*.log|RECURSE
FileKey2=%CommonAppData%\InterAction studios|*.log|RECURSE
FileKey3=%ProgramFiles%\*\Chicken Invaders*|*.log;*.html;*.png|RECURSE
FileKey4=%ProgramFiles%\Chicken*Invaders*|*.log|RECURSE

[Children of the Nile *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17100
FileKey1=%Documents%\Tilted Mill\Children of the Nile|*.log

[Chivalry: Medieval Warfare *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219640
FileKey1=%Documents%\My Games\Chivalry Medieval Warfare*\UDKGame\Logs|*.*

[Chocolatey *]
LangSecRef=3024
DetectFile=%CommonAppData%\chocolatey
FileKey1=%AppData%\ChocolateyGUI\Logs|*.*
FileKey2=%CommonAppData%\chocolatey\lib\*|*.txt
FileKey3=%CommonAppData%\chocolatey\logs|*.log

[Christmas Adventure: Candy Storm *]
Section=Games
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Adventure - Candy Storm1.1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Adventure - Candy Stormv1.3
DetectFile=%ProgramFiles%\Christmas Adventure - Candy Storm
FileKey1=%AppData%\Argali|*.log|RECURSE
FileKey2=%ProgramFiles%\Christmas Adventure - Candy Storm|*.nfo;*.txt
FileKey3=%ProgramFiles%\Foxy Games\Christmas Adventure - Candy Storm|*.html;*.msi;*.nfo;*.txt;*.url

[Christmas Griddlers 2014 *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Griddlers 20141.1
FileKey1=%ProgramFiles%\*\Christmas Griddlers*|*.ico;*.html;*msi;*.nfo;*.txt;*.url|RECURSE
FileKey2=%ProgramFiles%\Christmas Griddlers*|*.ico;*.html;*msi;*.nfo;*.txt;*.url|RECURSE

[Christmas Wonderland *]
Section=Games
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 2
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 3 1.0
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 4 1.0.4
Detect4=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 21.0
Detect5=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 31.0
Detect6=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 41.1
FileKey1=%ProgramFiles%\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE
FileKey2=%ProgramFiles%\Foxy Games\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE
FileKey3=%SystemDrive%\Games\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE

[Chrome Sandbox *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\chrome.sandbox.mfcdmec0b66bbd70f841470aa70f965aa4fb831f77b7f
FileKey1=%LocalAppData%\Packages\chrome.sandbox.*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\chrome.sandbox.*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\chrome.sandbox.*\AC\Temp|*.*|RECURSE

[Chuzzle Deluxe *]
Section=Games
DetectFile=%ProgramFiles%\HP Games\Chuzzle Deluxe
FileKey1=%ProgramFiles%\HP Games\Chuzzle Deluxe|DEBUG.TXT

[Cinema Tycoon *]
Section=Games
Detect1=HKCU\Software\TikGames\Cinema Tycoon Gold
Detect2=HKLM\Software\Big Fish Games\Persistence\GameDB\Cinema Tycoon Gold
Detect3=HKLM\Software\Big Fish Games\Persistence\Install\F2676T1L1
Detect4=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cinema Tycoon 2  Movie Mania1.0
FileKey1=%ProgramFiles%\Cinema Tycoon*|flashplayer7_winax.exe;*.txt

[Cisco Connect *]
LangSecRef=3022
DetectFile=%CommonAppData%\Cisco Systems\Cisco Connect
FileKey1=%CommonAppData%\Cisco Systems\Cisco Connect\Log|*.*

[Cisco HostScan *]
LangSecRef=3021
DetectFile=%LocalAppData%\Cisco\Cisco HostScan\log
FileKey1=%LocalAppData%\Cisco\Cisco HostScan\log|*.log

[Cities in Motion *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\73010
FileKey1=%Documents%\Cities in Motion|log_metro.txt

[Citrix ICA Client *]
LangSecRef=3021
Detect=HKLM\Software\Citrix\ICA Client
FileKey1=%AppData%\Citrix\ICA Client\Cache|*.*
FileKey2=%AppData%\Citrix\ICA Client\Cache\zlcache|*.*
FileKey3=%AppData%\ICAClient|wfcwin32.*
FileKey4=%AppData%\ICAClient\Cache|*.*
FileKey5=%AppData%\ICAClient\Cache\zlcache|*.*
RegKey1=HKLM\Software\Citrix\ICA Client\Default

[Citrix Online Plug-in Web Setup Files *]
LangSecRef=3021
Detect=HKLM\Software\Citrix\ICA Client
FileKey1=%CommonAppData%\Citrix\Citrix Online Plug-in - Web|*.msi;*.cab;eula*.rtf

[Civilization 5 Installers *]
Section=Games
Detect=HKCU\Software\Firaxis\Civilization5
Warning=This will remove DirectX and Visual C++ installers in your Civilization 5 installation directory. They can be reinstalled in your installation source.
FileKey1=%ProgramFiles%\Civilization V*\DirectX|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Civilization V*\VCRedist|*.*|REMOVESELF

[Civilization 5 Old AutoSaves *]
Section=Games
Detect=HKCU\Software\Firaxis\Civilization5
FileKey1=%Documents%\My Games\Sid Meier's Civilization 5\Saves\*\auto\prev|*.Civ5Save

[Civilization Cache *]
Section=Games
Detect1=HKCU\Software\Firaxis\Civilization5
Detect2=HKLM\Software\Firaxis Games
FileKey1=%AppData%\My Games\Beyond the Sword\cache|*.dat
FileKey2=%AppData%\My Games\Sid Meier's Civilization *\cache|*.dat
FileKey3=%AppData%\My Games\Warlords\cache|*.dat
FileKey4=%Documents%\My Games\Sid Meier's Civilization *\cache|*.db
FileKey5=%LocalAppData%\My Games\Beyond the Sword\cache|*.dat
FileKey6=%LocalAppData%\My Games\Sid Meier's Civilization *\cache|*.dat
FileKey7=%LocalAppData%\My Games\Warlords\cache|*.dat

[Civilization Logs *]
Section=Games
Detect1=HKCU\Software\Firaxis\Civilization5
Detect2=HKLM\Software\Firaxis Games
FileKey1=%Documents%\My Games\Beyond the Sword\Logs|*.*
FileKey2=%Documents%\My Games\Sid Meier's Civilization *\Logs|*.*
FileKey3=%Documents%\My Games\Warlords\Logs|*.*
FileKey4=%ProgramFiles%\2K Games\Firaxis Games\Sid Meier's Civilization IV Colonization|*.txt
FileKey5=%ProgramFiles%\Firaxis Games\Sid Meier's Civilization 4|*.txt
FileKey6=%ProgramFiles%\Firaxis Games\Sid Meier's Civilization 4\*|*.txt

[Clam Sentinel *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{060FE577-1BDF-4330-ACCA-B6760AB07191}_is1
FileKey1=%AppData%\ClamSentinel|*.txt
FileKey2=%ProgramFiles%\ClamSentinel|*.txt

[ClamWin *]
LangSecRef=3021
Detect1=HKCU\Software\ClamWin
Detect2=HKLM\Software\ClamWin
FileKey1=%AppData%\.clamwin\log|*.*|RECURSE
FileKey2=%CommonAppData%\.clamwin\log|*.*|RECURSE
FileKey3=%ProgramFiles%\ClamWin\bin|*.txt

[ClamWin Portable Failed Updates *]
LangSecRef=3024
DetectFile=%SystemDrive%\PortableApps\ClamWinPortable\ClamWinPortable.exe
FileKey1=%SystemDrive%\PortableApps\ClamWinPortable\Data\db\clamav*|*.*|REMOVESELF

[ClassicShell MRU *]
LangSecRef=3024
Detect=HKCU\Software\IvoSoft\ClassicStartMenu
RegKey1=HKCU\Software\IvoSoft\ClassicStartMenu\MRU

[Clean Genius 3 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CleanGenius 3\Update
FileKey1=%ProgramFiles%\CleanGenius 3\Update|update.log

[Clean Master *]
LangSecRef=3024
Detect=HKCU\Software\cmcm\cleanMaster
FileKey1=%ProgramFiles%\Clean Master|*.log*
FileKey2=%ProgramFiles%\Clean Master\log|*.*

[CleanMyPC Registry Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\CleanMyPC\CleanMyPC - Registry Cleaner
FileKey1=%AppData%\CleanMyPC Software\CleanMyPC Registry Cleaner|fixlog.ini
FileKey2=%WinDir%\$regcmp$|*.*|REMOVESELF

[CleanUp! *]
LangSecRef=3024
Detect=HKCU\Software\stevengould.org\CleanUp!
FileKey1=%AppData%|CleanUp!.log

[Clementine *]
LangSecRef=3023
Detect=HKCU\Software\Clementine
FileKey1=%UserProfile%\.config\Clementine\networkcache\http|*.cache|RECURSE

[Click.to *]
LangSecRef=3021
DetectFile=%LocalAppData%\click.to
FileKey1=%LocalAppData%\click.to|*.txt|RECURSE

[ClickFree Full Imaging Backup *]
LangSecRef=3024
DetectFile=%CommonAppData%\ClickFree\FullImagingBackup
FileKey1=%CommonAppData%\ClickFree\FullImagingBackup|*.log

[ClipArt Gallery *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\ClipArt Gallery\2.0
RegKey1=HKCU\Software\Microsoft\ClipArt Gallery\2.0\MRUDescription

[ClipX *]
LangSecRef=3024
DetectFile=%LocalAppData%\ClipX
FileKey1=%LocalAppData%\ClipX\Storage|*.*

[CloneSpy *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CloneSpy
FileKey1=%ProgramFiles%\CloneSpy|CloneSpy.log

[Cloud Experience Host *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\TempState|*.*|RECURSE

[Cloudfogger *]
LangSecRef=3023
Detect1=HKCU\Software\Cloudfogger
Detect2=HKCU\Software\Cloudfogger.com
FileKey1=%AppData%\Cloudfogger|*.log|RECURSE

[Cloudfogger Keys *]
LangSecRef=3023
Detect1=HKCU\Software\Cloudfogger
Detect2=HKCU\Software\Cloudfogger.com
FileKey1=%AppData%\Cloudfogger\Keys|*.*|RECURSE

[CloudShark Plugin for Wireshark *]
LangSecRef=3024
DetectFile=%AppData%\Wireshark\plugins\cloudshark
FileKey1=%AppData%\Wireshark\plugins\cloudshark\tmp|*.*

[Clover *]
LangSecRef=3024
Detect=HKCU\Software\Clover
FileKey1=%LocalAppData%\Clover\User Data\Default\JumpListIcons*|*tmp
FileKey2=%LocalAppData%\Clover\User Data\temp|*.*|RECURSE

[Clover Bookmarks Backups *]
LangSecRef=3024
Detect=HKCU\Software\Clover
FileKey1=%LocalAppData%\Clover\User Data\Default|Bookmarks.bak

[Clover Session *]
LangSecRef=3024
Detect=HKCU\Software\Clover
FileKey1=%LocalAppData%\Clover\User Data\Default|Current *;Last *

[CNET Tech Tracker *]
LangSecRef=3024
Detect=HKCU\Software\CBS Interactive\CNET TechTracker
FileKey1=%AppData%\CBS Interactive\CNET TechTracker\data|temp.html;ztempimages*.png;*.db
FileKey2=%AppData%\CBS Interactive\CNET TechTracker\temp|*.*|REMOVESELF
FileKey3=%Documents%\Downloads\CNET TechTracker|*.*
RegKey1=HKCU\Software\CBS Interactive\CNET TechTracker\Recent File List

[CNET Tech Tracker Backups *]
LangSecRef=3024
Detect=HKCU\Software\CBS Interactive\CNET TechTracker
FileKey1=%AppData%\CBS Interactive\CNET TechTracker|*.bak

[CNN *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\588E6FFA.CNNAppforWindows_cs8eyncph15zy
FileKey1=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Microsoft\CLR_v4.0|*.log
FileKey3=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\TempState|*.*|RECURSE

[CobraTek PC Info *]
LangSecRef=3024
Detect=HKCU\Software\CobraTek\PC Info
FileKey1=%LocalAppData%\CobraTek\PC Info\ChangeLog|*.txt
FileKey2=%LocalAppData%\CobraTek\PC Info\Log|*.*

[CodeGear RAD Studio 2009 *]
LangSecRef=3024
Detect=HKCU\Software\CodeGear\BDS\6.0
RegKey1=HKCU\Software\CodeGear\BDS\6.0\Closed Files
RegKey2=HKCU\Software\CodeGear\BDS\6.0\Closed Projects
RegKey3=HKCU\Software\CodeGear\BDS\6.0\Session

[CodeMeter *]
LangSecRef=3023
DetectFile=%CommonAppData%\CodeMeter
FileKey1=%CommonAppData%\CodeMeter\Logs|*.*

[CoffeeCup GIF Animator *]
LangSecRef=3024
Detect=HKCU\Software\CoffeeCup Software\GIF Animator
RegKey1=HKCU\Software\CoffeeCup Software\GIF Animator\Settings\MRU

[Cogs *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\26500
FileKey1=%LocalAppData%\Lazy 8 Studio\Cogs|log.txt

[CoinManage *]
LangSecRef=3021
Detect1=HKCU\Software\Liberty Street Software\CoinManage
Detect2=HKCU\Software\Liberty Street Software\CoinManage Canada
FileKey1=%Documents%|CoinManage.zip;CRASH.DMP;ERRORLOG.TXT;XCrashReport.ini;XCRASHREPORT_Mon1.bmp
FileKey2=%ProgramFiles%\CoinManage*|*.txt

[ColorSchemer *]
LangSecRef=3023
Detect=HKCU\Software\ColorSchemer
FileKey1=%AppData%\ColorSchemer\Studio\*|recentfiles.xml

[ComboFix *]
LangSecRef=3024
DetectFile=%SystemDrive%\Qoobox
Warning=This will delete ComboFix history. Do not delete until you have reviewed these logs.
FileKey1=%SystemDrive%|ComboFix.txt
FileKey2=%SystemDrive%\*.tmp|*.*|REMOVESELF
FileKey3=%SystemDrive%\Qoobox|*.txt
FileKey4=%SystemDrive%\Qoobox\LastRun|*.*|REMOVESELF
FileKey5=%SystemDrive%\Qoobox\Quarantine|*.log
FileKey6=%SystemDrive%\Qoobox\Test*|*.*|REMOVESELF

[Comcast Toolbar *]
LangSecRef=3022
Detect=HKCU\Software\ComcastToolbar
FileKey1=%ProgramFiles%\ComcastToolbar\Cache|*.*

[ComicRack *]
LangSecRef=3021
DetectFile=%LocalAppData%\cYo\ComicRack
FileKey1=%LocalAppData%\cYo\ComicRack\Cache\Images|*.*|RECURSE
FileKey2=%LocalAppData%\cYo\ComicRack\Cache\Thumbnails|*.*|RECURSE

[Common Language Runtime *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\CLR_v*.*|*.*|RECURSE
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v*.*|*.*|RECURSE
FileKey3=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Microsoft\CLR_v*.*|*.*|RECURSE
FileKey4=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v*.*|*.*|RECURSE
FileKey5=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\Microsoft\CLR_v*.*|*.*|RECURSE

[Comodo *]
LangSecRef=3024
Detect=HKCU\Software\ComodoGroup
FileKey1=%AppData%\Comodo\CCE\Logs|*.*
FileKey2=%AppData%\ComodoGroup\CSC\Cache|*.*
FileKey3=%CommonAppData%\Comodo Downloader|*.*
FileKey4=%CommonAppData%\Comodo\Cis\Quarantine\Temp\TempFiles|*.*
FileKey5=%CommonAppData%\Comodo\CisDumps|*.*
FileKey6=%CommonAppData%\Comodo\Firewall Pro|cislogs.sdb
FileKey7=%CommonAppData%\Comodo\Installer|*.*
FileKey8=%LocalAppData%\COMODO|*.tmp
FileKey9=%ProgramFiles%\COMODO\COMODO Internet Security|*.tmp;CRASH.DMP;cmdagent.zip

[Comodo CertSentry *]
LangSecRef=3022
Detect=HKLM\Software\COMODO\CertSentry
FileKey1=%LocalAppData%\COMODO\CertSentry|*.log

[Comodo GeekBuddy *]
LangSecRef=3021
Detect=HKLM\Software\GeekBuddyRSP
DetectFile=%ProgramFiles%\Comodo\GeekBuddy
FileKey1=%ProgramFiles%\Comodo\GeekBuddy\logs|*.*|RECURSE

[Comodo System Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\COMODO\COMODO System-Cleaner
FileKey1=%ProgramFiles%\COMODO\COMODO System-Cleaner|*.log
FileKey2=%ProgramFiles%\COMODO\COMODO System-Cleaner\Backup\CDC_Backup|*.cbu;*.idx;*.reg;*.xml

[Company of Heroes *]
Section=Games
DetectFile=%Documents%\My Games\Company of Heroes*
FileKey1=%Documents%\My Games\Company of Heroes*|*.log
FileKey2=%Documents%\My Games\Company of Heroes*\Cache|*.*
FileKey3=%Documents%\My Games\Company of Heroes*\LogFiles|*.*

[Compatibility Assistant *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant
RegKey1=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
RegKey2=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
RegKey3=HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
RegKey4=HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

[Complete Internet Repair *]
LangSecRef=3024
DetectFile=%AppData%\Rizonesoft\ComIntRep
FileKey1=%AppData%\Rizonesoft\ComIntRep\Logging|*.*|RECURSE

[Conceiva Mezzmo *]
LangSecRef=3023
Detect=HKLM\Software\Conceiva\Mezzmo
FileKey1=%CommonAppData%\Conceiva\*|*.bat;*.exe;*.txt
FileKey2=%CommonAppData%\Conceiva\Mezzmo\CER|*.zip
FileKey3=%LocalAppData%\Conceiva\Logs|*.*|REMOVESELF
FileKey4=%LocalAppData%\Conceiva\Mezzmo|DebugCERwrite.txt
FileKey5=%LocalAppData%\Conceiva\Mezzmo\Temporary_*_Files|*.*|REMOVESELF
FileKey6=%ProgramFiles%\Conceiva\Mezzmo|*.txt
FileKey7=%ProgramFiles%\Conceiva\Mezzmo\Third\MKVToolNix|*.txt
FileKey8=%ProgramFiles%\Conceiva\Mezzmo\Third\OGMDemuxer\doc|*.*|REMOVESELF
RegKey1=HKCU\Software\Conceiva\Mezzmo\General|LastWatchFolder

[Conduit *]
LangSecRef=3021
Detect=HKCU\Software\Conduit
FileKey1=%LocalLowAppData%\Conduit\Community Alerts\Log|*.*|REMOVESELF
FileKey2=%LocalLowAppData%\ConduitEngine\CacheIcons|*.*
FileKey3=%LocalLowAppData%\ConduitEngine\Logs|*.*
FileKey4=%WinDir%\System32|ConduitEngine.tmp

[Conexant Logs *]
LangSecRef=3024
Detect=HKCU\Software\Conexant
FileKey1=%CommonAppData%\Conexant\UCILogs\COINST|*.log
FileKey2=%Public%|CAFADEBUG.log

[Connectify Hotspot *]
LangSecRef=3022
Detect=HKLM\Software\Connectify
FileKey1=%CommonAppData%\Connectify\cache|*.time;*.cache;*.runtime
FileKey2=%ProgramFiles%\Connectify\Installer|*.*|REMOVESELF
FileKey3=%ProgramFiles%\Connectify\Portal|*.*|REMOVESELF

[Conquer Online *]
Section=Games
DetectFile=%ProgramFiles%\NetDragon\Conquer Online 2.0\AutoPatch
FileKey1=%ProgramFiles%\NetDragon\Conquer Online 2.0\AutoPatch|Update.log

[Contact Support *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Windows.ContactSupport_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey4=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Temp|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Windows.ContactSupport_*\LocalCache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Windows.ContactSupport_*\LocalState\Cache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Windows.ContactSupport_*\TempState|*.*|RECURSE

[Content Delivery Manager *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\Favicons|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\MobilityExperience\ImageCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\OneSettingsResponseCache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\TargetedContentCache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\TempState|*.*|RECURSE

[ConTEXT *]
LangSecRef=3021
Detect=HKCU\Software\Eden\ConTEXT
RegKey1=HKCU\Software\Eden\ConTEXT\FileHistory
RegKey2=HKCU\Software\Eden\ConTEXT\FindHistory

[Cook'n Backups *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n
FileKey1=%Documents%\Cook'n Backups|*.ckn
FileKey2=%Documents%\Cook'n10\Workspace\data|download;dvodb.backup
FileKey3=%Documents%\Cook'n10\Workspace\update|update.zip
FileKey4=%Documents%\Cook'n11\Download|*.*

[Cook'n Cache *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n
FileKey1=%AppData%\Mozilla\eclipse\Cache|*.*

[Cook'n Dups *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n
Warning=This removes identical duplicates of the huge Getting Started Guide.
FileKey1=%LocalAppData%\DVO\Cook'n10App\plugins|Getting Started Guide.rtf|RECURSE

[Cook'n Logs *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n
FileKey1=%Documents%\Cook'n*|*.log|RECURSE
FileKey2=%LocalAppData%\DVO\Cook'n*App|*.log|RECURSE

[Coolmuster PDF Image Extractor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Coolmuster\Coolmuster PDF Image Extractor\Bin\PDF_IMAGE_EXTRACTOR_COOL.exe
FileKey1=%Documents%\Coolmuster files\Coolmuster PDF Image Extractor|PDF_IMAGE_EXTRACTOR_COOL.cfg

[Copernic DesktopSearch4 *]
LangSecRef=3024
Detect=HKLM\Software\Copernic\DesktopSearch4
FileKey1=%AppData%\Copernic\DesktopSearch4\Logs|*.*|REMOVESELF
FileKey2=%LocalAppData%\Copernic\DesktopSearch4\Logs|*.*|REMOVESELF

[CopyTo Synchronizer *]
LangSecRef=3024
Detect=HKCU\Software\kishDesign\CopyTo
RegKey1=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder00
RegKey2=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder01
RegKey3=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder02
RegKey4=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder03
RegKey5=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder04
RegKey6=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder05
RegKey7=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder06
RegKey8=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder07
RegKey9=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder08
RegKey10=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder09
RegKey11=HKCU\Software\kishDesign\CopyTo\settings3|scutname00
RegKey12=HKCU\Software\kishDesign\CopyTo\settings3|scutname01
RegKey13=HKCU\Software\kishDesign\CopyTo\settings3|scutname02
RegKey14=HKCU\Software\kishDesign\CopyTo\settings3|scutname03
RegKey15=HKCU\Software\kishDesign\CopyTo\settings3|scutname04
RegKey16=HKCU\Software\kishDesign\CopyTo\settings3|scutname05
RegKey17=HKCU\Software\kishDesign\CopyTo\settings3|scutname06
RegKey18=HKCU\Software\kishDesign\CopyTo\settings3|scutname07
RegKey19=HKCU\Software\kishDesign\CopyTo\settings3|scutname08
RegKey20=HKCU\Software\kishDesign\CopyTo\settings3|scutname09
RegKey21=HKCU\Software\kishDesign\CopyTo\settings3|Source00
RegKey22=HKCU\Software\kishDesign\CopyTo\settings3|Source01
RegKey23=HKCU\Software\kishDesign\CopyTo\settings3|Source02
RegKey24=HKCU\Software\kishDesign\CopyTo\settings3|Source03
RegKey25=HKCU\Software\kishDesign\CopyTo\settings3|Source04
RegKey26=HKCU\Software\kishDesign\CopyTo\settings3|Source05
RegKey27=HKCU\Software\kishDesign\CopyTo\settings3|Source06
RegKey28=HKCU\Software\kishDesign\CopyTo\settings3|Source07
RegKey29=HKCU\Software\kishDesign\CopyTo\settings3|Source08
RegKey30=HKCU\Software\kishDesign\CopyTo\settings3|Source09
RegKey31=HKCU\Software\kishDesign\CopyTo\settings3|target00
RegKey32=HKCU\Software\kishDesign\CopyTo\settings3|target01
RegKey33=HKCU\Software\kishDesign\CopyTo\settings3|target02
RegKey34=HKCU\Software\kishDesign\CopyTo\settings3|target03
RegKey35=HKCU\Software\kishDesign\CopyTo\settings3|target04
RegKey36=HKCU\Software\kishDesign\CopyTo\settings3|target05
RegKey37=HKCU\Software\kishDesign\CopyTo\settings3|target06
RegKey38=HKCU\Software\kishDesign\CopyTo\settings3|target07
RegKey39=HKCU\Software\kishDesign\CopyTo\settings3|target08
RegKey40=HKCU\Software\kishDesign\CopyTo\settings3|target09

[CopyTrans *]
LangSecRef=3023
DetectFile1=%AppData%\WindSolutions\CopyTrans*
DetectFile2=%CommonAppData%\WindSolutions\CopyTrans*
FileKey1=%CommonAppData%\WindSolutions|*.txt|RECURSE
FileKey2=%CommonAppData%\WindSolutions\CopyTrans*\Logs|*.*|RECURSE

[Core Temp *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Core Temp
FileKey1=%ProgramFiles%\Core Temp|*.csv

[Corel AfterShot Pro *]
LangSecRef=3023
Detect=HKCU\Software\Corel\AfterShot Pro V3
FileKey1=%LocalAppData%\Corel\AfterShot Pro *|*.log
FileKey2=%LocalAppData%\Corel\AfterShot Pro *\Cache|*.*|RECURSE

[Corel Downloads *]
LangSecRef=3021
DetectFile=%CommonAppData%\Corel\Downloads
FileKey1=%CommonAppData%\Corel\Downloads|*.*|RECURSE

[Corel PaintShop Pro *]
LangSecRef=3023
Detect1=HKCU\Software\Corel\PaintShop Pro\X4
Detect2=HKCU\Software\Corel\PaintShop Pro\X5
Detect3=HKCU\Software\Corel\PaintShop Pro\X6
Detect4=HKCU\Software\Corel\PaintShop Pro\X7
Detect5=HKCU\Software\Corel\PaintShop Pro\X10
Detect6=HKCU\Software\Corel\PhotoDownloader\2
FileKey1=%AppData%\Corel\PaintShop Photo Pro\13\Cache|*.*|RECURSE
FileKey2=%LocalAppData%\Corel|*.db;*.PspCache
FileKey3=%LocalAppData%\Corel PaintShop Pro\*\Cache|*.*
FileKey4=%LocalAppData%\Corel PaintShop Pro\*\Database|*.db
FileKey5=%LocalAppData%\Corel PaintShop Pro\*\Thumbs|*.*|RECURSE
FileKey6=%LocalAppData%\Corel\Thumbs|*.*|RECURSE
RegKey1=HKCU\Software\Corel\PaintShop Pro\X7\CoreMemoryManager\0
RegKey2=HKCU\Software\Corel\PaintShop Pro\X10\CoreMemoryManager\0
RegKey3=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DefaultDownloadFolder
RegKey4=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DownloadFolder

[Corel PaintShop Pro AutoPreserve *]
LangSecRef=3023
Detect1=HKCU\Software\Corel\PaintShop Pro\X6
Detect2=HKCU\Software\Corel\PaintShop Pro\X7
Detect3=HKCU\Software\Corel\PaintShop Pro\X10
FileKey1=%Pictures%\Corel Auto-Preserve|*.*

[Corel PhotoImpact X3 *]
LangSecRef=3023
DetectFile=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0
FileKey1=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0\Ulead.DAT\BwsCache|*.*
FileKey2=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0\Ulead.DAT\Recently|*.lnk

[Corel VideoStudio Pro *]
LangSecRef=3023
Detect1=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\14.0
Detect2=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\15.0
Detect3=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\16.0
Detect4=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\17.0
FileKey1=%Documents%\Corel VideoStudio Pro\*.0\AudioTmp|*.*
FileKey2=%Documents%\Corel VideoStudio Pro\*.0\SmartProxy|*.*
RegKey1=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\14.0\Preference|Working Folder
RegKey2=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\16.0\HerRFL
RegKey3=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\17.0\HerRFL

[Corel Wordperfect Presentations *]
LangSecRef=3021
Detect=HKCU\Software\Corel\User Assistant
RegKey1=HKCU\Software\Corel\User Assistant\11\Recent Work\Presentations
RegKey2=HKCU\Software\Corel\User Assistant\12\Recent Work\Presentations
RegKey3=HKCU\Software\Corel\User Assistant\13\Recent Work\Presentations
RegKey4=HKCU\Software\Corel\User Assistant\14\Recent Work\Presentations
RegKey5=HKCU\Software\Corel\User Assistant\X3\Recent Work\Presentations
RegKey6=HKCU\Software\Corel\User Assistant\X4\Recent Work\Presentations

[CorelDRAW Graphics Suite X7 *]
LangSecRef=3021
Detect=HKCU\Software\Corel\CorelDRAW\17.0
FileKey1=%CommonAppData%\Bitstream\Font Navigator\6.0\Cache|*.*|RECURSE
FileKey2=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Config|corelpdf.ini;capture.ini
FileKey3=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Connect|Connect.config
FileKey4=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw|FindAndReplaceMRU.xml
FileKey5=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\Export|dialog.export.web.xml
FileKey6=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\Presets\HTML Export|default.pst
FileKey7=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\PreviewCache|*.*|RECURSE
FileKey8=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\PHOTO-PAINT\PreviewCache|*.*|RECURSE
FileKey9=%ProgramFiles%\Corel\CorelDRAW Graphics Suite X7\Setup|*.*|REMOVESELF
RegKey1=HKCU\Software\Bitstream\Font Navigator\6.0\Copy|Folders
RegKey2=HKCU\Software\Bitstream\Font Navigator\6.0\Move|Folders
RegKey3=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\Directories|DrawDocsDir
RegKey4=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\Framework|RecentFiles
RegKey5=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\HTML Export|DestPath
RegKey6=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\NewFromTemplate|BrowseTemplateDir
RegKey7=HKCU\Software\Corel\CorelDRAW\17.0\PHOTO-PAINT\Application Preferences\Framework|RecentFiles

[Corsair iCue *]
LangSecRef=3024
DetectFile=%CommonAppData%\Corsair\CUE\Service logs
Warning=Disabling "Debug Logging" in iCue will prevent these files from being recreated.
FileKey1=%CommonAppData%\Corsair\CorsairLLAccessService|*.log
FileKey2=%CommonAppData%\Corsair\CUE\Service logs|Service_Trace*.log
FileKey3=%LocalAppData%\Corsair\CUE\logs|*.log

[Cortana *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Cortana_8wekyb3d8bbwe
Detect3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Cortana_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.*Cortana_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.*Cortana_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.*Cortana_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.*Cortana_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.*Cortana_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.*Cortana_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.*Cortana_*\TempState|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.549981C3F5F10_*\AC\INet*|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.549981C3F5F10_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.549981C3F5F10_*\AC\Temp|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.549981C3F5F10_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.549981C3F5F10_*\LocalCache|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.549981C3F5F10_*\TempState|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalCache|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\AppIconCache|*.*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\DeviceSearchCache|*.tmp;*.txt
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\DeviceSearchCache\|SettingsCache.txt

[Cortana Show Me *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.CortanaFollowMe_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.CortanaFollowMe_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.CortanaFollowMe_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.CortanaFollowMe_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.CortanaFollowMe_*\LocalCache\Local\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.CortanaFollowMe_*\LocalState|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.CortanaFollowMe_*\TempState|*.*|RECURSE

[Counter-Strike *]
Section=Games
DetectFile=%ProgramFiles%\Counter-Strike*
FileKey1=%ProgramFiles%\Counter-Strike *|*.log
FileKey2=%ProgramFiles%\Counter-Strike *\cstrike\addons\amxmodx\logs|*.log
FileKey3=%ProgramFiles%\Counter-Strike *\cstrike\lhdoc\Demo Player\SK Player|history.txt

[CounterSpy *]
LangSecRef=3024
Detect=HKLM\Software\Sunbelt Software\CounterSpy
FileKey1=%CommonAppData%\Sunbelt Software\CounterSpy\Logs|*.*

[CrashRpt Logs *]
LangSecRef=3024
DetectFile=%LocalAppData%\CrashRpt
FileKey1=%LocalAppData%\CrashRpt|*.*|RECURSE

[Crayon Physics Deluxe *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\26900
FileKey1=%AppData%\Crayon Physics Deluxe|log.txt
FileKey2=%AppData%\Crayon Physics Deluxe\data\recordings\temp|current_recording.tmp
FileKey3=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe|log.txt
FileKey4=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\cache|*.*
FileKey5=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\data\editor|*.tmp
FileKey6=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\data\recordings\temp|*.tmp

[Creative Installation Information *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Creative Installation Information
FileKey1=%ProgramFiles%\Creative Installation Information|*.log|RECURSE

[Creative Live! Central 3 *]
LangSecRef=3023
DetectFile=%AppData%\Creative\Live! Central 3
FileKey1=%AppData%\Creative\Live! Central 3|*.txt|RECURSE

[Creative Pro Proteus VX *]
LangSecRef=3023
Detect=HKCU\Software\Creative Professional\Proteus VX
RegKey1=HKCU\Software\Creative Professional\Proteus VX VSTi\Recent File List

[Creative Sound Blaster *]
LangSecRef=3024
Detect1=HKLM\Software\CREATIVE TECH\Software Installed\Software Update
Detect2=HKLM\Software\CREATIVE TECH\Sound Blaster X-Fi MB
Detect3=HKLM\Software\CREATIVE TECH\Sound Blaster Z-Series Control Panel
FileKey1=%CommonAppData%\Creative\Software Update\Cache|*.*|RECURSE
FileKey2=%CommonAppData%\Creative\Software Update\Log|*.*

[Crypt of the NecroDancer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\247080
FileKey1=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\logs|*.*

[CrypTool 2 *]
LangSecRef=3024
Detect=HKCU\Software\CrypTool2.0
FileKey1=%LocalAppData%\CrypTool2\Temp|*.*|REMOVESELF
RegKey1=HKCU\Software\CrypTool2.0|recentFileList

[Crysis *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\17300
Detect2=HKCU\Software\Valve\Steam\Apps\17330
Detect3=HKCU\Software\Valve\Steam\Apps\108800
Detect4=HKLM\Software\Origin Games\71503
Detect5=HKLM\Software\Origin Games\1003295
Detect6=HKLM\Software\Origin Games\1003302
Detect7=HKLM\Software\Origin Games\1003310
FileKey1=%ProgramFiles%\Origin Games\Crysis *|*.log
FileKey2=%ProgramFiles%\Origin Games\Crysis *\LogBackups|*.*
FileKey3=%ProgramFiles%\Steam\Steamapps\common\Crysis *|*.log
FileKey4=%ProgramFiles%\Steam\Steamapps\common\Crysis *\LogBackups|*.*

[Crysis Cache *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\17300
Detect2=HKCU\Software\Valve\Steam\Apps\17330
Detect3=HKCU\Software\Valve\Steam\Apps\108800
Detect4=HKLM\Software\Origin Games\71503
Detect5=HKLM\Software\Origin Games\1003295
Detect6=HKLM\Software\Origin Games\1003302
Detect7=HKLM\Software\Origin Games\1003310
FileKey1=%Documents%\My Games\Crysis*\Shaders\Cache|*.*|RECURSE
FileKey2=%UserProfile%\Saved Games\Crysis*\Shaders\Cache|*.*|RECURSE

[CrystalDiskInfo *]
LangSecRef=3024
DetectFile=%ProgramFiles%\CrystalDiskInfo\Smart
Warning=This will delete all saved SMART data for history/graph function.
FileKey1=%ProgramFiles%\CrystalDiskInfo\Smart|*.*|RECURSE

[CurrencyManage *]
LangSecRef=3021
Detect=HKCU\Software\Liberty Street Software\CurrencyManage
FileKey1=%ProgramFiles%\CurrencyManage|*.txt

[Curse Client *]
Section=Games
Detect=HKCU\Software\Classes\Curse
FileKey1=%AppData%\Curse Client|*.log
FileKey2=%AppData%\Curse Client\Logs|*.*
FileKey3=%LocalAppData%\Apps\2.0|*.Log|RECURSE

[CursorArts *]
LangSecRef=3023
Detect=HKCU\Software\CursorArts
RegKey1=HKCU\Software\CursorArts\MRU Items
RegKey2=HKCU\Software\CursorArts\MRU Library Items

[CursorFX *]
LangSecRef=3024
Detect=HKCU\Software\CursorFX Theme Editor
RegKey1=HKCU\Software\CursorFX Theme Editor\Recent File List

[CustomBrushesMini Paint.Net-Plunging *]
LangSecRef=3021
DetectFile=%AppData%\CustomBrushesMini
FileKey1=%AppData%\CustomBrushesMini\ThumbCache|*.*|RECURSE

[CuteHTML 2.3 *]
LangSecRef=3024
Detect=HKCU\Software\GlobalSCAPE\CuteHTML\2.3
RegKey1=HKCU\Software\GlobalSCAPE\CuteHTML\2.3\Recent File List

[CutePDF Writer *]
LangSecRef=3023
Detect=HKCU\Software\Acro Software Inc\CPW
FileKey1=%LocalAppData%\CutePDF Writer|*.tmp
RegKey1=HKCU\Software\Acro Software Inc\CPW|Filename
RegKey2=HKCU\Software\Acro Software Inc\CPW|Title

[Cyberduck *]
LangSecRef=3024
Detect=HKCR\.cyberducklicense
FileKey1=%AppData%\Cyberduck|*.log

[CyberLink AudioDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\AudioDirector4
Detect2=HKCU\Software\CyberLink\AudioDirector5
Detect3=HKCU\Software\CyberLink\AudioDirector6
Detect4=HKCU\Software\CyberLink\AudioDirector7
Detect5=HKCU\Software\CyberLink\AudioDirector8
Detect6=HKCU\Software\CyberLink\AudioDirector9
FileKey1=%Documents%\Cyberlink\AudioDirector\*\SplitterIndex|*.*|RECURSE
FileKey2=%LocalAppData%\Cyberlink\AudioDirector\*|*.*|RECURSE
RegKey1=HKCU\Software\CyberLink\AudioDirector4\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\AudioDirector4\MediaObj\MediaCache5\Thumbnail5
RegKey3=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Data5
RegKey4=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Thumbnail5
RegKey5=HKCU\Software\CyberLink\AudioDirector6\MediaObj\MediaCache5\Data5
RegKey6=HKCU\Software\CyberLink\AudioDirector6\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\AudioDirector7\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\AudioDirector7\MediaObj\MediaCache5\Thumbnail5
RegKey9=HKCU\Software\CyberLink\AudioDirector8\MediaObj\MediaCache5\Data5
RegKey10=HKCU\Software\CyberLink\AudioDirector8\MediaObj\MediaCache5\Thumbnail5
RegKey11=HKCU\Software\CyberLink\AudioDirector9\MediaObj\MediaCache5\Data5
RegKey12=HKCU\Software\CyberLink\AudioDirector9\MediaObj\MediaCache5\Thumbnail5

[CyberLink ColorDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\ColorDirector3
Detect2=HKCU\Software\CyberLink\ColorDirector4
Detect3=HKCU\Software\CyberLink\ColorDirector5
Detect4=HKCU\Software\CyberLink\ColorDirector6
Detect5=HKCU\Software\CyberLink\ColorDirector7
FileKey1=%LocalAppData%\Cyberlink\ColorDirector\*|*.*|RECURSE
RegKey1=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Thumbnail5
RegKey3=HKCU\Software\CyberLink\ColorDirector4\MediaObj\MediaCache5\Data5
RegKey4=HKCU\Software\CyberLink\ColorDirector4\MediaObj\MediaCache5\Thumbnail5
RegKey5=HKCU\Software\CyberLink\ColorDirector5\MediaObj\MediaCache5\Data5
RegKey6=HKCU\Software\CyberLink\ColorDirector5\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\ColorDirector6\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\ColorDirector6\MediaObj\MediaCache5\Thumbnail5
RegKey9=HKCU\Software\CyberLink\ColorDirector7\MediaObj\MediaCache5\Data5
RegKey10=HKCU\Software\CyberLink\ColorDirector7\MediaObj\MediaCache5\Thumbnail5

[CyberLink Crash Files *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink
FileKey1=%CommonAppData%\CyberLink\Boomerang\*|*.xml;*.dmp
FileKey2=%CommonAppData%\CyberLink\PowerDVD*\Boomerang\*|*.xml;*.dmp

[CyberLink Downloader *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\CLDownloader
FileKey1=%CommonAppData%\CyberLink\CBE\*|*.*|RECURSE
FileKey2=%CommonAppData%\CyberLink\Downloader|*.*|RECURSE

[CyberLink Install Files *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink
FileKey1=%CommonAppData%\install_backup|*.*|REMOVESELF
FileKey2=%CommonAppData%\install_clap|*.*|REMOVESELF

[CyberLink Media Cache *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink
FileKey1=%AppData%\CyberLink\MediaCache|*.*|RECURSE
RegKey1=HKCU\Software\CyberLink\DSSharedMediaInfo\SharedInfoCache
RegKey2=HKCU\Software\CyberLink\MediaCache\Data4
RegKey3=HKCU\Software\CyberLink\MediaCache\Thumbnail4
RegKey4=HKCU\Software\CyberLink\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\MediaCache5\Thumbnail5

[CyberLink PhotoDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PhotoDirector3
Detect2=HKLM\Software\CyberLink\PhotoDirector4
Detect3=HKLM\Software\CyberLink\PhotoDirector5
Detect4=HKLM\Software\CyberLink\PhotoDirector6
Detect5=HKLM\Software\CyberLink\PhotoDirector7
Detect6=HKLM\Software\CyberLink\PhotoDirector8
Detect7=HKLM\Software\CyberLink\PhotoDirector9
Detect8=HKLM\Software\CyberLink\PhotoDirector10
FileKey1=%Pictures%\PhotoDirector\*\*|*.*|RECURSE
ExcludeKey1=PATH|%Pictures%\PhotoDirector\*\*\|*.phd

[CyberLink Power2Go *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\Power2Go9\9.0
Detect2=HKCU\Software\CyberLink\Power2Go10\10.0
Detect3=HKCU\Software\CyberLink\Power2Go11\11.0
Detect4=HKCU\Software\CyberLink\Power2Go12\12.0
FileKey1=%Documents%\PDRMUSIC.TMP|*.*|REMOVESELF
FileKey2=%LocalAppData%\Cyberlink\Power2Go*|DLDB.db
FileKey3=%Music%|*.tmp
FileKey4=%Pictures%|*.tmp
FileKey5=%ProgramFiles%\Cyberlink\Power2Go*|*.tmp
FileKey6=%ProgramFiles%\Cyberlink\Power2Go*|Thumbs.db|RECURSE
FileKey7=%Public%\Documents\Cyberlink\Power2Go*|MP3Cache.log
RegKey1=HKCU\Software\CyberLink\LabelPrint\Recent File List
RegKey2=HKCU\Software\CyberLink\Power2Go9\9.0|CDRippingPath
RegKey3=HKCU\Software\CyberLink\Power2Go9\9.0|CUEName
RegKey4=HKCU\Software\CyberLink\Power2Go9\9.0|CUEPath
RegKey5=HKCU\Software\CyberLink\Power2Go9\9.0|DestFolder
RegKey6=HKCU\Software\CyberLink\Power2Go9\9.0|DVDFolderPath
RegKey7=HKCU\Software\CyberLink\Power2Go9\9.0|ImagePath
RegKey8=HKCU\Software\CyberLink\Power2Go9\9.0|LastBrowsePath
RegKey9=HKCU\Software\CyberLink\Power2Go9\9.0|LastSaveProjPath
RegKey10=HKCU\Software\CyberLink\Power2Go9\9.0|MonitorPaths
RegKey11=HKCU\Software\CyberLink\Power2Go9\9.0|OpenPrjFilePath
RegKey12=HKCU\Software\CyberLink\Power2Go9\9.0|SelectedFolderPath
RegKey13=HKCU\Software\CyberLink\Power2Go9\9.0\MediaObj\MediaCache5\Data5
RegKey14=HKCU\Software\CyberLink\Power2Go9\9.0\MediaObj\MediaCache5\Thumbnail5
RegKey15=HKCU\Software\CyberLink\Power2Go10\10.0|CDRippingPath
RegKey16=HKCU\Software\CyberLink\Power2Go10\10.0|CUEName
RegKey17=HKCU\Software\CyberLink\Power2Go10\10.0|CUEPath
RegKey18=HKCU\Software\CyberLink\Power2Go10\10.0|DestFolder
RegKey19=HKCU\Software\CyberLink\Power2Go10\10.0|DVDFolderPath
RegKey20=HKCU\Software\CyberLink\Power2Go10\10.0|ImagePath
RegKey21=HKCU\Software\CyberLink\Power2Go10\10.0|LastBrowsePath
RegKey22=HKCU\Software\CyberLink\Power2Go10\10.0|LastSaveProjPath
RegKey23=HKCU\Software\CyberLink\Power2Go10\10.0|MonitorPaths
RegKey24=HKCU\Software\CyberLink\Power2Go10\10.0|OpenPrjFilePath
RegKey25=HKCU\Software\CyberLink\Power2Go10\10.0|SelectedFolderPath
RegKey26=HKCU\Software\CyberLink\Power2Go10\10.0\MediaObj\MediaCache5\Data5
RegKey27=HKCU\Software\CyberLink\Power2Go10\10.0\MediaObj\MediaCache5\Thumbnail5
RegKey28=HKCU\Software\CyberLink\Power2Go11\11.0|CDRippingPath
RegKey29=HKCU\Software\CyberLink\Power2Go11\11.0|CUEName
RegKey30=HKCU\Software\CyberLink\Power2Go11\11.0|CUEPath
RegKey31=HKCU\Software\CyberLink\Power2Go11\11.0|DestFolder
RegKey32=HKCU\Software\CyberLink\Power2Go11\11.0|DVDFolderPath
RegKey33=HKCU\Software\CyberLink\Power2Go11\11.0|ImagePath
RegKey34=HKCU\Software\CyberLink\Power2Go11\11.0|LastBrowsePath
RegKey35=HKCU\Software\CyberLink\Power2Go11\11.0|LastSaveProjPath
RegKey36=HKCU\Software\CyberLink\Power2Go11\11.0|MonitorPaths
RegKey37=HKCU\Software\CyberLink\Power2Go11\11.0|OpenPrjFilePath
RegKey38=HKCU\Software\CyberLink\Power2Go11\11.0|SelectedFolderPath
RegKey39=HKCU\Software\CyberLink\Power2Go11\11.0\MediaObj\MediaCache5\Data5
RegKey40=HKCU\Software\CyberLink\Power2Go11\11.0\MediaObj\MediaCache5\Thumbnail5
RegKey41=HKCU\Software\CyberLink\Power2Go12\12.0|CDRippingPath
RegKey42=HKCU\Software\CyberLink\Power2Go12\12.0|CUEName
RegKey43=HKCU\Software\CyberLink\Power2Go12\12.0|CUEPath
RegKey44=HKCU\Software\CyberLink\Power2Go12\12.0|DestFolder
RegKey45=HKCU\Software\CyberLink\Power2Go12\12.0|DVDFolderPath
RegKey46=HKCU\Software\CyberLink\Power2Go12\12.0|ImagePath
RegKey47=HKCU\Software\CyberLink\Power2Go12\12.0|LastBrowsePath
RegKey48=HKCU\Software\CyberLink\Power2Go12\12.0|LastSaveProjPath
RegKey49=HKCU\Software\CyberLink\Power2Go12\12.0|MonitorPaths
RegKey50=HKCU\Software\CyberLink\Power2Go12\12.0|OpenPrjFilePath
RegKey51=HKCU\Software\CyberLink\Power2Go12\12.0|SelectedFolderPath
RegKey52=HKCU\Software\CyberLink\Power2Go12\12.0\MediaObj\MediaCache5\Data5
RegKey53=HKCU\Software\CyberLink\Power2Go12\12.0\MediaObj\MediaCache5\Thumbnail5
RegKey54=HKCU\Software\CyberLink\WaveEditor\2.0|ImportDir
RegKey55=HKCU\Software\CyberLink\WaveEditor\2.0|TempFileDir
RegKey56=HKCU\Software\CyberLink\WaveEditor\2.0|WorkDir

[Cyberlink PowerCinema *]
LangSecRef=3023
Detect=HKCU\Software\Cyberlink\PowerCinema
DetectFile=%LocalAppData%\PowerCinema
FileKey1=%LocalAppData%\PowerCinema|trace.log;trace.txt

[CyberLink PowerDirector *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PowerDirector10
Detect2=HKCU\Software\CyberLink\PowerDirector11
Detect3=HKCU\Software\CyberLink\PowerDirector12
Detect4=HKCU\Software\CyberLink\PowerDirector13
Detect5=HKCU\Software\CyberLink\PowerDirector14
Detect6=HKCU\Software\CyberLink\PowerDirector15
Detect7=HKCU\Software\CyberLink\PowerDirector16
Detect8=HKCU\Software\CyberLink\PowerDirector17
FileKey1=%AppData%\Cyberlink\PowerDirector\*|Recentfiles.ini
FileKey2=%AppData%\CyberLink\PowerDirector\*\AutoSave|*.*|RECURSE
FileKey3=%AppData%\CyberLink\PowerDirector\*\photoTmp|*.*|RECURSE
FileKey4=%AppData%\Cyberlink\PowerDirector\*\WaveForms|*.*|RECURSE
FileKey5=%Documents%\CyberLink\PowerDirector\*|Snapshot(*).jpg
FileKey6=%Documents%\CyberLink\PowerDirector\*\MyTitles|*.*|RECURSE
FileKey7=%Documents%\Cyberlink\PowerDirector\*\PDRMUSIC.TMP|*.*|REMOVESELF
FileKey8=%Documents%\Cyberlink\PowerDirector\*\PP.TWOPASS|*.*|REMOVESELF
FileKey9=%Documents%\CyberLink\PowerDirector\*\Preview Cache Files|*.*
FileKey10=%Documents%\CyberLink\PowerDirector\*\ShadowEditFiles|*.MPG
FileKey11=%Documents%\CyberLink\PowerDirector\*\SplitterIndex|*.maidx
RegKey1=HKCU\Software\CyberLink\Hanuman
RegKey2=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Data5
RegKey3=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Thumbnail5
RegKey4=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Thumbnail5
RegKey6=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Data5
RegKey7=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Thumbnail5
RegKey8=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Data5
RegKey9=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Thumbnail5
RegKey10=HKCU\Software\CyberLink\PowerDirector14\MediaObj\MediaCache5\Data5
RegKey11=HKCU\Software\CyberLink\PowerDirector14\MediaObj\MediaCache5\Thumbnail5
RegKey12=HKCU\Software\CyberLink\PowerDirector15\MediaObj\MediaCache5\Data5
RegKey13=HKCU\Software\CyberLink\PowerDirector15\MediaObj\MediaCache5\Thumbnail5
RegKey14=HKCU\Software\CyberLink\PowerDirector16\MediaObj\MediaCache5\Data5
RegKey15=HKCU\Software\CyberLink\PowerDirector16\MediaObj\MediaCache5\Thumbnail5
RegKey16=HKCU\Software\CyberLink\PowerDirector17\MediaObj\MediaCache5\Data5
RegKey17=HKCU\Software\CyberLink\PowerDirector17\MediaObj\MediaCache5\Thumbnail5
RegKey18=HKCU\Software\CyberLink\PowerDirector17\OldCacheFolder

[CyberLink PowerDVD *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PowerDVD14
Detect2=HKCU\Software\CyberLink\PowerDVD15
Detect3=HKCU\Software\CyberLink\PowerDVD16
Detect4=HKCU\Software\CyberLink\PowerDVD17
Detect5=HKCU\Software\CyberLink\PowerDVD18
Detect6=HKCU\Software\CyberLink\PowerDVD19
Detect7=HKCU\Software\CyberLink\PowerDVD20
FileKey1=%CommonAppData%\Cyberlink\Evoparser|*.xml
FileKey2=%CommonAppData%\SUPPORTDIR\*|*.log
FileKey3=%LocalAppData%\Cyberlink\DigitalHome|*.log|RECURSE
FileKey4=%LocalAppData%\Cyberlink\PowerDVD*|*.log|RECURSE
FileKey5=%LocalAppData%\Cyberlink\PowerDVD*\*\PowerDVDMainAP|*.*|RECURSE
FileKey6=%LocalAppData%\Cyberlink\PowerDVD*\cache*|*.*|RECURSE
FileKey7=%LocalAppData%\Cyberlink\PowerDVD*\CL_DMP_Browser|*.*|RECURSE
FileKey8=%LocalAppData%\Cyberlink\PowerDVD*\DB*\computer|*.db|RECURSE
FileKey9=%LocalAppData%\Cyberlink\PowerDVD*\DefaultMember|*.*|RECURSE
RegKey1=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey3=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey4=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey6=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey9=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey10=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey11=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey12=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey13=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey14=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey15=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey16=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey17=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey18=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey19=HKCU\Software\CyberLink\PowerDVD20\CoarseSnapshot\MediaObj\MediaCache5\Data5
RegKey20=HKCU\Software\CyberLink\PowerDVD20\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo

[CyberLink YouCam *]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\YouCam
FileKey1=%Documents%\YouCam|*.tmp

[CzDC *]
LangSecRef=3022
DetectFile=%AppData%\CzDC
FileKey1=%AppData%\CzDC|*.bak|RECURSE

[Daemon Tools *]
LangSecRef=3024
Detect1=HKCU\Software\Disc Soft
Detect2=HKCU\Software\DT Soft
Detect3=HKLM\Software\Disc Soft
Detect4=HKLM\Software\DT Soft
FileKey1=%AppData%\DAEMON Tools*|ImgList.dat
FileKey2=%AppData%\DAEMON Tools*\*Cache|*.*|RECURSE
RegKey1=HKCU\Software\Disc Soft\DAEMON Tools Pro\GuiNamespace|MountFolder
RegKey2=HKCU\Software\DT Soft\DAEMON Tools Pro\GuiNamespace|MountFolder

[Dakota AG *]
LangSecRef=3021
DetectFile=%SystemDrive%\dakotaag
FileKey1=%Documents%|dakotaDeinstallieren.log
FileKey2=%SystemDrive%\dakotaag|*.log|RECURSE

[DAMN Hash Calculator *]
LangSecRef=3024
Detect=HKCU\Software\DAMN\Hash Calculator
RegKey1=HKCU\Software\DAMN\Hash Calculator\Settings|LastDir

[DAMN NFO Viewer *]
LangSecRef=3024
Detect=HKCU\Software\DAMN\DAMN NFO Viewer
RegKey1=HKCU\Software\DAMN\DAMN NFO Viewer|WorkingDirectory
RegKey2=HKCU\Software\DAMN\DAMN NFO Viewer\Recently Viewed Files

[Damned *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\251170
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Damned|*.log|RECURSE

[Dangerous Waters *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1600
DetectFile=%ProgramFiles%\Sonalysts Combat Simulations\Dangerous Waters
FileKey1=%ProgramFiles%\Sonalysts Combat Simulations\Dangerous Waters|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Dangerous Waters|*.log

[DARK *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225360
FileKey1=%AppData%\Kalypso Media\Dark|log.txt

[Dark Blood Online *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\267790
FileKey1=%AppData%\DarkBlood ServiceST|*.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Dark Blood\logs|*.*|RECURSE

[Darksiders II Deathinitive Edition Backups *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\388410
Warning=You won't be able to restore corrupted saves.
FileKey1=%ProgramFiles%\Steam\steamapps\common\Darksiders II Deathinitive Edition\Debug Saves|*.*

[Darksiders Warmastered Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\462780
FileKey1=%ProgramFiles%\Steam\steamapps\common\Darksiders Warmastered Edition|*.log

[Darkspore *]
Section=Games
DetectFile=%ProgramFiles%\Origin Games\Darkspore
FileKey1=%ProgramFiles%\Origin Games\Darkspore|*.log|RECURSE

[Dashlane *]
LangSecRef=3022
DetectFile=%AppData%\Dashlane
FileKey1=%AppData%\Dashlane\*\background_cache|*.*|RECURSE

[DataNumen Outlook Password Recovery *]
LangSecRef=3024
Detect=HKCU\Software\DOPR
RegKey1=HKCU\Software\DOPR\Misc|OpenDirectory

[DataNumen Outlook Repair *]
LangSecRef=3024
Detect1=HKCU\Software\DOLKR
Detect2=HKCU\Software\DOLKR64
RegKey1=HKCU\Software\DOLKR\Misc|OpenDirectory
RegKey2=HKCU\Software\DOLKR64\Misc|OpenDirectory

[DataTron 7 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\DataTron7
FileKey1=%ProgramFiles%\DataTron7|*.GID;*.BAK

[DATEV *]
LangSecRef=3021
DetectFile=%SystemDrive%\DATEV
FileKey1=%SystemDrive%\DATEV\LOG|*.log|RECURSE

[DayZ *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\221100
FileKey1=%LocalAppData%\DayZ|DayZ.mdmp;DayZ.bidmp

[DB Browser for SQLite *]
LangSecRef=3024
Detect=HKCU\Software\sqlitebrowser\sqlitebrowser
RegKey1=HKCU\Software\sqlitebrowser\sqlitebrowser\db|lastlocation
RegKey2=HKCU\Software\sqlitebrowser\sqlitebrowser\General|recentFileList
RegKey3=HKCU\Software\sqlitebrowser\sqlitebrowser\MainWindow

[DBFView *]
LangSecRef=3021
Detect=HKCU\Software\DBFView
RegKey1=HKCU\Software\DBFView\DBFView\Recent File List

[dBpoweramp *]
LangSecRef=3023
Detect=HKCU\Software\Illustrate\dBpoweramp
FileKey1=%AppData%\dBpoweramp|*.bin

[DC Universe Online *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\24200
FileKey1=%Documents%\My Games\DC Universe Online\Logs|*.*
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\DC Universe Online|.downloadInfo.txt;.downloadStats.txt

[DC++ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\DC++\DCPlusPlus.exe
FileKey1=%AppData%\DC++|FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey2=%AppData%\DC++\FileLists|*.*
FileKey3=%AppData%\DC++\Logs|*.*
FileKey4=%LocalAppData%\DC++|FinishedTransfers.xml;Queue.xml.bak;Recents.xml
FileKey5=%ProgramFiles%\DC++|FinishedTransfers.xml;Queue.xml.bak;Recents.xml

[Dead Island *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\91310
Detect2=HKCU\Software\Valve\Steam\Apps\383150
Detect3=HKCU\Software\Valve\Steam\Apps\383180
FileKey1=%Documents%\DeadIsland*\out\logs|*.*

[DeadHash *]
LangSecRef=3024
DetectFile=%AppData%\deadhash
FileKey1=%AppData%\deadhash\*Cache|*.*|RECURSE
FileKey2=%AppData%\deadhash\blob_storage|*.*|RECURSE
FileKey3=%AppData%\deadhash\Local Storage|*.*|RECURSE
FileKey4=%AppData%\deadhash\Session Storage|*.*
FileKey5=%LocalAppData%\deadhash-updater|*.exe

[Dear Esther *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\203810
FileKey1=%ProgramFiles%\Steam\Steamapps\common\dear esther\dearesther|*.tmp
FileKey2=%ProgramFiles%\Steam\Steamapps\common\dear esther\dearesther\resource|*.icns

[Death to Spies: Moment of Truth *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\34410
FileKey1=%Documents%\My Games\Smersh_MT\Cache|*.*

[Death Track: Resurrection *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\7840
FileKey1=%Documents%\Skyfallen Entertaiment\DeathTrack\Logs|*.*

[Debenu *]
LangSecRef=3021
Detect=HKCU\Software\Debenu
FileKey1=%CommonAppData%\Debenu\PDF Tools\Reports\App Log|*.*
RegKey1=HKCU\Software\Debenu\Debenu PDF Maximus 2\MaximusViewerRecentDocs
RegKey2=HKCU\Software\Debenu\Debenu PDF Maximus 2\MaximusViewerRecentFolders

[DeepBurner *]
LangSecRef=3024
Detect=HKCU\Software\Astonsoft\DeepBurner
FileKey1=%AppData%\DeepBurner|DeepBurner.log

[Deezer Desktop *]
LangSecRef=3022
DetectFile=%LocalAppData%\Programs\deezer.desktop
FileKey1=%AppData%\Deezer*|*-journal;LOG;LOG.old|RECURSE
FileKey2=%AppData%\Deezer*|Network Persistent State;Origin Bound Certs;QuotaManager;log.log
FileKey3=%AppData%\Deezer*\*Cache|*.*|RECURSE
FileKey4=%AppData%\Deezer*\*logs|*.*|RECURSE
FileKey5=%AppData%\Deezer*\blob_storage|*.*|RECURSE
FileKey6=%AppData%\Deezer*\Service Worker\*Cache*|*.*|RECURSE
FileKey7=%LocalAppData%\deezer*desktop-updater|*.*|RECURSE

[Defense Grid: The Awakening *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\18500
FileKey1=%ProgramFiles%\Steam\steamapps\common\defensegridtheawakening\Shaders\Generated|*.cache

[Defraggler *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\Defraggler
FileKey1=%ProgramFiles%\Defraggler|*.dmp;*statistics*;*.log;Defraggler*.txt
FileKey2=%UserProfile%|Defraggler*.txt

[Delfix *]
LangSecRef=3024
DetectFile=%SystemDrive%\DelFix.txt
FileKey1=%SystemDrive%|DelFix.txt

[Delivery Optimization Service *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache|*.*|RECURSE
FileKey2=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs|*.*|RECURSE

[Dell Customer Connect *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellCustomerConnect_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\LocalCache\Local\Microsoft\CLR_v4.0_32\UsageLogs|*.log
FileKey4=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\LocalState\serilog|*.txt
FileKey5=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\TempState|*.*|RECURSE

[Dell Digital Delivery *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellDigitalDelivery_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\LocalState\serilog|*.txt
FileKey5=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\TempState|*.*|RECURSE

[Dell Help & Support *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellHelpSupport_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\AC\Temp|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\LocalCache\Local\Dell\DHSC\Logs|*.log
FileKey3=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs|*.log
FileKey4=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\TempState|*.*|RECURSE

[Dell Installation Files *]
LangSecRef=3024
DetectFile=%SystemDrive%\Dell
Warning=This will delete your Dell installation files.
FileKey1=%SystemDrive%\Dell|*.*|REMOVESELF

[Dell Logs *]
LangSecRef=3024
Detect1=HKLM\Software\Dell\MUP
Detect2=HKLM\Software\Dell\UpdateService
Detect3=HKLM\Software\PC-Doctor
DetectFile1=%AppData%\Creative\DELL Webcam Center
DetectFile2=%CommonAppData%\Dell
DetectFile3=%LocalAppData%\Dell
DetectFile4=%LocalAppData%\SupportSoft\DellSupportCenter
DetectFile5=%ProgramFiles%\Dell*
FileKey1=%AppData%\Creative\DELL Webcam Center|MO_Log.txt
FileKey2=%AppData%\PCDr\*\Logs|*.*
FileKey3=%CommonAppData%\Dell\*\Log|*.*|RECURSE
FileKey4=%CommonAppData%\Dell\*\Logs|*.*
FileKey5=%CommonAppData%\Dell\BiosVerification|*.log
FileKey6=%CommonAppData%\Dell\D3\pla\*\*|*.txt|REMOVESELF
FileKey7=%CommonAppData%\Dell\D3\Resources\Logs\serilog|*.*
FileKey8=%CommonAppData%\Dell\Drivers\*|*.log;*.tmp|RECURSE
FileKey9=%CommonAppData%\Dell\TrustedDevice|*.log
FileKey10=%CommonAppData%\Dell\Update|*.txt
FileKey11=%CommonAppData%\Dell\UpdateService\Clients\Update|*.log
FileKey12=%CommonAppData%\Dell\UpdateService\UpdatePackage\Log|*.txt
FileKey13=%CommonAppData%\PCDr\*\Cache|*.xml
FileKey14=%CommonAppData%\PCDr\*\Cache\archives|*.*|RECURSE
FileKey15=%CommonAppData%\PCDr\*\Cache\BUMA|*.*
FileKey16=%CommonAppData%\PCDr\*\Cache\DriverScan|*.*
FileKey17=%CommonAppData%\PCDr\*\Logs|*.*
FileKey18=%LocalAppData%\Dell\*\Log|*.*
FileKey19=%LocalAppData%\Dell\DellMobileConnect|*.log
FileKey20=%LocalAppData%\SupportSoft\DellSupportCenter\*\state\logs|*.*
FileKey21=%ProgramFiles%\Dell*|*.log|RECURSE

[Dell Mobile Connect *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ScreenovateTechnologies.DellMobileConnect_0vhbc3ng4wbp0
FileKey1=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\LocalCache\Local\Dell\DellMobileConnect|*.log
FileKey4=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs|*.log
FileKey5=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\TempState|*.*|RECURSE

[Dell PC Doctor Dumps *]
LangSecRef=3024
DetectFile=%CommonAppData%\PCDr
FileKey1=%CommonAppData%\PCDr|*.dmp|RECURSE

[Dell Power Manager *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellPowerManager_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellPowerManager_*\AC\Temp|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellPowerManager_*\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs|*.log
FileKey3=%LocalAppData%\Packages\DellInc.DellPowerManager_*\TempState|*.*|RECURSE

[Dell PremierColor *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\PortraitDisplays.DellPremierColor_2dgmkzkw4h30c
FileKey1=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\AC\Temp|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\LocalCache\Local\Microsoft\Windows\Caches|*.db
FileKey3=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\TempState|*.*|RECURSE

[Dell Product Registration *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellProductRegistration_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\LocalCache\Local\Dell\Product Registration\UILog|*.htm
FileKey4=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs|*.log
FileKey5=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\TempState|*.*|RECURSE

[Dell SupportAssist *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellSupportAssistforPCs_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_*\LocalCache\Local\Microsoft\CLR_v4.0_32\UsageLogs|*.log
FileKey5=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_*\LocalCache\Local\Microsoft\Windows\Caches|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs_*\TempState|*.*|RECURSE

[Dell SupportAssist Agent *]
LangSecRef=3024
Detect=HKLM\Software\Dell\SupportAssistAgent
FileKey1=%CommonAppData%\PCDr\*\snapshots\*|*.*
FileKey2=%CommonAppData%\SupportAssist\Client\Agent\Downloads|*.*|RECURSE
FileKey3=%CommonAppData%\SupportAssist\Client\Agent\Logs\*|*.*|REMOVESELF
FileKey4=%CommonAppData%\SupportAssist\Client\SRE|*.log
FileKey5=%CommonAppData%\SupportAssist\Client\SRE\ExtendedLogs|*.*
FileKey6=%CommonAppData%\SupportAssist\Client\TechnicianToolkit\Library\Logs|*.*|RECURSE
FileKey7=%CommonAppData%\SupportAssist\Client\TechnicianToolkit\Library\RegBackup|*.*
FileKey8=%CommonAppData%\SupportAssist\Client\TechnicianToolkit\Library\Temp|*.*|RECURSE

[Dell Update *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.DellUpdate_htrsf667h5kn2
FileKey1=%CommonAppData%\Dell\UpdateService\Downloads\*|*.*|REMOVESELF
FileKey2=%LocalAppData%\Packages\DellInc.DellUpdate_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.DellUpdate_*\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs|*.log
FileKey4=%LocalAppData%\Packages\DellInc.DellUpdate_*\LocalCache\Local\Microsoft\Windows\Caches|*.*
FileKey5=%LocalAppData%\Packages\DellInc.DellUpdate_*\TempState|*.*|RECURSE

[Dependency Walker *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Dependency Walker
RegKey1=HKCU\Software\Microsoft\Dependency Walker\Recent File List

[Deponia *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\214340
DetectFile=%LocalAppData%\Daedalic Entertainment\Deponia
FileKey1=%LocalAppData%\Daedalic Entertainment\Deponia|*.log

[Desk 365 *]
LangSecRef=3021
Detect1=HKCU\Software\V9\Desk 365
Detect2=HKLM\Software\V9\Desk 365 Plus
DetectFile1=%ProgramFiles%\Desk 365 Plus\edeskplus.exe
DetectFile2=%ProgramFiles%\Desk 365\desk365.exe
FileKey1=%AppData%\Desk 365*\icons|*.*|RECURSE
FileKey2=%AppData%\Desk 365*\sysicons|*.ico
FileKey3=%ProgramFiles%\Desk 365|recent.xml
FileKey4=%SystemDrive%\User Data\Default|*.*

[Desura Game Cache *]
Section=Games
Detect=HKLM\Software\Desura
DetectFile=%ProgramFiles%\Desura
FileKey1=%CommonAppData%\Desura\DesuraApp\Cache|*.*|RECURSE
FileKey2=%ProgramFiles%\Desura\Cache\games|*.*|RECURSE

[Desura Game Installation Tools *]
Section=Games
Detect=HKLM\Software\Desura
DetectFile=%ProgramFiles%\Desura
Warning=Don't use this if you have limited bandwidth as they will be re-downloaded on next game installation.
FileKey1=%CommonAppData%\Desura\DesuraApp\tools|*.*|RECURSE
ExcludeKey1=PATH|%CommonAppData%\Desura\DesuraApp\tools\installcheck\|*.*

[Desura Logs *]
Section=Games
Detect=HKLM\Software\Desura
DetectFile=%ProgramFiles%\Desura
FileKey1=%CommonAppData%\Desura\DesuraApp|update_log.txt
FileKey2=%CommonAppData%\Desura\DesuraApp\dumps|*.*
FileKey3=%ProgramFiles%\Desura|*.log

[Desura Update Backups *]
Section=Games
Detect=HKLM\Software\Desura
DetectFile=%ProgramFiles%\Desura
FileKey1=%ProgramFiles%\Desura|*.exe_old

[Desura Web Cache *]
Section=Games
Detect=HKLM\Software\Desura
DetectFile=%ProgramFiles%\Desura
FileKey1=%CommonAppData%\Desura\DesuraApp|webcore_cache.sqlite

[Deus Ex *]
Section=Games
DetectFile=%SystemDrive%\DeusEx\System
FileKey1=%SystemDrive%\DeusEx\System|DeusEx.log;Detected.log

[Device Icon Downloads *]
LangSecRef=3025
DetectFile=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads
FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads|*.tmp

[Device Manager Cache *]
DetectOS=6.0|
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Warning=This clears cached drivers of connected devices. As soon as you connect a new device, this file regenerates.
FileKey1=%WinDir%\System32\DriverStore|INFCACHE.1

[Device Manager Cache XP *]
DetectOS=|5.1
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Warning=This clears cached drivers of connected devices. As soon as you connect a new device, this file regenerates.
FileKey1=%WinDir%\inf|INFCACHE.1

[DeviceDoctor *]
LangSecRef=3024
DetectFile=%AppData%\DeviceDoctorSoftware\DeviceDoctor
FileKey1=%AppData%\DeviceDoctorSoftware\DeviceDoctor\Logs|*.*

[Devolo Cockpit *]
LangSecRef=3024
Detect=HKLM\Software\devolo\dLAN
FileKey1=%ProgramFiles%\devolo\dlan|dlanhistory.*txt;dlanstats.*xml;support.html;support.zip
FileKey2=%ProgramFiles%\devolo\dlan\updates|*.*|RECURSE

[Devolutions Remote Desktop Manager *]
LangSecRef=3021
DetectFile=%AppData%\Devolutions\RemoteDesktopManager
FileKey1=%AppData%\Devolutions\RemoteDesktopManager|*.log;*.log.db
FileKey2=%LocalAppData%\Devolutions\RemoteDesktopManager|*.log;*.log.db

[Dexpot *]
LangSecRef=3024
Detect=HKCU\Software\Dexpot
FileKey1=%AppData%\Dexpot|*.log

[DFX *]
LangSecRef=3021
Detect=HKCU\Software\DFX
FileKey1=%LocalAppData%\DFX\*|dfx_skin.txt
FileKey2=%LocalAppData%\DFX\*\Tmp|*.*|REMOVESELF

[Diablo II *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Diablo II
FileKey1=%ProgramFiles%\Diablo II|*.log;BnetLog.txt;D*.txt
FileKey2=%SystemDrive%\Diablo II|*.log;BnetLog.txt;D*.txt

[Diablo III *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\D3
FileKey1=%CommonAppData%\Battle.net\Setup\diablo3_engb\Log|*.*
FileKey2=%ProgramFiles%\Diablo III*\Logs|*.*

[Diagnose Windows *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Diagnose Windows\Diagnose.exe
FileKey1=%ProgramFiles%\Diagnose Windows|*.log

[Digi Net Mobile *]
LangSecRef=3021
DetectFile=%CommonAppData%\Digi Net Mobile
FileKey1=%CommonAppData%\Digi Net Mobile\log|*.log;*.txt

[Digital Janitor *]
LangSecRef=3024
Detect=HKCU\Software\Davide Vitelaru\Digital Janitor
FileKey1=%AppData%\Digital Janitor|ToSortHistory

[Digsby *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Digsby
FileKey1=%LocalAppData%\Digsby\Logs|*.*|RECURSE
FileKey2=%LocalAppData%\Digsby\Temp|*.*|RECURSE

[Digsby Cache *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Digsby
FileKey1=%LocalAppData%\Digsby\Cache|*.*|RECURSE

[Digsby Chat Logs *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Digsby
FileKey1=%Documents%\Digsby Logs|*.*|RECURSE

[Direct3D Shader Cache *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\D3DSCache|*.*|RECURSE
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\D3DSCache|*.*|RECURSE

[Directory Opus *]
LangSecRef=3024
Detect=HKLM\Software\GPSoftware\Directory Opus
FileKey1=%AppData%\GPSoftware\Directory Opus\Icon Cache Roaming|*.*|RECURSE
FileKey2=%LocalAppData%\GPSoftware\Directory Opus\Thumbnail Cache|*.*|RECURSE

[Discord *]
LangSecRef=3022
Detect1=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Discord
Detect2=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiscordCanary
Detect3=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiscordPTB
FileKey1=%AppData%\discord*|*.old;*.tmp;LOG;modules.log
FileKey2=%AppData%\discord*\*Cache|*.*|REMOVESELF
FileKey3=%AppData%\discord*\Logs|*.*
FileKey4=%LocalAppData%\Discord*|*.log
FileKey5=%LocalAppData%\Discord*\packages\SquirrelTemp|*.*|REMOVESELF
FileKey6=%LocalAppData%\SquirrelTemp|*.*|REMOVESELF

[Dishonored *]
Section=Games
Detect=HKCU\Software\Arkane\Dishonored
DetectFile=%Documents%\My Games\Dishonored
FileKey1=%Documents%\My Games\Dishonored\DishonoredGame\Logs|*.*

[Disk Space Fan *]
LangSecRef=3024
Detect=HKCU\Software\Cookapp\DSF4
FileKey1=%AppData%\DiskSpaceFan|log.txt;history_C.sqlite

[DiskBoss *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskBoss Ultimate
FileKey1=%LocalAppData%\DiskBoss Ultimate\data\reports|*.*|REMOVESELF

[DiskMax *]
LangSecRef=3024
Detect=HKCU\Software\KoshyJohn.com
FileKey1=%AppData%\KoshyJohn.com\DiskMax|DiskMax Log.txt

[DisplayFusion *]
LangSecRef=3024
Detect=HKCU\Software\Binary Fortress Software\DisplayFusion
FileKey1=%AppData%\DisplayFusion|DisplayFusionSetup.exe;DisplayFusion*.log;DebugInfo.*
FileKey2=%CommonAppData%\Binary Fortress Software\DisplayFusion|DisplayFusionSetup.exe;*.log

[DivFix++ *]
LangSecRef=3023
Detect=HKCU\Software\Death Knight\DivFix++
RegKey1=HKCU\Software\Death Knight\DivFix++|PathLog
RegKey2=HKCU\Software\Death Knight\DivFix++|PathOut

[DivX *]
LangSecRef=3023
Detect1=HKCU\Software\DivX
Detect2=HKLM\Software\DivXNetworks
FileKey1=%AppData%\DivX|Font Cache.*|RECURSE
FileKey2=%AppData%\DivX\DMS\logs|*.*
FileKey3=%CommonAppData%\DivX|*.log|RECURSE
FileKey4=%Video%\DivX Movies|*.*|RECURSE
RegKey1=HKCU\Software\DivX\Settings\Converter|lastBrowseDir
RegKey2=HKCU\Software\DivX\Settings\Converter|outputDir
RegKey3=HKCU\Software\DivX\Settings\Player\PlayerState|LastOpenFileLocation
RegKey4=HKCU\Software\DivX\Settings\TransferWizard|LastBrwosedDir
RegKey5=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry1
RegKey6=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry2
RegKey7=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry3
RegKey8=HKCU\Software\DivXNetworks\DivX Player|CustomOpenFileFolder
RegKey9=HKCU\Software\DivXNetworks\DivX Player|file
RegKey10=HKCU\Software\DivXNetworks\DivX Player|LastOpenFileFolder
RegKey11=HKCU\Software\DivXNetworks\DivX4Windows|MP4 File Name
RegKey12=HKCU\Software\DivXNetworks\DivX4Windows|MV File Name
RegKey13=HKCU\Software\DivXNetworks\DivX4Windows|YUV Dir Name
RegKey14=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry1
RegKey15=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry2
RegKey16=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry3
RegKey17=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry4
RegKey18=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry5
RegKey19=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry6

[DjVuReader *]
LangSecRef=3021
Detect=HKCU\Software\DjVuReader
RegKey1=HKCU\Software\DjVuReader\MRUList

[DLExpert *]
LangSecRef=3021
Detect=HKCU\Software\Ying3\DLExpert
RegKey1=HKCU\Software\Ying3\DLExpert|ftp
RegKey2=HKCU\Software\Ying3\DLExpert|http
RegKey3=HKCU\Software\Ying3\DLExpert\MAIN|ALLFILE
RegKey4=HKCU\Software\Ying3\DLExpert\MAIN|GOOD
RegKey5=HKCU\Software\Ying3\DLExpert\MAIN|GOODURL
RegKey6=HKCU\Software\Ying3\DLExpert\Recent File List

[DoctorWeb *]
LangSecRef=3024
DetectFile=%UserProfile%\DoctorWeb\Quarantine
FileKey1=%UserProfile%\DoctorWeb\Quarantine|*.*|RECURSE

[Document Trace Remover *]
LangSecRef=3024
Detect=HKCU\Software\Smart PC Solutions\Document Trace Remover
FileKey1=%AppData%\Smart PC Solutions\Smart Fast PC\Log|*.*
RegKey1=HKCU\Software\Smart PC Solutions\Document Trace Remover|LastFile
RegKey2=HKCU\Software\Smart PC Solutions\Document Trace Remover|LastFolder

[DocX Viewer *]
LangSecRef=3021
DetectFile=%SystemDrive%\epingsoft\DocXV\DocXV.exe
FileKey1=%SystemDrive%\epingsoft\DocXV|rec.lst

[Dogpile Toolbar *]
LangSecRef=3022
Detect=HKCU\Software\Infospace\DogpileToolbar
RegKey1=HKCU\Software\Infospace\DogpileToolbar\History|1-terms

[Dollar Dash *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\214320
FileKey1=%Documents%\My Games\DollarDash\PKGame\Logs|*.*

[Dolphin Emulator *]
Section=Games
DetectFile=%Documents%\Dolphin Emulator
FileKey1=%Documents%\Dolphin Emulator\Logs|*.*|RECURSE

[Don't Starve *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219740
FileKey1=%Documents%\Klei\DoNotStarve|log.txt
FileKey2=%ProgramFiles%\Steam\steamapps\common\dont_starve\bin|log.txt

[Dooble Downloads *]
LangSecRef=3022
DetectFile=%SystemDrive%\Dooble
FileKey1=%SystemDrive%\Dooble\*\.dooble|downloads.db

[Dooble Internet Traces *]
LangSecRef=3022
DetectFile=%SystemDrive%\Dooble
FileKey1=%SystemDrive%\Dooble\*\.dooble|cookies.db;favicons.fb;history.db
FileKey2=%SystemDrive%\Dooble\*\.dooble\Cache|*.*|REMOVESELF

[DOOM 2016 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\379720
FileKey1=%LocalAppData%\id Software\DOOM\base\generated\temp|*.*
FileKey2=%UserProfile%\Saved Games\id Software\DOOM\base\generated\temp|*.*

[Double Vision Browser 3.0 *]
LangSecRef=3022
Detect=HKCU\Software\Sincell\Double Vision 3.0.0
FileKey1=%ProgramFiles%\Sincell\Double Vision 3.0.0\Logs|*.*

[Download Accelerator Plus *]
LangSecRef=3022
Detect=HKCU\Software\SpeedBit\Download Accelerator
DetectFile=%ProgramFiles%\DAP\DAP.exe
FileKey1=%CommonAppData%\SpeedBit\DAP\Plugins\Log|*.*

[Download App *]
LangSecRef=3024
Detect=HKCU\Software\CBS Interactive\Download App
FileKey1=%AppData%\CBS Interactive\Download App|*.log
FileKey2=%AppData%\CBS Interactive\Download App\Cache|*.*

[Download App Databases *]
LangSecRef=3024
Detect=HKCU\Software\CBS Interactive\Download App
FileKey1=%AppData%\CBS Interactive\Download App\Data|*.db

[Download App Downloads *]
LangSecRef=3024
Detect=HKCU\Software\CBS Interactive\Download App
FileKey1=%Documents%\Downloads\Download App|*.*

[Download Manager *]
LangSecRef=3022
DetectFile=%AppData%\Download Manager
FileKey1=%AppData%\Download Manager|DownloadManagerList.dmc

[DownTango *]
LangSecRef=3022
DetectFile=%LocalAppData%\DownTango
FileKey1=%LocalAppData%\DownTango|application.log
FileKey2=%LocalAppData%\DownTango\Logs|log.txt

[Dr. Despicable's Dastardly Deeds *]
Section=Games
DetectFile=%AppData%\HitPoint Studios\DrD
FileKey1=%AppData%\HitPoint Studios\DrD|logfile.txt

[Dr. Hardware 2014 Report *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Dr. Hardware 2014_is1
FileKey1=%UserProfile%|Report_drhard.txt

[Dr. Web CureIt! *]
LangSecRef=3024
DetectFile=%UserProfile%\Doctor Web
FileKey1=%UserProfile%\Doctor Web|*.log

[DraftSight *]
LangSecRef=3021
Detect1=HKCU\Software\Dassault Systemes\DraftSight
Detect2=HKLM\Software\Dassualt Systemes\DraftSight
FileKey1=%AppData%\DraftSight\*|history.txt;plot.log
FileKey2=%LocalAppData%\Dassault Systemes\DraftSight\cache|*.*|RECURSE

[Dragon Age: Origins *]
Section=Games
Detect1=HKCU\Software\BioWare\Dragon Age
Detect2=HKLM\Software\BioWare\Dragon Age
FileKey1=%CommonAppData%\BioWare\Dragon Age\DA Updater\Logs|*.*
FileKey2=%Documents%\BioWare\Dragon Age\Logs|*.*

[Dragon UnPACKer 5 *]
LangSecRef=3024
Detect=HKCU\Software\Dragon Software\Dragon UnPACKer 5
FileKey1=%ProgramFiles%\Dragon UnPACKer 5|*.log;*.diz
RegKey1=HKCU\Software\Dragon Software\Dragon UnPACKer 5\HyperRipper|Source
RegKey2=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|LastFilterIndex
RegKey3=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|LastFilterIndex_Hash
RegKey4=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_0
RegKey5=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_1
RegKey6=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_2
RegKey7=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_3
RegKey8=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_4
RegKey9=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_5
RegKey10=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_6
RegKey11=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_7
RegKey12=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_8
RegKey13=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_9

[Dreadnought *]
Section=Games
Detect=HKCU\Software\Grey Box\Dreadnought
FileKey1=%LocalAppData%\DreadGame\Saved\Logs|*.log

[DriveImage XML *]
LangSecRef=3021
Detect=HKLM\Software\Runtime Software\DIXML
FileKey1=%ProgramFiles%\Runtime Software\DriveImage XML|log.txt

[Driver Cleaner.NET *]
LangSecRef=3024
DetectFile=%ProgramFiles%\DriverCleanerDotNET\DriverCleanerDotNET.exe
FileKey1=%ProgramFiles%\DriverCleanerDotNET\Backup|*.*|RECURSE
FileKey2=%ProgramFiles%\DriverCleanerDotNET\Log|*.*

[Driver Fusion *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Driver Fusion\Logs
FileKey1=%ProgramFiles%\Driver Fusion\Logs|*.*|RECURSE

[Driver Fusion Backups *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Driver Fusion\Backup
Warning=This will delete your driver backups.
FileKey1=%ProgramFiles%\Driver Fusion\Backup|*.*|RECURSE

[Driver Installation Files *]
LangSecRef=3025
DetectFile=%SystemDrive%\Drivers
FileKey1=%SystemDrive%\Drivers|*.*|REMOVESELF

[Driver Magician *]
LangSecRef=3021
Detect=HKCU\Software\Driver Magician
FileKey1=%AppData%\Driver Magician|HiddenUpdate.txt

[Driver Reinstall Backups *]
LangSecRef=3025
DetectFile=%WinDir%\System32\ReinstallBackups
FileKey1=%WinDir%\System32\ReinstallBackups|*.*|RECURSE

[Driver Updater *]
LangSecRef=3023
Detect=HKLM\Software\SuperEasy Software
FileKey1=%AppData%\SuperEasy Software\Driver Updater|*.log

[DriverCure *]
LangSecRef=3024
Detect=HKCU\Software\ParetoLogic DriverCure
FileKey1=%AppData%\DriverCure|LogFile.*

[DriverEasy Driver Backups *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easeware\DriverEasy
FileKey1=%Documents%\DriverEasy|*.*|RECURSE

[DriverEasy Driver Installation Files *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easeware\DriverEasy
FileKey1=%AppData%\Easeware\DriverEasy\drivers|*.*|RECURSE

[DriverGenius *]
LangSecRef=3024
Detect=HKLM\Software\Driver-Soft\DriverGenius
DetectFile=%ProgramFiles%\Driver-Soft\DriverGenius
FileKey1=%CommonAppData%\DriverGenius|*.log
FileKey2=%CommonAppData%\DriverGenius\InstalledUpdates|*.*
FileKey3=%CommonAppData%\DriverGenius\Temp|*.*
FileKey4=%LocalAppData%\DriverGenius|ScanLog.log

[DriverGenius Downloads *]
LangSecRef=3024
Detect=HKLM\Software\Driver-Soft\DriverGenius
DetectFile=%ProgramFiles%\Driver-Soft\DriverGenius
Warning=This will delete the downloaded drivers.
FileKey1=%CommonAppData%\DriverGenius\Downloads|*.*

[DriverMax *]
LangSecRef=3024
Detect=HKCU\Software\Innovative Solutions\DriverMax
FileKey1=%LocalAppData%\Innovative Solutions\DriverMax\Agent|*.tmp;dmxlog.txt
FileKey2=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Downloded Drivers|*.*
FileKey3=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Uploads|*.*|RECURSE
FileKey4=%LocalAppData%\Innovative Solutions\DriverMax\Backup|*.*
FileKey5=%LocalAppData%\Innovative Solutions\DriverMax\LastScan|*.*
FileKey6=%LocalAppData%\Innovative Solutions\DriverMax\Temp*|*.*
FileKey7=%ProgramFiles%\Innovative Solutions\DriverMax|*.log

[DriverPack Solution *]
LangSecRef=3024
Detect=HKCU\Software\drpsu
Warning=This will delete your bug report.
FileKey1=%AppData%\DRPSu\Logs|*.*
FileKey2=%AppData%\DRPSu\snapshots|*.*
FileKey3=%AppData%\DRPSu\temp|*.*
FileKey4=%Documents%\DRP-Log|*.*
FileKey5=%WinDir%\Logs\DRPLog|*.png;*.txt
FileKey6=%WinDir%\Logs\SysInfo|*.*

[DriverRadarPro *]
LangSecRef=3024
Detect=HKCU\Software\NoVirusThanks\DriverRadarPro
RegKey1=HKCU\Software\NoVirusThanks\DriverRadarPro|edCopyDrvTo
RegKey2=HKCU\Software\NoVirusThanks\DriverRadarPro|edSaveLogsTo

[DriverRobot *]
LangSecRef=3024
Detect=HKCU\Software\Driver Robot
FileKey1=%AppData%\Blitware\DriverRobot\Logs|*.*

[Drivers Installer Assistant *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\Drivers Installer Assistant
FileKey1=%WinDir%\Logs\DIALog|*.txt

[DriverUpdate *]
LangSecRef=3024
DetectFile=%LocalAppData%\Slimware Utilities Inc\DriverUpdate
FileKey1=%LocalAppData%\SlimWare Utilities Inc\DriverUpdate\Logs|*.*|RECURSE

[DriverUpdate Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\Slimware Utilities Inc\DriverUpdate
FileKey1=%LocalAppData%\Slimware Utilities Inc\DriverUpdate\Backups|*.*

[DriverUpdate Downloads *]
LangSecRef=3024
DetectFile=%LocalAppData%\Slimware Utilities Inc\DriverUpdate
FileKey1=%LocalAppData%\SlimWare Utilities Inc\DriverUpdate\Downloads|*.*|RECURSE
FileKey2=%LocalAppData%\SlimWare Utilities Inc\DriverUpdate\Images|*.*|RECURSE

[Dropbox *]
LangSecRef=3024
Detect=HKCU\Software\Dropbox
FileKey1=%AppData%\DropBox|Filecache.db;SigStore.db
FileKey2=%AppData%\DropBox\Bin|*.log
FileKey3=%AppData%\Dropbox\installer|*.*|RECURSE
FileKey4=%AppData%\Dropbox\logs|*.*|RECURSE
FileKey5=%AppData%\DropBoxOem\Log|*.*|RECURSE
FileKey6=%CommonAppData%\Dropbox\Update\Log|*.*
FileKey7=%LocalAppData%\Dropbox\Crashpad\reports|*.dmp
FileKey8=%LocalAppData%\Dropbox\CrashReports|*.*|RECURSE
FileKey9=%LocalAppData%\Dropbox\Logs|*.*|RECURSE
FileKey10=%ProgramFiles%\Dropbox\Update\Download|*.*|REMOVESELF

[Dropbox Cache *]
LangSecRef=3024
Detect=HKCU\Software\Dropbox
Warning=This will remove cached versions of modified and deleted files.
FileKey1=%AppData%\Dropbox\Cache|*.*|RECURSE
FileKey2=%Documents%\Dropbox\.dropbox.cache|*.*|RECURSE
FileKey3=%UserProfile%\Dropbox\.dropbox.cache|*.*|RECURSE

[DSDCS InputMapper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\DSDCS
FileKey1=%ProgramFiles%\DSDCS|*.log|RECURSE

[DU Meter *]
LangSecRef=3022
Detect=HKCU\Software\Hagel\DU Meter
FileKey1=%CommonAppData%\Hagel Technologies\DU Meter|*.csv

[DuckieTV *]
LangSecRef=3023
DetectFile=%AppData%\DuckieTV
FileKey1=%AppData%\DuckieTV|*.log;*.txt

[Duke Nukem 3D *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\225140
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Duke Nukem 3D\bin|stderr.txt;stdout.txt

[DUMo *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\DUMo
FileKey1=%AppData%\KC Softwares\DUMo|*.log

[Dungeon of the Endless *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\249050
FileKey1=%Documents%\Dungeon of the Endless\Temporary Files|*.*

[Dungeons - The Dark Lord *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\200550
FileKey1=%AppData%\Kalypso Media\Dungeons - The Dark Lord|log.txt

[Dup Detector *]
LangSecRef=3023
Detect=HKCU\Software\Prismatic Software\PhotoBatch
RegKey1=HKCU\Software\Prismatic Software\PhotoBatch\Dialogs|LastBatchFile
RegKey2=HKCU\Software\Prismatic Software\PhotoBatch\Dialogs|LastBatchFolder
RegKey3=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastBatFile
RegKey4=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastFold
RegKey5=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastSecFold
RegKey6=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastSingleFold
RegKey7=HKCU\Software\Prismatic Software\PhotoBatch\MRU

[Duplicate Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\DigitalVolcano
FileKey1=%AppData%\DigitalVolcano\DuplicateCleaner|*.data
FileKey2=%Documents%|Duplicate Cleaner log.txt

[Duplicate Photo Finder *]
LangSecRef=3024
Detect=HKCU\Software\Duplicate Photo Finder
RegKey1=HKCU\Software\Duplicate Photo Finder|AddFolderWiz
RegKey2=HKCU\Software\Duplicate Photo Finder|last1
RegKey3=HKCU\Software\Duplicate Photo Finder|lastR1

[DUSK *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\519860
FileKey1=%LocalLowAppData%\David Szymanski\Dusk|output_log.txt

[DVBDream *]
LangSecRef=3024
Detect=HKLM\Software\DVBDream
FileKey1=%ProgramFiles%\dvbdream|*.log;*.bak;*levellog*|RECURSE
FileKey2=%ProgramFiles%\dvbdream\Logs|*.*
FileKey3=%SystemDrive%\dvbdream|*.log;*.bak;*levellog*|RECURSE
FileKey4=%SystemDrive%\dvbdream\Logs|*.*

[DVBViewer *]
LangSecRef=3023
Detect=HKLM\Software\CM&V\DVBViewer
FileKey1=%AppData%\CMUV\DVBViewer*|*.bak;*.log
FileKey2=%CommonAppData%\CMUV\DVBViewer*|*.bak;*.log

[DVBViewer Setup Files *]
LangSecRef=3023
Detect=HKLM\Software\CM&V\DVBViewer
Warning=This will prevent a modify installation. You have to download the installer to modify the installation.
FileKey1=%CommonAppData%\CMUV\DVBViewer\backup|*.*|REMOVESELF
FileKey2=%ProgramFiles%\DVBViewer\backup|*.*|REMOVESELF
FileKey3=%ProgramFiles%\DVBViewer\GraphPresets|*.fgp
FileKey4=%ProgramFiles%\DVBViewer\Remotes|*.*
FileKey5=%ProgramFiles%\DVBViewer\setup|*.*
FileKey6=%ProgramFiles%\DVBViewer\Transponders|*.*

[DVD-Cloner *]
LangSecRef=3023
Detect1=HKCU\Software\Dvd-cloner
Detect2=HKCU\Software\DVD-Cloner Gold
Detect3=HKCU\Software\iPod-Cloner
FileKey1=%AppData%\DVD-Cloner*|*.log
FileKey2=%CommonAppData%\DVD-Cloner*|*.log
FileKey3=%Documents%|Smart.log;Smart_result.log
FileKey4=%ProgramFiles%\DVD-Cloner Platinum\*\readcache|*.*
FileKey5=%ProgramFiles%\DVD-Cloner*|*.log|RECURSE
FileKey6=%SystemDrive%|dtdlog.txt
FileKey7=%WinDir%\System32|dvdtest10024.dat

[DVD-Ranger *]
LangSecRef=3021
Detect=HKLM\Software\DVD-Ranger
FileKey1=%CommonAppData%\DVDRanger\DDF626ADdvdcss|*.*
FileKey2=%CommonAppData%\DVDRanger\Logs|*.*
FileKey3=%Documents%\DVDRanger\Screenshots|*.*|RECURSE
FileKey4=%Documents%\DVDRanger\Temp|*.*|REMOVESELF
FileKey5=%SystemDrive%\DVDRanger|*.*|REMOVESELF

[DVD Flick *]
LangSecRef=3023
DetectFile=%ProgramFiles%\DVD Flick\dvdflick.exe
FileKey1=%AppData%\DVD Flick|dvdflick.log;report.txt

[DVD Shrink Analysis Results *]
LangSecRef=3023
Detect=HKCU\Software\DVD Shrink
Warning=Each time you use this you'll have to agree to the DVD Shrink license.
FileKey1=%CommonAppData%\DVD Shrink|*.*

[dvdcss *]
LangSecRef=3023
DetectFile1=%AppData%\.dvdcss
DetectFile2=%AppData%\dvdcss
DetectFile3=%UserProfile%\.dvdcss
FileKey1=%AppData%\.dvdcss|*.*|REMOVESELF
FileKey2=%AppData%\dvdcss|*.*|REMOVESELF
FileKey3=%UserProfile%\.dvdcss|*.*|REMOVESELF

[DVDFab *]
LangSecRef=3023
Detect1=HKCU\Software\DVDFab
Detect2=HKCU\Software\DVDFab Passkey
Detect3=HKCU\Software\FabPlayer
FileKey1=%AppData%\DVDFab Player*\Advertis*|*.*|RECURSE
FileKey2=%AppData%\DVDFab\DVDFab*\SceneData|*.*|RECURSE
FileKey3=%Documents%\DVDFab*|*.log
FileKey4=%Documents%\DVDFab*\Log|*.*|RECURSE
FileKey5=%Documents%\DVDFab*\SceneData|*.*|RECURSE
FileKey6=%Documents%\DVDFab*\Temp|*.*|RECURSE
FileKey7=%Documents%\DVDFab\DVDFab*\Log|*.*|RECURSE
FileKey8=%Documents%\DVDFab\DVDFab*\Temp|*.*|RECURSE
FileKey9=%Documents%\PcSetup|*.*|RECURSE
RegKey1=HKCU\Software\FabPlayer|DefaultDir
RegKey2=HKCU\Software\FabPlayer|DefaultFile

[DVDSmith *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DVDSmith Movie Backup_is1
FileKey1=%Documents%\dvdsmith|*.log

[DVDVideoSoft *]
LangSecRef=3023
Detect1=HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Detect2=HKCU\Software\DVDVideoSoft
FileKey1=%AppData%\DVDVideoSoft\*\History|*.*|RECURSE
FileKey2=%AppData%\DVDVideoSoft\*Logs|*.*|RECURSE
FileKey3=%Documents%\DVDVideoSoft|*log.txt|RECURSE
FileKey4=%LocalAppData%\DVDVideoSoftTB\Logs|*.*|RECURSE

[DVDVideoSoft Backups *]
LangSecRef=3024
Detect=HKCU\Software\DVDVideoSoft
FileKey1=%AppData%\DVDVideoSoft\Backup|*.*|RECURSE

[DVDx *]
LangSecRef=3023
Detect=HKCU\Software\DVDx
FileKey1=%ProgramFiles%\DVDx|*.tmp
RegKey1=HKCU\Software\DVDx\LastDir
RegKey2=HKCU\Software\DVDx\LastOutput

[DxO Photo Suite *]
LangSecRef=3021
Detect1=HKCU\Software\DxO
Detect2=HKCU\Software\DxO Labs
Detect3=HKCU\Software\DxOLabs
Detect4=HKLM\Software\DxO
Detect5=HKLM\Software\DxO Labs
Detect6=HKLM\Software\DxOLabs
FileKey1=%Documents%\DxO * crash*s|*.*
FileKey2=%Documents%\DxO * logs|*.*
FileKey3=%Documents%\DxO*\CrashReports|*.*|RECURSE
FileKey4=%Documents%\DxO*\log|*.*
FileKey5=%LocalAppData%\DxO*\DataCache|*.*|RECURSE
FileKey6=%LocalAppData%\DxO*\DxO*\*Cache|*.*|RECURSE
FileKey7=%LocalAppData%\DxO*\DxO*\CrashReports|*.*|RECURSE
FileKey8=%LocalAppData%\DxO*\DxO*\Logs|*.*
FileKey9=%LocalAppData%\DxO*\Logs|*.*

[Dying Light *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\239140
FileKey1=%Documents%\Dying Light\out\logs|*.*

[Dyn Updater *]
LangSecRef=3022
Detect=HKCU\Software\Dyn\Dyn Updater
FileKey1=%CommonAppData%\Dyn\Updater|*.log;*.msi

[EA Core *]
Section=Games
Detect=HKCU\Software\EA Games\EA Core
FileKey1=%CommonAppData%\EA Core\Cache|*.*|REMOVESELF
FileKey2=%CommonAppData%\EA Logs|*.*
FileKey3=%CommonAppData%\Electronic Arts\EA Core\logs|*.*
FileKey4=%LocalAppData%\EA Core\Cache|*.*|REMOVESELF

[EA Download Manager *]
Section=Games
Detect=HKLM\Software\Electronic Arts\EADM
FileKey1=%LocalAppData%\Electronic Arts\EADMUI\Web Cache|*.*|RECURSE

[Earth 2160 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\19000
FileKey1=%Documents%\Earth 2160\FontsCache|*.*

[Earth Alerts Images *]
LangSecRef=3022
Detect=HKCU\Software\South Wind Technologies\Earth Alerts
FileKey1=%AppData%\Earth Alerts\Images|*.*|RECURSE

[Earth Alerts Messages *]
LangSecRef=3022
Detect=HKCU\Software\South Wind Technologies\Earth Alerts
FileKey1=%AppData%\Earth Alerts\Messages|*.*|RECURSE

[EaseUS Data Recovery Wizard *]
LangSecRef=3024
DetectFile=%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard
FileKey1=%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard|*.log
ExcludeKey1=FILE|%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard\|install.log

[EaseUS MobiSaver *]
LangSecRef=3021
Detect=HKLM\Software\EASEUS\EASEUS IPhone Wizard
FileKey1=%ProgramFiles%\EaseUS\EaseUS MobiSaver\bin|CommDbg.txt;easeusue.log;PR.log
FileKey2=%SystemDrive%\EaseUS MobiSaver Temp Backup|*.*|RECURSE

[EaseUS MobiSaver for Android *]
LangSecRef=3021
Detect=HKLM\Software\EaseUS\Mobisaver for Android
FileKey1=%ProgramFiles%\EaseUS\EaseUS MobiSaver for Android\bin|CommDbg.txt;Eaolog;easeusue.log;mbs;PR.log
FileKey2=%SystemDrive%\EaseUS MobiSaver for Android Temp Backup|*.*|RECURSE

[EaseUS Partition Master *]
LangSecRef=3024
Detect=HKCU\Software\EASEUS\EASEUS Partition Manager
FileKey1=%ProgramFiles%\EASEUS\EASEUS Partition Master*\bin|*.log|RECURSE

[EaseUS ToDo Backup *]
LangSecRef=3024
Detect=HKCU\Software\EaseUS\EaseUS Todo Backup
FileKey1=%ProgramFiles%\EaseUS\Todo Backup\bin|easeus.log;TbLogsysClient.tblog

[East-Tec Eraser *]
LangSecRef=3024
Detect=HKLM\Software\East-Tec\east-tec Eraser
FileKey1=%CommonAppData%\East-Tec\east-tec Eraser\Updates|*.*|RECURSE
FileKey2=%ProgramFiles%\east-tec Eraser|except.log

[Easy Anti-Cheat *]
Section=Games
DetectFile=%AppData%\EasyAntiCheat
FileKey1=%AppData%\EasyAntiCheat|*.log|REMOVESELF

[Easy CD-DA Extractor *]
LangSecRef=3024
Detect=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8
RegKey1=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k8c
RegKey2=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k80
RegKey3=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k81
RegKey4=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k91
RegKey5=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k92

[Easy Duplicate Finder *]
LangSecRef=3024
Detect=HKCU\Software\Easy Duplicate Finder
DetectFile=%ProgramFiles%\Easy Duplicate Finder 4\EasyDuplicateFinder.exe
FileKey1=%AppData%\EasyDuplicateFinder\Logs|*.log

[EasyGPS *]
LangSecRef=3024
Detect=HKCU\Software\TopoGrafix\EasyGPS
FileKey1=%LocalAppData%\TopoGrafix\Error Logs|*.txt
RegKey1=HKCU\Software\TopoGrafix\EasyGPS\Error Log
RegKey2=HKCU\Software\TopoGrafix\EasyGPS\Recent File List

[eBay Toolbar *]
LangSecRef=3022
Detect=HKCU\Software\eBay\eBayToolbar
FileKey1=%ProgramFiles%\eBay\eBay Toolbar*|*.log
FileKey2=%ProgramFiles%\eBay\eBay Toolbar*\eBayhistory|*.*|RECURSE
RegKey1=HKCU\Software\eBay\eBayToolbar\History
RegKey2=HKCU\Software\eBay\eBayToolbar\RecentSearches

[eBay TurboLister *]
LangSecRef=3021
Detect1=HKCU\Software\eBay\Turbo lister
Detect2=HKCU\Software\eBay\Turbo lister2
FileKey1=%CommonAppData%\eBay\Turbo Lister*|*.log|RECURSE

[EC XTRA Timer *]
LangSecRef=3021
DetectFile=%AppData%\The Toro Company
FileKey1=%AppData%\The Toro Company|ECXTRAoutput.txt

[Edna & Harvey: Harvey's New Eyes *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219910
DetectFile=%LocalAppData%\Daedalic Entertainment\Harvey
FileKey1=%LocalAppData%\Daedalic Entertainment\Harvey|*.log
FileKey2=%ProgramFiles%\Steam\Steamapps\common\Edna and Harvey Harvey's New Eyes|stderr.txt

[Effective File Search *]
LangSecRef=3024
Detect=HKCU\Software\SOW\EFS
FileKey1=%ProgramFiles%\efs|cblist*.dat

[Efficient Calendar *]
LangSecRef=3021
DetectFile=%AppData%\Efficient Calendar
FileKey1=%AppData%\Efficient Calendar\MRUItems|*.*|RECURSE

[Elcomsoft Advanced EFS Data Recovery *]
LangSecRef=3021
Detect=HKCU\Software\ElcomSoft\Advanced EFS Data Recovery
FileKey1=%SystemDrive%|aefsdr.log

[Elcomsoft Password Digger *]
LangSecRef=3021
Detect=HKCU\Software\ElcomSoft\Elcomsoft Password Digger
FileKey1=%AppData%\Elcomsoft\*Password Digger|journal.sqlite

[Elcomsoft Password Recovery *]
LangSecRef=3021
Detect1=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery
Detect2=HKCU\Software\ElcomSoft\Advanced Office Password Recovery
Detect3=HKCU\Software\ElcomSoft\Advanced PDF Password Recovery
Detect4=HKCU\Software\ElcomSoft\Distributed Password Recovery
Detect5=HKCU\Software\ElcomSoft\Elcomsoft Internet Password Breaker
Detect6=HKCU\Software\ElcomSoft\Elcomsoft Phone Password Breaker
Detect7=HKCU\Software\ElcomSoft\Elcomsoft Proactive Password Auditor
Detect8=HKCU\Software\ElcomSoft\Elcomsoft Wireless Security Auditor
FileKey1=%AppData%\Elcomsoft\Elcomsoft Phone Password Breaker|*.log
FileKey2=%CommonAppData%\Elcomsoft Password Recovery\Distributed Password Recovery\Logs|*.*
FileKey3=%ProgramFiles%\Elcomsoft Password Recovery\*|*.log;*log.txt
RegKey1=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery\Paths
RegKey2=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery\Recent Files
RegKey3=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 1
RegKey4=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 2
RegKey5=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 3
RegKey6=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 4
RegKey7=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 5
RegKey8=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 6
RegKey9=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 7
RegKey10=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 8
RegKey11=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 9
RegKey12=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 10
RegKey13=HKCU\Software\ElcomSoft\Advanced PDF Password Recovery\Recent Files

[Electric Sheep *]
LangSecRef=3021
DetectFile=%CommonAppData%\ElectricSheep
FileKey1=%CommonAppData%\ElectricSheep\Logs|*.*

[ElsterFormular *]
LangSecRef=3021
DetectFile=%AppData%\elsterformular
FileKey1=%AppData%\elsterformular\*\log|*.log;*.log.*
FileKey2=%AppData%\elsterformular\*\tmp|*.*|RECURSE
FileKey3=%AppData%\elsterformular\pluginmanager\data|*_cpy.zip
FileKey4=%CommonAppData%\elsterformular\log|*.log
FileKey5=%LocalAppData%\.elfohilfe|*.*|REMOVESELF
FileKey6=%LocalAppData%\elfopatch|*.*|REMOVESELF

[eM Client *]
LangSecRef=3022
Detect=HKCU\Software\eM Client
FileKey1=%AppData%\eM Client\Logs|*.*

[Email Address Collector *]
LangSecRef=3022
DetectFile=%AppData%\DS Development\EAC
FileKey1=%AppData%\DS Development\EAC|*.log

[EmailTray *]
LangSecRef=3024
Detect=HKCU\Software\EmailTray
FileKey1=%LocalLowAppData%\EmailTray|*.log|RECURSE

[EmEditor *]
LangSecRef=3024
Detect=HKCU\Software\EmSoft\EmEditor v3
RegKey1=HKCU\Software\EmSoft\EmEditor v3\Recent File List
RegKey2=HKCU\Software\EmSoft\EmEditor v3\Recent Folder List
RegKey3=HKCU\Software\EmSoft\EmEditor v3\Recent Font List

[emesene2 *]
LangSecRef=3022
DetectFile=%AppData%\emesene\emesene2
FileKey1=%AppData%\emesene\emesene2\*\*\*\avatars|*.*|RECURSE
FileKey2=%AppData%\emesene\emesene2\*\*\*avatars|*.*|RECURSE
FileKey3=%AppData%\emesene\emesene2\*\*\log|*.*|RECURSE

[Emsisoft HiJackFree *]
LangSecRef=3024
Detect=HKLM\Software\Emsi Software GmbH\a-squared HiJackFree
FileKey1=%ProgramFiles%\Emsisoft HiJackFree|*.old
FileKey2=%ProgramFiles%\Emsisoft HiJackFree\Logs|*.*

[EndNote X6 *]
LangSecRef=3021
Detect=HKLM\Software\ISI ResearchSoft\EndNote
FileKey1=%AppData%\EndNote|*.log;*.16
FileKey2=%CommonAppData%\Thomson.ResearchSoft.Installers|*.*|REMOVESELF
FileKey3=%CommonProgramFiles%\Risxtd|*.LOG;*.txt
FileKey4=%Documents%\My EndNote Library.Data\Trash|*.*|RECURSE
FileKey5=%ProgramFiles%\EndNote X6\Product-Support\ThirdParty\Apache2|NOTICE
FileKey6=%ProgramFiles%\EndNote*|*.txt

[EnhanceMy8 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\EnhanceMy8
FileKey1=%AppData%\SeriousBit\EnhanceMy8|Logs.txt
FileKey2=%AppData%\SeriousBit\EnhanceMy8\Backups|*.*|RECURSE

[Epic Games Launcher *]
Section=Games
Detect=HKCU\Software\Epic Games\EpicGamesLauncher
FileKey1=%LocalAppData%\EpicGamesLauncher\Saved\Crashes|*.*|REMOVESELF
FileKey2=%LocalAppData%\EpicGamesLauncher\Saved\Logs|*.*|REMOVESELF

[Epic Games Launcher Cache *]
Section=Games
Detect=HKCU\Software\Epic Games\EpicGamesLauncher
FileKey1=%LocalAppData%\EpicGamesLauncher\Saved\webcache|*.*|REMOVESELF

[Epson *]
LangSecRef=3021
Detect=HKCU\Software\EPSON
FileKey1=%AppData%\Epson\FAX Utility\FAXLOG|*.*

[Eraser *]
LangSecRef=3024
Detect=HKCU\Software\Heidi Computers Ltd\Eraser\5.5
FileKey1=%ProgramFiles%\Eraser*|schedlog.txt

[ESET *]
LangSecRef=3021
Detect=HKLM\Software\ESET\ESET Security
Warning=You may need to run this in Windows Safe Mode. You should also disable the ERA service to properly clean the ERA files.
FileKey1=%CommonAppData%\ESET\ESET*\Logs|*.*|RECURSE
FileKey2=%CommonAppData%\ESET\ESET*\Oldfiles|*.*|RECURSE
FileKey3=%CommonAppData%\ESET\ESET*\Updfiles|*.*|REMOVESELF

[ESET Online Scanner *]
LangSecRef=3024
Detect=HKLM\Software\ESET\ESET Security
FileKey1=%ProgramFiles%\ESET\ESET Online Scanner|log.txt
FileKey2=%ProgramFiles%\ESET\ESET Online Scanner\Modules\data\updfiles\temp|*.*
FileKey3=%ProgramFiles%\ESET\ESET Online Scanner\Quarantine|*.*

[eSobi *]
LangSecRef=3022
DetectFile=%AppData%\eSobi
FileKey1=%AppData%\eSobi\*\temp|*.*|RECURSE

[ESPN Cricinfo *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma
FileKey1=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\Microsoft\CLR_v4.0\NativeImages\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\LocalState|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_*\TempState|*.*|RECURSE

[ESPN FC *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma
FileKey1=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_*\AC\Temp|*.*
FileKey5=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_*\LocalState|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_*\TempState|*.*|RECURSE

[ESPN Motion *]
LangSecRef=3023
Detect=HKCU\Software\Disney\DIGStream
FileKey1=%CommonAppData%\DIGStream\ESPNMotion|*.wmv;*.tmp

[Essential NetTools 3 *]
LangSecRef=3022
Detect=HKCU\Software\ENT3
DetectFile=%ProgramFiles%\Essential NetTools\Ent.exe
FileKey1=%Documents%\EssNetTools\LOGS|*.csv
FileKey2=%ProgramFiles%\Essential NetTools\LOGS|*.*
RegKey1=HKCU\Software\ENT3\Recent

[EssentialPIM *]
LangSecRef=3021
Detect=HKLM\Software\clients\mail\essentialpim pro
DetectFile=%AppData%\EssentialPIM
FileKey1=%AppData%\EssentialPIM*\Logs|*.*

[Etherscan Password Sniffer *]
LangSecRef=3022
Detect=HKCU\Software\Win Sniffer\Etherscan Password Sniffer
RegKey1=HKCU\Software\Win Sniffer\Etherscan Password Sniffer\Recent File List
RegKey2=HKCU\Software\Win Sniffer\Etherscan Password Sniffer\Recent Item List

[Eudora *]
LangSecRef=3022
DetectFile=%AppData%\Qualcomm\Eudora
FileKey1=%AppData%\Qualcomm\Eudora|*.log

[Euro Truck Simulator *]
Section=Games
Detect1=HKCU\Software\SCS Software
Detect2=HKLM\Software\SCS Software
DetectFile=%Documents%\Euro Truck Simulator 2
FileKey1=%Documents%\Euro Truck Simulator 2\cache|*.navcache
FileKey2=%Documents%\Euro Truck Simulator 2\online\lscr_cache|*.jpg
FileKey3=%Documents%\Euro Truck Simulator*|*.log;*log.txt;*.crash

[Euro Truck Simulator 2 Multiplayer Mod *]
Section=Games
DetectFile=%Documents%\ETS2MP
FileKey1=%Documents%\ETS2MP\logs|*.log

[Euro Truck Simulator Profile Backups *]
Section=Games
Detect1=HKCU\Software\SCS Software
Detect2=HKLM\Software\SCS Software
Warning=This will delete your Euro Truck Simulator profile backups. A profile backup will regenerate at next start.
FileKey1=%Documents%\Euro Truck Simulator*|backups.txt
FileKey2=%Documents%\Euro Truck Simulator*\profiles*.bak|*.*|REMOVESELF

[EuroSYSTEMS CoCut Professional 2011 *]
LangSecRef=3021
Detect=HKCU\Software\EuroSYSTEMS\CoCut Professional 2011
FileKey1=%AppData%\EUROSYSTEMS\CoCut Professional 2011 15|*.bak
FileKey2=%ProgramFiles%\EUROSYSTEMS\CoCut Professional 2011|*.log;*.bak;*.tmp
FileKey3=%ProgramFiles%\EUROSYSTEMS\CoCut Professional 2011\log|*.*

[EuroSYSTEMS SmartCut Pro *]
LangSecRef=3021
Detect=HKCU\Software\EuroSYSTEMS
FileKey1=%ProgramFiles%\EUROSYSTEMS\SmartCut Pro|*.bak;*.tmp
FileKey2=%ProgramFiles%\EUROSYSTEMS\SmartCut Pro\Temp|*.*|RECURSE

[EVE Online *]
Section=Games
Detect=HKCU\Software\CCP
FileKey1=%AppData%\EVEMon|*.bak
FileKey2=%Documents%\EVE\Logs|*.*|RECURSE
FileKey3=%LocalAppData%\CCP\EVE|history.txt

[Evernote Skitch *]
LangSecRef=3021
Detect=HKCU\Software\Evernote\Skitch
FileKey1=%LocalAppData%\Skitch|logfile.txt
RegKey1=HKCU\Software\Evernote\Skitch|lastDoc

[Evernote Updates *]
LangSecRef=3021
Detect=HKCU\Software\Evernote
FileKey1=%LocalAppData%\Evernote\Evernote\AutoUpdate|*.exe
FileKey2=%LocalAppData%\Evernote\Evernote\Updates|*.*

[Everyday Genius: SquareLogic *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\32150
DetectFile=%AppData%\SquareLogic
FileKey1=%AppData%\SquareLogic|*.log

[Everything *]
LangSecRef=3024
DetectFile1=%AppData%\Everything
DetectFile2=%ProgramFiles%\Everything
FileKey1=%AppData%\Everything|*.csv;*.txt;*.tmp
FileKey2=%ProgramFiles%\Everything|*.csv;*.txt;*.tmp
ExcludeKey1=FILE|%AppData%\Everything\|Filters.csv
ExcludeKey2=FILE|%ProgramFiles%\Everything\|Filters.csv

[ExactFile *]
LangSecRef=3024
Detect=HKCU\Software\ExactFile
RegKey1=HKCU\Software\ExactFile|CDLastFolderSelected
RegKey2=HKCU\Software\ExactFile\FormMain_Properties|EditCDFolderOutputFileName.Text
RegKey3=HKCU\Software\ExactFile\FormMain_Properties|EditCDFolderPath.Text
RegKey4=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditsfcFile.Text
RegKey5=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTDBaseFolder.Text
RegKey6=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTestDigestFile.Text
RegKey7=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTFPath.Text

[ExamDiff Pro *]
LangSecRef=3024
Detect=HKCU\Software\PrestoSoft\ExamDiff Pro
RegKey1=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Binary Find Strings
RegKey2=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Center Merged Files
RegKey3=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Left Merged Files
RegKey4=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Sessions

[Exif Tag Remover *]
LangSecRef=3024
Detect=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover
RegKey1=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover|sLastAddDir
RegKey2=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover|sLastDir

[Exifer *]
LangSecRef=3024
Detect=HKCU\Software\Exifer
RegKey1=HKCU\Software\Exifer\Browse\History

[ExifPro *]
LangSecRef=3024
Detect=HKCU\Software\MKowalski\ExifPro
FileKey1=%CommonAppData%\MiK\ExifPro|Cache*
RegKey1=HKCU\Software\MKowalski\ExifPro\1.0\Browser\View 0|LastPath
RegKey2=HKCU\Software\MKowalski\ExifPro\1.0\HTMLAlbumGen\RecentDestPaths
RegKey3=HKCU\Software\MKowalski\ExifPro\1.0\RecentPaths
RegKey4=HKCU\Software\MKowalski\ExifPro\1.0\ResizeDlg\RecentDestPaths

[Exodus Cache *]
LangSecRef=3022
Detect=HKCU\Software\Jabber\Exodus
FileKey1=%AppData%\Exodus\avatars|cache.xml

[Exodus Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Jabber\Exodus
FileKey1=%Documents%\Exodus-Logs|*.*|RECURSE

[ExpertGHID *]
LangSecRef=3021
Detect1=HKCU\Software\ExpertGHID
Detect2=HKCU\Software\Local AppWizard-Generated Applications\ExpertGHID
RegKey1=HKCU\Software\ExpertGHID\Recent File List
RegKey2=HKCU\Software\Local AppWizard-Generated Applications\ExpertGHID\Recent File List

[Exportizer *]
LangSecRef=3024
Detect=HKCU\Software\Vitaliy Levchenko\Exportizer 5
RegKey1=HKCU\Software\Vitaliy Levchenko\Exportizer 5\Settings|LastExt
RegKey2=HKLM\Software\ODBC\Temporary (volatile) Jet DSN for process 0x5ac Thread 0x3d8 DBC 0x2bd1e84 Xbase|DefaultDir
RegKey3=HKLM\Software\ODBC\Temporary (volatile) Jet DSN for process 0x858 Thread 0xfb0 DBC 0x2ca3a74 Paradox|DefaultDir

[ExpressPoints *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\ExpressPoints
RegKey1=HKCU\Software\NCH Software\ExpressPoints\RecentFileList

[EZ Backup Ultimate *]
LangSecRef=3024
Detect=HKCU\Software\Perception\EZ Backup Ultimate
FileKey1=%AppData%\EZ Backup Ultimate|lastlog.html

[F-Secure Password Manager *]
LangSecRef=3021
Detect=HKCU\Software\F-Secure
FileKey1=%LocalAppData%\F-Secure\Pwmgr|*.log
FileKey2=%LocalAppData%\F-Secure\Pwmgr\LocalStorage|*.*|RECURSE

[Facebook *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Facebook.Facebook_8xx8rvfyw5nnt
FileKey1=%LocalAppData%\Packages\Facebook.Facebook_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Facebook.Facebook_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Facebook.Facebook_*\AC\Temp|*.*|RECURSE

[Facebook Messenger *]
LangSecRef=3022
DetectFile=%LocalAppData%\Facebook\Messenger
FileKey1=%LocalAppData%\Facebook\Messenger|*.log|RECURSE
FileKey2=%LocalAppData%\Facebook\Messenger\fbmessenger.cache|index;data_*

[Facebook Plugin *]
LangSecRef=3022
Detect=HKCU\Software\Facebook
FileKey1=%LocalAppData%\Facebook\CrashReports|*.*

[FACEIT Client *]
Section=Games
DetectFile=%AppData%\FACEIT
FileKey1=%AppData%\FACEIT\*Cache|*.*
FileKey2=%AppData%\FACEIT\FACEIT Client|debug.log

[Faceprov *]
LangSecRef=3023
Detect=HKCU\Software\Lenovo
FileKey1=%SystemDrive%|Faceprov.*

[Fallout Shelter *]
Section=Games
Detect1=HKCU\Software\Bethesda\Fallout Shelter
Detect2=HKCU\Software\Valve\Steam\Apps\588430
FileKey1=%LocalAppData%\FalloutShelter|*.log;*.bkp

[Fantasy Wars *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\63900
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Fantasy Wars|gui_log.txt

[FAR Manager *]
LangSecRef=3021
Detect1=HKCU\Software\Far
Detect2=HKCU\Software\Far2
Detect3=HKCU\Software\Far18
RegKey1=HKCU\Software\Far\Editor\LastPositions
RegKey2=HKCU\Software\Far\SavedDialogHistory
RegKey3=HKCU\Software\Far\SavedDialogHistory\PersPath
RegKey4=HKCU\Software\Far\SavedFolderHistory
RegKey5=HKCU\Software\Far\SavedHistory
RegKey6=HKCU\Software\Far\SavedViewHistory
RegKey7=HKCU\Software\Far\Viewer\LastPositions
RegKey8=HKCU\Software\Far2\Editor\LastPositions
RegKey9=HKCU\Software\Far2\SavedDialogHistory
RegKey10=HKCU\Software\Far2\SavedDialogHistory\PersPath
RegKey11=HKCU\Software\Far2\SavedFolderHistory
RegKey12=HKCU\Software\Far2\SavedHistory
RegKey13=HKCU\Software\Far2\SavedViewHistory
RegKey14=HKCU\Software\Far2\Viewer\LastPositions
RegKey15=HKCU\Software\Far18\Editor\LastPositions
RegKey16=HKCU\Software\Far18\SavedDialogHistory
RegKey17=HKCU\Software\Far18\SavedDialogHistory\PersPath
RegKey18=HKCU\Software\Far18\SavedFolderHistory
RegKey19=HKCU\Software\Far18\SavedHistory
RegKey20=HKCU\Software\Far18\SavedViewHistory
RegKey21=HKCU\Software\Far18\Viewer\LastPositions

[Farming Simulator *]
Section=Games
Detect=HKLM\Software\SCS Software
FileKey1=%Documents%\My Games\FarmingSimulator*|*.txt
FileKey2=%Documents%\My Games\FarmingSimulator*\pdlc*|*.dlc|REMOVESELF
FileKey3=%Documents%\My Games\FarmingSimulator*\shader_cache|*.shc;*.xml|REMOVESELF

[Farming Simulator Old AutoSaves *]
Section=Games
Detect=HKLM\Software\SCS Software
FileKey1=%Documents%\My Games\FarmingSimulator*\savegame*|*.*|REMOVESELF
ExcludeKey1=PATH|%Documents%\My Games\FarmingSimulator*\savegame1\|*.*
ExcludeKey2=PATH|%Documents%\My Games\FarmingSimulator*\savegameBackup\|*.*

[Fast Clean Pro *]
LangSecRef=3024
DetectFile=%LocalAppData%\Fastcleanpro
FileKey1=%LocalAppData%\Fastcleanpro\logs|*.*

[FastStone Capture *]
LangSecRef=3024
Detect=HKCU\Software\FastStone Capture
DetectFile=%AppData%\FastStone\FSC
FileKey1=%AppData%\FastStone\FSC|*.bak;fsc.db
FileKey2=%LocalAppData%\FastStone\FSC|fsc.db
RegKey1=HKCU\Software\FastStone|_LastClipPlayed
RegKey2=HKCU\Software\FastStone|_LastRecordingFileName
RegKey3=HKCU\Software\FastStone\APP.FSRecorder\Global|_GrbId
RegKey4=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastClipPlayed
RegKey5=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastRecordingFileName

[FastStone Image Viewer *]
LangSecRef=3023
Detect=HKLM\Software\FastStone Image Viewer
FileKey1=%AppData%\FastStone\FSIV|FSViewer.db

[FatBatt *]
LangSecRef=3024
Detect=HKCU\Software\MiserWare, Inc.\FatBatt
FileKey1=%CommonAppData%\MiserWare\FatBatt\logs|*.log

[FBReader *]
LangSecRef=3021
Detect=HKCU\Software\FBReader
DetectFile=%ProgramFiles%\FBReader\FBReader.exe
FileKey1=%UserProfile%\.FBReader|books.db;network.db;state.db

[Feedback Hub *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\LocalState\DiagOutputDir|*.txt
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\TempState|*.*|RECURSE

[FEZ *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\224760
FileKey1=%AppData%\FEZ|Debug Log.txt

[FFsplit *]
LangSecRef=3023
DetectFile=%ProgramFiles%\FFsplit
FileKey1=%AppData%\FFsplit|FFsourceLog.txt
FileKey2=%AppData%\FFsplit\logs|*.*

[FIGHTERStools *]
LangSecRef=3024
Detect=HKCU\Software\Fighters
FileKey1=%AppData%\Fighters\*\Logs|*.log;*log.txt
FileKey2=%CommonAppData%\Common Toolkit Suite\Tools\Logs|*.log
FileKey3=%CommonAppData%\Fighters\*\Logs|*.log

[File Manager *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\FileManager_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\FileManager_*\LocalState|*.jpg

[File Shredder *]
LangSecRef=3024
Detect=HKCU\Software\Shredder
RegKey1=HKCU\Software\Shredder\{FF14D9EE-48EB-4873-80AC-8E224BEE5823}

[File Transfer Manager *]
LangSecRef=3025
DetectFile=%AppData%\Microsoft\File Transfer Manager
FileKey1=%AppData%\Microsoft\File Transfer Manager|*.bak;ftm_History.xml

[File Type Doctor Last Selected *]
LangSecRef=3024
Detect=HKCU\Software\Creative Element\File Type Doctor
RegKey1=HKCU\Software\Creative Element\File Type Doctor|LastSelected

[FileCleaner *]
LangSecRef=3024
Detect=HKCU\Software\WebMinds, Inc\FileCleaner
FileKey1=%AppData%\FileCleaner|log.txt

[FileHippo Update Checker *]
LangSecRef=3024
Detect=HKCU\Software\Filehippo.com\Update Checker
FileKey1=%Documents%\My Filehippo Downloads|*.*|RECURSE

[FileLocator Pro *]
LangSecRef=3024
Detect=HKCU\Software\Mythicsoft\FileLocatorPro
RegKey1=HKCU\Software\Mythicsoft\FileLocatorPro\RecentContains
RegKey2=HKCU\Software\Mythicsoft\FileLocatorPro\RecentFileName
RegKey3=HKCU\Software\Mythicsoft\FileLocatorPro\RecentFolders

[FileMind QuickFix *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92789900-80D0-4B61-B742-7897964A69AB}_is1
FileKey1=%ProgramFiles%\Metability Software\FileMindQuickFix|*.log|RECURSE

[FileSearchEX *]
LangSecRef=3024
Detect=HKCU\Software\GOFF Concepts\FileSearchEX
RegKey1=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_ContainingTextHistory
RegKey2=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_LookinHistory
RegKey3=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_SearchHistory

[FileZilla *]
LangSecRef=3022
Detect=HKLM\Software\FileZilla Client
FileKey1=%ProgramFiles%\FileZilla FTP Client|*.tmp

[FilmOn TV and/or FilmOn Live TV *]
LangSecRef=3031
DetectFile=%LocalAppData%\Packages\FilmOnLiveTVFree.*_zx03kxexxb716
FileKey1=%LocalAppData%\Packages\FilmOnLiveTVFree.*_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\FilmOnLiveTVFree.*_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\FilmOnLiveTVFree.*_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\FilmOnLiveTVFree.*_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\FilmOnLiveTVFree.FilmOnLiveTVFree_zx03kxexxb716\SearchHistory

[Finders Keepers *]
LangSecRef=3021
Detect=HKCU\Software\Yadu Digital\Finders Keepers
RegKey1=HKCU\Software\Yadu Digital\Finders Keepers\Options\General|Last file

[Firebird Project *]
LangSecRef=3023
Detect=HKLM\Software\Firebird Project
FileKey1=%ProgramFiles%\Firebird\Firebird_2_1|*.log

[Fishdom H2O *]
Section=Games
DetectFile=%AppData%\Playrix Entertainment\Fishdom H2O Final
FileKey1=%AppData%\Playrix Entertainment\Fishdom H2O Final|log.html

[FixCleaner *]
LangSecRef=3024
DetectFile=%AppData%\FixCleaner
FileKey1=%AppData%\FixCleaner\Logs|*.*

[Flash Media Encoder *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Adobe\Flash Media Live Encoder*
FileKey1=%Video%|fmle*.log

[FlashFXP *]
LangSecRef=3022
Detect=HKLM\Software\FlashFXP
FileKey1=%ProgramFiles%\FlashFXP|quick.dat

[FlashGet *]
LangSecRef=3022
Detect=HKCU\Software\JetCar
FileKey1=%ProgramFiles%\FlashGet|Default.bk*;Default.jcd.bak
RegKey1=HKCU\Software\JetCar\JetCar|Recent File List

[FLEXnet *]
LangSecRef=3021
Detect1=HKCU\Software\FlexNet
Detect2=HKLM\System\CurrentControlSet\services\FLEXnet Licensing Service
FileKey1=%CommonAppData%\FLEXnet|*.data_backup.*;*.log

[FlvtoConverter *]
LangSecRef=3023
Detect=HKCU\Software\FlvtoConverter
FileKey1=%AppData%\FlvtoConverter|log.log
FileKey2=%AppData%\FlvtoConverter\preview|*.jpeg

[Folders View Settings *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=This will reset folders size, view, icon or position settings to default and remove traces of the folders that do not exist anymore.
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
RegKey3=HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
RegKey4=HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags
RegKey5=HKCU\Software\Microsoft\Windows\Shell\BagMRU
RegKey6=HKCU\Software\Microsoft\Windows\Shell\Bags
RegKey7=HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU
RegKey8=HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags
ExcludeKey1=REG|HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders
ExcludeKey2=REG|HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders
ExcludeKey3=REG|HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop
ExcludeKey4=REG|HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\AllFolders

[FolderShare *]
LangSecRef=3022
DetectFile=%LocalAppData%\FolderShare
FileKey1=%LocalAppData%\FolderShare\Logs|*.*

[Font Cache *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%LocalAppData%|GDIPFONTCACHEV1.DAT
FileKey2=%WinDir%\ServiceProfiles\LocalService\AppData\Local|FontCache*.dat
FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local\FontCache|~*.dat

[Foobar2000 *]
LangSecRef=3023
Detect=HKLM\Software\foobar2000
DetectFile=%ProgramFiles%\foobar2000\foobar2000.exe
FileKey1=%ProgramFiles%\foobar2000|failure.txt
FileKey2=%ProgramFiles%\foobar2000\crash reports|failure*.dmp;failure*.txt

[Foobar2000 YouTube Source *]
LangSecRef=3023
DetectFile=%AppData%\foobar2000\user-components\foo_youtube
FileKey1=%AppData%\foobar2000\foo_youtube\cache|*.*|RECURSE

[Ford Sync My iTunes *]
LangSecRef=3023
DetectFile=%AppData%\Ford Motor Company
FileKey1=%AppData%\Ford Motor Company\logs|*.*

[ForgetBox Cache *]
LangSecRef=3022
Detect=HKCU\Software\ForgetBox SAS
FileKey1=%AppData%\ForgetBox\cache|*.*|RECURSE

[Forte Agent *]
LangSecRef=3025
Detect=HKLM\Software\Forte
FileKey1=%AppData%\Forte\Agent|errorlog.xml;*.log|RECURSE
FileKey2=%SystemDrive%\My Data\ForteAgent|*.bak;*.log

[Fortnite *]
Section=Games
DetectFile=%LocalAppData%\FortniteGame
FileKey1=%LocalAppData%\FortniteGame\Saved\Crashes|*.*|REMOVESELF
FileKey2=%LocalAppData%\FortniteGame\Saved\Demos|UnsavedReplay*.replay|REMOVESELF
FileKey3=%LocalAppData%\FortniteGame\Saved\Logs|*.*|REMOVESELF

[Fortnite Cache *]
Section=Games
DetectFile=%LocalAppData%\FortniteGame
FileKey1=%LocalAppData%\FortniteGame\Saved\webcache|*.*|REMOVESELF

[Forward Observer *]
LangSecRef=3021
DetectFile=%ProgramFiles%\AAForwardObserver\AAForwardObserver.exe
FileKey1=%ProgramFiles%\AAForwardObserver|FO.log

[Foxit PhantomPDF *]
LangSecRef=3021
Detect1=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0
Detect2=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0
Detect3=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0
Detect4=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0
FileKey1=%AppData%\Foxit Software\Foxit PDF Creator\Creator-Log|*.*|RECURSE
FileKey2=%AppData%\Foxit Software\Foxit PhantomPDF\FormFiller|AutoComplete.ds
FileKey3=%AppData%\Foxit Software\Foxit PhantomPDF\StartPage\*\Start\en-US|index.html
FileKey4=%AppData%\Foxit Software\RMS|FXRMS_Log.txt
FileKey5=%LocalAppData%\Foxit PhantomPDF\msilog|*.log
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Roaming\Foxit Software\Foxit PDF Creator|*__foxittemp.xml|RECURSE
RegKey1=HKCU\Software\Foxit Software Company\Foxit PDF Editor|Recent File List
RegKey2=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\History
RegKey3=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\RecentFiles
RegKey4=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\File MRU
RegKey5=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\Place MRU
RegKey6=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\plugins\JSPlugins
RegKey7=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Preferences\History
RegKey8=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Recent File List
RegKey9=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\CommentPanel\Filter
RegKey10=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey11=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\File MRU
RegKey12=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\Place MRU
RegKey13=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\plugins\JSPlugins
RegKey14=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Preferences\History
RegKey15=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Recent File List
RegKey16=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\CommentPanel\Filter
RegKey17=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey18=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\File MRU
RegKey19=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\Place MRU
RegKey20=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\plugins\JSPlugins
RegKey21=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Preferences\History
RegKey22=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Recent File List

[Foxit Reader 6.0 *]
LangSecRef=3021
Detect=HKCU\Software\Foxit Software\Foxit Reader 6.0
FileKey1=%AppData%\Foxit Software\Foxit Reader\StartPage\Start|history.txt
FileKey2=%LocalAppData%\Foxit Reader|*.TXT;*.zip;*.reg
RegKey1=HKCU\Software\Foxit Software\Foxit Reader 6.0\Preferences\History\Options

[Fractal: Make Blooms Not War *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\61310
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Fractal\fractal_data|output_log.txt

[Fre:ac *]
LangSecRef=3024
DetectFile=%AppData%\freac
FileKey1=%AppData%\Freac\cddb|*.*|REMOVESELF

[Free Download Manager *]
LangSecRef=3022
Detect=HKCU\Software\FreeDownloadManager.ORG\Free Download Manager
FileKey1=%AppData%\Free Download Manager|downloads.del.sav

[Free Editor *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Free Editor\FreeEditor.exe
FileKey1=%ProgramFiles%\Free Editor|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Free Editor\NGEN\x64|ngen.log
FileKey3=%ProgramFiles%\Free Editor\NGEN\x86|ngen.log

[Free Hex Editor *]
LangSecRef=3024
Detect=HKCU\Software\Frhed
RegKey1=HKCU\Software\Frhed\Settings\0|MRU_File1
RegKey2=HKCU\Software\Frhed\Settings\0|MRU_File2
RegKey3=HKCU\Software\Frhed\Settings\0|MRU_File3
RegKey4=HKCU\Software\Frhed\Settings\0|MRU_File4
RegKey5=HKCU\Software\Frhed\Settings\0|MRU_File5
RegKey6=HKCU\Software\Frhed\Settings\0|MRU_File6
RegKey7=HKCU\Software\Frhed\Settings\0|MRU_File7
RegKey8=HKCU\Software\Frhed\Settings\0|MRU_File8
RegKey9=HKCU\Software\Frhed\Settings\0|MRU_File9

[Free Image Editor *]
LangSecRef=3023
Detect=HKCU\Software\RasterVect Software\Free Image Editor
RegKey1=HKCU\Software\RasterVect Software\Free Image Editor\Options|CurrDir
RegKey2=HKCU\Software\RasterVect Software\Free Image Editor\Recent File List

[Free Opener *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Free Opener\FreeOpener.exe
FileKey1=%ProgramFiles%\Free Opener|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Free Opener\NGEN\x64|ngen.log
FileKey3=%ProgramFiles%\Free Opener\NGEN\x86|ngen.log

[Free PDF XP *]
LangSecRef=3024
Detect=HKCU\Software\shbox\FreePdfXP
FileKey1=%SystemDrive%|IfpRedmon.log

[Free Registry Defrag *]
LangSecRef=3024
Detect=HKCU\Software\Local AppWizard-Generated Applications\RegDefrag
FileKey1=%WinDir%\$regcmp$|*.*

[Free Viewer *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Free Viewer\FreeViewer.exe
FileKey1=%ProgramFiles%\Free Viewer|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Free Viewer\NGEN\x64|ngen.log
FileKey3=%ProgramFiles%\Free Viewer\NGEN\x86|ngen.log

[FreeCommander XE *]
LangSecRef=3021
DetectFile=%LocalAppData%\FreeCommanderXE
FileKey1=%LocalAppData%\FreeCommanderXE\Settings\Bkp_Settings_*|*.*|REMOVESELF
FileKey2=%ProgramFiles%\FreeCommander XE\backup|*.*|REMOVESELF

[FreeFixer *]
LangSecRef=3024
DetectFile=%LocalAppData%\FreeFixer
FileKey1=%LocalAppData%\FreeFixer|itemtracking.txt
FileKey2=%LocalAppData%\FreeFixer\icons|*.ico|RECURSE
FileKey3=%LocalAppData%\FreeFixer\logs|*.*|RECURSE

[Freemake Video Downloader *]
LangSecRef=3022
Detect=HKCU\Software\Freemake\FreemakeVideoDownloader
FileKey1=%Documents%\Freemake\FreemakeVideoDownloader|fvd.bin
FileKey2=%ProgramFiles%\Freemake|*.txt

[Freenet *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Freenet
DetectFile=%LocalAppData%\Freenet\freenet.exe
FileKey1=%LocalAppData%\Freenet|*.bak
FileKey2=%LocalAppData%\Freenet\logs|*.gz;*.log
FileKey3=%LocalAppData%\Freenet\persistent-temp|*.tmp
FileKey4=%LocalAppData%\Freenet\temp|*.*
FileKey5=%LocalAppData%\Freenet\wrapper|*.log

[FrostWire *]
LangSecRef=3022
Detect=HKLM\Software\FrostWire
FileKey1=%AppData%\FrostWire\.AppSpecialShare|*.*|RECURSE
FileKey2=%AppData%\FrostWire\azureus|*.*|RECURSE
FileKey3=%Documents%\FrostWire\Incomplete|*.*|RECURSE

[Frozen Synapse *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\98200
FileKey1=%ProgramFiles%\Steam\Steamapps\common\Frozen Synapse|*.log

[FTL: Faster Than Light *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\212680
DetectFile=%Documents%\My Games\FasterThanLight
FileKey1=%ProgramFiles%\Steam\steamapps\common\FTL Faster Than Light\crashlogs|*.*

[Full Bore *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105430
FileKey1=%Documents%\Full Bore|log.txt

[Full Tilt Poker *]
Section=Games
DetectFile=%ProgramFiles%\Full Tilt Poker.net
FileKey1=%ProgramFiles%\Full Tilt Poker.net\Cache|*.*

[G-Data *]
LangSecRef=3023
Detect=HKCU\Software\G Data
FileKey1=%CommonAppData%\G Data\AVK\Log|*.*|RECURSE
FileKey2=%CommonProgramFiles%\G Data\AVKScanP\G Data|*.log;*old
FileKey3=%ProgramFiles%\G Data\AntiVirus\AVK\UpdatePGM|*.log

[Gadu-Gadu *]
LangSecRef=3022
Detect=HKCU\Software\Gadu-Gadu
FileKey1=%WinDir%|TEMP*.htm*

[Gajim *]
LangSecRef=3022
DetectFile=%AppData%\Gajim
FileKey1=%AppData%\Gajim|cache.db;Logs.db;gajim.log
FileKey2=%AppData%\Gajim\Avatars|*.*

[Galaxy *]
Section=Games
Detect=HKCU\Software\GOG.com\Galaxy
FileKey1=%CommonAppData%\GOG.com\Galaxy\logs|*.log
FileKey2=%CommonAppData%\GOG.com\Galaxy\temp\desktop-galaxy-updater|*.*|REMOVESELF

[Galaxy Cache *]
Section=Games
Detect=HKCU\Software\GOG.com\Galaxy
FileKey1=%CommonAppData%\GOG.com\Galaxy\webcache|*.*|REMOVESELF

[Game Maker *]
LangSecRef=3021
Detect1=HKCU\Software\Game Maker 4
Detect2=HKCU\Software\Game Maker\Version 5
Detect3=HKCU\Software\Game Maker\Version 6
Detect4=HKCU\Software\Game Maker\Version 7
Detect5=HKCU\Software\Game Maker\Version 8
RegKey1=HKCU\Software\Game Maker 4\Preferences|GameDir
RegKey2=HKCU\Software\Game Maker 4\Preferences|Recent0
RegKey3=HKCU\Software\Game Maker 4\Preferences|Recent1
RegKey4=HKCU\Software\Game Maker 4\Preferences|Recent2
RegKey5=HKCU\Software\Game Maker 4\Preferences|Recent3
RegKey6=HKCU\Software\Game Maker\Version 5\Preferences|GameDir
RegKey7=HKCU\Software\Game Maker\Version 5\Preferences|Recent0
RegKey8=HKCU\Software\Game Maker\Version 5\Preferences|Recent1
RegKey9=HKCU\Software\Game Maker\Version 5\Preferences|Recent2
RegKey10=HKCU\Software\Game Maker\Version 5\Preferences|Recent3
RegKey11=HKCU\Software\Game Maker\Version 5\Preferences|Recent4
RegKey12=HKCU\Software\Game Maker\Version 5\Preferences|Recent5
RegKey13=HKCU\Software\Game Maker\Version 5\Preferences|Recent6
RegKey14=HKCU\Software\Game Maker\Version 5\Preferences|Recent7
RegKey15=HKCU\Software\Game Maker\Version 6\Preferences|GameDir
RegKey16=HKCU\Software\Game Maker\Version 6\Preferences|Recent0
RegKey17=HKCU\Software\Game Maker\Version 6\Preferences|Recent1
RegKey18=HKCU\Software\Game Maker\Version 6\Preferences|Recent2
RegKey19=HKCU\Software\Game Maker\Version 6\Preferences|Recent3
RegKey20=HKCU\Software\Game Maker\Version 6\Preferences|Recent4
RegKey21=HKCU\Software\Game Maker\Version 6\Preferences|Recent5
RegKey22=HKCU\Software\Game Maker\Version 6\Preferences|Recent6
RegKey23=HKCU\Software\Game Maker\Version 6\Preferences|Recent7
RegKey24=HKCU\Software\Game Maker\Version 7\Preferences|GameDir
RegKey25=HKCU\Software\Game Maker\Version 7\Preferences|Recent0
RegKey26=HKCU\Software\Game Maker\Version 7\Preferences|Recent1
RegKey27=HKCU\Software\Game Maker\Version 7\Preferences|Recent2
RegKey28=HKCU\Software\Game Maker\Version 7\Preferences|Recent3
RegKey29=HKCU\Software\Game Maker\Version 7\Preferences|Recent4
RegKey30=HKCU\Software\Game Maker\Version 7\Preferences|Recent5
RegKey31=HKCU\Software\Game Maker\Version 7\Preferences|Recent6
RegKey32=HKCU\Software\Game Maker\Version 7\Preferences|Recent7
RegKey33=HKCU\Software\Game Maker\Version 8\Preferences|GameDir
RegKey34=HKCU\Software\Game Maker\Version 8\Preferences|Recent0
RegKey35=HKCU\Software\Game Maker\Version 8\Preferences|Recent1
RegKey36=HKCU\Software\Game Maker\Version 8\Preferences|Recent2
RegKey37=HKCU\Software\Game Maker\Version 8\Preferences|Recent3
RegKey38=HKCU\Software\Game Maker\Version 8\Preferences|Recent4
RegKey39=HKCU\Software\Game Maker\Version 8\Preferences|Recent5
RegKey40=HKCU\Software\Game Maker\Version 8\Preferences|Recent6
RegKey41=HKCU\Software\Game Maker\Version 8\Preferences|Recent7

[Games for Windows Live *]
Section=Games
DetectFile=%LocalAppData%\Microsoft\GFWLive
FileKey1=%CommonAppData%\Microsoft\GFWLive\Install\Logs|*.log
FileKey2=%LocalAppData%\Microsoft\GFWLive|*.log|RECURSE
FileKey3=%ProgramFiles%\Microsoft Games for Windows - LIVE\Client|dotNetFx40_Client_setup.exe

[Games for Windows Live Installers *]
Section=Games
Detect1=HKCR\Installer\Products\81024F76746FC3D4EB268FBCF42ECF5D
Detect2=HKCR\Installer\Products\3128052F989958E40A8727EB849371FE
FileKey1=%ProgramFiles%\Microsoft Games for Windows - LIVE\Redist|*.*|RECURSE

[GameSave Manager *]
LangSecRef=3021
Detect1=HKCR\GSM_gsba
Detect2=HKCR\GSM_gsdu
Detect3=HKCR\GSM_gsms
FileKey1=%AppData%\GameSave Manager*\*Cache*|*.*
FileKey2=%AppData%\GameSave Manager*\TaskLogs|*.*
FileKey3=%ProgramFiles%\GameSave Manager*\settings|*.log;ScanResults.txt|RECURSE

[Gardens Inc. 2: The Road to Fame *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBB8E5A9-EE43-491D-9A2D-84172C3C9384}_is1
FileKey1=%ProgramFiles%\*\Gardens Inc. 2*|*.ico;*.html;*msi;*.nfo;*.txt;*.url|RECURSE

[Gardenscapes *]
Section=Games
DetectFile=%AppData%\Playrix Entertainment\Gardenscapes
FileKey1=%AppData%\Playrix Entertainment\Gardenscapes|log.html

[Garena Messenger *]
Section=Games
Detect=HKCU\Software\Garena\im
DetectFile=%ProgramFiles%\Garena Plus\GarenaMessenger.exe
FileKey1=%CommonAppData%\GarenaMessenger|im.log;im.log.*
FileKey2=%CommonAppData%\GarenaMessenger\cache\clan|*.*|RECURSE
FileKey3=%CommonAppData%\GarenaMessenger\cache\customAvatar\buddy|*.*
FileKey4=%CommonAppData%\GarenaMessenger\cache\emoticon|*.*
FileKey5=%CommonAppData%\GarenaMessenger\cache\screencapture|*.*
FileKey6=%CommonAppData%\GarenaMessenger\garena.game.plugins|*.tmp
FileKey7=%CommonAppData%\GarenaMessenger\update*|*.*|RECURSE

[Garmin Express *]
LangSecRef=3024
Detect=HKCU\Software\Garmin\Express
FileKey1=%CommonAppData%\Garmin\Logs|*.log;*.txt|RECURSE
FileKey2=%Documents%\Garmin\Backups\*|*.*|RECURSE

[Garmin MapSource *]
LangSecRef=3024
Detect=HKCU\Software\Garmin\MapSource
FileKey1=%AppData%\GARMIN\MapSource\TileCache|*.*|REMOVESELF

[GarrysMod Cache *]
Section=Games
DetectFile=%ProgramFiles%\Steam\steamapps\common\GarrysMod
FileKey1=%ProgramFiles%\Steam\steamapps\common\GarrysMod|*.cache|RECURSE

[GasBuddy *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\45351D82.GasBuddy-FindCheapGasPrices_932xwky9axss4
FileKey1=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\TempState|*.*|RECURSE

[gBurner *]
LangSecRef=3021
Detect=HKCU\Software\gBurner
RegKey1=HKCU\Software\gBurner|Reopen0
RegKey2=HKCU\Software\gBurner|Reopen1
RegKey3=HKCU\Software\gBurner|Reopen2
RegKey4=HKCU\Software\gBurner|Reopen3

[GEAR DIFx Installers *]
LangSecRef=3024
Detect1=HKCR\Installer\Products\CACFC38969C58104B8CE6D8561446C45
Detect2=HKLM\Software\GEAR Software\DIFx
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EC13FCAF38E85F44B0F1137C7FB5037
FileKey1=%AppData%\34BE82C4-E596-4e99-A191-52C6199EBF69|*.*|REMOVESELF
FileKey2=%AppData%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*.*|REMOVESELF
FileKey3=%AppData%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*.*|REMOVESELF
FileKey4=%AppData%\Downloaded Installations|*.*|REMOVESELF
FileKey5=%CommonAppData%\{755AC846-7372-4AC8-8550-C52491DAA8BD}|*.*|REMOVESELF
FileKey6=%CommonAppData%\34BE82C4-E596-4e99-A191-52C6199EBF69|*.*|REMOVESELF
FileKey7=%CommonAppData%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*.*|REMOVESELF
FileKey8=%CommonAppData%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*.*|REMOVESELF
FileKey9=%CommonAppData%\9727E41D-AD6A-47cd-B9BC-CF630B6013FD|*.*|REMOVESELF
FileKey10=%CommonAppData%\A73B37F8-7A4D-41f4-98A8-7F608CE8B98F|*.*|REMOVESELF
FileKey11=%CommonAppData%\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB|*.log|RECURSE
FileKey12=%CommonAppData%\E1864A66-75E3-486a-BD95-D1B7D99A84A7|*.*|REMOVESELF
FileKey13=%LocalAppData%\Downloaded Installations|*.*|REMOVESELF
FileKey14=%ProgramFiles%\34BE82C4-E596-4e99-A191-52C6199EBF69|*.*|REMOVESELF
FileKey15=%ProgramFiles%\38FDB89C-1EBD-4366-84B2-336D12CC3209|*.*|REMOVESELF
FileKey16=%ProgramFiles%\93E26451-CD9A-43A5-A2FA-C42392EA4001|*.*|REMOVESELF
FileKey17=%ProgramFiles%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*.*|REMOVESELF
FileKey18=%ProgramFiles%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*.*|REMOVESELF
FileKey19=%ProgramFiles%\9727E41D-AD6A-47cd-B9BC-CF630B6013FD|*.*|REMOVESELF

[Geek Uninstaller *]
LangSecRef=3024
Detect=HKCU\Software\Geek Uninstaller
FileKey1=%AppData%\Geek Uninstaller|*.log;*cache.dat

[GeekSquad *]
LangSecRef=3024
DetectFile=%CommonAppData%\Geek Squad
FileKey1=%CommonAppData%\Geek Squad\MRI|EventLog.gsl|RECURSE
FileKey2=%CommonAppData%\Geek Squad\MRI\Automation Reports|*.*|REMOVESELF
FileKey3=%CommonAppData%\Geek Squad\MRI\Downloads|*.*|REMOVESELF

[Genie-Soft *]
LangSecRef=3024
Detect=HKCU\Software\Genie-Soft
FileKey1=%AppData%\Genie-soft\*\logs|*.*

[Genieo *]
LangSecRef=3022
DetectFile=%AppData%\Genieo
FileKey1=%AppData%\Genieo\log|*.*|RECURSE
FileKey2=%AppData%\Genieo\sp_cache|*.*|RECURSE
FileKey3=%AppData%\Genieo\tmp|*.*|RECURSE

[Genymobile *]
LangSecRef=3024
Detect=HKCU\Software\Genymobile
FileKey1=%LocalAppData%\Genymobile|*.log
FileKey2=%UserProfile%\VirtualBox VMs\*|genymotion-player*.log;logcat*.txt

[Get Help *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.GetHelp_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.GetHelp_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.GetHelp_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.GetHelp_*\TempState|*.*|RECURSE

[GetDiz Recent Files List *]
LangSecRef=3021
Detect=HKCU\Software\Outertech\GetDiz
RegKey1=HKCU\Software\Outertech\GetDiz|Recent Files_1
RegKey2=HKCU\Software\Outertech\GetDiz|Recent Files_2
RegKey3=HKCU\Software\Outertech\GetDiz|Recent Files_3
RegKey4=HKCU\Software\Outertech\GetDiz|Recent Files_4
RegKey5=HKCU\Software\Outertech\GetDiz|Recent Files_5
RegKey6=HKCU\Software\Outertech\GetDiz|Recent Files_6
RegKey7=HKCU\Software\Outertech\GetDiz|Recent Files_7
RegKey8=HKCU\Software\Outertech\GetDiz|Recent Files_8
RegKey9=HKCU\Software\Outertech\GetDiz|Recent Files_9
RegKey10=HKCU\Software\Outertech\GetDiz|Recent Files_10

[GetFLV *]
LangSecRef=3023
Detect=HKCU\Software\getflv
DetectFile=%ProgramFiles%\GetFLV\GetFLV.exe
FileKey1=%ProgramFiles%\GetFLV|history.xml;URLHistory.dat;setting.ini
FileKey2=%ProgramFiles%\GetFLV\temp|*.*
FileKey3=%ProgramFiles%\GetFLV\thumb|*.*
FileKey4=%ProgramFiles%\GetFLV\tmp|*.*
RegKey1=HKCU\Software\GetFLV|DownloadDir
RegKey2=HKCU\Software\getflv|FLVTitle
RegKey3=HKCU\Software\GetFLV|FLVURL

[GetRight *]
LangSecRef=3022
Detect=HKCU\Software\Headlight\GetRight
FileKey1=%AppData%\GetRight|GetRight.lst
RegKey1=HKCU\Software\Headlight\GetRight\FileQueue
RegKey2=HKCU\Software\Headlight\GetRight\ResumeServers
RegKey3=HKCU\Software\Headlight\GetRight\Stats
RegKey4=HKCU\Software\Headlight\GetRight\UserAgent

[GetRightToGo *]
LangSecRef=3022
Detect=HKCU\Software\Headlight\GetRightToGo
FileKey1=%AppData%\GetRightToGo|*.data|RECURSE

[Getting Over It with Bennett Foddy *]
Section=Games
Detect=HKCU\Software\steam\apps\266490
FileKey1=%LocalLowAppData%\Bennett Foddy\Getting Over It|output_log.txt
FileKey2=%LocalLowAppData%\Bennett Foddy\Getting Over It\Crashes|*.*

[Ghostbuster *]
LangSecRef=3021
DetectFile=%AppData%\Ghostbuster
FileKey1=%AppData%\Ghostbuster|*.*|REMOVESELF

[GhostMouse *]
LangSecRef=3024
DetectFile=%ProgramFiles%\GhostMouse
FileKey1=%Documents%\AutomaticSolution Software\GhostMouse\conf\temp|*.tmp

[GIANT AntiSpyware *]
LangSecRef=3021
Detect=HKCU\Software\GIANTCompany\AntiSpyware
FileKey1=%ProgramFiles%\GIANT Company Software\GIANT AntiSpyware|errors.log;cleaner.log;tracksEraser.log

[Gigantic *]
Section=Games
DetectFile=%Documents%\My Games\Gigantic
FileKey1=%Documents%\My Games\Gigantic\RxGame\Logs|*.log;*.dmg|RECURSE

[GigaTribe *]
LangSecRef=3022
Detect=HKCU\Software\ShalSoft\GigaTribe
FileKey1=%LocalAppData%\Shalsoft\Gigatribe\*\re*sources|*.*|RECURSE

[GIMP *]
LangSecRef=3021
DetectFile1=%UserProfile%\.gimp-2.2\gimprc
DetectFile2=%UserProfile%\.gimp-2.8
FileKey1=%LocalAppData%|recently-used.xbel
FileKey2=%LocalAppData%\webkit|*.*|REMOVESELF
FileKey3=%UserProfile%\.gimp-2.2|documents

[Ginger *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Ginger
FileKey1=%Documents%\Add-in Express|*.log
FileKey2=%ProgramFiles%\Ginger|*.log;*.tmp|RECURSE
FileKey3=%SystemDrive%|GingerSetup.log

[GitHub *]
LangSecRef=3022
DetectFile=%LocalAppData%\GitHub
FileKey1=%LocalAppData%\GitHub|thelog.txt;*.log;git-log.txt;git-reflog.txt;git-shortlog.txt|RECURSE

[GitHub Desktop *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\GitHubDesktop
FileKey1=%AppData%\GitHub*Desktop\*Cache|*.*|REMOVESELF
FileKey2=%AppData%\GitHub*Desktop\logs|*.*|REMOVESELF
FileKey3=%LocalAppData%\GitHubDesktop|*.log
FileKey4=%LocalAppData%\GitHubDesktop\packages\SquirrelTemp|*.*|REMOVESELF
FileKey5=%LocalAppData%\SquirrelTemp|*.*|REMOVESELF

[GMG Capsule *]
Section=Games
DetectFile=%LocalAppData%\Green Man Gaming\Capsule
FileKey1=%LocalAppData%\Green Man Gaming\Capsule\Logfiles|*.*

[GMote *]
LangSecRef=3024
DetectFile=%AppData%\Gmote
FileKey1=%AppData%\Gmote|*.log

[GNU Cache *]
LangSecRef=3021
Detect=HKCU\Software\GNU
FileKey1=%LocalAppData%\GNU\Cache\*|*.*|RECURSE
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Gnu\Cache|*.*|RECURSE
FileKey3=%WinDir%\System32\config\systemprofile\local settings\application data\gnu\cache|*.*|RECURSE
FileKey4=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\GNU\Cache|*.*|RECURSE

[GnuCash *]
LangSecRef=3021
Detect=HKCU\Software\GSettings\org\gnucash
Warning=This removes the last open history, auto saves and logs.
FileKey1=%UserProfile%\*|*.gnucash.*.log;*.gnucash.*.gnucash;translog.*.log|RECURSE
RegKey1=HKCU\Software\GSettings\org\gnucash\history

[Go!Zilla *]
LangSecRef=3022
Detect=HKCU\Software\Go!Zilla
FileKey1=%ProgramFiles%\Go!Zilla|golog.htm;download.log;leech.hst

[Goalscape *]
LangSecRef=3021
DetectFile=%ProgramFiles%\GoalScape
FileKey1=%AppData%\com.goalscape.app.*\Logging|*.*|RECURSE

[Goat Simulator *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\265930
FileKey1=%Documents%\my games\GoatSim\GoatGame\Logs|*.*

[Gom Player *]
LangSecRef=3023
Detect=HKCU\Software\GRETECH\GomPlayer
FileKey1=%AppData%\GRETECH\GomPlayer|*.bmk
RegKey1=HKCU\Software\GRETECH\GomPlayer\OPTION|sRecentPLFolder

[Goodix Fingerprint Driver *]
LangSecRef=3024
DetectFile=%CommonAppData%\Goodix
FileKey1=%CommonAppData%\Goodix|*.log;*.bak

[GoodSync *]
LangSecRef=3024
Detect=HKCU\Software\Siber Systems\GoodSync
FileKey1=%AppData%\GoodSync|*.log|RECURSE
FileKey2=%Documents%\_gsdata_|*.log|RECURSE

[Google Apps Sync *]
LangSecRef=3022
DetectFile=%LocalAppData%\Google\Google Apps*
FileKey1=%LocalAppData%\Google\Google Apps *|*.log|RECURSE

[Google Calendar Sync *]
LangSecRef=3022
DetectFile=%LocalAppData%\Google\Google Calendar Sync
FileKey1=%LocalAppData%\Google\Google Calendar Sync|*.log|RECURSE

[Google Drive *]
LangSecRef=3024
Detect=HKCU\Software\Google\Drive
DetectFile=%ProgramFiles%\Google\Drive\googledrivesync.exe
FileKey1=%LocalAppData%\Google\Drive|*.log
FileKey2=%LocalAppData%\Google\Drive\CrashReports|*.*|RECURSE
FileKey3=%LocalAppData%\Google\Drive\user_default|*.log
FileKey4=%ProgramFiles%\Google\Drive|*.log

[Google Earth *]
LangSecRef=3021
Detect1=HKCU\Software\Google\Google Earth Plus
Detect2=HKCU\Software\Google\Google Earth Pro
Detect3=HKLM\Software\Google\Google Earth Plus
Detect4=HKLM\Software\Google\Google Earth Pro
FileKey1=%LocalLowAppData%\Google\GoogleEarth|*.tmp;*.log|RECURSE
FileKey2=%LocalLowAppData%\Google\GoogleEarth\Cache|*.*|RECURSE
FileKey3=%ProgramFiles%\Google\GoogleEarth\client|*.log

[Google GBScreensaver *]
LangSecRef=3021
DetectFile=%LocalAppData%\Google\GBScreensaver
FileKey1=%LocalAppData%\Google\GBScreensaver|network.log

[Google Music Manager *]
LangSecRef=3023
Detect=HKCU\Software\Google\MusicManager
FileKey1=%LocalAppData%\Google\MusicManager|*.log

[Google Picasa2Albums Backups *]
LangSecRef=3021
Detect=HKCU\Software\Google\Picasa
FileKey1=%LocalAppData%\Google\Picasa2Albums\backup|*.*|REMOVESELF

[Google Toolbar *]
LangSecRef=3022
DetectFile=%LocalAppData%\Google\Toolbar History
FileKey1=%LocalAppData%\Google\Toolbar History\urls|*.*

[Google Toolbar Notifier *]
LangSecRef=3022
Detect=HKCU\Software\Google\GoogleToolbarNotifier
FileKey1=%ProgramFiles%\Google\GoogleToolbarNotifier|*.tmp|RECURSE

[Google Update *]
LangSecRef=3021
Detect=HKCU\Software\Google\Update
FileKey1=%LocalAppData%\Google\Chrome*\Application|old_chrome.exe
FileKey2=%LocalAppData%\Google\Update\Download|*.*|RECURSE
FileKey3=%LocalAppData%\Google\Update\Install|*.*|RECURSE
FileKey4=%LocalAppData%\Google\Update\Offline|*.*|RECURSE
FileKey5=%ProgramFiles%\Google\Chrome*\Application|old_chrome.exe
FileKey6=%ProgramFiles%\Google\Update\Download|*.*|RECURSE
FileKey7=%ProgramFiles%\Google\Update\Install|*.*|RECURSE
FileKey8=%ProgramFiles%\Google\Update\Offline|*.*|RECURSE

[Google Video Player *]
LangSecRef=3023
Detect=HKCU\Software\Google\Google Video Player
RegKey1=HKCU\Software\Google\Google Video Player\MRUList

[GoPlayer *]
LangSecRef=3023
DetectFile=%ProgramFiles%\GoPlayer
FileKey1=%ProgramFiles%\GoPlayer|*.log

[Gotham City Impostors *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\206210
FileKey1=%Documents%\WB Games\Gotham City Impostors - Free To Play|*.log

[Gothic 3 *]
Section=Games
Detect=HKCU\Software\JoWooD Productions Software AG\Gothic III
FileKey1=%ProgramFiles%\Gothic III|setup*.txt

[GradeKeeper *]
LangSecRef=3021
Detect=HKCU\Software\Gradekeeper
FileKey1=%AppData%\Gradekeeper|*.*

[Gratuitous Space Battles *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\41800
FileKey1=%Documents%\My Games\GratuitousSpaceBattles\debug|*.*
FileKey2=%ProgramFiles%\Steam\Steamapps\common\gratuitous space battles\data\temp|*.*|RECURSE

[Gravity Guy *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MiniclipSA.GravityGuy_gpanv85qtf6rc
FileKey1=%LocalAppData%\Packages\MiniclipSA.GravityGuy_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\MiniclipSA.GravityGuy_*\AC\Microsoft\CryptnetUrlCache\*|*.*

[Green Ranch *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Green RanchFINAL
FileKey1=%AppData%\Palaplay\GreenRanch_Survey|*.txt

[Greenfish Icon Editor Pro *]
LangSecRef=3021
DetectFile=%LocalAppData%\gfie\recent.txt
FileKey1=%LocalAppData%\gfie|recent.txt

[Greenshot *]
LangSecRef=3024
DetectFile=%LocalAppData%\Greenshot
FileKey1=%LocalAppData%\Greenshot|*.log*

[grepWin *]
LangSecRef=3024
Detect=HKCU\Software\grepWin
RegKey1=HKCU\Software\grepWin|searchpath
RegKey2=HKCU\Software\grepWin\History

[GridinSoft Notepad *]
LangSecRef=3021
Detect=HKCU\Software\GridinSoft\Notepad3
RegKey1=HKCU\Software\GridinSoft\Notepad3\Files
RegKey2=HKCU\Software\GridinSoft\Notepad3\Search|ReplaceTextHistory
RegKey3=HKCU\Software\GridinSoft\Notepad3\Search|TextHistory

[Grim Tales: The Wishes CE *]
Section=Games
DetectFile=%AppData%\Elephant Games\Grim Tales The Wishes CE
FileKey1=%AppData%\Elephant Games\Grim Tales The Wishes CE|logfile.txt

[Grokster *]
LangSecRef=3022
Detect=HKCU\Software\Grokster\Grokster
RegKey1=HKCU\Software\Grokster\Grokster\Recent File List

[Groove Music *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\Database\*|*.log
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageCache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageRetrievalFailure|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageStore|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\navigationHistory|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\PlayReady|*.*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory

[GroupWise Messenger *]
LangSecRef=3021
Detect=HKCU\Software\Novell\Messenger
FileKey1=%LocalAppData%\Novell\GroupWise Messenger\history\%UserName%|*.*

[Growl *]
LangSecRef=3024
Detect=HKCU\Software\Growl
FileKey1=%LocalAppData%\Growl\*\History|*.*|RECURSE
FileKey2=%LocalAppData%\Growl\*\ImageCache|*.*|RECURSE
FileKey3=%LocalAppData%\Growl\*\Log|*.*|RECURSE

[GSpot *]
LangSecRef=3024
Detect=HKCU\Software\GSpot Appliance Corp
RegKey1=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|LastMediaFile

[gSyncit *]
LangSecRef=3022
DetectFile=%AppData%\gSyncit
FileKey1=%AppData%\gSyncit|gsyncit*.*

[GT Interactive Driver *]
LangSecRef=3024
DetectFile=%ProgramFiles%\GT Interactive\Driver
FileKey1=%ProgramFiles%\GT Interactive\Driver|debug.log

[Guild Wars *]
Section=Games
DetectFile=%ProgramFiles%\Guild Wars
FileKey1=%ProgramFiles%\Guild Wars|*.tmp

[Gwent - The Witcher Card Game *]
Section=Games
Detect=HKCU\Software\CDProjektRED\Gwent
FileKey1=%CommonAppData%\CDProjekt RED\Gwent\Logs|*.log

[Hacknet *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\365450
FileKey1=%Documents%\My Games\Hacknet\Reports|*.txt

[Halite *]
LangSecRef=3021
DetectFile=%LocalAppData%\Halite
FileKey1=%LocalAppData%\Halite|HaliteLog.txt|RECURSE

[Halite Backups *]
LangSecRef=3021
DetectFile=%LocalAppData%\Halite
FileKey1=%LocalAppData%\Halite|Halite.xml.*|RECURSE

[Halo: Spartan Assault *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_*\AC\Microsoft\CryptnetUrlCache\*|*.*

[HandBrake *]
LangSecRef=3021
DetectFile=%ProgramFiles%\HandBrake
FileKey1=%AppData%\HandBrake\logs|*.*|REMOVESELF
FileKey2=%ProgramFiles%\HandBrake|*.stackdump

[Handle Regshot Reports *]
LangSecRef=3024
DetectFile=%SystemDrive%\Hive
FileKey1=%SystemDrive%\Hive|*.css;*.html;*.reg

[Handle Regshot Snapshots *]
LangSecRef=3024
DetectFile=%SystemDrive%\Hive
Warning=This will delete all saved snapshots.
FileKey1=%SystemDrive%\Hive|*.hive

[Handy Backup *]
LangSecRef=3024
Detect=HKCU\Software\Novosoft\Handy Backup
FileKey1=%AppData%\Novosoft\Handy Backup\logs|*.*

[Happy Cloud *]
Section=Games
Detect=HKCU\Software\HappyCloud
FileKey1=%CommonAppData%\HappyCloud|*.log
FileKey2=%CommonAppData%\HappyCloud\cache|*.*

[Hard Drive Inspector *]
LangSecRef=3024
DetectFile=%CommonAppData%\AltrixSoft\Hard Drive Inspector
FileKey1=%CommonAppData%\AltrixSoft\Hard Drive Inspector|log.err

[Hauppauge WinTV *]
LangSecRef=3024
Detect=HKLM\Software\Hauppauge
FileKey1=%Public%\WinTV|Settings-old.xml
FileKey2=%Public%\WinTV\Channel Database|hcwChanDB_5-lastgood.mdb
FileKey3=%Public%\WinTV\Installation Log|*.*|RECURSE
FileKey4=%Public%\WinTV\Logs|*.log;*.txt
FileKey5=%Public%\WinTV\Logs\minidump|*.*|RECURSE
FileKey6=%SystemDrive%|hcwDriverInstall.txt

[HDD Health *]
LangSecRef=3022
Detect=HKLM\System\CurrentControlSet\services\HDDHealth
FileKey1=%ProgramFiles%\HDD Health|*.tmp

[HDD Regenerator *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HDD Regenerator
FileKey1=%ProgramFiles%\HDD Regenerator|*.log|RECURSE

[HDD Thermometer *]
LangSecRef=3024
Detect=HKCU\Software\RSD Software, Inc.\HDD Thermometer
FileKey1=%CommonAppData%\HDD Thermometer|*.log|RECURSE

[HDDExpert *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\HDDExpert
FileKey1=%AppData%\KC Softwares\HDDExpert|*.log

[Hearthstone *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Hearthstone
FileKey1=%LocalAppData%\Blizzard\Hearthstone\Logs|*.*
FileKey2=%ProgramFiles%\Hearthstone|*.log;*.log.txt;*.dmp|RECURSE

[Hearthstone Cache *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Hearthstone
FileKey1=%LocalAppData%\Blizzard\Hearthstone\Cache|*.*|RECURSE

[Hedgewars *]
Section=Games
Detect=HKLM\Software\Hedgewars
FileKey1=%Documents%\Hedgewars\Logs|*.*
FileKey2=%Documents%\Hedgewars\VideoTemp|*.*

[Helium Music Manager *]
LangSecRef=3023
Detect1=HKCU\Software\Intermedia Software\Helium 8
Detect2=HKCU\Software\Intermedia Software\Helium 9
Detect3=HKCU\Software\Intermedia Software\Helium 10
FileKey1=%AppData%\Intermedia Software\Helium *\Logs|*.*

[Help and Support Center Session History *]
LangSecRef=3025
Detect=HKCR\AppID\HelpCtr.EXE
FileKey1=%LocalAppData%\Microsoft\HelpCtr|HelpSessionHistory.dat

[herdProtect Anti-Malware Scanner *]
LangSecRef=3024
Detect=HKCU\Software\Reason\herdProtect
DetectFile=%ProgramFiles%\Reason\herdProtect\Scanner\herdProtectScan.exe
FileKey1=%ProgramFiles%\Reason\herdProtect\Scanner*|Errors.dat
FileKey2=%ProgramFiles%\Reason\herdProtect\Scanner*\Cache|*.*|RECURSE
FileKey3=%ProgramFiles%\Reason\herdProtect\Scanner*\Logs|*.*

[Heroes of a Broken Land *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\314470
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Heroes of a Broken Land\hobl_data|output_log.txt

[Heroes of Newerth *]
Section=Games
Detect=HKCU\Software\Heroes of Newerth
FileKey1=%Documents%\Heroes of Newerth\game|console.log

[Heroes of the Storm *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Heroes of the Storm
FileKey1=%Documents%\Heroes of the Storm\GameLogs|*.*

[Heroes of the Storm Cache *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Heroes of the Storm
FileKey1=%LocalAppData%\Blizzard Entertainment\Heroes of the Storm\BrowserCookies|*.*|RECURSE

[Hex Chat *]
LangSecRef=3024
DetectFile=%AppData%\HexChat
FileKey1=%AppData%\HexChat\logs|*.*|REMOVESELF
FileKey2=%AppData%\HexChat\scrollback|*.*|REMOVESELF

[Hi-Rez Studios *]
Section=Games
Detect=HKLM\Software\Hi-Rez Studios
FileKey1=%CommonAppData%\Hi-Rez Studios\BrowserCacheTribes\Default|*.*|RECURSE
FileKey2=%CommonAppData%\Hi-Rez Studios\HiPatchService\log|*.*
FileKey3=%ProgramFiles%\Hi-Rez Studios\hireztemp|*.*
FileKey4=%SystemDrive%|HiRezUpdateInstallLog.txt

[HistoryKill *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HistoryKill*
FileKey1=%LocalAppData%\HistoryKill|hk.dat;reseller.txt

[HitmanPro *]
LangSecRef=3024
Detect1=HKCU\Software\HitMan Pro
Detect2=HKCU\Software\HitMan Pro 2
Detect3=HKCU\Software\HitMan Pro 3
Detect4=HKLM\Software\HitmanPro
FileKey1=%CommonAppData%\HitmanPro\Logs|*.*
FileKey2=%ProgramFiles%\Hitman Pro*\downloads|*.*
FileKey3=%ProgramFiles%\Hitman Pro*\logs|*.htm
FileKey4=%ProgramFiles%\Hitman Pro*\updates|*.*
FileKey5=%WinDir%\System32|HitmanPro*.log
FileKey6=%WinDir%\SysWOW64|HitmanPro*.log

[HM NIS Edit *]
LangSecRef=3021
Detect=HKCU\Software\HM Software\Nis Edit
RegKey1=HKCU\Software\HM Software\Nis Edit\Recent

[Holiday Express *]
Section=Games
Detect1=HKLM\Software\GameHouse\Holiday Express
Detect2=HKLM\Software\HipSoft\Holiday Express
FileKey1=%ProgramFiles%\GameHouse Games Collection\Holiday Express|*.txt
FileKey2=%ProgramFiles%\Holiday Express|*html;*.txt

[HomeCinema CyberLink *]
LangSecRef=3023
DetectFile=%ProgramFiles%\HomeCinema
FileKey1=%ProgramFiles%\HomeCinema\PowerProducer\Template\Cyberlink\frame|*tmp

[Homeworld Remastered Collection *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\244160
FileKey1=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\LOGFILES|*.*
FileKey2=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\Release|*.dmp;*.log;*.mdmp;*ErrorLog.txt

[Homeworld Remastered Collection Cache *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\244160
FileKey1=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\CACHE|*.*|RECURSE

[Homeworld: Deserts of Kharak Backups *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\281610
Warning=You will not be able to restore corrupted saves.
FileKey1=%ProgramFiles%\Steam\steamapps\common\Deserts of Kharak\out\backup|*.*|RECURSE

[Honeyview Bookmarks *]
LangSecRef=3023
Detect=HKCU\Software\Honeyview
RegKey1=HKCU\Software\Honeyview\BMPath0
RegKey2=HKCU\Software\Honeyview\BMPath1
RegKey3=HKCU\Software\Honeyview\BMPath2
RegKey4=HKCU\Software\Honeyview\BMPath3
RegKey5=HKCU\Software\Honeyview\BMPath4
RegKey6=HKCU\Software\Honeyview\BMPath5
RegKey7=HKCU\Software\Honeyview\BMPath6
RegKey8=HKCU\Software\Honeyview\BMPath7
RegKey9=HKCU\Software\Honeyview\BMPath8
RegKey10=HKCU\Software\Honeyview\BMPath9
RegKey11=HKCU\Software\Honeyview\BMPath10
RegKey12=HKCU\Software\Honeyview\BMPath11
RegKey13=HKCU\Software\Honeyview\BMPath12
RegKey14=HKCU\Software\Honeyview\BMPath13
RegKey15=HKCU\Software\Honeyview\BMPath14
RegKey16=HKCU\Software\Honeyview\BMPath15
RegKey17=HKCU\Software\Honeyview\BMPath16
RegKey18=HKCU\Software\Honeyview\BMPath17
RegKey19=HKCU\Software\Honeyview\BMPath18
RegKey20=HKCU\Software\Honeyview\BMPath19
RegKey21=HKCU\Software\Honeyview\BMPath20
RegKey22=HKCU\Software\Honeyview\BMPath21
RegKey23=HKCU\Software\Honeyview\BMPath22
RegKey24=HKCU\Software\Honeyview\BMPath23
RegKey25=HKCU\Software\Honeyview\BMPath24
RegKey26=HKCU\Software\Honeyview\BMPath25
RegKey27=HKCU\Software\Honeyview\BMPath26
RegKey28=HKCU\Software\Honeyview\BMPath27
RegKey29=HKCU\Software\Honeyview\BMPath28
RegKey30=HKCU\Software\Honeyview\BMPath29

[Honeyview MRU *]
LangSecRef=3023
Detect=HKCU\Software\Honeyview
RegKey1=HKCU\Software\Honeyview\RecentFolder0
RegKey2=HKCU\Software\Honeyview\RecentFolder1
RegKey3=HKCU\Software\Honeyview\RecentFolder2
RegKey4=HKCU\Software\Honeyview\RecentFolder3
RegKey5=HKCU\Software\Honeyview\RecentFolder4
RegKey6=HKCU\Software\Honeyview\RecentFolder5
RegKey7=HKCU\Software\Honeyview\RecentFolder6
RegKey8=HKCU\Software\Honeyview\RecentFolder7
RegKey9=HKCU\Software\Honeyview\RecentFolder8
RegKey10=HKCU\Software\Honeyview\RecentFolder9
RegKey11=HKCU\Software\Honeyview\sRecentFolder
RegKey12=HKCU\Software\Honeyview\sStoreFilePath
RegKey13=HKCU\Software\Honeyview\sStoreFilePath2
RegKey14=HKCU\Software\Honeyview\transf.sTargetFolder

[Hostile Makeover *]
Section=Games
DetectFile=%AppData%\Merscom\Hostile Makeover
FileKey1=%AppData%\Merscom\Hostile Makeover|logfile.txt

[HostsMan Backups *]
LangSecRef=3024
DetectFile=%CommonAppData%\abelhadigital.com\HostsMan
FileKey1=%Public%\Documents\HostsMan Backups|*.*|REMOVESELF
FileKey2=%WinDir%\System32\drivers\etc|HOSTS.bak;HOSTS.tmp

[HostsMan HostsServer *]
LangSecRef=3024
Detect=HKLM\Software\abelhadigital.com\HostsServer
DetectFile=%ProgramFiles%\HostsMan\hostssrv.exe
FileKey1=%AppData%\abelhadigital.com\HostsServer|*.log|RECURSE
FileKey2=%LocalLowAppData%\abelhadigital.com\HostsServer\Logs|*.log

[Hotbar *]
LangSecRef=3022
Detect=HKCU\Software\Hotbar
FileKey1=%ProgramFiles%\Hotbar\*\dynamic|*.*|RECURSE
FileKey2=%ProgramFiles%\Hotbar\*\static|*.*
RegKey1=HKCU\Software\Hotbar\hotbar\ImagesHistory

[Hotline Miami *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219150
FileKey1=%Documents%\My Games\HotlineMiami|debug.log

[Hotspot Shield *]
LangSecRef=3021
Detect=HKLM\Software\HotspotShield
DetectFile=%ProgramFiles%\Hotspot Shield\bin\HSSCP.exe
FileKey1=%LocalLowAppData%\Hotspot_Shield\Logs|*.*|RECURSE
FileKey2=%ProgramFiles%\Hotspot Shield\log|*.log

[Hover Desk *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HoverDesk
FileKey1=%ProgramFiles%\HoverDesk\User|hdcmdrec.txt

[HP Drive Key Boot Utility *]
LangSecRef=3024
Detect=HKLM\Software\microsoft\windows\currentversion\uninstall\HP Drive Key Boot Utility
FileKey1=%SystemDrive%\CPQSYSTEM|*.*|REMOVESELF

[HP Guide *]
LangSecRef=3024
DetectFile=%LocalAppData%\HP Guide
FileKey1=%LocalAppData%\HP Guide|log1.*
FileKey2=%LocalAppData%\HP Guide\mp_cache|*.*

[HP Install Temps *]
LangSecRef=3021
Detect=HKCU\Software\HP
DetectFile=%CommonAppData%\HP
FileKey1=%CommonAppData%\HP\Installer\Temp|*.*
FileKey2=%CommonAppData%\HP\Temp|*.*
FileKey3=%LocalAppData%\HP\AtInstall|*.log;*log.txt|RECURSE
FileKey4=%ProgramFiles%\HP\Temp|*.*|RECURSE
FileKey5=%WinDir%|*.dat.temp

[HP Installation Files *]
LangSecRef=3024
DetectFile1=%SystemDrive%\HP Universal Print Driver
DetectFile2=%SystemDrive%\swsetup
FileKey1=%SystemDrive%\HP Universal Print Driver|*.*|REMOVESELF
FileKey2=%SystemDrive%\swsetup|*.*|REMOVESELF

[HP Logs *]
LangSecRef=3021
Detect=HKCU\Software\HP
DetectFile1=%AppData%\hpqlog
DetectFile2=%CommonAppData%\Hewlett-Packard
DetectFile3=%CommonAppData%\HP
DetectFile4=%LocalAppData%\TouchSmartData
DetectFile5=%ProgramFiles%\HPQ\Shared\Sierra Wireless
FileKey1=%AppData%\HP\WebRegLogs|WebRegLog.txt
FileKey2=%AppData%\hpqlog|*.log
FileKey3=%CommonAppData%|hpzinstall.log
FileKey4=%CommonAppData%\Hewlett-Packard|*.log*.*;*Log.txt|RECURSE
FileKey5=%CommonAppData%\Hewlett-Packard\HP*\Log*|*.*|RECURSE
FileKey6=%LocalAppData%\TouchSmartData\Log|*.*
FileKey7=%ProgramFiles%\HPQ\Shared\Sierra Wireless|*.log|RECURSE
FileKey8=%SystemDrive%\hp\bin\logs|*.log

[HP MediaSmart Photo *]
LangSecRef=3023
DetectFile=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo
FileKey1=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo|subsys.cache
FileKey2=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo\tm*Cache|*.*|REMOVESELF

[HP Photosmart Premier *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\HP Photo & Imaging
FileKey1=%LocalAppData%\HP\Digital Imaging\cache|*.*

[HP Scan and Capture *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AD2F1837.HPScanandCapture_v10z8vjag6ke6
FileKey1=%LocalAppData%\Packages\*.HPScanandCapture_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.HPScanandCapture_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*.HPScanandCapture_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*.HPScanandCapture_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\*.HPScanandCapture_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*.HPScanandCapture_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*.HPScanandCapture_*\LocalState|*.*|RECURSE

[HP Smart *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AD2F1837.HPPrinterControl_v10z8vjag6ke6
FileKey1=%LocalAppData%\Packages\*.HPPrinterControl_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.HPPrinterControl_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*.HPPrinterControl_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*.HPPrinterControl_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*.HPPrinterControl_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\*.HPPrinterControl_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\*.HPPrinterControl_*\TempState|*.*|RECURSE

[HP Update *]
LangSecRef=3021
DetectFile=%AppData%\HPUpdate
FileKey1=%AppData%\HpUpdate|*.*

[HTC Home Apis *]
LangSecRef=3021
DetectFile=%ProgramFiles%\HTC Home
FileKey1=%ProgramFiles%\HTC Home\log|*.*|RECURSE

[HTC Logs *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Installer\Products\34180280D77760A4BB4517FBA01DBB07\SourceList
FileKey1=%SystemDrive%\Temp|HSM*.txt

[HTC Sync *]
LangSecRef=3024
DetectFile=%ProgramFiles%\HTC\HTC Sync 3.0
FileKey1=%AppData%\HTC\Logs|*.log

[HTML Help *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\HTMLHelp
Warning=This will remove CHM position, preferences, favorites information.
FileKey1=%AppData%\Microsoft\HTML Help|hh.dat;hhcolreg.dat;*.chw
FileKey2=%CommonAppData%\Microsoft\HTML Help|hh.dat;hhcolreg.dat
FileKey3=%SystemDrive%\Documents and Settings\LocalService\Application Data\Microsoft\HTML Help|hh.dat
FileKey4=%WinDir%\Application Data\Microsoft\HTML Help|hh.dat
FileKey5=%WinDir%\Help|*.cnt;*.chw

[Huawei Hisuite *]
LangSecRef=3021
DetectFile=%LocalAppData%\Hisuite
FileKey1=%LocalAppData%\Hisuite\log|*.log;*.zip
FileKey2=%LocalAppData%\Hisuite\userdata\AppIcon|*.png
FileKey3=%LocalAppData%\Hisuite\userdata\driver\all|*.log
FileKey4=%ProgramFiles%\HiSuite\HandSetService\log|*.log

[Huawei Logs *]
LangSecRef=3023
Detect=HKLM\Software\Huawei technologies
FileKey1=%ProgramFiles%\BILDmobil\Log|*.*
FileKey2=%ProgramFiles%\HUAWEI Modem Driver|*.log

[Hulu *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\HuluLLC.HuluPlus_fphbd361v8tya
FileKey1=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\LocalState|*.tmp|RECURSE
FileKey7=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\TempState|*.*|RECURSE

[HuluDesktop *]
LangSecRef=3023
DetectFile=%LocalAppData%\HuluDesktop
FileKey1=%LocalAppData%\HuluDesktop\Data|*.log

[Huru Beach Party *]
Section=Games
DetectFile=%AppData%\HuruBeachParty
FileKey1=%AppData%\HuruBeachParty|*log.html

[HxD Hexeditor *]
LangSecRef=3021
Detect=HKCU\Software\Mael\HxD
RegKey1=HKCU\Software\Mael\HxD\History Lists\Recent Files

[Hyper for Youtube *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\19120CensoredUser.HyperforYouTube_c0tqyanwsgfn6
FileKey1=%LocalAppData%\Packages\*.HyperforYouTube_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.HyperforYouTube_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*.HyperforYouTube_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\*.HyperforYouTube_*\LocalState|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*.HyperforYouTube_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\19120CensoredUser.HyperforYouTube_c0tqyanwsgfn6\SearchHistory

[HyperSnap *]
LangSecRef=3021
Detect1=HKCU\Software\Hyperionics\HyperSnap 7
Detect2=HKCU\Software\Hyperionics\HyperSnap 8
FileKey1=%ProgramFiles%\HyperSnap *|*.url
RegKey1=HKCU\Software\Hyperionics\HyperSnap 7\Recent File List
RegKey2=HKCU\Software\Hyperionics\HyperSnap 8\Recent File List

[I2P *]
LangSecRef=3022
Detect=HKLM\System\CurrentControlSet\Services\i2p
DetectFile1=%AppData%\I2P
DetectFile2=%ProgramFiles%\i2p\i2p.exe
FileKey1=%AppData%\I2P\eepsite\logs|*.*
FileKey2=%AppData%\I2P\netDb|*.*
FileKey3=%ProgramFiles%\i2p|*.log
FileKey4=%ProgramFiles%\i2p\eepsite\logs|*.*

[Icaros *]
LangSecRef=3024
DetectFile=%LocalAppData%\Icaros
FileKey1=%LocalAppData%\Icaros\IcarosCache|*.icdb

[Icon Cache *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=You may need to restart explorer.exe for this to take effect.
FileKey1=%LocalAppData%|IconCache.db
FileKey2=%LocalAppData%\Microsoft\Windows\Explorer|iconcache_*.db

[IconCool Editor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IconCoolEditor\IconCooleditor.exe
FileKey1=%ProgramFiles%\IconCoolEditor|IconFileList.src;Recentlyused.src

[Icons from File *]
LangSecRef=3024
Detect=HKCU\Software\Vitaliy Levchenko\Icons from File
RegKey1=HKCU\Software\Vitaliy Levchenko\Icons from File\Recent

[ID Privacy Shield *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ID Security Suite\ID Privacy Shield
FileKey1=%ProgramFiles%\ID Security Suite\ID Privacy Shield\logs|*.*|RECURSE

[IDEA *]
LangSecRef=3021
Detect1=HKCU\Software\JetBrains\IntelliJ IDEA
Detect2=HKCU\Software\JetBrains\IntelliJ IDEA Community Edition
FileKey1=%UserProfile%\.IdeaC*\System\Caches|*.*
FileKey2=%UserProfile%\.IdeaC*\System\Logs|*.*
FileKey3=%UserProfile%\.IdeaC*\System\tmp|*.*|RECURSE
FileKey4=%UserProfile%\.IntelliJIdea12\system\Caches|*.*
FileKey5=%UserProfile%\.IntelliJIdea12\system\log|*.*
FileKey6=%UserProfile%\.IntelliJIdea12\system\tmp|*.*|RECURSE

[IDEA History *]
LangSecRef=3021
Detect1=HKCU\Software\JetBrains\IntelliJ IDEA
Detect2=HKCU\Software\JetBrains\IntelliJ IDEA Community Edition
FileKey1=%UserProfile%\.IdeaC*\System\LocalHistory|*.*
FileKey2=%UserProfile%\.IntelliJIdea12\system\LocalHistory|*.*

[IdeaSoft Scrapbooks Plus 1.0 *]
LangSecRef=3021
Detect=HKCU\Software\IdeaSoft\Scrapbooks Plus\1.0
RegKey1=HKCU\Software\IdeaSoft\Scrapbooks Plus\1.0\Recent File List

[IDLE Recent Files *]
LangSecRef=3021
Detect=HKCU\Software\Python
FileKey1=%UserProfile%\.idlerc|recent-files.lst

[idoo Video Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\idoo\Video Editor\videoeditor.exe
FileKey1=%ProgramFiles%\idoo\Video Editor|*.log

[IDPhotoStudio *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\IDPhotoStudio
FileKey1=%AppData%\KC Softwares\IDPhotoStudio|*.log

[IDrive *]
LangSecRef=3021
DetectFile1=%LocalAppData%\IDrive
DetectFile2=%ProgramFiles%\IDriveWindows
FileKey1=%CommonAppData%\IDrive\IBCOMMON|Tracefile.txt
FileKey2=%LocalAppData%\IDrive\IBCOMMON|SerTraceFile.txt
FileKey3=%ProgramFiles%\IDriveWindows\IBCOMMON|SerTraceFile.txt

[IDT NetGUI *]
LangSecRef=3022
DetectFile=%AppData%\IDT\NetGUI
FileKey1=%AppData%\IDT\NetGUI\Log|*.log

[IE Toy *]
LangSecRef=3024
Detect=HKCU\Software\MySoftware\IEToy
FileKey1=%ProgramFiles%\IE Toy\Data|history;history_ad
RegKey1=HKCU\Software\MySoftware\IEToy|FRAGS_ad
RegKey2=HKCU\Software\MySoftware\IEToy|FRAGS_popup

[IE7pro *]
LangSecRef=3022
Detect=HKCU\Software\IE7pro
RegKey1=HKCU\Software\IE7pro\ClosedTabs

[IEPro *]
LangSecRef=3022
Detect=HKCU\Software\AppDataLow\IEPro
DetectFile=%ProgramFiles%\IEPro\IEProCx.exe
RegKey1=HKCU\Software\AppDataLow\IEPro\ClosedTabs
RegKey2=HKCU\Software\AppDataLow\IEPro\VisitedTabs

[iExpert Registry Clean Expert *]
LangSecRef=3024
Detect=HKCU\Software\iExpertSoft\Registry Clean Expert
DetectFile=%ProgramFiles%\Registry Clean Expert\RCleaner.exe
FileKey1=%AppData%\iExpert Software\Registry Clean Expert\UndoCenter|*.*
FileKey2=%ProgramFiles%\Registry Clean Expert|*.LOG
FileKey3=%WinDir%\$regcmp$|*.*|REMOVESELF
RegKey1=HKCU\Software\iExpertSoft\Registry Clean Expert\Recent File List

[iFunbox *]
LangSecRef=3024
DetectFile=%ProgramFiles%\i-Funbox DevTeam
FileKey1=%ProgramFiles%\i-Funbox DevTeam|debug.log

[Ignition *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\Ignition
FileKey1=%AppData%\KC Software\Ignition|*.log

[IISExpress *]
LangSecRef=3022
DetectFile=%Documents%\IISExpress
FileKey1=%Documents%\IISExpress\Logs|*.*
FileKey2=%Documents%\IISExpress\TraceLogFiles|*.*|RECURSE

[ImageRanger *]
LangSecRef=3023
DetectFile=%ProgramFiles%\ImageRanger\imageranger.exe
FileKey1=%ProgramFiles%\ImageRanger|vc*redist*x*.exe
FileKey2=%ProgramFiles%\ImageRanger\licenses|*.txt

[ImgBurn *]
LangSecRef=3021
Detect=HKCU\Software\ImgBurn
RegKey1=HKCU\Software\ImgBurn|ISOREAD_RecentFiles_Destination
RegKey2=HKCU\Software\ImgBurn|ISOREAD_RecentFolders_Destination

[Immunet *]
LangSecRef=3021
Detect=HKLM\Software\Immunet Protect
Warning=Immunet service must be stopped to remove log files.
FileKey1=%AppData%\Immunet|*.*|REMOVESELF
FileKey2=%CommonAppData%\Immunet|*.log
FileKey3=%ProgramFiles%\Immunet|*.log|RECURSE

[iMobie *]
LangSecRef=3024
DetectFile=%AppData%\iMobie
FileKey1=%AppData%\iMobie\*|iTunesPrefs
FileKey2=%AppData%\iMobie\*\AutoUpdate|*.*|RECURSE
FileKey3=%AppData%\iMobie\*\Configue|Settings.plist
FileKey4=%AppData%\iMobie\*\EasyLoseFiles|*.*|RECURSE
FileKey5=%AppData%\iMobie\*\ErrorLog|*.*|RECURSE
FileKey6=%AppData%\iMobie\*\Files|*.*|RECURSE
FileKey7=%AppData%\iMobie\*\iMobieConfig|*.*|RECURSE
FileKey8=%AppData%\iMobie\*\TempFiles|*.*|RECURSE
ExcludeKey1=FILE|%AppData%\iMobie\*\iMobieConfig\|ConfigReg.ini

[iMobie Backups *]
LangSecRef=3024
DetectFile=%AppData%\iMobie
FileKey1=%AppData%\iMobie\*\*Backup|*.*|RECURSE
FileKey2=%AppData%\iMobie\Backup|*.*|RECURSE

[ImTOO iPad Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\ImTOO\iPad Video Converter
FileKey1=%ProgramFiles%\ImTOO\iPad Video Converter|*.log;ERRORLOG.TXT

[ImTOO Video Converter Ultimate *]
LangSecRef=3023
Detect=HKCU\Software\ImTOO\Video Converter Ultimate
FileKey1=%CommonAppData%\ImTOO\Video Converter Ultimate\customdata|settings.old
RegKey1=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_openfile_dir
RegKey2=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_output_dir
RegKey3=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_profile_group
RegKey4=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_profile_url
RegKey5=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|recent_profiles
RegKey6=HKCU\Software\ImTOO\Video Converter Ultimate\Settings\output

[IMVU *]
LangSecRef=3022
Detect=HKCU\Software\IMVU
FileKey1=%AppData%\IMVU|*.chk|RECURSE
FileKey2=%AppData%\IMVU|*.db;mini.dmp.bak;*.pickle;*.jpg;*.txt;*.log.*;*.log
FileKey3=%AppData%\IMVU\*Cache|*.*|REMOVESELF
FileKey4=%AppData%\IMVUClient|*.icns|RECURSE
FileKey5=%AppData%\IMVUClient\installer|*.*|RECURSE
FileKey6=%AppData%\IMVUClient\ui\profile|*.sqlite;*.js;*.dat;*.mfl
FileKey7=%AppData%\IMVUClient\ui\profile\cache|*.*|REMOVESELF

[iMyFone Umate *]
LangSecRef=3024
Detect=HKLM\Software\iMyFone\Umate
FileKey1=%ProgramFiles%\iMyFone\iMyFone Umate|mate.log
FileKey2=%ProgramFiles%\iMyFone\iMyFone Umate\cache|*.*|RECURSE
FileKey3=%ProgramFiles%\iMyFone\iMyFone Umate\Log|*.*|RECURSE
FileKey4=%ProgramFiles%\iMyFone\iMyFone Umate\temp|*.*|RECURSE

[inFlow Inventory *]
LangSecRef=3021
DetectFile=%AppData%\inFlow Inventory
FileKey1=%AppData%\inFlow Inventory|log.txt
FileKey2=%CommonAppData%\inFlow Inventory\Logs|*.*

[Injector DLL *]
LangSecRef=3024
Detect=HKCU\Software\Drowse\Injector
RegKey1=HKCU\Software\Drowse\Injector|DLL

[InkScape *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\inkscape.exe
FileKey1=%LocalAppData%|recently-used.xbel

[Inky *]
LangSecRef=3022
Detect=HKCU\Software\Inky
FileKey1=%LocalAppData%\Arcode\Plugin|*.log|RECURSE
FileKey2=%LocalAppData%\Inky|data_*;f_*;index;*.log
FileKey3=%LocalAppData%\Inky\Local Storage|*.*

[Inno Setup *]
LangSecRef=3021
Detect=HKCU\Software\Jordan Russell\Inno Setup
RegKey1=HKCU\Software\Jordan Russell\Inno Setup\ScriptFileHistoryNew

[InnoExtractor *]
LangSecRef=3024
DetectFile1=%AppData%\InnoExtractor\InnoExtractor.exe
DetectFile2=%LocalAppData%\InnoExtractor\InnoExtractor.exe
DetectFile3=%ProgramFiles%\InnoExtractor\InnoExtractor.exe
DetectFile4=%SystemDrive%\Programs\InnoExtractor\InnoExtractor.exe
FileKey1=%AppData%\InnoExtractor|Historial.dat
FileKey2=%LocalAppData%\InnoExtractor|Historial.dat
FileKey3=%ProgramFiles%\InnoExtractor|Historial.dat
FileKey4=%SystemDrive%\Programs\InnoExtractor|Historial.dat

[InnoTab *]
LangSecRef=3021
DetectFile=%CommonAppData%\VTech\DA
FileKey1=%CommonAppData%\VTech\DA|*.log;InnoTab.txt;IntallLog.txt|RECURSE
FileKey2=%CommonAppData%\VTech\DA\InnoTab\ConsoleLog|*.*
FileKey3=%CommonAppData%\VTech\DA\InnoTab\Games\tmp|*.*|REMOVESELF

[Inpaint *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\Inpaint
RegKey1=HKCU\Software\Teorex\Inpaint\Recent File List
RegKey2=HKCU\Software\Teorex\Inpaint\RecentFileList

[inSSIDer Home *]
LangSecRef=3024
Detect=HKCU\Software\MetaGeek, LLC\inSSIDer Home
FileKey1=%LocalAppData%\MetaGeek,_LLC|ConnectionErrorLog;MetaGeek-OUI.backup

[InstallShield *]
LangSecRef=3024
Detect=HKCU\Software\InstallShield
FileKey1=%ProgramFiles%|_ISTMP1.DIR
FileKey2=%ProgramFiles%\InstallShield Installation Information|*.log|RECURSE
FileKey3=%SystemDrive%|_ISTMP*.DIR
RegKey1=HKCU\Software\InstallShield\16.0\Professional\Recent File List
RegKey2=HKCU\Software\InstallShield\17.0\Professional\Recent File List
RegKey3=HKCU\Software\InstallShield\18.0\Professional\Recent File List
RegKey4=HKCU\Software\InstallShield\19.0\Professional\Recent File List
RegKey5=HKCU\Software\InstallShield\20.0\Professional\Recent File List
RegKey6=HKCU\Software\InstallShield\21.0\Professional\Recent File List
RegKey7=HKCU\Software\InstallShield\InstallShield Cabinet and Log File Viewer\Recent File List
RegKey8=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU1
RegKey9=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU2
RegKey10=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU3
RegKey11=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU4

[Instant Dungeon! *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\326720
FileKey1=%AppData%\Instant Dungeon|log.txt

[Instantbird *]
LangSecRef=3022
DetectFile=%AppData%\Instantbird
FileKey1=%AppData%\Instantbird\Crash Reports|*.*|RECURSE
FileKey2=%AppData%\Instantbird\Profiles\*|*.corrupt|RECURSE
FileKey3=%AppData%\Instantbird\Profiles\*|extensions.log
FileKey4=%AppData%\Instantbird\Profiles\*\icons|*.*|RECURSE
FileKey5=%AppData%\Instantbird\Profiles\*\logs|*.*|RECURSE
FileKey6=%AppData%\Instantbird\Profiles\*\minidumps|*.*|RECURSE
FileKey7=%LocalAppData%\Instantbird\Profiles\*\*cache|*.*|RECURSE
FileKey8=%LocalAppData%\Instantbird\Profiles\*\Updates|*.log|RECURSE
FileKey9=%ProgramFiles%\Instantbird|install.log

[InstEd *]
LangSecRef=3024
Detect=HKCU\Software\instedit.com\insted
RegKey1=HKCU\Software\instedit.com\insted\MRU

[Intel Graphics Command Center *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt
FileKey1=%LocalAppData%\Intel\GCC|*.txt
FileKey2=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\AC\BackgroundTransferApi|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\AC\INet*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\LocalState|gcc*_log_*.txt
FileKey8=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\LocalState\Games2\cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\LocalState\Intel\GCC|gcc*_log_*.txt
FileKey10=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\LocalState\MetroLogs|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\LocalState\Promotions|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience_*\TempState|*.*|RECURSE

[Intel Graphics Control Panel *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AppUp.IntelGraphicsControlPanel_8j3eq9eme6ctt
FileKey1=%LocalAppData%\Packages\AppUp.IntelGraphicsControlPanel_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\AppUp.IntelGraphicsControlPanel_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\AppUp.IntelGraphicsControlPanel_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\AppUp.IntelGraphicsControlPanel_*\TempState|*.*|RECURSE

[Intel Graphics Control Panel Promotions *]
LangSecRef=3024
DetectFile=%LocalAppData%\Intel\CUIPromotions
FileKey1=%LocalAppData%\Intel\CUIPromotions\Images|*.*|RECURSE
FileKey2=%LocalAppData%\Intel\CUIPromotions\Temp|*.*|RECURSE

[Intel Logs *]
LangSecRef=3024
Detect1=HKCU\Software\Intel
Detect2=HKLM\Software\Intel
FileKey1=%CommonAppData%\Intel|*.log;*.log.bak|RECURSE
FileKey2=%CommonAppData%\Intel(R) Update Manager\AppData|ium.log
FileKey3=%CommonAppData%\Intel\*\Logs|*.*
FileKey4=%ProgramFiles%\Intel\*|*.log;*Log.txt|RECURSE
FileKey5=%ProgramFiles%\Intel\InfInst|*.*|REMOVESELF
FileKey6=%SystemDrive%|IFRToolLog.txt
FileKey7=%SystemDrive%\Driver_allOS\MEI\Drivers\MEI\INTERNAL|*.log|RECURSE
FileKey8=%SystemDrive%\Intel\Logs|*.*|REMOVESELF
FileKey9=%UserProfile%\Intel\Logs|*.*|REMOVESELF
FileKey10=%WinDir%\debug\Intel\Logs|*.*|REMOVESELF
FileKey11=%WinDir%\System32|Default_error_Stack-*.txt;Gms.log
FileKey12=%WinDir%\System32\config\systemprofile\Intel\Logs|*.*|REMOVESELF
FileKey13=%WinDir%\SysWOW64|Gms.log
FileKey14=%WinDir%\SysWOW64\config\systemprofile\Intel\Logs|*.*|REMOVESELF

[Intel Shader Cache *]
LangSecRef=3024
DetectFile1=%CommonAppData%\Intel\ShaderCache
DetectFile2=%LocalLowAppData%\Intel\ShaderCache
FileKey1=%CommonAppData%\Intel\ShaderCache|*.*
FileKey2=%LocalLowAppData%\Intel\ShaderCache|*.*

[Intel Storage Counters *]
LangSecRef=3024
DetectFile=%WinDir%\Inf\Intel Storage Counters
FileKey1=%WinDir%\Inf\Intel Storage Counters|*.tmp|RECURSE

[Inter-Tel Device *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Inter-Tel
FileKey1=%ProgramFiles%\Inter-Tel|*.log|RECURSE

[Internet Business Promoter *]
LangSecRef=3022
DetectFile=%AppData%\IBP
FileKey1=%AppData%\IBP|*Log.txt;*.bak|RECURSE

[Internet Download Manager *]
LangSecRef=3022
Detect=HKCU\Software\DownloadManager
Warning=This will delete unfinished downloads.
FileKey1=%AppData%\IDM|*.Log;*.txt
FileKey2=%AppData%\IDM\DwnlData|*.*|REMOVESELF
FileKey3=%ProgramFiles%\Internet Download Manager|*.log
FileKey4=%SystemDrive%|IDMSetup2.log
RegKey1=HKCU\Software\DownloadManager\1
RegKey2=HKCU\Software\DownloadManager\2
RegKey3=HKCU\Software\DownloadManager\3
RegKey4=HKCU\Software\DownloadManager\4
RegKey5=HKCU\Software\DownloadManager\5
RegKey6=HKCU\Software\DownloadManager\6
RegKey7=HKCU\Software\DownloadManager\7
RegKey8=HKCU\Software\DownloadManager\8
RegKey9=HKCU\Software\DownloadManager\9
RegKey10=HKCU\Software\DownloadManager\10
RegKey11=HKCU\Software\DownloadManager\11
RegKey12=HKCU\Software\DownloadManager\12
RegKey13=HKCU\Software\DownloadManager\13
RegKey14=HKCU\Software\DownloadManager\14
RegKey15=HKCU\Software\DownloadManager\15
RegKey16=HKCU\Software\DownloadManager\16
RegKey17=HKCU\Software\DownloadManager\17
RegKey18=HKCU\Software\DownloadManager\18
RegKey19=HKCU\Software\DownloadManager\19
RegKey20=HKCU\Software\DownloadManager\20
RegKey21=HKCU\Software\DownloadManager\21
RegKey22=HKCU\Software\DownloadManager\22
RegKey23=HKCU\Software\DownloadManager\23
RegKey24=HKCU\Software\DownloadManager\24
RegKey25=HKCU\Software\DownloadManager\25
RegKey26=HKCU\Software\DownloadManager\26
RegKey27=HKCU\Software\DownloadManager\27
RegKey28=HKCU\Software\DownloadManager\28
RegKey29=HKCU\Software\DownloadManager\29
RegKey30=HKCU\Software\DownloadManager\30
RegKey31=HKCU\Software\DownloadManager\31
RegKey32=HKCU\Software\DownloadManager\32
RegKey33=HKCU\Software\DownloadManager\33
RegKey34=HKCU\Software\DownloadManager\34
RegKey35=HKCU\Software\DownloadManager\35
RegKey36=HKCU\Software\DownloadManager\36
RegKey37=HKCU\Software\DownloadManager\37
RegKey38=HKCU\Software\DownloadManager\38
RegKey39=HKCU\Software\DownloadManager\39
RegKey40=HKCU\Software\DownloadManager\40
RegKey41=HKCU\Software\DownloadManager\41
RegKey42=HKCU\Software\DownloadManager\42
RegKey43=HKCU\Software\DownloadManager\43
RegKey44=HKCU\Software\DownloadManager\44
RegKey45=HKCU\Software\DownloadManager\45
RegKey46=HKCU\Software\DownloadManager\46
RegKey47=HKCU\Software\DownloadManager\47
RegKey48=HKCU\Software\DownloadManager\48
RegKey49=HKCU\Software\DownloadManager\49
RegKey50=HKCU\Software\DownloadManager\50
RegKey51=HKCU\Software\DownloadManager\51
RegKey52=HKCU\Software\DownloadManager\52
RegKey53=HKCU\Software\DownloadManager\53
RegKey54=HKCU\Software\DownloadManager\54
RegKey55=HKCU\Software\DownloadManager\55
RegKey56=HKCU\Software\DownloadManager\56
RegKey57=HKCU\Software\DownloadManager\57
RegKey58=HKCU\Software\DownloadManager\58
RegKey59=HKCU\Software\DownloadManager\59
RegKey60=HKCU\Software\DownloadManager\60
RegKey61=HKCU\Software\DownloadManager\61
RegKey62=HKCU\Software\DownloadManager\62
RegKey63=HKCU\Software\DownloadManager\63
RegKey64=HKCU\Software\DownloadManager\64
RegKey65=HKCU\Software\DownloadManager\65
RegKey66=HKCU\Software\DownloadManager\66
RegKey67=HKCU\Software\DownloadManager\67
RegKey68=HKCU\Software\DownloadManager\68
RegKey69=HKCU\Software\DownloadManager\69
RegKey70=HKCU\Software\DownloadManager\70
RegKey71=HKCU\Software\DownloadManager\71
RegKey72=HKCU\Software\DownloadManager\72
RegKey73=HKCU\Software\DownloadManager\73
RegKey74=HKCU\Software\DownloadManager\74
RegKey75=HKCU\Software\DownloadManager\75
RegKey76=HKCU\Software\DownloadManager\maxID

[Internet Download Manager Registry *]
LangSecRef=3022
Detect=HKCU\Software\DownloadManager
Warning=Workaround for unnecessary browser registry key. Do not use if you have installed the browser "CocCoc".
RegKey1=HKCU\Software\CocCoc

[InterVideo WinDVD *]
LangSecRef=3023
Detect=HKCU\Software\InterVideo\WinDVD4
DetectFile=%ProgramFiles%\InterVideo\WinDVD\WinDVD.exe
FileKey1=%AppData%\InterVideo\WinDVD\*\Bookmark|*.bmk

[Intuit Data Protect *]
LangSecRef=3024
DetectFile=%LocalAppData%\Intuit\Intuit Data Protect
FileKey1=%CommonAppData%\Intuit\Intuit Data Protect|*.log
FileKey2=%LocalAppData%\Intuit\Intuit Data Protect|*.log

[Intuit Entitlement Client *]
LangSecRef=3021
DetectFile=%CommonAppData%\Intuit\Entitlement Client
FileKey1=%CommonAppData%\Intuit\Entitlement Client\*|IntuitEntitlementLog*.*

[Intuit PTI *]
LangSecRef=3021
DetectFile=%AppData%\Intuit\PTI
FileKey1=%AppData%\Intuit\PTI\Log|*.*

[Intuit TurboTax *]
LangSecRef=3021
DetectFile=%ProgramFiles%\TurboTax*
FileKey1=%AppData%\Intuit*|*.log|RECURSE
FileKey2=%CommonAppData%|*.bc
FileKey3=%CommonAppData%\Intuit*|*.log|RECURSE
FileKey4=%CommonAppData%\Intuit\Common\Metrix\*\Logs|*.*
FileKey5=%CommonAppData%\Intuit\Common\QuickBaseClient\*\Logs|*.*
FileKey6=%CommonAppData%\Intuit\Common\Update Service\*\Logs|*.*
FileKey7=%CommonAppData%\Intuit\TurboTax\MSI\*\Logs|*.*
FileKey8=%CommonProgramFiles%\Intuit\Internet Client|Msdun13.exe
FileKey9=%ProgramFiles%\TurboTax*|*.txt

[IObit Advanced SystemCare *]
LangSecRef=3024
DetectFile1=%AppData%\IObit\Advanced SystemCare V*
DetectFile2=%CommonAppData%\IObit\Advanced SystemCare V*
FileKey1=%AppData%\IObit\Advanced SystemCare *|*.log
FileKey2=%AppData%\IObit\Advanced SystemCare *\Boottime|*.log
FileKey3=%AppData%\IObit\Advanced SystemCare *\ClonedFilesScanner|*_log.txt
FileKey4=%AppData%\IObit\Advanced SystemCare *\EmptyFolder|*.*|RECURSE
FileKey5=%AppData%\IObit\Advanced SystemCare *\Log|*.*|RECURSE
FileKey6=%CommonAppData%\IObit\Advanced SystemCare *\Log|*.*|REMOVESELF
FileKey7=%CommonAppData%\IObit\ASCDownloader|*.log
FileKey8=%ProgramFiles%\IObit\Advanced SystemCare *|*.log;*.tmp;*.txt|RECURSE
FileKey9=%ProgramFiles%\IObit\Advanced SystemCare *\*.cab_Temp|*.*|REMOVESELF
FileKey10=%ProgramFiles%\IObit\Advanced SystemCare *\ASCServiceLog|*.*|RECURSE
FileKey11=%SystemDrive%\Users\Default\AppData\Roaming\IObit\Advanced SystemCare *|*.log
FileKey12=%WinDir%\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare *|*.log
FileKey13=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare *|*.log

[IObit Advanced SystemCare Antivirus Backups *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\Advanced SystemCare Ultimate
FileKey1=%ProgramFiles%\IObit\Advanced SystemCare Ultimate\Antivirus\BackupRec|*.*|RECURSE

[IObit Driver Booster *]
LangSecRef=3024
DetectFile1=%AppData%\IObit\Driver Booster
DetectFile2=%ProgramFiles%\IObit\Driver Booster\DriverBooster.exe
FileKey1=%AppData%\IObit\Driver Booster|*.log|RECURSE
FileKey2=%ProgramFiles%\IObit\Driver Booster|*.log
FileKey3=%ProgramFiles%\IObit\Driver Booster\Update|*.tmp

[IObit Game Booster *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\Game Booster 3
FileKey1=%CommonAppData%\IObit\Game Booster 3|Defrags.ini
FileKey2=%ProgramFiles%\IObit\Game Booster 3|*.log
FileKey3=%ProgramFiles%\IObit\Game Booster 3\FPS|*.*|RECURSE
FileKey4=%ProgramFiles%\IObit\Game Booster 3\Update|Update.tmp

[IObit KB Downloader *]
LangSecRef=3024
DetectFile=%CommonAppData%\IObit\KBDownloader
FileKey1=%CommonAppData%\IObit\KBDownloader|*.*|RECURSE

[IObit LiveUpdate *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\LiveUpdate
FileKey1=%ProgramFiles%\IObit\LiveUpdate|*.log|RECURSE

[IObit Malware Fighter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\IObit Malware Fighter
FileKey1=%ProgramFiles%\IObit\IObit Malware Fighter\adsremoval\IE|*.log
FileKey2=%ProgramFiles%\IObit\IObit Malware Fighter\log|*.*|RECURSE

[IObit Smart Defrag *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\Smart Defrag*
FileKey1=%ProgramFiles%\IObit\Smart Defrag *|*.log
FileKey2=%ProgramFiles%\IObit\Smart Defrag *\Log|*.*
FileKey3=%ProgramFiles%\IObit\Smart Defrag *\Temp|*.*|RECURSE
FileKey4=%ProgramFiles%\IObit\Smart Defrag *\Update|*.tmp

[IObit Start Menu 8 Freeware Programs Installer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\Start Menu 8
FileKey1=%ProgramFiles%\IObit\Start Menu 8\Freeware|*.exe

[IObit Surfing Protection *]
LangSecRef=3024
DetectFile=%ProgramFiles%\IObit\Surfing Protection
FileKey1=%ProgramFiles%\IObit\Surfing Protection|*.log

[IObit Uninstaller *]
LangSecRef=3024
DetectFile=%AppData%\IObit\IObit Uninstaller
FileKey1=%AppData%\IObit\IObit Uninstaller\*Log|*.log
FileKey2=%ProgramFiles%\IObit\iObit Uninstaller|*.log|RECURSE

[Iperius Backup *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Iperius Backup
FileKey1=%CommonAppData%\IperiusBackup\Logs|*.*|RECURSE

[iPod-Cloner *]
LangSecRef=3023
Detect=HKCU\Software\iPod-Cloner
FileKey1=%ProgramFiles%\iPod-Cloner|*.log
FileKey2=%ProgramFiles%\iPod-Cloner\ReadCache|*.*
FileKey3=%SystemDrive%|dtdlog.txt

[iResizer *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\iResizer
RegKey1=HKCU\Software\Teorex\iResizer\RecentFileList

[iSkysoft Helper Compact *]
LangSecRef=3023
DetectFile=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact
FileKey1=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact|ProductUpdateLists.xml;ISHelper.exe_temp;ISHelperSetup.exe_temp
FileKey2=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\DATADICT|*.*|RECURSE
FileKey3=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\log|*.*|RECURSE
FileKey4=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\Temp|*.*|RECURSE
RegKey1=HKLM\Software\iSkysoft\iSkysoft Helper Compact
RegKey2=HKLM\Software\Wow6432Node\iSkysoft\iSkysoft Helper Compact

[iSkysoft Video Converter *]
LangSecRef=3023
Detect1=HKLM\Software\iSkysoft\iSkysoft Video Converter
Detect2=HKLM\Software\iSkysoft\iSkysoft Video Converter Ultimate
FileKey1=%CommonAppData%\iSkysoft Video Converter*|*.dat.bak
FileKey2=%CommonAppData%\iSkysoft Video Converter*\Temp*Dir|*.*|RECURSE
FileKey3=%ProgramFiles%\iSkysoft\Video Converter*\Log|*.*|RECURSE
FileKey4=%ProgramFiles%\iSkysoft\Video Converter*\TempThumbDir|*.*|RECURSE

[iSkysoft Video Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\iSkysoft\Video Editor\VideoEditor.exe
FileKey1=%ProgramFiles%\iSkysoft\Video Editor\Log|*.txt

[IsoBuster *]
LangSecRef=3021
Detect=HKCU\Software\Smart Projects\IsoBuster
RegKey1=HKCU\Software\Smart Projects\IsoBuster\RecentImages

[iSpy *]
LangSecRef=3021
Detect=HKCU\Software\ISpy\ISPY
FileKey1=%AppData%\iSpy\WebServerRoot\Media|*.*|RECURSE
FileKey2=%LocalAppData%\iSpy\WebServerRoot\Media|*.*|RECURSE

[iSysCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Utils\iSysCleaner\iSysCleaner.exe
FileKey1=%ProgramFiles%\Utils\iSysCleaner\traces|*.*

[iTunes *]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.\iTunes
FileKey1=%AppData%\Apple Computer\iTunes|*.ipcc;*.ipsw;*.log
FileKey2=%AppData%\Apple Computer\iTunes\Cookies|Cookies.binarycookies
FileKey3=%AppData%\Apple Computer\Logs|*.*|RECURSE
FileKey4=%CommonAppData%\Apple Computer\iTunes\iPhone Temporary Files|*.*|RECURSE
FileKey5=%LocalAppData%\Apple Computer\iTunes|Cache.db
FileKey6=%Music%\iTunes|*.tmp|RECURSE
FileKey7=%Music%\iTunes\Album Artwork\Cache|*.*|RECURSE
FileKey8=%WinDir%\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*.*|RECURSE
FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*.*|RECURSE

[iTunes App *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AppleInc.iTunes_nzyj5cx40ttqa
FileKey1=%LocalAppData%\Packages\AppleInc.iTunes_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\AppleInc.iTunes_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\AppleInc.iTunes_*\LocalCache\Local\Apple Computer\iTunes|Cache.db;*.xml
FileKey4=%LocalAppData%\Packages\AppleInc.iTunes_*\LocalCache\Local\Microsoft\Windows\Caches|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\AppleInc.iTunes_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\AppleInc.iTunes_*\LocalCache\Roaming\Apple Computer\iTunes\Cookies|Cookies.binarycookies
FileKey7=%LocalAppData%\Packages\AppleInc.iTunes_*\LocalCache\Roaming\Apple Computer\Logs|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\AppleInc.iTunes_*\SystemAppData\Helium\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\AppleInc.iTunes_*\TempState|*.*|RECURSE
FileKey10=%WinDir%\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*.*|RECURSE

[iWisoft Free Video Converter *]
LangSecRef=3023
DetectFile=%ProgramFiles%\iWisoft Free Video Converter
FileKey1=%ProgramFiles%\iWisoft Free Video Converter|VideoConverter.log

[iXL *]
LangSecRef=3021
DetectFile=%AppData%\Fisher-Price\iXL
FileKey1=%AppData%\Fisher-Price\iXL\Log|*.*

[iZotope RX 2 Session Data *]
LangSecRef=3021
DetectFile=%AppData%\iZotope\iZotope RX 2 Session Data
FileKey1=%AppData%\iZotope\iZotope RX 2 Session Data|*.*|RECURSE

[Jabbear *]
LangSecRef=3022
Detect=HKCU\Software\Jabbear
FileKey1=%ProgramFiles%\Jabbear|*.log|RECURSE
FileKey2=%ProgramFiles%\Jabbear\avatars|*.*|RECURSE
FileKey3=%ProgramFiles%\Jabbear\cachedir|*.*|RECURSE

[Jabbear Chat History *]
LangSecRef=3022
Detect=HKCU\Software\Jabbear
FileKey1=%ProgramFiles%\Jabbear\Users|*.dat;*.html|RECURSE

[Jagex Cache *]
Section=Games
DetectFile=%UserProfile%\jagexcache
FileKey1=%UserProfile%\jagex*|*.*|RECURSE
FileKey2=%WinDir%\.jagex*|*.*|REMOVESELF
ExcludeKey1=PATH|%UserProfile%\jagexcache\jagexlauncher\|*.*

[JAJC *]
LangSecRef=3022
DetectFile=%UserProfile%\JAJC
FileKey1=%UserProfile%\JAJC\Avatars|*.*|RECURSE
FileKey2=%UserProfile%\JAJC\Logs|*.*|RECURSE

[Jalatext *]
LangSecRef=3021
DetectFile=%UserProfile%\.jalatext
FileKey1=%UserProfile%\.jalatext\log|*.*

[James Patterson's Women's Murder Club: Twice in a Blue Moon *]
Section=Games
DetectFile=%AppData%\Flood Light Games\WMC3
FileKey1=%AppData%\Flood Light Games\WMC3|*.log

[jAnrufmonitor *]
LangSecRef=3025
DetectFile=%ProgramFiles%\jAnrufmonitor
FileKey1=%ProgramFiles%\jAnrufmonitor\data|*.log
FileKey2=%ProgramFiles%\jAnrufmonitor\lib\cache|classloader.cache.log
FileKey3=%ProgramFiles%\jAnrufmonitor\logs|*.*

[Jasc Animation Shop *]
LangSecRef=3023
Detect=HKCU\Software\Jasc\animation shop
RegKey1=HKCU\Software\JASC\Animation Shop\Cache

[Java *]
LangSecRef=3022
Detect1=HKLM\Software\JavaSoft\Java Plug-in
Detect2=HKLM\Software\JavaSoft\Java Runtime Environment
Detect3=HKLM\Software\JavaSoft\Java Web Start
DetectFile=%CommonAppData%\Oracle\Java
FileKey1=%AppData%\Sun\Java\Deployment\SystemCache|*.*|RECURSE
FileKey2=%CommonAppData%\Oracle\Java\.oracle_jre_usage|*.*
FileKey3=%LocalAppData%\Sun\Java\Deployment\*Cache|*.*|RECURSE
FileKey4=%LocalLowAppData%\Sun\Java\Deployment\SystemCache|*.*|RECURSE
FileKey5=%ProgramFiles%\Java\jre*|*PATCH.ERR
FileKey6=%ProgramFiles%\Java\jre*\lib\security|*.bak
FileKey7=%SystemDrive%\Users\*\.oracle_jre_usage|*.*|REMOVESELF
FileKey8=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\Cache|*.*|RECURSE
FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\Cache|*.*|RECURSE

[Java Setup Files *]
LangSecRef=3022
Detect=HKLM\Software\JavaSoft\Java Runtime Environment
FileKey1=%AppData%\Sun\Java\jre*|*.*|REMOVESELF
FileKey2=%CommonAppData%\Oracle\Java\installcache|*.*|RECURSE
FileKey3=%LocalLowAppData%\Oracle\Java\jdk*|*.*|REMOVESELF
FileKey4=%LocalLowAppData%\Oracle\Java\jre*|*.*|REMOVESELF
FileKey5=%LocalLowAppData%\Sun\Java\jdk*|*.*|REMOVESELF
FileKey6=%LocalLowAppData%\Sun\Java\jre*|*.*|REMOVESELF

[JavaRa *]
LangSecRef=3022
DetectFile1=%ProgramFiles%\JavaRa 2.0\JavaRa.exe
DetectFile2=%ProgramFiles%\JavaRa\JavaRa.exe
FileKey1=%ProgramFiles%\JavaRa 2.0|*.log|RECURSE
FileKey2=%SystemDrive%|JavaRa.log

[JDownloader *]
LangSecRef=3022
Detect=HKLM\Software\JDownloader
DetectFile=%ProgramFiles%\JDownloader
FileKey1=%ProgramFiles%\JDownloader*|*.log;updateLog.txt;*.lck;*.log.*|RECURSE
FileKey2=%ProgramFiles%\JDownloader*\.junique|*.*
FileKey3=%ProgramFiles%\JDownloader*\captchas|*.*
FileKey4=%ProgramFiles%\JDownloader*\container|*.*
FileKey5=%ProgramFiles%\JDownloader*\downloads|*.*
FileKey6=%ProgramFiles%\JDownloader*\tmp\linksave|*.*
FileKey7=%UserProfile%\.jd_home|JDownloader.log
FileKey8=%UserProfile%\.jd_home\logs|*.0

[JDownloader Backups *]
LangSecRef=3022
Detect=HKLM\Software\JDownloader
DetectFile=%ProgramFiles%\JDownloader
FileKey1=%ProgramFiles%\JDownloader*\backup|*.*

[JDownloader2 *]
LangSecRef=3022
Detect=HKLM\Software\Classes\JDownloader2
DetectFile=%ProgramFiles%\JDownloader 2
FileKey1=%LocalAppData%\JDownloader*2*|JDownloader.log;Updater_*-*-*.log;SessionInstallLog.json.*;output.log|RECURSE
FileKey2=%LocalAppData%\JDownloader*2*\.install4j|*.log
FileKey3=%LocalAppData%\JDownloader*2*\captchas|*.*|RECURSE
FileKey4=%LocalAppData%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey5=%LocalAppData%\JDownloader*2*\logs|*.*|RECURSE
FileKey6=%LocalAppData%\JDownloader*2*\tmp|*.*|RECURSE
FileKey7=%ProgramFiles%\JDownloader*2*|JDownloader.log;Updater_*-*-*.log;SessionInstallLog.json.*;output.log|RECURSE
FileKey8=%ProgramFiles%\JDownloader*2*\.install4j|*.log
FileKey9=%ProgramFiles%\JDownloader*2*\captchas|*.*|RECURSE
FileKey10=%ProgramFiles%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey11=%ProgramFiles%\JDownloader*2*\logs|*.*|RECURSE
FileKey12=%ProgramFiles%\JDownloader*2*\tmp|*.*|RECURSE
ExcludeKey1=PATH|%LocalAppData%\JDownloader*2*\cfg\|subconf_*.ejs
ExcludeKey2=PATH|%ProgramFiles%\JDownloader*2*\cfg\|subconf_*.ejs

[jEdit *]
LangSecRef=3021
DetectFile=%UserProfile%\.jedit
FileKey1=%UserProfile%\.jedit|*.log|RECURSE
FileKey2=%UserProfile%\.jedit\jars-cache|*.*|RECURSE

[Jet Downloader *]
LangSecRef=3022
DetectFile=%ProgramFiles%\CloudTech\Jet Downloader
FileKey1=%ProgramFiles%\CloudTech\Jet Downloader|*.log

[JetBrains dotPeek v1.1 *]
LangSecRef=3024
Detect=HKLM\Software\JetBrains\dotPeek
FileKey1=%LocalAppData%\JetBrains\dotPeek\v1.1\Caches|*.*|REMOVESELF

[JetDrive *]
LangSecRef=3024
DetectFile=%ProgramFiles%\JetDrive
FileKey1=%LocalAppData%\Abelssoft\JetDrive|JetDrive.reports.xml
FileKey2=%ProgramFiles%\JetDrive|JetDrive.log

[Jetico Personal Firewall *]
LangSecRef=3022
Detect=HKLM\Software\Jetico\Personal Firewall
FileKey1=%ProgramFiles%\Jetico\Jetico Personal Firewall|firewall*.log

[Jing *]
LangSecRef=3024
Detect=HKLM\Software\TechSmith\Jing
FileKey1=%LocalAppData%\TechSmith\Jing\DataStore|*.*|RECURSE
FileKey2=%LocalAppData%\TechSmith\Jing\Temp|*.*|RECURSE

[Jitsi *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Jitsi
FileKey1=%AppData%\Jitsi\avatarcache|*.*|RECURSE
FileKey2=%AppData%\Jitsi\Log|*.*|RECURSE

[Jitsi Chat/File History *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Jitsi
FileKey1=%AppData%\Jitsi\History*|*.*|RECURSE

[Joboshare DVD Toolkit *]
LangSecRef=3023
Detect=HKCU\Software\Joboshare
FileKey1=%Documents%\Joboshare\DVD Copy\ifo_temp|*.*|REMOVESELF
FileKey2=%Documents%\Joboshare\DVD Copy\log|*.*|REMOVESELF
FileKey3=%SystemDrive%|*temp.txt;*test.txt

[Join.Me *]
LangSecRef=3022
Detect=HKCU\Software\join.me
FileKey1=%LocalAppData%\join.me|*.log

[Join.Me Install Backups *]
LangSecRef=3022
Detect=HKCU\Software\join.me
Warning=This will remove all old versions of Join.Me that are automatically backed up on each install.
FileKey1=%LocalAppData%\join.me\join.me.*.*.*.*|*.*|REMOVESELF

[Jojo's Fashion Show *]
Section=Games
DetectFile=%AppData%\Gamelab\Jojos Fashion Show
FileKey1=%AppData%\Gamelab\Jojos Fashion Show|log.txt

[JOSM *]
LangSecRef=3021
DetectFile=%LocalAppData%\JOSM
FileKey1=%LocalAppData%\JOSM\cache\tiles|*.*|RECURSE

[Jump Lists *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%AppData%\Microsoft\windows\recent\Automaticdestinations|*.*|RECURSE
FileKey2=%AppData%\Microsoft\windows\recent\CustomDestinations|*.*|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\|f01b4d95cf55d32a.automaticDestinations-ms

[Juniper Networks *]
LangSecRef=3021
Detect1=HKCU\Software\Juniper Networks
Detect2=HKLM\Software\Juniper Networks
FileKey1=%AppData%\Juniper Networks|*.old;*.log|RECURSE
FileKey2=%LocalAppData%\Juniper Networks\Logging|*.*
RegKey1=HKLM\Software\Juniper Networks\Default

[Just Manager *]
LangSecRef=3021
Detect=HKLM\Software\JustManager
DetectFile=%ProgramFiles%\JustManager\JustManager.exe
FileKey1=%LocalAppData%\JustManager|Log.txt

[jv16 PowerTools-X StartupOptimiser *]
LangSecRef=3024
DetectFile=%ProgramFiles%\jv16 PowerTools X\jv16PT.exe
FileKey1=%ProgramFiles%\jv16 PowerTools X|StartupOptimizer*.log

[jv16 RegCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegCleaner\RegCleanr.exe
FileKey1=%ProgramFiles%\RegCleaner|old.dat
FileKey2=%ProgramFiles%\RegCleaner\Backups|*.*

[K-Lite Codec Pack *]
LangSecRef=3023
Detect=HKLM\Software\KLCodecPack
FileKey1=%ProgramFiles%\K-Lite*|*.log;*.txt|RECURSE
FileKey2=%SystemDrive%|*klcp_itp_*.tmp;*klcp_iph_*.tmp
FileKey3=%UserProfile%\Desktop|klcp_codec_log.txt
RegKey1=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path0
RegKey2=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path1
RegKey3=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path2

[Kakao Talk *]
LangSecRef=3022
DetectFile=%LocalAppData%\Kakao\KakaoTalk
FileKey1=%LocalAppData%\Kakao\KakaoTalk\Dump|*.*|RECURSE

[Kalypso Launcher *]
Section=Games
DetectFile=%AppData%\Kalypso Media\Launcher
FileKey1=%AppData%\Kalypso Media\Launcher|log_appdata.txt;log.txt

[KarenWare Hasher *]
LangSecRef=3024
Detect=HKCU\Software\KarenWare\Power Tools\Hasher
RegKey1=HKCU\Software\KarenWare\Power Tools\Hasher|LastRun

[Kaspersky *]
LangSecRef=3024
Detect=HKCU\Software\KasperskyLab
Warning=Make sure to disable "Self Defense" before cleaning.
FileKey1=%CommonAppData%\Kaspersky Lab|*.dmp;*.dmp.stat;*.log
FileKey2=%CommonAppData%\Kaspersky Lab\*\Bases\Cache|*.*|RECURSE
FileKey3=%CommonAppData%\Kaspersky Lab\*\Data\Updater\Temporary Files|*.*|RECURSE
FileKey4=%CommonAppData%\Kaspersky Lab\*\Temp|*.*
FileKey5=%CommonAppData%\Kaspersky Lab\UCPStorage|ucp_agent.bin.bak
FileKey6=%ProgramFiles%\Kaspersky Lab\NetworkAgent\~dumps|*.*

[Kaspersky Now *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\KasperskyLab.KasperskyNow_8jx5e25qw3tdc
FileKey1=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Microsoft\CLR_v4.0_32|*.log
FileKey3=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\LocalCache|*.*|RECURSE

[Kate's Video Toolkit *]
LangSecRef=3023
Detect=HKCU\Software\Web Solution Mart\Kate's Video Toolkit
FileKey1=%CommonAppData%\Web Solution Mart\*|*.log|RECURSE

[KCleaner *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\KCleaner
FileKey1=%AppData%\KC Softwares\KCleaner|*.log

[KDE *]
LangSecRef=3021
Detect=HKCU\Software\KDE.org
FileKey1=%UserProfile%\.kde\cache*|*.*|RECURSE

[Keroon Reset Local Password Pro *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Reset Local Password Pro
FileKey1=%ProgramFiles%\Reset Local Password Pro|*.log

[KFK *]
LangSecRef=3023
Detect=HKCU\Software\KC Softwares\KFK
FileKey1=%AppData%\KC Softwares\KFK|*.log

[Killing Floor 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\232090
FileKey1=%Documents%\My Games\KillingFloor2\KFGame\Logs|*.*|RECURSE

[Kinetic Jump Updater *]
LangSecRef=3021
DetectFile=%LocalAppData%\Kjs.AppLife.Update
FileKey1=%LocalAppData%\Kjs.AppLife.Update|*.log

[Kingsoft Office *]
LangSecRef=3021
Detect=HKCU\Software\Kingsoft
FileKey1=%AppData%\Kingsoft\*|*.bak
FileKey2=%AppData%\Kingsoft\*\backup|*.*
FileKey3=%AppData%\Kingsoft\*\update\log|*.log
FileKey4=%LocalAppData%\Kingsoft\*\cache\http*|*.*
FileKey5=%ProgramFiles%\Kingsoft\Kingsoft Office\*|*.log

[Kingston SSD Manager *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Kingston_SSD_Manager
FileKey1=%ProgramFiles%\Kingston_SSD_Manager|*.log;*log.txt

[Kite Plugin *]
LangSecRef=3024
DetectFile=%AppData%\Kite
FileKey1=%AppData%\Kite\*Cache|*.*

[Kleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Skyler Lyon\Kleaner\Kleaner.exe
FileKey1=%ProgramFiles%\Skyler Lyon\Kleaner|*.txt

[KlokworkTeamConsole *]
LangSecRef=3024
DetectFile=%ProgramFiles%\KlokworkTeamConsole
FileKey1=%AppData%\com.mcgraphix.KlokworkTeamConsole\local store|debug.txt

[KMS Emulator *]
LangSecRef=3024
DetectFile1=%CommonAppData%\KMSAuto\bin\KMSSS.exe
DetectFile2=%WinDir%\AutoKMS\AutoKMS.exe
FileKey1=%CommonAppData%\KMSAuto\bin|*.log
FileKey2=%WinDir%\AutoKMS|*.log

[Kodak AiO Software Disable Startup *]
LangSecRef=3021
Detect1=HKLM\Software\Eastman Kodak Company\KODAK AiO Home Center
Detect2=HKLM\Software\Kodak\Kodak AiO Software
Warning=Disables the Kodak AiO Software from automatically starting with Windows. Every time you print, it will re-enable itself to start with Windows.
RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\Run|EKAIO2StatusMonitor
RegKey2=HKLM\Software\Microsoft\Windows\CurrentVersion\Run|EKStatusMonitor

[Kodak Logs *]
LangSecRef=3021
Detect1=HKCU\Software\Kodak
Detect2=HKLM\Software\Eastman Kodak Company\KODAK AiO Home Center
Detect3=HKLM\Software\Kodak\Kodak AiO Software
DetectFile=%AppData%\Kodak\Share Button App
FileKey1=%AppData%\Kodak\Share Button App|*.log
FileKey2=%CommonAppData%\Kodak\Diagnostics|*.*
FileKey3=%CommonAppData%\Kodak\Inkjet Logging|*.*|RECURSE
FileKey4=%LocalAppData%|LaunchHomeCenter.log
FileKey5=%LocalAppData%\Kodak\Diagnostics|UploadLog.xml
FileKey6=%LocalAppData%\Kodak\Inkjet Logging|Status Monitor Log.*

[Kodi *]
LangSecRef=3023
DetectFile=%AppData%\kodi
FileKey1=%AppData%\kodi|*.log;*.dmp;*.txt
FileKey2=%AppData%\kodi*\userdata\cache|*.*|RECURSE
FileKey3=%AppData%\kodi*\userdata\thumbnails|*.*|RECURSE
FileKey4=%AppData%\kodi\addons\packages|*.*|RECURSE
FileKey5=%AppData%\kodi\cache|*.*|RECURSE

[Koffix Blocker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Koffix Blocker\Koffix.exe
FileKey1=%Documents%\My Koffix Blocker Logs|*.*

[Koinonein Bittorrent Client *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Koinonein BitTorrent Client\Koinonein BitTorrent Client.exe
FileKey1=%LocalAppData%\Koinonein BitTorrent Client*\Application|log.db

[KoolPlaya *]
LangSecRef=3023
Detect=HKCU\Software\AKi-Software\Kool-Playa
RegKey1=HKCU\Software\AKi-Software\Kool-Playa\VideoHistory
RegKey2=HKCU\Software\AKi-Software\Kool-Playa\Videos
RegKey3=HKCU\Software\AKi-Software\Kool-PlayaX64\VideoHistory
RegKey4=HKCU\Software\AKi-Software\Kool-PlayaX64\Videos

[Krita *]
LangSecRef=3023
Detect=HKLM\Software\Krita
FileKey1=%LocalAppData%|krita.log;krita-sysinfo.log
FileKey2=%LocalAppData%\krita\cache|*.*|RECURSE

[L0phtCrack *]
LangSecRef=3024
Detect=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6
DetectFile=%ProgramFiles%\L0phtCrack*
FileKey1=%ProgramFiles%\L0phtCrack *|vc*redist*x*.exe
RegKey1=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last LC File
RegKey2=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last Remote Machine
RegKey3=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last SAM File
RegKey4=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last SYSTEM File

[LanGuard 10 *]
LangSecRef=3022
DetectFile=%CommonAppData%\GFI Software\LanGuard 10
FileKey1=%CommonAppData%\GFI Software\LanGuard 10|newfileslog.*
FileKey2=%CommonAppData%\GFI Software\LanGuard 10\*Logs|*.*|RECURSE
FileKey3=%CommonAppData%\GFI Software\LanGuard 10\Cache|*.*|REMOVESELF

[Lantern *]
LangSecRef=3022
DetectFile=%AppData%\Lantern\lantern.exe
FileKey1=%AppData%\Lantern|*.old
FileKey2=%AppData%\Lantern\logs|*.log

[Launchy *]
LangSecRef=3021
DetectFile=%AppData%\Launchy
FileKey1=%AppData%\Launchy\*-icon-cache|*.*

[Lavender's Botanicals *]
Section=Games
DetectFile=%AppData%\MysteryStudio\Lavender
FileKey1=%AppData%\MysteryStudio\Lavender|*.log

[Layers of Fear Cache *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\391720
FileKey1=%AppData%\Aspyr Media\GameGuide\Cache|*.*|RECURSE

[League of Legends *]
Section=Games
Detect1=HKCU\Software\Bugsplat\lol_beta_riotgames_com
Detect2=HKCU\Software\Riot Games
Detect3=HKLM\Software\Riot Games
FileKey1=%AppData%\LolClient*|*.*|RECURSE
FileKey2=%SystemDrive%\Riot Games\League of Legends|*.log*;*.tmp;*.pandurl;Localization_Errors.txt;*r3dlog.txt;*netlog.txt|RECURSE
FileKey3=%UserProfile%\riotsGamesLogs|*.*

[Leapfrog Connect *]
LangSecRef=3021
DetectFile=%ProgramFiles%\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe
FileKey1=%CommonAppData%\Leapfrog\LeapFrog Connect\cache\*\cookies|*.*
FileKey2=%CommonAppData%\Leapfrog\LeapFrog Connect\cache\*\data7\*|*.*
FileKey3=%CommonAppData%\Leapfrog\LeapFrog Connect\cache\*\http*|*.*
FileKey4=%CommonAppData%\Leapfrog\LeapFrog Connect\cache\*\prepared|*.*
FileKey5=%CommonAppData%\Leapfrog\LeapFrog Connect\DownloadCache|*.*

[LeapFTP *]
LangSecRef=3022
DetectFile=%ProgramFiles%\LeapFTP
FileKey1=%ProgramFiles%\LeapFTP|stats.dat

[Learn2 Player *]
LangSecRef=3023
DetectFile=%AppData%\Learn2.com
FileKey1=%AppData%\Learn2.com\strunner\StCache|*.*|RECURSE
FileKey2=%LocalAppData%\Learn2.com\strunner\StCache|*.*|RECURSE

[Leawo Prof. Media *]
LangSecRef=3023
Detect=HKCU\Software\Leawo Software\SoftwarePassport\Leawo Prof. Media
FileKey1=%AppData%\Leawo\Prof. Media|*.xml
FileKey2=%AppData%\Leawo\Prof. Media\Burn|*.log
FileKey3=%AppData%\Leawo\Prof. Media\Burn\MenuTemplate\Cache|*.*|RECURSE
FileKey4=%AppData%\Leawo\Prof. Media\CrashReport|*.*|RECURSE
FileKey5=%AppData%\Leawo\Prof. Media\Download|*.dat;*.db;*log;*.xml
FileKey6=%AppData%\Leawo\Prof. Media\Download\Thumbnails|*.*|RECURSE
FileKey7=%AppData%\Leawo\Prof. Media\Download\WebCache|*.*|RECURSE
FileKey8=%AppData%\Leawo\Prof. Media\Download\WebFiles|*.*|RECURSE
FileKey9=%AppData%\Leawo\Prof. Media\Log|*.*|RECURSE
FileKey10=%LocalAppData%\Leawo Prof\cache|*.*|RECURSE

[Leawo Video Converter *]
LangSecRef=3023
DetectFile=%AppData%\Leawo\Video Converter*
FileKey1=%AppData%\Leawo\Video Converter*|*.log
FileKey2=%AppData%\Leawo\Video Converter*\CrashReport|*.*|RECURSE
FileKey3=%LocalAppData%\Video Converter*\cache|*.*|RECURSE

[LEGO Universe *]
Section=Games
DetectFile=%LocalAppData%\LEGO Software\LEGO Universe
FileKey1=%LocalAppData%\LEGO Software\LEGO Universe\Log Files|*.*

[Lenovo SWTOOLS *]
LangSecRef=3025
DetectFile=%SystemDrive%\SWTOOLS
FileKey1=%SystemDrive%\SWTOOLS|*.*|REMOVESELF

[Lenovo System Update *]
LangSecRef=3024
DetectFile=%CommonAppData%\Lenovo\SystemUpdate\sessionSE\Repository
FileKey1=%CommonAppData%\Lenovo\SystemUpdate\sessionSE\Repository|*.*|RECURSE
FileKey2=%CommonAppData%\Lenovo\SystemUpdate\sessionSE\system\SSClientCommon|*.xml

[Leviev Sales Information Portal *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Leviev Sales Information Portal
FileKey1=%ProgramFiles%\JMS|JMSErrors.txt
FileKey2=%ProgramFiles%\Leviev Sales Information Portal|JMSErrors.txt

[Lexmark Logs *]
LangSecRef=3021
DetectFile=%CommonAppData%\gn_logs
FileKey1=%CommonAppData%\gn_logs\*|*.*

[Lexmark Photo Editor *]
LangSecRef=3021
Detect=HKCU\Software\LexmarkPhoto\Lexmark Photo Software\pheditor
DetectFile=%ProgramFiles%\Lexmark 5200 Series\pheditor.exe
RegKey1=HKCU\Software\LexmarkPhoto\Lexmark Photo Software\pheditor\Recent File List

[Lexware *]
LangSecRef=3021
DetectFile=%LocalAppData%\Lexware
FileKey1=%AppData%\Lexware|*.log|RECURSE
FileKey2=%CommonAppData%\Lexware|*.log;*.logx|RECURSE
FileKey3=%CommonAppData%\Lexware\elster\Log|*.*|REMOVESELF
FileKey4=%CommonAppData%\Lexware\logs|*.*|REMOVESELF
FileKey5=%CommonProgramFiles%\Lexware|*.log|RECURSE
FileKey6=%LocalAppData%\Lexware|*.log;*.logx|RECURSE
FileKey7=%ProgramFiles%\Lexware|*.log|RECURSE
FileKey8=%SystemDrive%|LxDasi.Log

[LibreOffice *]
LangSecRef=3021
Detect=HKLM\Software\LibreOffice
FileKey1=%AppData%\LibreOffice\*\cache|*.log
FileKey2=%AppData%\LibreOffice\*\User\backup|*.*
FileKey3=%AppData%\LibreOffice\*\User\extensions\shared|log.*
FileKey4=%AppData%\LibreOffice\*\User\temp|*.*
FileKey5=%AppData%\LibreOffice\*\User\uno_packages\cache|log.*
FileKey6=%ProgramFiles%\LibreOffice*\program_old*|*.*|REMOVESELF

[LifeCam *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.LifeCamDashboard_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\PRICache|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\TempState|*.*|RECURSE

[LightScribe *]
LangSecRef=3023
Detect=HKCU\Software\LightScribe
FileKey1=%CommonAppData%\LightScribe\log|*.xml

[LightShot *]
LangSecRef=3022
DetectFile=%LocalAppData%\Skillbrains\lightshot
FileKey1=%LocalAppData%|updater.log

[Lightworks *]
LangSecRef=3021
Detect=HKLM\Software\Lightworks
FileKey1=%Public%\Documents\Lightworks\Logs|*.*|REMOVESELF

[Lili: Child of Geos - Complete Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\apps\266490
FileKey1=%Documents%\my games\UnrealEngine3-MazeGame\MazeGame\Logs|*.*

[LimePro *]
LangSecRef=3022
Detect=HKCU\Software\LimePro
RegKey1=HKCU\Software\LimePro|GUI.LastChatRoomBrowse
RegKey2=HKCU\Software\LimePro|GUI.LastSearch

[LimeWire *]
LangSecRef=3022
Detect=HKLM\Software\LimeWire
FileKey1=%AppData%\LimeWire|fileurns.cache;createtimes.cache;responses.cache;ttree.cache;gnutella.net
FileKey2=%UserProfile%\Incomplete|*.*|RECURSE

[LinkAlyzer *]
LangSecRef=3024
Detect=HKCU\Software\Sanderson Forensics\LinkAlyzer
RegKey1=HKCU\Software\Sanderson Forensics\LinkAlyzer|LastOpenFolder
RegKey2=HKCU\Software\Sanderson Forensics\LinkAlyzer|LastSaveFolder

[Listary *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
FileKey1=%AppData%\Listary\CrashRpt|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Listary|*.log

[Loadout *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\208090
FileKey1=%LocalAppData%\EdgeOfReality\Loudout\CrashReports|*.*

[Locate32 *]
LangSecRef=3024
Detect=HKCU\Software\Update\Locate32
RegKey1=HKCU\Software\Update\Locate32\Dialogs|Advanced/ContainData
RegKey2=HKCU\Software\Update\Locate32\Dialogs|Name/LookIn
RegKey3=HKCU\Software\Update\Locate32\Dialogs|Name/Name
RegKey4=HKCU\Software\Update\Locate32\Dialogs|Name/Type
RegKey5=HKCU\Software\Update\Locate32\Recent Strings

[Lock Screen *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.LockApp_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.LockApp_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.LockApp_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.LockApp_*\TempState|*.*|RECURSE

[LockHunter *]
LangSecRef=3024
Detect=HKCU\Software\LockHunter
FileKey1=%AppData%\LockHunter|*.txt;*.log
FileKey2=%CommonAppData%\LHService|*.txt;*.log

[Logitech Camera *]
LangSecRef=3023
Detect=HKLM\Software\Logitech\QuickCam\Drivers
FileKey1=%LocalAppData%\LogiShrd\Vid|*.*|RECURSE

[Logitech Desktop Messenger *]
LangSecRef=3024
Detect1=HKCU\Software\Logitech\DesktopMessenger
Detect2=HKLM\Software\Logitech\DesktopMessenger
Detect3=HKLM\Software\Logitech\Logitech Desktop Messenger
FileKey1=%ProgramFiles%\Logitech\Desktop Messenger|*.log;*.bak|RECURSE

[Logitech Harmony Remote Cache *]
LangSecRef=3021
Detect=HKCU\Software\JavaSoft\Prefs\Com\Logitech\harmony
FileKey1=%UserProfile%\Logitech\browser - logitech\Cache|*.*

[Logitech Logs *]
LangSecRef=3021
Detect=HKCU\Software\Logitech\Setpoint
DetectFile=%AppData%\Logishrd
FileKey1=%AppData%\Logishrd|*.log|RECURSE
FileKey2=%AppData%\Logishrd\sp6_Log|*.*|REMOVESELF
FileKey3=%AppData%\Logishrd\Updater|UpdateList.csv
FileKey4=%CommonAppData%\Logishrd|*.log|RECURSE
FileKey5=%CommonAppData%\Logishrd\unifying|EngineLog.*;*.txt
FileKey6=%CommonAppData%\Logitech\KHAL\Battery|*.log
FileKey7=%CommonProgramFiles%\Logishrd|*.log|RECURSE
FileKey8=%WinDir%\System32|lvcoinst.log

[LogMeIn Hamachi *]
LangSecRef=3022
Detect=HKLM\Software\LogMeIn, Inc.
FileKey1=%WinDir%\System32\config\systemprofile\*\*\LogMeIn Hamachi|h2-engine.log;h2-ui.log;*.old;*.bak
FileKey2=%WinDir%\SysWOW64\config\systemprofile\*\*\LogMeIn Hamachi|h2-engine.log;h2-ui.log;*.old;*.bak

[LoL Replay *]
Section=Games
Detect=HKCU\Software\LOLReplay
FileKey1=%Documents%\LOLReplay|*_log.txt;*.log;*.old|RECURSE

[LoL Summonerinfo *]
Section=Games
DetectFile=%ProgramFiles%\LSI\logs
FileKey1=%ProgramFiles%\LSI\logs|*.*

[Lost Photos *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Lost Photos
FileKey1=%LocalAppData%\Lost_Photos\*|ResultSearchFile.info
FileKey2=%ProgramFiles%\Lost Photos\Logs|*.*

[Lotus Notes *]
LangSecRef=3021
DetectFile=%ProgramFiles%\IBM\Lotus\Notes\Data\Cache.NDK
FileKey1=%ProgramFiles%\IBM\Lotus\Notes\Data|Cache.NDK

[Lunascape6 *]
LangSecRef=3022
Detect=HKLM\Software\Lunascape Corporation
FileKey1=%AppData%\lunascape\Lunascape6\ApplicationData|rebar.bmp
FileKey2=%AppData%\lunascape\Lunascape6\ApplicationData\icons|*.*|RECURSE
FileKey3=%AppData%\lunascape\Lunascape6\ApplicationData\Temp|*.*|RECURSE
FileKey4=%ProgramFiles%\Lunascape\Lunascape6\applicationdata|rebar.bmp

[Lunascape6 Backups *]
LangSecRef=3022
Detect=HKLM\Software\Lunascape Corporation
FileKey1=%AppData%\Lunascape\Lunascape6\backup|*.*|RECURSE

[Lunascape6 History *]
LangSecRef=3022
Detect=HKLM\Software\Lunascape Corporation
Warning=Lunascape will show you a warning on next start up.
FileKey1=%AppData%\lunascape\Lunascape6\ApplicationData|history.ld2
FileKey2=%ProgramFiles%\Lunascape\Lunascape6\applicationdata|history.ld2

[Lupinho.Net Hardlink *]
LangSecRef=3023
Detect=HKLM\Software\Lupinho.Net
FileKey1=%LocalAppData%\Lupinho.Net|*.log|RECURSE

[Lynx Web Browser *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Lynx - web browser
FileKey1=%ProgramFiles%\Lynx - web browser\tmp|*.*

[Lyrik *]
LangSecRef=3023
Detect=HKLM\Software\Lyrik
FileKey1=%LocalAppData%\Lyrik|*.*

[Lyx *]
LangSecRef=3021
DetectFile=%AppData%\LyX2.0
FileKey1=%AppData%\LyX2.0|*.log|RECURSE
FileKey2=%AppData%\LyX2.0\Cache|*.*|RECURSE

[Macaw *]
LangSecRef=3022
DetectFile=%AppData%\Macaw
FileKey1=%AppData%\Macaw\cef_data|cookies*.*;data*.;index.
FileKey2=%AppData%\Macaw\cef_data\gpucache|*.*|RECURSE
FileKey3=%AppData%\Macaw\cef_data\Local Storage|*.*

[Machete *]
LangSecRef=3023
Detect=HKCU\Software\MacheteSoft\Machete
DetectFile=%ProgramFiles%\MacheteSoft\Machete\Machete.exe
FileKey1=%AppData%\Machete|MacheteSettings.xml.bak
RegKey1=HKCU\Software\Local AppWizard-Generated Applications\Machete\Recent File List
RegKey2=HKCU\Software\MacheteSoft\Machete\Recent File List
RegKey3=HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache
RegKey4=HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache64

[Macrium Reflect *]
LangSecRef=3024
Detect=HKCU\Software\Macrium\Reflect
FileKey1=%CommonAppData%\Macrium|*.log|RECURSE
FileKey2=%CommonAppData%\Macrium\Reflect|*.html;*.vsslog;*.tmp
FileKey3=%CommonAppData%\Macrium\waik|waiklog.txt
FileKey4=%SystemDrive%|ref~tmp~.txt;Reflect_Install.log;rescuepe.log

[Macromedia Shockwave *]
LangSecRef=3023
Detect1=HKCU\Software\Macromedia\Shockwave 8
Detect2=HKCU\Software\Macromedia\Shockwave 9
RegKey1=HKCU\Software\Macromedia\Shockwave 8\movies
RegKey2=HKCU\Software\Macromedia\Shockwave 9\movies

[Magicka *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\42910
FileKey1=%ProgramFiles%\Steam\steamapps\common\magicka|errorReport*.txt

[MagicTweak Magic Utilities *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Mgutil\mgutil.exe
FileKey1=%ProgramFiles%\Mgutil|*_log.txt

[MAGIX Installation Manager *]
LangSecRef=3023
Detect=HKCU\Software\Magix\MAGIX Installation manager
FileKey1=%CommonAppData%\MAGIX\*|*.log;*.reg
FileKey2=%CommonAppData%\MAGIX\*\download|*.*|RECURSE

[MAGIX Video Easy TERRATEC Edition *]
LangSecRef=3023
Detect=HKLM\Software\MAGIX\Video_easy_3_TerraTec
FileKey1=%AppData%\MAGIX\Video_easy_TERRATEC_Edition|*.log|RECURSE

[MAGIX Video Pro *]
LangSecRef=3023
Detect1=HKCU\Software\MAGIX AG\Videodeluxe18_pro
Detect2=HKCU\Software\MAGIX AG\Videodeluxe19_pro
FileKey1=%AppData%\MAGIX\Video*Pro*|*.log
FileKey2=%Documents%\MAGIX\Video*Pro*\AudioTemp|*.*|RECURSE
RegKey1=HKCU\Software\MAGIX AG\Videodeluxe19_pro\ExportConfigurator\DialogItems|LastFile
RegKey2=HKCU\Software\MAGIX AG\Videodeluxe19_pro\ExportConfigurator\DialogItems|LastPreset

[Mail and Calendar *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Comms\Unistore\data|AggregateCache.uca
FileKey2=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Temp|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState|*.etl;*.log
FileKey10=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState\AppData\Local\Office\*\WebServiceCache\AllUsers\officeclient.microsoft.com|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SearchHistory

[MailWasher Pro *]
LangSecRef=3022
Detect1=HKCU\Software\FireTrust\MailWasher
Detect2=HKCU\Software\FireTrust\MailWasher Pro
Detect3=HKCU\Software\FireTrust\MailWasherPro
FileKey1=%AppData%\Firetrust\MailWasher\cache|*.*|RECURSE
ExcludeKey1=FILE|%AppData%\Firetrust\MailWasher\cache\|MWP.db3
ExcludeKey2=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_conv.dat
ExcludeKey3=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_exw.dat
ExcludeKey4=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_inw.dat
ExcludeKey5=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_pmap.dat

[MakeHuman *]
LangSecRef=3021
DetectFile=%Documents%\makehuman
FileKey1=%Documents%\makehuman\v1|makehuman.log;makehuman-debug.txt;python_err.txt;python_out.txt
FileKey2=%Documents%\makehuman\v1\cache|*.mhc

[MAL Updater *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Mal Updater 2\MalUpdater.exe
FileKey1=%AppData%\Mal Updater\*Pics|*.*
FileKey2=%AppData%\Mal Updater\SeasonData|*.*
FileKey3=%AppData%\Mal Updater\Users|*.log|RECURSE

[Malwarebytes Anti-Exploit *]
LangSecRef=3024
Detect=HKLM\System\CurrentControlSet\Services\MbaeSvc
DetectFile=%CommonAppData%\Malwarebytes Anti-Exploit
FileKey1=%CommonAppData%\Malwarebytes Anti-Exploit|*.log;mbae-default.log.bak;mbae-protector.xpe.bak
FileKey2=%ProgramFiles%\Malwarebytes Anti-Exploit|mbae-uninstall.log;changelog.txt

[Malwarebytes Anti-Malware *]
LangSecRef=3024
Detect=HKCU\Software\Malwarebytes
DetectFile=%ProgramFiles%\Malwarebytes Anti-Malware\mbam.exe
Warning=You must manually and temporarily turn off Malwarebytes "self-protection" to remove the logs.
FileKey1=%AppData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|*.*
FileKey2=%CommonAppData%\Malwarebytes\Malwarebytes*Anti-Malware|mbam-setup.exe
FileKey3=%CommonAppData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|*.*
FileKey4=%CommonAppData%\Malwarebytes\MBAMService|*.log;*.bak;*.regtrans-ms;*.TM.blf;*-ntuser.dat;*.LOG1;*.LOG2;*-UsrClass.dat
FileKey5=%CommonAppData%\Malwarebytes\MBAMService\config|*.bak
FileKey6=%CommonAppData%\Malwarebytes\MBAMService\logs|*.*
FileKey7=%CommonAppData%\Malwarebytes\MBAMService\ScanResults|*.*
FileKey8=%CommonAppData%\Malwarebytes\MBAMService\tmp|*.*
FileKey9=%LocalAppData%\Crashdumps\Malwarebytes|*.*|REMOVESELF
FileKey10=%LocalAppData%\mbam\cache\qmlcache|*.jsc;*.qmlc
FileKey11=%LocalLowAppData%\IGDump|*.*|REMOVESELF

[ManiaPlanet *]
Section=Games
DetectFile=%CommonAppData%\ManiaPlanet
FileKey1=%CommonAppData%\ManiaPlanet\Cache|*.*

[ManyCam *]
LangSecRef=3023
Detect1=HKCU\Software\ManyCam
Detect2=HKLM\Software\ManyCam
FileKey1=%AppData%\ManyCam\Settings\MoviesThumbnails|*.*|RECURSE
FileKey2=%LocalAppData%\ManyCam|*.log|RECURSE
FileKey3=%LocalAppData%\ManyCam\cache\gallery|*.*|RECURSE

[Maps *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsMaps_8wekyb3d8bbwe
FileKey1=%CommonAppData%\Microsoft\MapData|events.log
FileKey2=%CommonAppData%\Microsoft\MapData\mapscache|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\AppCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\INet*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\Temp|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\LocalCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\LocalState\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\TempState|*.*|RECURSE

[Marine Sharpshooter 3 *]
Section=Games
DetectFile=%ProgramFiles%\Groove Games\Marine Sharpshooter 3
FileKey1=%ProgramFiles%\Groove Games\Marine Sharpshooter 3|*.dmp;*.mdmp|RECURSE

[Mass Downloader *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Mass Downloader
FileKey1=%ProgramFiles%\Mass Downloader|*.bak;massdown.dat;history.dat|RECURSE
FileKey2=%ProgramFiles%\Mass Downloader\Index|*.*|RECURSE

[Mass Effect *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\17460
Detect2=HKCU\Software\Valve\Steam\Apps\24980
Detect3=HKLM\Software\BioWare\Mass Effect
Detect4=HKLM\Software\BioWare\Mass Effect 2
Detect5=HKLM\Software\BioWare\Mass Effect 3
FileKey1=%Documents%\BioWare\Mass Effect*\BIOGame\Logs|*.*
FileKey2=%Documents%\BioWare\Mass Effect*\Logs|*.*

[MassTube *]
LangSecRef=3024
DetectFile1=%AppData%\MassTube\MassTube.exe
DetectFile2=%LocalAppData%\MassTube\MassTube.exe
DetectFile3=%ProgramFiles%\MassTube\MassTube.exe
DetectFile4=%SystemDrive%\Programs\MassTube\MassTube.exe
FileKey1=%AppData%\MassTube|Historial.dat
FileKey2=%AppData%\MassTube\Miniaturas|*.jpg
FileKey3=%LocalAppData%\MassTube|Historial.dat
FileKey4=%LocalAppData%\MassTube\Miniaturas|*.jpg
FileKey5=%ProgramFiles%\MassTube|Historial.dat
FileKey6=%ProgramFiles%\MassTube\Miniaturas|*.jpg
FileKey7=%SystemDrive%\Programs\MassTube|Historial.dat
FileKey8=%SystemDrive%\Programs\MassTube\Miniaturas|*.jpg

[MATLAB *]
Detect=HKLM\Software\MathWorks\R2014a\MATLAB
DetectFile=%ProgramFiles%\MATLAB\R20*
FileKey1=%AppData%\MathWorks\MATLAB\R20*|*.prev;cwdhistory.m;History.xml;matlab.prf;MATLABDesktop.xml
FileKey2=%AppData%\MathWorks\MATLAB\R20*\HtmlPanel\cache|*.*|RECURSE
FileKey3=%ProgramFiles%\MATLAB\R20*\polyspace\examples\cxx\*|*.log|RECURSE
FileKey4=%ProgramFiles%\MATLAB\R20*\sys\jxbrowser-chromium\win32\chromium|*.log
FileKey5=%ProgramFiles%\MATLAB\R20*\sys\tex\latex\base|*.log
FileKey6=%ProgramFiles%\MATLAB\R20*\sys\tomcat\temp|*.tmp
FileKey7=%ProgramFiles%\MATLAB\R20*\toolbox\rtw\rtwdemos\tlctutorial\tlcdebug\solutions|*.log

[Mavis Beacon *]
LangSecRef=3021
DetectFile=%AppData%\Broderbund\Mavis
FileKey1=%AppData%\Broderbund\Mavis|logfile.*

[Max Recorder *]
LangSecRef=3023
Detect=HKLM\Software\MaxRecorder
FileKey1=%LocalAppData%\MaxRecorder|*.tmp|RECURSE

[Maxprog iCash *]
LangSecRef=3021
Detect=HKCR\iCash
FileKey1=%Documents%\Maxprog\iCash\Database Logs|*.*|REMOVESELF
FileKey2=%Documents%\Maxprog\iCash\Error Logs|*.*|REMOVESELF
FileKey3=%Documents%\Maxprog\iCash\XML Dumps|*.*|REMOVESELF
FileKey4=%ProgramFiles%\iCash\vlogs|*.*|REMOVESELF

[MAXQDA Reader *]
LangSecRef=3021
DetectFile=%ProgramFiles%\MAXQDA*_Reader
FileKey1=%AppData%\MAXQDA* Reader|*Log_*.html
FileKey2=%Documents%\MAXQDA*\_MAXQDA_System|MAXQDA*_Support.zip
FileKey3=%LocalAppData%\javasharedresources|*.*
FileKey4=%LocalAppData%\MAXQDA*_Reader\cache\QtWebEngine\Default\Cache|*.*
FileKey5=%LocalAppData%\MAXQDA*_Reader\QtWebEngine\Default\GPUCache|*.*
FileKey6=%ProgramFiles%\MAXQDA*_Reader|debug.log
FileKey7=%ProgramFiles%\MAXQDA*_Reader\Resources\jdk-*-jre\legal|*.*|REMOVESELF
FileKey8=%ProgramFiles%\MAXQDA*_Reader\Resources\Lemmatization|Licenses.zip

[Maxthon *]
LangSecRef=3022
Detect1=HKCU\Software\Maxthon
Detect2=HKCU\Software\Maxthon2
Detect3=HKCU\Software\Maxthon3
FileKey1=%AppData%\Maxthon3\Users\*\Backup|*.*|RECURSE
FileKey2=%AppData%\Maxthon3\Users\*\Cookie|cookie.dat
FileKey3=%AppData%\Maxthon3\Users\*\History|history.dat;lasttab.dat
FileKey4=%AppData%\Maxthon3\Users\*\LocalStorage|*.*|RECURSE
FileKey5=%ProgramFiles%\Maxthon*\Temp|*.*

[Maxthon 5 Backups *]
LangSecRef=3022
Detect=HKCU\Software\Maxthon5
FileKey1=%AppData%\Maxthon5\Users\*\Backups|*.*|RECURSE

[Maxthon 5 Cookies *]
LangSecRef=3022
Detect=HKCU\Software\Maxthon5
FileKey1=%AppData%\Maxthon5\Users\*|Cookies*;QuotaManager
FileKey2=%AppData%\Maxthon5\Users\*\IndexedDB\http*_*.indexeddb.*|*.*|REMOVESELF
FileKey3=%AppData%\Maxthon5\Users\*\Local Storage|*.*|RECURSE

[Maxthon 5 Internet Cache *]
LangSecRef=3022
Detect=HKCU\Software\Maxthon5
FileKey1=%AppData%\Maxthon5\Users\*|*-journal;*.tmp|RECURSE
FileKey2=%AppData%\Maxthon5\Users\*\File System|*.*|REMOVESELF
FileKey3=%AppData%\Maxthon5\Users\*\GPUCache|*.*
FileKey4=%AppData%\Maxthon5\Users\*\Service Worker|*.*|REMOVESELF

[Maxthon 5 Internet History *]
LangSecRef=3022
Detect=HKCU\Software\Maxthon5
FileKey1=%AppData%\Maxthon5\Public\JumpList|*.*
FileKey2=%AppData%\Maxthon5\Users\*\History|*.*

[Maxthon 5 Saved Form Information and Passwords *]
LangSecRef=3022
Detect=HKCU\Software\Maxthon5
FileKey1=%AppData%\Maxthon5\Users\*|Web Data

[McAfee *]
LangSecRef=3024
Detect1=HKCU\Software\SiteAdvisor
Detect2=HKLM\Software\McAfee
FileKey1=%CommonAppData%\McAfee\AMCore\datreputation\Logs|*.*|RECURSE
FileKey2=%CommonAppData%\McAfee\Common Framework\AgentEvents|*.*
FileKey3=%CommonAppData%\McAfee\CSP\ETW|*.bak
FileKey4=%CommonAppData%\McAfee\Jcm|*.tmp
FileKey5=%CommonAppData%\McAfee\MCLOGS|*.bak;*.log|RECURSE
FileKey6=%CommonAppData%\McAfee\MHN|*.bak
FileKey7=%CommonAppData%\McAfee\modulecoreservice.exe|*.txt
FileKey8=%CommonAppData%\McAfee\MPF|*.tmp
FileKey9=%CommonAppData%\McAfee\MPF\data|*.*|RECURSE
FileKey10=%CommonAppData%\McAfee\MSC\Cache|McSubDB.Bak
FileKey11=%CommonAppData%\McAfee\MSC\Logs|*.log
FileKey12=%CommonAppData%\McAfee\SiteAdvisor|*.txt;*.log;log.txt;*.tmp|RECURSE
FileKey13=%CommonAppData%\McAfee\Uninstall.exe|log.txt
FileKey14=%CommonAppData%\McAfee\Update|*.*|RECURSE
FileKey15=%CommonAppData%\McAfee\VirusScan\Data|*.log;*.old
FileKey16=%CommonAppData%\McAfee\VirusScan\Logs|*.*|RECURSE
FileKey17=%CommonAppData%\Network Associates\Common Framework\AgentEvents|*.*

[McPixel *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\220860
FileKey1=%ProgramFiles%\Steam\Steamapps\common\mcpixel|log.txt

[Media Center 18 *]
LangSecRef=3023
Detect=HKCU\Software\J. River\Media Center 18
FileKey1=%AppData%\J River\Media Center 18\Library|field (filename).jmd;field (name).jmd
FileKey2=%Documents%\J River\Media Center 18\Library|*.*|RECURSE

[Media Jukebox *]
LangSecRef=3023
Detect=HKCU\Software\J. River\Music Exchange\1.0\Media Jukebox
FileKey1=%ProgramFiles%\J River\Media Jukebox\Data|*.jmd

[Media Play Ready Client *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\TempState|*.*|RECURSE

[Media Player Classic *]
LangSecRef=3023
Detect1=HKCU\Software\Gabest\Media Player Classic
Detect2=HKCU\Software\MPC-BE
Detect3=HKCU\Software\MPC-HC\MPC-HC
FileKey1=%AppData%\Media Player Classic|*.dmp
FileKey2=%AppData%\MPC-*|*.dmp
RegKey1=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 0
RegKey2=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 1
RegKey3=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 2
RegKey4=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 3
RegKey5=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 4
RegKey6=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 5
RegKey7=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 6
RegKey8=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 7
RegKey9=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 8
RegKey10=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 9
RegKey11=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 10
RegKey12=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 11
RegKey13=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 12
RegKey14=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 13
RegKey15=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 14
RegKey16=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 15
RegKey17=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 16
RegKey18=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 17
RegKey19=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 18
RegKey20=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 19
RegKey21=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 20
RegKey22=HKCU\Software\MPC-BE\RecentFiles
RegKey23=HKCU\Software\MPC-BE\Settings|DVDPath
RegKey24=HKCU\Software\MPC-BE\Settings|LastOpenDir
RegKey25=HKCU\Software\MPC-BE\Settings|LastOpenFilterDir
RegKey26=HKCU\Software\MPC-BE\Settings|LastSavedPlaylistDir
RegKey27=HKCU\Software\MPC-BE\Settings|SnapShotPath
RegKey28=HKCU\Software\MPC-HC\MPC-HC\Settings|SnapshotPath

[MegaCloud *]
LangSecRef=3022
DetectFile=%AppData%\MegaCloud
FileKey1=%AppData%\MegaCloud|*.log|RECURSE
FileKey2=%AppData%\MegaCloud\AutoUpdate\Temp|*.*|RECURSE

[MemoMaster 5 *]
LangSecRef=3021
Detect=HKCU\Software\JBSoftware\MemoMaster5
RegKey1=HKCU\Software\JBSoftware\MemoMaster5|FileMRU1
RegKey2=HKCU\Software\JBSoftware\MemoMaster5|FileMRU2
RegKey3=HKCU\Software\JBSoftware\MemoMaster5|FileMRU3
RegKey4=HKCU\Software\JBSoftware\MemoMaster5|FileMRU4
RegKey5=HKCU\Software\JBSoftware\MemoMaster5|FileMRU5
RegKey6=HKCU\Software\JBSoftware\MemoMaster5|FileMRU6
RegKey7=HKCU\Software\JBSoftware\MemoMaster5|FileMRU7
RegKey8=HKCU\Software\JBSoftware\MemoMaster5|FileMRU8
RegKey9=HKCU\Software\JBSoftware\MemoMaster5|FileMRU9
RegKey10=HKCU\Software\JBSoftware\MemoMaster5|FileMRU10
RegKey11=HKCU\Software\JBSoftware\MemoMaster5|FileMRU11
RegKey12=HKCU\Software\JBSoftware\MemoMaster5|FileMRU12
RegKey13=HKCU\Software\JBSoftware\MemoMaster5|FileMRU13
RegKey14=HKCU\Software\JBSoftware\MemoMaster5|FileMRU14
RegKey15=HKCU\Software\JBSoftware\MemoMaster5|FileMRU15

[Men of War *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\3130
Detect2=HKCU\Software\Valve\Steam\Apps\7830
Detect3=HKCU\Software\Valve\Steam\Apps\63940
Detect4=HKCU\Software\Valve\Steam\Apps\64000
Detect5=HKCU\Software\Valve\Steam\Apps\204860
FileKey1=%Documents%\My Games\men of war*\log|*.*
FileKey2=%Documents%\My Games\men of war*\shader_cache|*.*|RECURSE
FileKey3=%Documents%\My Games\mow *\log|*.*
FileKey4=%Documents%\My Games\mow *\shader_cache|*.*|RECURSE

[Mention *]
LangSecRef=3022
Detect=HKCU\Software\Mention
FileKey1=%LocalAppData%\Mention\Mention|WebpageIcons.db;cookies
FileKey2=%LocalAppData%\Mention\Mention\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Mention\Mention\LocalStorage|*.*|RECURSE

[Messaging *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Messaging_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Messaging_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Messaging_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Messaging_*\LocalCache|*.etl;*.xml
FileKey4=%LocalAppData%\Packages\Microsoft.Messaging_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Messaging_*\TempState|*.*|RECURSE

[Messenger for Desktop *]
LangSecRef=3022
DetectFile=%LocalAppData%\Programs\messengerfordesktop
FileKey1=%LocalAppData%\messengerfordesktop-updater|*.*|RECURSE

[Messenger Plus! Live *]
LangSecRef=3022
Detect=HKCU\Software\Patchou
FileKey1=%Documents%\My Chat Logs|*.*|RECURSE

[Metadata Analyzer *]
LangSecRef=3024
Detect=HKCU\Software\Smart PC Solutions\Metadata Analyzer
RegKey1=HKCU\Software\Smart PC Solutions\Metadata Analyzer|LastFile
RegKey2=HKCU\Software\Smart PC Solutions\Metadata Analyzer|LastFolder

[Metamorphose *]
LangSecRef=3024
DetectFile=%ProgramFiles%\metamorphose\metamorphose.exe
FileKey1=%AppData%\.metamorphose\undo|*.*

[Metapad *]
LangSecRef=3021
Detect=HKCU\Software\metapad
RegKey1=HKCU\Software\metapad|mru_1
RegKey2=HKCU\Software\metapad|mru_2
RegKey3=HKCU\Software\metapad|mru_3
RegKey4=HKCU\Software\metapad|mru_4
RegKey5=HKCU\Software\metapad|mru_5
RegKey6=HKCU\Software\metapad|mru_6
RegKey7=HKCU\Software\metapad|mru_7
RegKey8=HKCU\Software\metapad|mru_8
RegKey9=HKCU\Software\metapad|mru_9
RegKey10=HKCU\Software\metapad|mru_10
RegKey11=HKCU\Software\metapad|szLastDirectory

[MetaX *]
LangSecRef=3024
Detect=HKCU\Software\No Bull Software\MetaX
FileKey1=%Documents%\MetaX|*.log
RegKey1=HKCU\Software\No Bull Software\MetaX\Preferences|lastDir

[Metin2 *]
Section=Games
DetectFile=%ProgramFiles%\Metin2\metin2.exe
FileKey1=%ProgramFiles%\Metin2|*.log
FileKey2=%ProgramFiles%\Metin2\hshield|*.log
FileKey3=%ProgramFiles%\Metin2\hshield\Update|*.log
FileKey4=%ProgramFiles%\Metin2\temp|*.log

[MetroTwit *]
LangSecRef=3022
DetectFile=%AppData%\MetroTwit
FileKey1=%AppData%\MetroTwit|MetroTwit.backup
FileKey2=%AppData%\MetroTwit\*|User.cache;User.backup
FileKey3=%AppData%\MetroTwit\*\User_Images|*.*|RECURSE

[Microangelo *]
LangSecRef=3021
Detect1=HKCU\Software\Eclipsit\Microangelo\Toolset 6
Detect2=HKCU\Software\Impact\Microangelo
RegKey1=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Animator\MRU List
RegKey2=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Librarian\MRU List
RegKey3=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Studio\MRU List
RegKey4=HKCU\Software\Impact\Microangelo\Animator\MRU List
RegKey5=HKCU\Software\Impact\Microangelo\Librarian\MRU List
RegKey6=HKCU\Software\Impact\Microangelo\Studio\MRU List

[Micron Storage Executive *]
LangSecRef=3024
Detect=HKLM\Software\Micron\StorageExecutive
Warning=You need to disable "Momentum Cache" to properly clean the log files.
FileKey1=%ProgramFiles%\Micron Technology\Micron Storage Executive\logs|*.txt

[Microsoft Bing Bar *]
LangSecRef=3021
Detect=HKCU\Software\AppDataLow\Software\Microsoft\BingBar
FileKey1=%LocalAppData%\Microsoft\BingBar\Apps|*.tmp|RECURSE

[Microsoft Deployment Toolkit *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Microsoft Deployment Toolkit
Warning=To get a new component list, check for updates in the Management Console.
FileKey1=%ProgramFiles%\Microsoft Deployment Toolkit\Downloads|*.*|RECURSE

[Microsoft Diagnostics and Recovery Toolkit *]
LangSecRef=3025
Detect=HKCU\Software\MSDART
RegKey1=HKCU\Software\MSDART\Explorer\Recent File List

[Microsoft Edge *]
LangSecRef=3005
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\INetCookies|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\Microsoft\Cryptnet*Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\MicrosoftEdge\User\Default\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Microsoft\Cryptnet*Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp
FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\*\DBStore|V01*.log;V01*.jrs
FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Indexed\Data\nouser1\*|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\ImageStore|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\Recovery\Active|*.dat
FileKey12=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Temp|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AppData\User\Default\Indexed DB|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\LocalState\Favicons\PushNotificationGrouping|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedPickerData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge\DefaultOpenFileMultiple
RegKey3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedPickerData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge\DefaultOpenFileSingle
RegKey4=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedPickerData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge\DefaultSaveFileSingle

[Microsoft Edge Favorites Backup *]
LangSecRef=3005
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
FileKey1=%UserProfile%\MicrosoftEdgeBackups|*.*|RECURSE

[Microsoft Edge Favorites Icons *]
LangSecRef=3005
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
Warning=This will delete all the icons of your favorites. The icons will be rebuilt as websites are manually re-visited.
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\Datastore\Data\nouser1\*\Favorites|*.ico

[Microsoft Expression Web *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Expression\Web Designer
RegKey1=HKCU\Software\Microsoft\Expression\Web Designer\FindMRU

[Microsoft Flight Simulator X *]
Section=Games
Detect=HKLM\Software\Microsoft\Microsoft Games\Flight Simulator\10.0
FileKey1=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL
FileKey2=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log
ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\|kiosk.rtf
ExcludeKey2=PATH|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\|readme.*

[Microsoft Message Analyzer *]
LangSecRef=3024
DetectFile=%LocalAppData%\Microsoft\MessageAnalyzer
FileKey1=%Documents%\MessageAnalyzer\Traces|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\MessageAnalyzer|*.log

[Microsoft Mouse and Keyboard Center *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\Microsoft Device Center
DetectFile2=%ProgramFiles%\Microsoft Mouse and Keyboard Center
Warning=This will also delete all app-specific settings.
RegKey1=HKCU\Software\Microsoft\IntelliPoint\AppSpecific
RegKey2=HKCU\Software\Microsoft\IntelliType Pro\AppSpecific

[Microsoft News *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingNews_*\LocalState\Cache\Images|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.BingNews_*\TempState|*.*|RECURSE

[Microsoft Outlook Express 5.0 *]
LangSecRef=3022
Detect=HKCU\Identities\{9745A9A1-95D3-4584-B4E8-C9C2374B3BD3}\Software\Microsoft\Outlook Express\5.0
RegKey1=HKCU\Identities\{9745A9A1-95D3-4584-B4E8-C9C2374B3BD3}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List

[Microsoft Project 2010 *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\14.0\MS Project
RegKey1=HKCU\Software\Microsoft\Office\14.0\MS Project\Recent File List
RegKey2=HKCU\Software\Microsoft\Office\14.0\MS Project\Recent Templates

[Microsoft Reader *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Reader_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Reader_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.Reader_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.Reader_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe\SearchHistory

[Microsoft Security Essentials *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Microsoft Antimalware
Detect2=HKLM\Software\Microsoft\Microsoft Antimalware
FileKey1=%CommonAppData%\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE
FileKey2=%CommonAppData%\Microsoft\Microsoft Antimalware\Network Inspection System\Support|NisLog.txt.bak
FileKey3=%CommonAppData%\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE
FileKey4=%CommonAppData%\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log

[Microsoft Silverlight *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Silverlight
FileKey1=%LocalLowAppData%\Microsoft\Silverlight|*.*|RECURSE

[Microsoft Solitaire Collection *]
DetectOS=10.0|
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\TempState|*.*|RECURSE

[Microsoft Standalone System Sweeper Tool *]
LangSecRef=3024
Detect=HKCU\Software\Microsoft\Microsoft Standalone System Sweeper Tool
FileKey1=%CommonAppData%\Microsoft\Microsoft Standalone System Sweeper Tool\Support|*.log

[Microsoft Teams *]
LangSecRef=3021
DetectFile=%LocalAppData%\Microsoft\Teams
FileKey1=%AppData%\Microsoft\Teams|old_logs_*.txt
FileKey2=%AppData%\Microsoft\Teams\*Cache|*.*|RECURSE
FileKey3=%AppData%\Microsoft\Teams\blob_storage|*.*|RECURSE
FileKey4=%AppData%\Microsoft\Teams\databases|*.*|RECURSE
FileKey5=%AppData%\Microsoft\Teams\IndexedDB|*.*|RECURSE
FileKey6=%AppData%\Microsoft\Teams\Local Storage|*.*|RECURSE
FileKey7=%AppData%\Microsoft\Teams\Service Worker\CacheStorage|*.*|REMOVESELF
FileKey8=%AppData%\Microsoft\Teams\tmp|*.*|RECURSE
FileKey9=%LocalAppData%\Microsoft\Teams\previous|*.*|REMOVESELF

[Microsoft To Do *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Todos_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Todos_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Todos_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Todos_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Todos_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Todos_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Todos_*\TempState|*.*|RECURSE

[Microsoft Ultimate Word Games *]
Section=Games
DetectFile=%LocalAppData%\Packages\Microsoft.Studios.Wordament_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Studios.Wordament_*\TempState|*.log

[Microsoft Wi-Fi *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ConnectivityStore_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\TempState|*.*|RECURSE

[Microsoft XNA Game Studio *]
Section=Games
Detect=HKLM\Software\Microsoft\XNA
FileKey1=%ProgramFiles%\Microsoft XNA\XNA Game Studio\*\Redist|*.*|REMOVESELF

[Midori *]
LangSecRef=3022
Detect=HKLM\Software\Midori
FileKey1=%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Midori|*.*|RECURSE
FileKey2=%LocalAppData%\Midori|cookies.db;history.*;session.xbel

[Migration Wizard *]
LangSecRef=3025
DetectFile=%WinDir%\System32\migwiz\migwiz.exe
FileKey1=%LocalAppData%\MigWiz|*.*|REMOVESELF

[MiKTeX *]
LangSecRef=3021
Detect=HKCU\Software\MiKTeX.org\MiKTeX
FileKey1=%CommonAppData%\MiKTeX\*\miktex\log|*.log
FileKey2=%LocalAppData%\MiKTeX\*\miktex\log|*.log
FileKey3=%ProgramFiles%\MiKTeX\miktex\config|*.log

[MindGems Audio Dedupe *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Audio Dedupe
FileKey1=%LocalAppData%\MindGems\Audio Dedupe|*.dat;*.idx
RegKey1=HKCU\Software\MindGems\Audio Dedupe|MRU1
RegKey2=HKCU\Software\MindGems\Audio Dedupe|MRU2
RegKey3=HKCU\Software\MindGems\Audio Dedupe|MRU3
RegKey4=HKCU\Software\MindGems\Audio Dedupe|MRU4
RegKey5=HKCU\Software\MindGems\Audio Dedupe|MRU5
RegKey6=HKCU\Software\MindGems\Audio Dedupe\Settings|ExcludeExt
RegKey7=HKCU\Software\MindGems\Audio Dedupe\Settings|ExcludeFileNameWords
RegKey8=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeExt
RegKey9=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeFileNameWords
RegKey10=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeFolderNameWords
RegKey11=HKCU\Software\MindGems\Audio Dedupe\Settings|LastFolder
RegKey12=HKCU\Software\MindGems\Audio Dedupe\Settings|MoveToFolder
RegKey13=HKCU\Software\MindGems\Audio Dedupe\Settings|QuickCheckExt
RegKey14=HKCU\Software\MindGems\Audio Dedupe\Settings|QuickCheckFileNameWords

[MindGems Fast Duplicate File Finder *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Fast Duplicate File Finder
RegKey1=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU1
RegKey2=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU2
RegKey3=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU3
RegKey4=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU4
RegKey5=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU5
RegKey6=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|ExcludeExt
RegKey7=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|ExcludeFileNameWords
RegKey8=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeExt
RegKey9=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeFileNameWords
RegKey10=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeFolderNameWords
RegKey11=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|LastFolder
RegKey12=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|MoveToFolder
RegKey13=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|QuickCheckExt
RegKey14=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|QuickCheckFileNameWords

[MindGems Visual Similarity Duplicate Image Finder *]
LangSecRef=3023
Detect=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder
FileKey1=%LocalAppData%\MindGems\VSDIF|*.dat;*.idx
RegKey1=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU1
RegKey2=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU2
RegKey3=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU3
RegKey4=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU4
RegKey5=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU5
RegKey6=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|ExcludeExt
RegKey7=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|ExcludeFileNameWords
RegKey8=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeExt
RegKey9=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeFileNameWords
RegKey10=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeFolderNameWords
RegKey11=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|LastFolder
RegKey12=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|MoveToFolder
RegKey13=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|QuickCheckExt
RegKey14=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|QuickCheckFileNameWords

[Minecraft *]
Section=Games
DetectFile=%AppData%\.minecraft
FileKey1=%AppData%\.minecraft|*.log;*.log.*;nativelog.txt|RECURSE
FileKey2=%AppData%\.minecraft\crash-reports|*.*
FileKey3=%AppData%\.minecraft\debug|*.*
FileKey4=%AppData%\.minecraft\stats|*.old
FileKey5=%AppData%\java|*.*|REMOVESELF

[MiniTool Partition Wizard *]
LangSecRef=3024
Detect=HKCU\Software\MiniTool Software Limited\MiniTool Partition Wizard
FileKey1=%ProgramFiles%\MiniTool Partition Wizard *|log.txt

[Miranda IM Chat Logs *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Miranda IM
FileKey1=%AppData%\Miranda IM\Profiles\*\Logs\Chat|*.*|REMOVESELF

[Miranda IM Profiles *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Miranda IM
FileKey1=%AppData%\Miranda IM\Profiles|*.*|REMOVESELF

[mIRC *]
LangSecRef=3022
Detect=HKCU\Software\mIRC
FileKey1=%AppData%\mIRC\Logs|*.*
FileKey2=%ProgramFiles%\mIRC\logs|*.*

[Mirkes.De Tiny Hexer *]
LangSecRef=3021
Detect=HKCU\Software\mirkes.de\Tiny Hexer
FileKey1=%AppData%\mirkes.de\Tiny Hexer\*|*.bak

[Mirrors Edge Catalyst Backup *]
Section=Games
Detect=HKLM\Software\Origin Games\1026480
Warning=You will not be able to restore old profiles.
FileKey1=%Documents%\Mirrors Edge Catalyst\settings|PROF_SAVE_backup*

[MiTeC DFM Editor *]
LangSecRef=3021
Detect=HKCU\Software\MiTeC\DFM Editor
RegKey1=HKCU\Software\MiTeC\DFM Editor\5.x\Main\MRUHistory
RegKey2=HKCU\Software\MiTeC\DFM Editor\6.x\wnd_dfm_Main\Twnd_dfm_Main.MRUMan

[MiTeC HexEditor *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\HexEditor
RegKey1=HKCU\Software\MiTeC\HexEditor\4.x\wnd_hex_Main|od_InitialDir
RegKey2=HKCU\Software\MiTeC\HexEditor\4.x\wnd_hex_Main|sd_InitialDir

[MiTeC Icon Explorer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\Icon Explorer
RegKey1=HKCU\Software\MiTeC\Icon Explorer\4.x\wnd_icoexp_Main|de_Text
RegKey2=HKCU\Software\MiTeC\Icon Explorer\4.x\wnd_icoexp_Main|ShellTree_StartInFolder

[MiTeC INI Editor *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\INI Editor
RegKey1=HKCU\Software\MiTeC\INI Editor\1.0|od_InitialDir

[MiTeC SQLite Query *]
LangSecRef=3024
DetectFile=%AppData%\MiTeC\SQLite Query
FileKey1=%AppData%\MiTeC\SQLite Query|*.*|REMOVESELF

[MiTeC Structured Storage Viewer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\SSViewer
RegKey1=HKCU\Software\MiTeC\SSViewer\3.x\MRU
RegKey2=HKCU\Software\MiTeC\SSViewer\3.x\wnd_re_Main\MRUHistory
RegKey3=HKCU\Software\MiTeC\SSViewer\4.x\MRU

[MiTeC Windows Registry Analyzer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\WRA
RegKey1=HKCU\Software\MiTeC\WRA\1.x\Main\MRUHistory

[MiTeC Windows Registry File Viewer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\RFV
RegKey1=HKCU\Software\MiTeC\RFV\2.x\Recent Files

[MiTeC Windows Registry Recovery *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\WRR
RegKey1=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find|eFind_Text
RegKey2=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find\eFind_Items
RegKey3=HKCU\Software\MiTeC\WRR\1.x\Main\MRUHistory
RegKey4=HKCU\Software\MiTeC\WRR\1.x\wnd_wrr_Main\Twnd_wrr_Main.MRUMan
RegKey5=HKCU\Software\MiTeC\WRR\3.x\MRU

[MiTeC XMLViewer *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\XMLViewer
RegKey1=HKCU\Software\MiTeC\XMLViewer\4.x\wnd_xmlv_Main\Twnd_xmlv_Main.MRUManager

[Mixed Reality Portal *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MixedReality.Portal_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\TempState|*.*|RECURSE

[MixiDj Toolbar *]
LangSecRef=3022
DetectFile=%LocalLowAppData%\mixidj_v37
FileKey1=%LocalLowAppData%\mixidj_v37\logs|*.*|RECURSE

[Mixxx *]
LangSecRef=3023
DetectFile=%LocalAppData%\Mixxx
FileKey1=%LocalAppData%\Mixxx|*.log

[MKS_Vir Skaner Online *]
LangSecRef=3024
DetectFile=%ProgramFiles%\SkanerOnline
FileKey1=%ProgramFiles%\SkanerOnline\Raporty|*.*
FileKey2=%ProgramFiles%\SkanerOnline\tmp|*.*
FileKey3=%SystemDrive%|*.cpp.log

[MMOUI Minion *]
Section=Games
DetectFile=%AppData%\MMOUI\Minion
FileKey1=%AppData%\MMOUI\Minion|log.*

[Mo-Search *]
LangSecRef=3024
Detect=HKCU\Software\Meauxsoft\Mo-Search
FileKey1=%LocalAppData%\Meauxsoft\Mo-Search4.0\Logs|*.*
RegKey1=HKCU\Software\Meauxsoft\Mo-Search\Mo-Search v4.0.13\Last Position

[Mobile Broadband HL *]
LangSecRef=3021
DetectFile=%CommonAppData%\MobileBrServ
FileKey1=%CommonAppData%\MobileBrServ\log|*.*|REMOVESELF

[Mobile Plans *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.OneConnect_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalState\DiagOutputDir|*.txt
FileKey7=%LocalAppData%\Packages\Microsoft.OneConnect_*\TempState|*.*|RECURSE

[Mojo *]
LangSecRef=3022
DetectFile=%AppData%\Deusty\Mojo
FileKey1=%AppData%\Deusty\Mojo\*|*.log
FileKey2=%LocalAppData%\Deusty\Mojo|crash*.txt

[Molotov.tv *]
LangSecRef=3023
DetectFile=%AppData%\Molotov
FileKey1=%AppData%\Molotov|Cookies*;QuotaManager*
FileKey2=%AppData%\Molotov\*Cache|*.*
FileKey3=%AppData%\Molotov\databases|*.*
FileKey4=%AppData%\Molotov\IndexedDB|*.*|RECURSE
FileKey5=%LocalAppData%\Molotov|SquirrelSetup.log

[Money *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingFinance_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingFinance_*\TempState|*.*|RECURSE

[Monkey's Audio *]
LangSecRef=3023
Detect=HKCU\Software\Monkey's Audio
RegKey1=HKCU\Software\Monkey's Audio\Settings|Add Files MRU List
RegKey2=HKCU\Software\Monkey's Audio\Settings|Add Folder MRU List
RegKey3=HKCU\Software\Monkey's Audio\Settings|Output Location Directory

[Moon Hunters *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\320040
FileKey1=%ProgramFiles%\Steam\steamapps\common\Moon Hunters|log*.txt

[MoreTerra *]
Section=Games
DetectFile=%AppData%\MoreTerra
FileKey1=%AppData%\MoreTerra\Logs|*.*|RECURSE

[Morpheus *]
LangSecRef=3023
Detect=HKCU\Software\Morpheus
Warning=This will clear your shared folder and databases.
FileKey1=%ProgramFiles%\Morpheus\DB|*.*|RECURSE
FileKey2=%ProgramFiles%\Morpheus\My Shared Folder|*.*|RECURSE

[Motherboard Monitor 5 *]
LangSecRef=3023
Detect=HKCU\Software\Alexander van Kaam\MBM 5
FileKey1=%ProgramFiles%\Motherboard Monitor 5\Log|*.*|REMOVESELF

[Motorola Device Manager *]
LangSecRef=3024
Detect=HKLM\Software\Motorola
FileKey1=%AppData%\Motorola\MotoHelper|*.log
FileKey2=%CommonAppData%\Motorola\SUE|*.log
FileKey3=%ProgramFiles%\Motorola|*.log|RECURSE
FileKey4=%ProgramFiles%\Motorola Mobility\DeviceSoftwareUpdate|*.log
FileKey5=%ProgramFiles%\Motorola Mobility\Motorola Device Manager|*.log

[Motorola Device Manager Firmwares *]
LangSecRef=3024
Detect=HKLM\Software\Motorola
Warning=This will delete your Firmwares. You have to download again.
FileKey1=%CommonAppData%\Motorola\SUE\Firmwares|*.*

[Mount & Blade *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\22100
Detect2=HKCU\Software\Valve\Steam\Apps\48700
Detect3=HKCU\Software\Valve\Steam\Apps\48705
Detect4=HKCU\Software\Valve\Steam\Apps\48720
Detect5=HKLM\Software\Mount&Blade
Detect6=HKLM\Software\Mount&Blade Warband
Detect7=HKLM\Software\Mount&Blade With Fire and Sword
Detect8=HKLM\Software\Mount&Blade: Warband - Napoleonic Wars
FileKey1=%ProgramFiles%\Mount&Blade*|rgl_log.txt|RECURSE
FileKey2=%ProgramFiles%\Napoleonic Wars|rgl_log.txt|RECURSE
FileKey3=%ProgramFiles%\Steam\steamapps\common\Mount&Blade*|rgl_log.txt|RECURSE

[Mousotron *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Mousotron
FileKey1=%ProgramFiles%\Mousotron|*.log

[Movavi Photo Editor *]
LangSecRef=3022
DetectFile=%AppData%\Movavi Photo Editor*
FileKey1=%LocalAppData%\Movavi\Logs\PhotoEditor*|*.txt
FileKey2=%LocalAppData%\Movavi\Photo Editor\*\Cache|*.*|RECURSE

[Movavi Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\MOVAVI
FileKey1=%LocalAppData%\Movavi\Logs\MovaviStatistics|*.*
FileKey2=%LocalAppData%\Movavi\Logs\VideoConverter*|*.*
FileKey3=%LocalAppData%\Movavi\Video Converter*|Log.txt
FileKey4=%LocalAppData%\Movavi\Video Converter*\cache\videoconverter*\MSparkle|*.*|RECURSE
ExcludeKey1=PATH|%LocalAppData%\Movavi\Video Converter*\cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe

[Movavi Video Editor *]
LangSecRef=3022
DetectFile=%AppData%\Movavi Video Editor*
FileKey1=%LocalAppData%\Movavi\Logs\VideoEditor*|*.txt
FileKey2=%LocalAppData%\Movavi\SharedData\VideoEditor\waveforms\cache|*.*
FileKey3=%LocalAppData%\Movavi\Video Editor\Cache|*.*|RECURSE

[Movavi Video Suite *]
LangSecRef=3022
DetectFile=%AppData%\Movavi Video Suite*
FileKey1=%LocalAppData%\Movavi\Logs\VideoSuite*|*.txt
FileKey2=%LocalAppData%\Movavi\Video Suite|Log.txt
FileKey3=%LocalAppData%\Movavi\Video Suite\Cache|*.*|RECURSE

[Move Media Player *]
LangSecRef=3023
Detect=HKCU\Software\Move Media Player
FileKey1=%AppData%\Move Networks\QMCache00|*.*
FileKey2=%AppData%\Move Networks\temp|*.*

[Movie Collector - Collectorz *]
LangSecRef=3023
Detect=HKCU\Software\Collectorz.com\Movie
FileKey1=%Documents%\Movie Collector\Images|*.tmp
FileKey2=%LocalAppData%\Collectorz.com\Movie Collector\Temp\Images|*.*

[Movies & TV *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Database\anonymous|*.log
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageCache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageRetrievalFailure|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageStore|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\navigationHistory|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\PlayReady|*.*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory\SearchHistory

[MP3Gain *]
LangSecRef=3023
Detect=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis
FileKey1=%ProgramFiles%\MP3Gain|*.log
RegKey1=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|AddFilesPath
RegKey2=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|AddFolderPath
RegKey3=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|ChangeLog
RegKey4=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|ErrLog

[Mp3Rocket *]
LangSecRef=3023
DetectFile=%AppData%\Mp3Rocket
FileKey1=%AppData%\Mp3Rocket|*.cache

[Mp3tag *]
LangSecRef=3021
Detect=HKLM\Software\Florian Heidenreich\Mp3tag
FileKey1=%AppData%\Mp3tag|Mp3tagError.log

[MPEG Audio Collection *]
LangSecRef=3023
Detect=HKCU\Software\MPEG Audio Collection
RegKey1=HKCU\Software\MPEG Audio Collection|LastNameText1
RegKey2=HKCU\Software\MPEG Audio Collection|LastNameText2
RegKey3=HKCU\Software\MPEG Audio Collection|LastNameText3
RegKey4=HKCU\Software\MPEG Audio Collection|LastNameText4
RegKey5=HKCU\Software\MPEG Audio Collection|LastNameText5
RegKey6=HKCU\Software\MPEG Audio Collection|LastNameText6

[MPlayer *]
LangSecRef=3023
DetectFile=%LocalAppData%\MPlayer
FileKey1=%LocalAppData%\MPlayer|*.cache-3

[MS AntiMalware *]
LangSecRef=3025
DetectFile=%CommonAppData%\Microsoft\Microsoft antimalware
Warning=This will make MS Security Essentials think it has never run a scan.
FileKey1=%CommonAppData%\Microsoft\Microsoft antimalware\network inspection system\Support|*.log
FileKey2=%CommonAppData%\Microsoft\Microsoft antimalware\scans\history\results\Quick|*.*|REMOVESELF
FileKey3=%CommonAppData%\Microsoft\Microsoft antimalware\scans\history\results\resource|*.*|REMOVESELF
FileKey4=%CommonAppData%\Microsoft\Microsoft antimalware\scans\history\results\System|*.*|REMOVESELF
FileKey5=%CommonAppData%\Microsoft\Microsoft antimalware\support|*.log;*.txt
FileKey6=%SystemDrive%\Documents and Settings\NetworkService*\Temp|MpCmdRun.log
FileKey7=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Temp|MpCmdRun.log

[MS Backup *]
LangSecRef=3025
DetectFile=%WinDir%\System32\ntbackup.exe
FileKey1=%LocalAppData%\Microsoft\Windows NT\NTBackup\Data|*.log

[MS Baseline Security Analyzer *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Microsoft Baseline Security Analyzer
FileKey1=%LocalAppData%\Microsoft\MBSA\Cache|*.*
FileKey2=%UserProfile%\SecurityScans|*.mbsa

[MS Clip Organizer *]
LangSecRef=3025
DetectFile=%AppData%\Microsoft\Clip Organizer
FileKey1=%AppData%\Microsoft\Clip Organizer|mstore10.mgc;mstore12.mgc;mstore14.mgc;Offic10.MGC;Offic12.MGC;Offic14.Mgc

[MS Help Workshop *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Microsoft Help Workshop
RegKey1=HKCU\Software\Microsoft\Microsoft Help Workshop\Cnt Files
RegKey2=HKCU\Software\Microsoft\Microsoft Help Workshop\Forage Files
RegKey3=HKCU\Software\Microsoft\Microsoft Help Workshop\Hlp Files
RegKey4=HKCU\Software\Microsoft\Microsoft Help Workshop\Hpj Files
RegKey5=HKCU\Software\Microsoft\Microsoft Help Workshop\Map Files
RegKey6=HKCU\Software\Microsoft\Microsoft Help Workshop\Recent File List

[MS HTML Help Workshop *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\HTML Help Workshop
RegKey1=HKCU\Software\Microsoft\HTML Help Workshop\Compressed HTML
RegKey2=HKCU\Software\Microsoft\HTML Help Workshop\Html Titles
RegKey3=HKCU\Software\Microsoft\HTML Help Workshop\Project Files
RegKey4=HKCU\Software\Microsoft\HTML Help Workshop\Recent File List
RegKey5=HKCU\Software\Microsoft\HTML Help Workshop\Settings|LastProject
RegKey6=HKCU\Software\Microsoft\Microsoft HTML Help Image Editor\Folders
RegKey7=HKCU\Software\Microsoft\Microsoft HTML Help Image Editor\Recent File List

[MS IE6 Installation Temps *]
LangSecRef=3025
DetectFile1=%SystemDrive%\msdownld.tmp
DetectFile2=%WinDir%\msdownld.tmp
FileKey1=%SystemDrive%|msdownld.tmp
FileKey2=%WinDir%|msdownld.tmp

[MS Imaging *]
LangSecRef=3024
Detect=HKCU\Software\Kodak\Imaging
RegKey1=HKCU\Software\Kodak\Imaging\Recent File List

[MS Management Console *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%AppData%\Microsoft\MMC|eventvwr

[MS Netmeeting *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Conferencing
FileKey1=%ProgramFiles%\NetMeeting|CallLog.dat
RegKey1=HKCU\Software\Microsoft\Conferencing\UI\CallMRU

[MS Notepad *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Notepad
RegKey1=HKCU\Software\Microsoft\Notepad|replaceString
RegKey2=HKCU\Software\Microsoft\Notepad|searchString

[MS Office *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\11.0
Detect2=HKCU\Software\Microsoft\Office\12.0
Detect3=HKCU\Software\Microsoft\Office\14.0
Detect4=HKCU\Software\Microsoft\Office\15.0
Detect5=HKCU\Software\Microsoft\Office\16.0
FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE
FileKey2=%AppData%\Microsoft\Office|*.tmp|RECURSE
FileKey3=%AppData%\Microsoft\OIS|Toolbars.dat
FileKey4=%AppData%\Microsoft\UProof|*.bin;*.XML
FileKey5=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE
FileKey6=%LocalAppData%\Microsoft Help|*.*
FileKey7=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache
FileKey8=%LocalAppData%\Microsoft\Office\OTele|*.*|RECURSE
FileKey9=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache
FileKey10=%LocalAppData%\Microsoft\OneNote\*\cache|*.*|RECURSE
FileKey11=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\oice_*\AC\Temp|*.*|RECURSE
FileKey13=%SystemDrive%|propfix.log
FileKey14=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*.*|RECURSE
FileKey15=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution
RegKey2=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList
RegKey3=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList
RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList
RegKey5=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation
RegKey6=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations
RegKey7=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation
RegKey8=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations
RegKey9=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation
RegKey10=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations
RegKey11=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation
RegKey12=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations
RegKey13=HKCU\Software\Microsoft\Office\Common|FontBmpCache
RegKey14=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList
RegKey15=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList
RegKey16=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList
RegKey17=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList

[MS Office Recent Templates *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office
FileKey1=%AppData%\Microsoft\Templates|*.xlt;*.xltx;*.pot;*.potx;*.dot;*.dotx
RegKey1=HKCU\Software\Microsoft\Office\12.0\Common\OfficeStart\Web\Templates
RegKey2=HKCU\Software\Microsoft\Office\12.0\Excel\Recent Templates
RegKey3=HKCU\Software\Microsoft\Office\12.0\PowerPoint\Recent Templates
RegKey4=HKCU\Software\Microsoft\Office\12.0\Word\Recent Templates
RegKey5=HKCU\Software\Microsoft\Office\14.0\Common\OfficeStart\Web\Templates
RegKey6=HKCU\Software\Microsoft\Office\14.0\Excel\Recent Templates
RegKey7=HKCU\Software\Microsoft\Office\14.0\PowerPoint\Recent Templates
RegKey8=HKCU\Software\Microsoft\Office\14.0\Word\Recent Templates
RegKey9=HKCU\Software\Microsoft\Office\15.0\Common\OfficeStart\Web\Templates
RegKey10=HKCU\Software\Microsoft\Office\15.0\Excel\Recent Templates
RegKey11=HKCU\Software\Microsoft\Office\15.0\PowerPoint\Recent Templates
RegKey12=HKCU\Software\Microsoft\Office\15.0\Word\Recent Templates
RegKey13=HKCU\Software\Microsoft\Office\16.0\Common\OfficeStart\Web\Templates
RegKey14=HKCU\Software\Microsoft\Office\16.0\Excel\Recent Templates
RegKey15=HKCU\Software\Microsoft\Office\16.0\PowerPoint\Recent Templates
RegKey16=HKCU\Software\Microsoft\Office\16.0\Word\Recent Templates

[MS Office Unsaved Files *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office
FileKey1=%AppData%\Microsoft\Excel|*.*|RECURSE
FileKey2=%AppData%\Microsoft\PowerPoint|*.*|RECURSE
FileKey3=%AppData%\Microsoft\Word|*.*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Office\UnsavedFiles|*.*|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Word\|listgal.dat
ExcludeKey2=PATH|%AppData%\Microsoft\Excel\XLSTART\|*.*
ExcludeKey3=PATH|%AppData%\Microsoft\PowerPoint\|PPT*.pcb
ExcludeKey4=PATH|%AppData%\Microsoft\Word\STARTUP\|*.*

[MS OneDrive *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\OneDrive
FileKey1=%LocalAppData%\Microsoft\OneDrive\logs|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\OneDrive\setup\logs|*.*|RECURSE
FileKey3=%LocalAppData%\Microsoft\Windows\OneDrive\logs|*.*|RECURSE
FileKey4=%LocalAppData%\OneDrive\cache|*.*|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\logs|*.*|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\setup\logs|*.*|RECURSE
FileKey7=%WinDir%\System32\LogFiles\CloudFiles|*.*|RECURSE
FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\logs|*.*|RECURSE
FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\setup\logs|*.*|RECURSE

[MS PhotoDraw 2000 *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\PhotoDraw\1.0
RegKey1=HKCU\Software\Microsoft\PhotoDraw\1.0\Recent File List

[MS Robocopy GUI *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Microsoft Robocopy GUI
FileKey1=%AppData%\Microsoft Robocopy GUI\Logs|*.*
FileKey2=%ProgramFiles%\Microsoft\Microsoft Robocopy GUI\Logs|*.*

[MS Search *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex|*.*|RECURSE
FileKey2=%UserProfile%\Searches|*.search-ms;*.searchconnector-ms
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData

[MS SmallBasic *]
LangSecRef=3021
DetectFile=%LocalAppData%\SmallBasic\SB.exe.settings.catalog
FileKey1=%LocalAppData%\SmallBasic|*.*

[MS SQL Server *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Microsoft SQL Server
Detect2=HKLM\Software\Microsoft\Microsoft SQL Server
FileKey1=%ProgramFiles%\Microsoft SQL Server\*\MSSQL\Log|*ERRORLOG*;*.*|RECURSE
FileKey2=%ProgramFiles%\Microsoft SQL Server\*\Setup Bootstrap\LOG|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\FileMRUList
RegKey2=HKCU\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\ProjectMRUList
RegKey3=HKCU\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\FileMRUList
RegKey4=HKCU\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\ProjectMRUList
RegKey5=HKCU\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\FileMRUList
RegKey6=HKCU\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\ProjectMRUList
RegKey7=HKCU\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\FileMRUList
RegKey8=HKCU\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\ProjectMRUList
RegKey9=HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\FileMRUList
RegKey10=HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\ProjectMRUList
RegKey11=HKLM\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\FileMRUList
RegKey12=HKLM\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\ProjectMRUList
RegKey13=HKLM\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\FileMRUList
RegKey14=HKLM\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\ProjectMRUList
RegKey15=HKLM\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\FileMRUList
RegKey16=HKLM\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\ProjectMRUList

[MS UserScanProfiles *]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft\UserScanProfiles
FileKey1=%AppData%\Microsoft\Document Center\UserScanProfiles|*.*
FileKey2=%LocalAppData%\Microsoft\UserScanProfiles|*.*

[MS Visual Basic 2010 Express MRU *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VBExpress\10.0
RegKey1=HKCU\Software\Microsoft\VBExpress\10.0\FileMRUList
RegKey2=HKCU\Software\Microsoft\VBExpress\10.0\ProjectMRUList

[MS Visual Basic 2010 Express Search History *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VBExpress\10.0
RegKey1=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find
RegKey2=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 0
RegKey3=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 1
RegKey4=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 2
RegKey5=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 3
RegKey6=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 4
RegKey7=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 5
RegKey8=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 6
RegKey9=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 7
RegKey10=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 8
RegKey11=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 9
RegKey12=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 10
RegKey13=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 11
RegKey14=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 12
RegKey15=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 13
RegKey16=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 14
RegKey17=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 15
RegKey18=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 16
RegKey19=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 17
RegKey20=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 18
RegKey21=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 19
RegKey22=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace
RegKey23=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 0
RegKey24=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 1
RegKey25=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 2
RegKey26=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 3
RegKey27=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 4
RegKey28=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 5
RegKey29=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 6
RegKey30=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 7
RegKey31=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 8
RegKey32=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 9
RegKey33=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 10
RegKey34=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 11
RegKey35=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 12
RegKey36=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 13
RegKey37=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 14
RegKey38=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 15
RegKey39=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 16
RegKey40=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 17
RegKey41=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 18
RegKey42=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 19

[MS Visual C# 2010 Express MRU *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VCSExpress\10.0
RegKey1=HKCU\Software\Microsoft\VCSExpress\10.0\FileMRUList
RegKey2=HKCU\Software\Microsoft\VCSExpress\10.0\ProjectMRUList

[MS Visual C# 2010 Express Search History *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VCSExpress\10.0
RegKey1=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find
RegKey2=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 0
RegKey3=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 1
RegKey4=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 2
RegKey5=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 3
RegKey6=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 4
RegKey7=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 5
RegKey8=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 6
RegKey9=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 7
RegKey10=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 8
RegKey11=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 9
RegKey12=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 10
RegKey13=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 11
RegKey14=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 12
RegKey15=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 13
RegKey16=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 14
RegKey17=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 15
RegKey18=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 16
RegKey19=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 17
RegKey20=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 18
RegKey21=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 19
RegKey22=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace
RegKey23=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 0
RegKey24=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 1
RegKey25=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 2
RegKey26=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 3
RegKey27=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 4
RegKey28=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 5
RegKey29=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 6
RegKey30=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 7
RegKey31=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 8
RegKey32=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 9
RegKey33=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 10
RegKey34=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 11
RegKey35=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 12
RegKey36=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 13
RegKey37=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 14
RegKey38=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 15
RegKey39=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 16
RegKey40=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 17
RegKey41=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 18
RegKey42=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 19

[MS Visual C++ 2010 Express Backups *]
LangSecRef=3021
DetectFile=%AppData%\Microsoft\VCExpress\10.0
FileKey1=%AppData%\Microsoft\VCExpress\10.0|*.winprf_backup

[MS Visual C++ 2010 Express MRU *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VCExpress\10.0
RegKey1=HKCU\Software\Microsoft\VCExpress\10.0\FileMRUList
RegKey2=HKCU\Software\Microsoft\VCExpress\10.0\ProjectMRUList

[MS Visual C++ 2010 Express Search History *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VCExpress\10.0
RegKey1=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find
RegKey2=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 0
RegKey3=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 1
RegKey4=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 2
RegKey5=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 3
RegKey6=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 4
RegKey7=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 5
RegKey8=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 6
RegKey9=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 7
RegKey10=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 8
RegKey11=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 9
RegKey12=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 10
RegKey13=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 11
RegKey14=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 12
RegKey15=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 13
RegKey16=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 14
RegKey17=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 15
RegKey18=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 16
RegKey19=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 17
RegKey20=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 18
RegKey21=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 19
RegKey22=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace
RegKey23=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 0
RegKey24=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 1
RegKey25=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 2
RegKey26=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 3
RegKey27=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 4
RegKey28=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 5
RegKey29=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 6
RegKey30=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 7
RegKey31=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 8
RegKey32=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 9
RegKey33=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 10
RegKey34=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 11
RegKey35=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 12
RegKey36=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 13
RegKey37=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 14
RegKey38=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 15
RegKey39=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 16
RegKey40=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 17
RegKey41=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 18
RegKey42=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 19

[MS Visual C++ Library *]
LangSecRef=3031
DetectFile=%LocalAppData%\Packages\Microsoft.VCLibs.1*0.00_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\TempState|*.*|RECURSE

[MS Visual Studio *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%LocalAppData%\Microsoft\VisualStudio\SettingsLogs|*.*|RECURSE
FileKey2=%LocalAppData%\PerfWatson|*.*
FileKey3=%ProgramFiles%\Microsoft Visual Studio *\*\Logs|*.*|RECURSE

[MS Visual Studio Backups *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%Documents%\Visual Studio *\Backup Files|*.*|RECURSE

[MS Visual Studio Cache *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%LocalAppData%\Microsoft\VisualStudio\*\ComponentModelCache|*.*
FileKey2=%LocalAppData%\Microsoft\VisualStudio\*\Extensions|*.cache
FileKey3=%LocalAppData%\Microsoft\VisualStudio\*\ImageLibrary|*.cache
FileKey4=%LocalAppData%\Microsoft\VisualStudio\*\MEFCacheBackup|*.*
FileKey5=%LocalAppData%\Microsoft\VisualStudio\*\Notifications|*.cache
FileKey6=%LocalAppData%\Microsoft\VisualStudio\*\ProjectAssemblies|*.*
FileKey7=%LocalAppData%\Microsoft\VisualStudio\*\TextMateCache|*.*
FileKey8=%LocalAppData%\Microsoft\websiteCache|*.*|RECURSE
FileKey9=%LocalAppData%\NuGet\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\NuGet\v3-cache|*.*|REMOVESELF
FileKey11=%UserProfile%\.nuget|*.*|RECURSE

[MS Visual Studio Installation Packages *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
FileKey1=%CommonAppData%\Microsoft\VisualStudio\Packages|*.*|RECURSE
ExcludeKey1=PATH|%CommonAppData%\Microsoft\VisualStudio\Packages\_Instances\|*.*

[MS Visual Studio MRU *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
RegKey1=HKCU\Software\Microsoft\VisualStudio\9.0\FileMRUList
RegKey2=HKCU\Software\Microsoft\VisualStudio\9.0\LastLoadedSolution
RegKey3=HKCU\Software\Microsoft\VisualStudio\9.0\ProjectMRUList
RegKey4=HKCU\Software\Microsoft\VisualStudio\10.0\FileMRUList
RegKey5=HKCU\Software\Microsoft\VisualStudio\10.0\LastLoadedSolution
RegKey6=HKCU\Software\Microsoft\VisualStudio\10.0\ProjectMRUList
RegKey7=HKCU\Software\Microsoft\VisualStudio\11.0\FileMRUList
RegKey8=HKCU\Software\Microsoft\VisualStudio\11.0\LastLoadedSolution
RegKey9=HKCU\Software\Microsoft\VisualStudio\11.0\ProjectMRUList
RegKey10=HKCU\Software\Microsoft\VisualStudio\12.0\FileMRUList
RegKey11=HKCU\Software\Microsoft\VisualStudio\12.0\LastLoadedSolution
RegKey12=HKCU\Software\Microsoft\VisualStudio\12.0\ProjectMRUList
RegKey13=HKCU\Software\Microsoft\VisualStudio\14.0\FileMRUList
RegKey14=HKCU\Software\Microsoft\VisualStudio\14.0\LastLoadedSolution
RegKey15=HKCU\Software\Microsoft\VisualStudio\14.0\ProjectMRUList

[MS Visual Studio Search History *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\VisualStudio
RegKey1=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 0
RegKey2=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 1
RegKey3=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 2
RegKey4=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 3
RegKey5=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 4
RegKey6=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 5
RegKey7=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 6
RegKey8=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 7
RegKey9=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 8
RegKey10=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 9
RegKey11=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 10
RegKey12=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 11
RegKey13=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 12
RegKey14=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 13
RegKey15=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 14
RegKey16=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 15
RegKey17=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 16
RegKey18=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 17
RegKey19=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 18
RegKey20=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 19
RegKey21=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 0
RegKey22=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 1
RegKey23=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 2
RegKey24=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 3
RegKey25=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 4
RegKey26=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 5
RegKey27=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 6
RegKey28=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 7
RegKey29=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 8
RegKey30=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 9
RegKey31=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 10
RegKey32=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 11
RegKey33=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 12
RegKey34=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 13
RegKey35=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 14
RegKey36=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 15
RegKey37=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 16
RegKey38=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 17
RegKey39=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 18
RegKey40=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 19
RegKey41=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 0
RegKey42=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 1
RegKey43=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 2
RegKey44=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 3
RegKey45=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 4
RegKey46=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 5
RegKey47=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 6
RegKey48=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 7
RegKey49=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 8
RegKey50=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 9
RegKey51=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 10
RegKey52=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 11
RegKey53=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 12
RegKey54=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 13
RegKey55=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 14
RegKey56=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 15
RegKey57=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 16
RegKey58=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 17
RegKey59=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 18
RegKey60=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 19
RegKey61=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 0
RegKey62=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 1
RegKey63=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 2
RegKey64=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 3
RegKey65=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 4
RegKey66=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 5
RegKey67=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 6
RegKey68=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 7
RegKey69=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 8
RegKey70=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 9
RegKey71=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 10
RegKey72=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 11
RegKey73=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 12
RegKey74=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 13
RegKey75=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 14
RegKey76=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 15
RegKey77=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 16
RegKey78=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 17
RegKey79=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 18
RegKey80=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 19
RegKey81=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 0
RegKey82=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 1
RegKey83=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 2
RegKey84=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 3
RegKey85=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 4
RegKey86=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 5
RegKey87=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 6
RegKey88=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 7
RegKey89=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 8
RegKey90=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 9
RegKey91=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 10
RegKey92=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 11
RegKey93=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 12
RegKey94=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 13
RegKey95=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 14
RegKey96=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 15
RegKey97=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 16
RegKey98=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 17
RegKey99=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 18
RegKey100=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 19
RegKey101=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 0
RegKey102=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 1
RegKey103=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 2
RegKey104=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 3
RegKey105=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 4
RegKey106=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 5
RegKey107=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 6
RegKey108=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 7
RegKey109=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 8
RegKey110=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 9
RegKey111=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 10
RegKey112=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 11
RegKey113=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 12
RegKey114=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 13
RegKey115=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 14
RegKey116=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 15
RegKey117=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 16
RegKey118=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 17
RegKey119=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 18
RegKey120=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 19
RegKey121=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find
RegKey122=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 0
RegKey123=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 1
RegKey124=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 2
RegKey125=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 3
RegKey126=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 4
RegKey127=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 5
RegKey128=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 6
RegKey129=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 7
RegKey130=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 8
RegKey131=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 9
RegKey132=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 10
RegKey133=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 11
RegKey134=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 12
RegKey135=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 13
RegKey136=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 14
RegKey137=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 15
RegKey138=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 16
RegKey139=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 17
RegKey140=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 18
RegKey141=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 19
RegKey142=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace
RegKey143=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 0
RegKey144=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 1
RegKey145=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 2
RegKey146=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 3
RegKey147=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 4
RegKey148=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 5
RegKey149=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 6
RegKey150=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 7
RegKey151=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 8
RegKey152=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 9
RegKey153=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 10
RegKey154=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 11
RegKey155=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 12
RegKey156=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 13
RegKey157=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 14
RegKey158=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 15
RegKey159=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 16
RegKey160=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 17
RegKey161=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 18
RegKey162=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 19
RegKey163=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace
RegKey164=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 0
RegKey165=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 1
RegKey166=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 2
RegKey167=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 3
RegKey168=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 4
RegKey169=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 5
RegKey170=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 6
RegKey171=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 7
RegKey172=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 8
RegKey173=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 9
RegKey174=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 10
RegKey175=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 11
RegKey176=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 12
RegKey177=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 13
RegKey178=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 14
RegKey179=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 15
RegKey180=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 16
RegKey181=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 17
RegKey182=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 18
RegKey183=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 19

[MS Windows Game Statistics *]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft Games
FileKey1=%LocalAppData%\Microsoft Games|*.xml;*.xml.bak|RECURSE

[MS Works Suite 2006 *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Works\8.0
RegKey1=HKCU\Software\Microsoft\Works\8.0\Recent File List

[MS XML Notepad *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\XML Notepad
RegKey1=HKCU\Software\Microsoft\XML Notepad\Recent File List

[MSI Afterburner Hardware Monitoring *]
LangSecRef=3024
Detect=HKCU\Software\MSI
FileKey1=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml

[MSI Remind Manager *]
LangSecRef=3024
DetectFile=%ProgramFiles%\MSI\MSI Remind Manager
FileKey1=%ProgramFiles%\MSI\MSI Remind Manager|Log_reminder.txt

[MTA: San Andreas *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%CommonAppData%\MTA San Andreas All\1.*|report.log
FileKey2=%CommonAppData%\MTA San Andreas All\1.*\temp|*.*|RECURSE
FileKey3=%CommonAppData%\MTA San Andreas All\Common\Installer|nsis.log
FileKey4=%ProgramFiles%\MTA San Andreas 1.*\MTA|core.dmp;core.log
FileKey5=%ProgramFiles%\MTA San Andreas 1.*\MTA\CEF|cefdebug.txt
FileKey6=%ProgramFiles%\MTA San Andreas 1.*\MTA\dumps|*.dmp|RECURSE
FileKey7=%ProgramFiles%\MTA San Andreas 1.*\MTA\logs|*.*|RECURSE

[MTA: San Andreas Cache *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%CommonAppData%\MTA San Andreas All\1.*\upcache|*.*|RECURSE
FileKey2=%ProgramFiles%\MTA San Andreas 1.*\mods\deathmatch\resources|*.*|RECURSE
FileKey3=%ProgramFiles%\MTA San Andreas 1.*\MTA\config|servercache.xml

[MTA: San Andreas Config/Login Data *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%ProgramFiles%\MTA San Andreas 1.*\mods\deathmatch\priv|*.*|RECURSE

[MTA: San Andreas Dedicated Server *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
FileKey1=%ProgramFiles%\MTA San Andreas 1.*\server\mods\deathmatch\logs|server.log;server_auth.log;scripts.log

[MTA: San Andreas Dedicated Server Cache *]
Section=Games
Detect=HKLM\Software\Multi Theft Auto: San Andreas All
Warning=Do not clean while the server is still running.
FileKey1=%ProgramFiles%\MTA San Andreas 1.*\server\mods\deathmatch\resource-cache|*.*|RECURSE

[Multi-Edit 2008 *]
LangSecRef=3024
Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0
FileKey1=%AppData%\Multi Edit Software|*.log|RECURSE
FileKey2=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP
ExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|EVOLVE.LOG
ExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|FILEPANE.LOG
ExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|INSTALL.LOG
ExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|POLYSTYLE.LOG
ExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|TMPLPANE.LOG
ExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|WINLIST.LOG

[Multi Commander *]
LangSecRef=3024
Detect=HKLM\Software\MultiCommander
Warning=Close Multi Commander application before using this option.
FileKey1=%AppData%\MultiCommander\Logs|*.log
FileKey2=%ProgramFiles%\MultiCommander*|*Log.txt

[Multi Password Recovery *]
LangSecRef=3021
Detect=HKLM\System\CurrentControlSet\enum\root\legacy_block_reader
RegKey1=HKLM\Software\Classes\.mpf
RegKey2=HKLM\Software\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
RegKey3=HKLM\Software\Classes\MPR.DocHostUIHandler
RegKey4=HKLM\System\CurrentControlSet\enum\root\legacy_block_reader
RegKey5=HKLM\System\CurrentControlSet\Services\block_reader

[MultiBit *]
LangSecRef=3023
DetectFile=%AppData%\MultiBit
FileKey1=%AppData%\MultiBit\log|*.*

[MultiHasher *]
LangSecRef=3024
Detect=HKLM\Software\abelhadigital.com\MultiHasher
FileKey1=%ProgramFiles%\MultiHasher|*.txt;*.zip|RECURSE

[MultiViewInpaint *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\MultiViewInpaint
RegKey1=HKCU\Software\Teorex\MultiViewInpaint\Recent File List
RegKey2=HKCU\Software\Teorex\MultiViewInpaint\RecentFileList

[Mumble *]
LangSecRef=3022
Detect=HKCU\Software\Mumble
FileKey1=%AppData%\Mumble|console.txt

[Murder, She Wrote *]
Section=Games
DetectFile=%AppData%\MysteryStudio\MSW
FileKey1=%AppData%\MysteryStudio\MFW|*.log

[MuseScore *]
LangSecRef=3023
DetectFile=%LocalAppData%\MusE\MuseScore
FileKey1=%LocalAppData%\MusE\MuseScore|cookies.txt

[MusicBee *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MusicBee
FileKey1=%AppData%\MusicBee|*.dat
FileKey2=%AppData%\MusicBee\InternalCache|*.*|REMOVESELF

[MusicMatch Jukebox *]
LangSecRef=3023
Detect=HKLM\Software\MUSICMATCH\MUSICMATCH Jukebox
FileKey1=%LocalAppData%\Musicmatch\Jukebox\Cache|*.*|RECURSE
FileKey2=%ProgramFiles%\MUSICMATCH\MUSICMATCH Jukebox|*.log|RECURSE
FileKey3=%ProgramFiles%\MUSICMATCH\Musicmatch Jukebox\MMRadio\Cache|*.*|RECURSE

[MusicNet *]
LangSecRef=3023
DetectFile=%AppData%\MusicNet
FileKey1=%AppData%\MusicNet|*.log

[My Dell *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\DellInc.MyDell_htrsf667h5kn2
FileKey1=%LocalAppData%\Packages\DellInc.MyDell_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\DellInc.MyDell_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\DellInc.MyDell_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\DellInc.MyDell_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|REMOVESELF
FileKey5=%LocalAppData%\Packages\DellInc.MyDell_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\DellInc.MyDell_*\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs|*.log
FileKey7=%LocalAppData%\Packages\DellInc.MyDell_*\LocalState\Logs|*.*
FileKey8=%LocalAppData%\Packages\DellInc.MyDell_*\TempState|*.*|RECURSE

[My Family Tree *]
LangSecRef=3021
DetectFile=%LocalAppData%\My Family Tree
FileKey1=%LocalAppData%\My Family Tree\MapCache|*.*|RECURSE
FileKey2=%LocalAppData%\My Family Tree\Temp|*.*|RECURSE

[My Horse and Me *]
Section=Games
Detect=HKLM\Software\My Horse and Me 2
FileKey1=%ProgramFiles%\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey2=%ProgramFiles%\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey3=%ProgramFiles%\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE

[My Movies Collection *]
LangSecRef=3023
DetectFile=%CommonAppData%\My Movies
FileKey1=%CommonAppData%\My Movies|vc*redist*.*;installerlog.txt;log.txt
FileKey2=%CommonAppData%\My Movies\File Storage\Temp|*.*|RECURSE
FileKey3=%CommonAppData%\My Movies\Temp|*.*|RECURSE

[My Riding Stables *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyRidingStables
FileKey1=%ProgramFiles%\My Riding Stables*|*.txt;*.url

[My Singing Monsters *]
Section=Games
Detect1=HKLM\Software\Big Fish Games\Persistence\Install\F7664T1L1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\My Singing Monsters1.1
DetectFile=%ProgramFiles%\My Singing Monsters
FileKey1=%ProgramFiles%\*\My Singing Monsters|dotnetfx35setup.exe;*.html;*.PNG;vc*redist*.exe;*.log;*.txt|RECURSE
FileKey2=%ProgramFiles%\My Singing Monsters|dotnetfx35setup.exe;vc*redist*.exe;*.log;*.txt|RECURSE

[My ViewPad *]
LangSecRef=3023
DetectFile=%ProgramFiles%\My ViewPad
FileKey1=%ProgramFiles%\My ViewPad|ICP_MyViewPad.ini

[MyCraft *]
Section=Games
DetectFile=%UserProfile%\Desktop\MyCraft
FileKey1=%UserProfile%\Desktop\MyCraft|MyCraft Log.*

[MyDefrag *]
LangSecRef=3021
Detect=HKCU\Software\MyDefrag
FileKey1=%ProgramFiles%\MyDefrag *|*.log
FileKey2=%ProgramFiles%\MyDefrag *\LOGs|*.*

[MyPC Backup *]
LangSecRef=3022
DetectFile=%ProgramFiles%\MyPC Backup
FileKey1=%ProgramFiles%\MyPC Backup\log|*.*

[MyPhoneExplorer *]
LangSecRef=3024
Detect=HKCU\Software\MyPhoneExplorer
FileKey1=%AppData%\MyPhoneExplorer|Debug.txt

[MySMS *]
LangSecRef=3022
Detect=HKCU\Software\sms.at\mysms
FileKey1=%LocalAppData%\sms.at\mysms\LocalStorage|*.*
RegKey1=HKCU\Software\sms.at\mysms\cookies

[MySpaceIM *]
LangSecRef=3022
Detect=HKCU\Software\Myspace\IM
FileKey1=%AppData%\MySpace\IM\Dump|*.*
FileKey2=%AppData%\MySpace\IM\Images|*.*

[MySQL Workbench *]
LangSecRef=3021
DetectFile=%AppData%\MySQL\Workbench
FileKey1=%AppData%\MySQL\Workbench\cache|*.*
FileKey2=%AppData%\MySQL\Workbench\log|*.log
FileKey3=%AppData%\MySQL\Workbench\sql_history|*.*

[MyToolkit *]
LangSecRef=3024
Detect=HKCU\Software\FutureFog\MyToolkit\Options
RegKey1=HKCU\Software\FutureFog\MyToolkit\Options|LastUsedFolder

[myTube! *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\59750RYKENAPPS.435307C335C44_zd92nzxdcatqw
FileKey1=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\LocalState\YouTubeCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\TempState|*.*|RECURSE

[MyWinLocker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\EgisTec\mywinlocker 3
FileKey1=%LocalAppData%|mywinlockerinstaller.*
FileKey2=%ProgramFiles%\EgisTec\MyWinLocker 3\log|*.*

[Nancy Drew: The Secret of Shadow Ranch *]
Section=Games
Detect1=HKLM\Software\Big Fish Games\Persistence\Install\F7041T1L1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Nancy Drew - Secret of Shadow Ranch - Plus Guide1.0
DetectFile=%ProgramFiles%\Nancy Drew*
FileKey1=%ProgramFiles%\*\Nancy Drew*|dxwebsetup.exe;*.html
FileKey2=%ProgramFiles%\Nancy Drew*|dxwebsetup.exe;*.html

[Natural Selection 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\4920
DetectFile=%ProgramFiles%\Steam\steamapps\common\Natural Selection 2
Warning=Fixes corrupt cache and cleans cache bloat. The first game and map launch will take longer to load.
FileKey1=%AppData%\Natural Selection 2|log.txt
FileKey2=%AppData%\Natural Selection 2\cache|*.*|RECURSE

[NaturalReader Free 12 *]
LangSecRef=3021
Detect=HKLM\Software\Naturalreaderfree
FileKey1=%Documents%\Naturalsoft|nrtemp.txt
FileKey2=%Documents%\Naturalsoft\log|*.*|RECURSE
FileKey3=%ProgramFiles%\Naturalsoft\Free12\log|*.*

[NaturalReader Free 12 Setup Files *]
LangSecRef=3021
Detect=HKLM\Software\Naturalreaderfree
FileKey1=%Documents%\Naturalsoft|*.msi|RECURSE

[NBC News *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\msnbc.comDigitalNetwork.msnbc.com_amdjbdaxqsje6
FileKey1=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Microsoft\CLR_v4.0|*.log
FileKey3=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\TempState|*.*|RECURSE

[Neostar CMS Station Client *]
LangSecRef=3024
Detect=HKLM\Software\company\Neostar CMS
FileKey1=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\log|*.*
FileKey2=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\StreamServer|*.log
FileKey3=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\StreamServer\log|*.*

[Nero *]
LangSecRef=3021
Detect1=HKCU\Software\Ahead
Detect2=HKCU\Software\Nero
FileKey1=%AppData%\Nero|NeroHistory.log
FileKey2=%AppData%\Nero\Nero Burning ROM|*.log
FileKey3=%AppData%\Nero\Nero Start\cefcache.1|*.ldb;*.log;Cookies*;CURRENT;LOCK;LOG;LOG.old;MANIFEST-*;QuotaManager*;Visited Links
FileKey4=%AppData%\Nero\Nero Start\cefcache.1\*Cache|*.*|RECURSE
FileKey5=%AppData%\Nero\Nero Start\cefcache.1\IndexedDB|*.*|RECURSE
FileKey6=%AppData%\Nero\Nero Start\cefcache.1\Local Storage\leveldb|*.*
FileKey7=%AppData%\Nero\Nero Start\cefcache.1\Session Storage|*.*|RECURSE
FileKey8=%AppData%\Nero\Nero Start\logs|*.*|RECURSE
FileKey9=%AppData%\Nero\Nero Start\temp|*.*|RECURSE
FileKey10=%AppData%\Nero\Nero*\Nero BackItUp\Cache|*.*
FileKey11=%AppData%\Nero\Nero*\Nero Burning ROM|*.log
FileKey12=%AppData%\Nero\Nero*\Nero Recode\AnalysisData|*.dat
FileKey13=%AppData%\Nero\Nero*\Nero Recode\Thumbs|*.*
FileKey14=%AppData%\Nero\Nero*\Nero Vision|*.txt;*.bin
FileKey15=%AppData%\Nero\Nero*\Nero Vision\NVFACache|*.*
FileKey16=%AppData%\Nero\Nero*\Nero3D|*.log
FileKey17=%CommonAppData%\Nero\Nero BackItUp*\Cache|*.*
FileKey18=%CommonAppData%\Nero\PeakFiles|*.tmp
FileKey19=%LocalAppData%\Nero\Nero *\Nero Vision\Cache|*.*
FileKey20=%LocalAppData%\Nero\Nero *\Nero Vision\Cache\GraphicObjectCache|*.*
FileKey21=%LocalAppData%\Nero\NeroKnowHowPLUS|*.log
FileKey22=%LocalAppData%\Nero\NeroKnowHowPLUS\*|*.cache
RegKey1=HKCU\Software\ahead\Nero PhotoSnap\Recent File List
RegKey2=HKCU\Software\Ahead\NeroSearch\NeroSavedSearches\SavedSearches
RegKey3=HKCU\Software\ahead\NeroVision\2.0\RecentFiles
RegKey4=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelAutoTemplate
RegKey5=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelISOTemplate
RegKey6=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumelabelJolietTemplate
RegKey7=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelUDFTemplate
RegKey8=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Recent File List
RegKey9=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|EncodingLastDir
RegKey10=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|NeroCompilation
RegKey11=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|TrackSaveDir
RegKey12=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|WorkingDir
RegKey13=HKCU\Software\Nero\Nero 11\Nero CoverDesigner\Recent File List
RegKey14=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelAutoTemplate
RegKey15=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelISOTemplate
RegKey16=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumelabelJolietTemplate
RegKey17=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelUDFTemplate
RegKey18=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastAudioDir
RegKey19=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastISODir
RegKey20=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastVideoDVDKey
RegKey21=HKCU\Software\Nero\Nero 11\Nero Express\Recent File List
RegKey22=HKCU\Software\Nero\Nero 11\Nero Express\Settings|BootImageDir
RegKey23=HKCU\Software\Nero\Nero 11\Nero Express\Settings|BrowserDir
RegKey24=HKCU\Software\Nero\Nero 11\Nero Express\Settings|ImageDir
RegKey25=HKCU\Software\Nero\Nero 11\Nero Express\Settings|NeroCompilation
RegKey26=HKCU\Software\Nero\Nero 11\Nero Express\Settings|TrackSaveDir
RegKey27=HKCU\Software\Nero\Nero 11\Nero Express\Settings|WorkingDir
RegKey28=HKCU\Software\Nero\Nero 11\Nero Toolkit\DiscSpeed\Capture|Folder
RegKey29=HKCU\Software\Nero\Nero 11\Nero Toolkit\DiscSpeed\Save|Folder
RegKey30=HKCU\Software\Nero\Nero 11\Nero Vision\Application|AudioDir
RegKey31=HKCU\Software\Nero\Nero 11\Nero Vision\Application|CaptureDir
RegKey32=HKCU\Software\Nero\Nero 11\Nero Vision\Application|DocDir
RegKey33=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ExportAudioDir
RegKey34=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ExportVideoDir
RegKey35=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ImportVideoDir
RegKey36=HKCU\Software\Nero\Nero 11\Nero Vision\Application|MediaDir
RegKey37=HKCU\Software\Nero\Nero 11\Nero Vision\Application|PicDir
RegKey38=HKCU\Software\Nero\Nero 11\Nero Vision\Application|PicSaveDir
RegKey39=HKCU\Software\Nero\Nero 11\Nero Vision\Application|TmpDir
RegKey40=HKCU\Software\Nero\Nero 11\Nero Vision\Application|VideoDir
RegKey41=HKCU\Software\Nero\Nero 11\Nero WaveEditor\Directories|Last
RegKey42=HKCU\Software\Nero\Nero 11\Nero WaveEditor\Recent File List
RegKey43=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelAutoTemplate
RegKey44=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelISOTemplate
RegKey45=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumelabelJolietTemplate
RegKey46=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelUDFTemplate
RegKey47=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|EncodingLastDir
RegKey48=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|TrackSaveDir
RegKey49=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|WorkingDir
RegKey50=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelAutoTemplate
RegKey51=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelISOTemplate
RegKey52=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumelabelJolietTemplate
RegKey53=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelUDFTemplate
RegKey54=HKCU\Software\Nero\Nero 12\Nero Express\Settings|BootImageDir
RegKey55=HKCU\Software\Nero\Nero 12\Nero Express\Settings|ImageDir
RegKey56=HKCU\Software\Nero\Nero 12\Nero Express\Settings|NeroCompilation
RegKey57=HKCU\Software\Nero\Nero 12\Nero Express\Settings|TrackSaveDir
RegKey58=HKCU\Software\Nero\Nero 12\Nero Toolkit\DiscSpeed\Capture|Folder
RegKey59=HKCU\Software\Nero\Nero 12\Nero Toolkit\DiscSpeed\Save|Folder
RegKey60=HKCU\Software\Nero\Nero 12\Nero Vision\Application|AudioDir
RegKey61=HKCU\Software\Nero\Nero 12\Nero Vision\Application|CaptureDir
RegKey62=HKCU\Software\Nero\Nero 12\Nero Vision\Application|DocDir
RegKey63=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ExportAudioDir
RegKey64=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ExportVideoDir
RegKey65=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ImportVideoDir
RegKey66=HKCU\Software\Nero\Nero 12\Nero Vision\Application|MediaDir
RegKey67=HKCU\Software\Nero\Nero 12\Nero Vision\Application|PicDir
RegKey68=HKCU\Software\Nero\Nero 12\Nero Vision\Application|PicSaveDir
RegKey69=HKCU\Software\Nero\Nero 12\Nero Vision\Application|TmpDir
RegKey70=HKCU\Software\Nero\Nero 12\Nero Vision\Application|VideoDir
RegKey71=HKCU\Software\Nero\Nero 12\Nero WaveEditor\Directories|Last
RegKey72=HKCU\Software\Nero\Nero Blu-ray Player\Settings|DefFolder
RegKey73=HKCU\Software\Nero\Nero8\Cover Designer\Recent File List
RegKey74=HKCU\Software\Nero\Nero8\Nero - Burning Rom\Recent File List

[Net Vampire *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Net Vampire
FileKey1=%ProgramFiles%\Net Vampire\Data\Jobs|*.*|RECURSE
FileKey2=%ProgramFiles%\Net Vampire\Data\Sites|*.*|RECURSE
FileKey3=%ProgramFiles%\Net Vampire\Data\State|*.*|RECURSE

[Net2Printer RDP *]
LangSecRef=3021
DetectFile=%AppData%\Net2Printer RDP Client
FileKey1=%AppData%\Net2Printer RDP Client|*.*

[NetAnts *]
LangSecRef=3022
DetectFile=%ProgramFiles%\NetAnts
FileKey1=%ProgramFiles%\NetAnts|netants.job;history.txt

[NetBeans IDE *]
LangSecRef=3021
DetectFile1=%AppData%\NetBeans
DetectFile2=%UserProfile%\.nbi\log
FileKey1=%AppData%\NetBeans\*\var\log|*.*|RECURSE
FileKey2=%UserProfile%\.nbi\log|*.log|RECURSE

[NetCaptor *]
LangSecRef=3022
Detect=HKCU\Software\Stilesoft\NetCaptor
RegKey1=HKCU\Software\Stilesoft\NetCaptor\CurrentVersion\Last Open Sites

[Netflix *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\4DF9E0F8.Netflix_mcm4njqhnhss8
FileKey1=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\BackgroundTransferApi|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\INet*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|REMOVESELF
FileKey7=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\PRICache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Temp|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AppData\Indexed DB|*.log
FileKey10=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalCache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalState|*.tmp
FileKey12=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalState\LiveTile|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\4DF9E0F8.Netflix_mcm4njqhnhss8\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\Internet Explorer\DOMStore\*\|www.netflix[1].xml

[NETGEAR Genie *]
LangSecRef=3024
Detect=HKLM\Software\NETGEAR Genie
FileKey1=%LocalAppData%\NETGEARGenie|*.txt
FileKey2=%LocalAppData%\NETGEARGenie\log|*.log
FileKey3=%LocalAppData%\NETGEARGenie\update_temp|*.*

[NetLimiter *]
LangSecRef=3022
Detect=HKCU\Software\LockTime\NetLimiter
RegKey1=HKCU\Software\LockTime\NetLimiter\Recent File List

[Network Speed Test *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.NetworkSpeedTest_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey3=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\TempState|*.*|RECURSE

[Neverwinter *]
Section=Games
Detect=HKCU\Software\Cryptic\Neverwinter
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios|*.log|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios\localdata|_SWMWindowPosList.txt
FileKey3=%Public%\Games\Cryptic Studios|*.log|RECURSE
FileKey4=%Public%\Games\Cryptic Studios\localdata|_SWMWindowPosList.txt

[New Yankee in Santa's Service *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\New Yankee 3 - In Santas ServiceFinal
FileKey1=%AppData%\AlawarEntertainment|*_log.html|RECURSE
FileKey2=%ProgramFiles%\New Yankee 3 - In Santas Service|*.nfo

[News for CNN *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\65465Fetisenko.NewsReaderforCNN_806cg6g6fmyng
FileKey1=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\AC\AppCache\*|*.*|REMOVESELF
FileKey2=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\AC\INet*\*|*.*|REMOVESELF
FileKey3=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|REMOVESELF
FileKey5=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\AC\TokenBroker\Cache|*.*|REMOVESELF
FileKey7=%LocalAppData%\Packages\65465Fetisenko.NewsReaderforCNN_*\TempState|*.*|RECURSE

[Newsbin Pro *]
LangSecRef=3021
Detect1=HKCU\Software\DJI Interprises\Newsbin Pro
Detect2=HKCU\Software\DJI Interprises\Newsbin50
DetectFile=%LocalAppData%\Newsbin
FileKey1=%LocalAppData%\Newsbin|Logfile.txt;Downloaded.db3;DownloadMarker.db3;Downloads.db3*
FileKey2=%LocalAppData%\Newsbin\SPOOL_V6|*.*
FileKey3=%LocalAppData%\Newsbin\temp|*.*
RegKey1=HKCU\Software\DJI Interprises\Newsbin Pro\FilterHistory
RegKey2=HKCU\Software\DJI Interprises\Newsbin Pro\Recent File List

[Newsleecher Backups *]
LangSecRef=3021
DetectFile=%AppData%\Newsleecher\Backups
FileKey1=%AppData%\Newsleecher\Backups|*.*

[neXBC *]
LangSecRef=3022
DetectFile=%ProgramFiles%\neXBC\neXBC.exe
FileKey1=%ProgramFiles%\neXBC|messages.txt
FileKey2=%ProgramFiles%\neXBC\Logs\Hosted|*.*
FileKey3=%ProgramFiles%\neXBC\Logs\Joined|*.*

[NextSecurity GetKey *]
LangSecRef=3024
Detect=HKCU\Software\NextSecurity\GetKey
RegKey1=HKCU\Software\NextSecurity\GetKey\Recent File List

[Nextup TextAloud *]
LangSecRef=3021
Detect=HKCU\Software\NextUpTech\TextAloud3
FileKey1=%LocalAppData%\NextUp\TextAloud|*.adu;*.adl;*.dbg
FileKey2=%LocalAppData%\NextUp\TextAloud\Articles|*.*|RECURSE
RegKey1=HKCU\Software\NextUpTech\TextAloud3|AudioClipFileOpenDirectory
RegKey2=HKCU\Software\NextUpTech\TextAloud3|DocFileOpenDirectory

[Nexus Mod Manager *]
Section=Games
DetectFile=%Documents%\Nexus Mod Manager
FileKey1=%Documents%\Nexus Mod Manager|*.txt

[Nicotine+ *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Nicotine+\Nicotine+.exe
FileKey1=%AppData%\nicotine|*.backup;*.bak;*.old|RECURSE
FileKey2=%AppData%\nicotine\logs|*.*|RECURSE
FileKey3=%LocalAppData%|recently-used.xbel

[Nidhogg *]
Section=Games
DetectFile=%AppData%\Nidhogg
FileKey1=%AppData%\Nidhogg|*.log

[Nikon Capture NX2 *]
LangSecRef=3023
Detect=HKLM\Software\Nikon\Capture NX 2
FileKey1=%LocalAppData%\Nikon\Capture NX\ThumbnailCache|*.*|RECURSE

[Nikon ViewNX 2 Pic Viewer *]
LangSecRef=3023
Detect=HKLM\Software\Nikon\MCA2\ViewNX 2
FileKey1=%LocalAppData%\Nikon\mPT\*\CacheData\Original|*.*
FileKey2=%LocalAppData%\Nikon\mPT\*\CacheData\Others|*.*
FileKey3=%LocalAppData%\Nikon\mPT\*\CacheData\Screen|*.*
FileKey4=%LocalAppData%\Nikon\mPT\*\CacheData\Thumbnail|*.*
FileKey5=%LocalAppData%\Nikon\ViewNX 2\Cache|*.*

[Nimbuzz *]
LangSecRef=3022
Detect=HKCU\Software\Nimbuzz
FileKey1=%AppData%\nimbuzz|*.log

[NirSoft AddrView LastUrlAddr *]
LangSecRef=3024
Detect=HKCU\Software\NirSoft\AddrView
RegKey1=HKCU\Software\NirSoft\AddrView|LastUrlAddr

[NirSoft RegistryChangesView Snapshots *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NirSoft\RegistryChangesView.exe
FileKey1=%ProgramFiles%\NirSoft\RegSnapshot*|*.*|REMOVESELF
FileKey2=%ProgramFiles%\NirSoft\x64\RegSnapshot*|*.*|REMOVESELF

[NirSoft RegScanner *]
LangSecRef=3024
Detect=HKCU\Software\NirSoft\RegScanner
RegKey1=HKCU\Software\NirSoft\RegScanner|BaseKey
RegKey2=HKCU\Software\NirSoft\RegScanner|ExcludeList
RegKey3=HKCU\Software\NirSoft\RegScanner|Find
RegKey4=HKCU\Software\NirSoft\RegScanner|RemoteComputer
RegKey5=HKCU\Software\NirSoft\RegScanner|TimeFrom
RegKey6=HKCU\Software\NirSoft\RegScanner|TimeTo

[NirSoft RegScanner Reports *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft RegScanner
DetectFile=%ProgramFiles%\Nirsoft\regscanner.exe
FileKey1=%ProgramFiles%\NirSoft|report.html
FileKey2=%ProgramFiles%\NirSoft\x64|report.html

[Nitro PDF Reader *]
LangSecRef=3024
Detect=HKCU\Software\Nitro PDF\Reader
FileKey1=%AppData%\Nitro|*.log*;*Log.txt*|RECURSE
RegKey1=HKCU\Software\Nitro PDF\Reader\1.0\Recent File List
RegKey2=HKCU\Software\Nitro PDF\Reader\2.0\Recent File List

[Nitrous Backups *]
Section=Games
DetectFile=%AppData%\.nitrous
FileKey1=%AppData%\.nitrous\backups|*.*|REMOVESELF

[nLite *]
LangSecRef=3024
DetectFile=%ProgramFiles%\nLite
FileKey1=%ProgramFiles%\nLite\Presets|*.*

[No-IP DUC *]
LangSecRef=3022
Detect=HKCU\Software\Vitalwerks\DUC
FileKey1=%CommonAppData%\Vitalwerks\DUC|*.log
FileKey2=%LocalAppData%\Vitalwerks\DUC|*.log

[NodeSoft FileVer *]
LangSecRef=3024
Detect=HKLM\Software\NodeSoft\FileVer
RegKey1=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunFile
RegKey2=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunPath
RegKey3=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunTime

[Nokia Music Player *]
LangSecRef=3023
DetectFile=%LocalAppData%\Nokia\Nokia Music*
FileKey1=%LocalAppData%\Nokia\Nokia Music*|*.log

[Nokia Software Updater *]
LangSecRef=3021
Detect1=HKCU\Software\Nokia\NSU3
Detect2=HKLM\Software\Nokia\Nokia Suite
DetectFile1=%CommonAppData%\Nokia\Nokia Service Layer\A
DetectFile2=%CommonProgramFiles%\Nokia\Service Layer\A
Warning=This will remove Nokia phone firmwares, applications and other files stored by Nokia Suite Updater. Files will be re-downloaded when updating phone.
FileKey1=%CommonAppData%\Nokia\Nokia Service Layer\A|*.*|REMOVESELF
FileKey2=%CommonProgramFiles%\Nokia\Service Layer\A|*.*|REMOVESELF
FileKey3=%LocalAppData%\Nokia\NSU3\NOSSU2|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Nokia\NSU3\NOSSU2\|usergroups.cfg
ExcludeKey2=PATH|%LocalAppData%\Nokia\NSU3\NOSSU2\Flash\|*.*

[Nokia Suite Installer *]
LangSecRef=3021
DetectFile=%CommonAppData%\NokiaInstallerCache
FileKey1=%CommonAppData%\NokiaInstallerCache\PackageCache|*.*|RECURSE

[NordVPN *]
LangSecRef=3024
DetectFile=%LocalAppData%\NordVPN
FileKey1=%LocalAppData%\NordVPN\logs|*.*

[Norman Security Suite *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Norman
FileKey1=%ProgramFiles%\Norman|*.log
FileKey2=%ProgramFiles%\Norman\Download|*.*
FileKey3=%ProgramFiles%\Norman\Logs|*.*
FileKey4=%ProgramFiles%\Norman\Temp|*.*

[Norton *]
LangSecRef=3024
DetectFile=%CommonAppData%\Norton
FileKey1=%CommonAppData%\Norton|*.log;*.txt
FileKey2=%CommonAppData%\Norton\LocalDumps|*.dmp
FileKey3=%CommonAppData%\NortonInstaller\Logs|*.*|RECURSE
FileKey4=%CommonAppData%\VPNService|*.log

[Norton Online Backup *]
LangSecRef=3024
DetectFile=%CommonAppData%\Symantec\Norton Online Backup
FileKey1=%CommonAppData%\Symantec\Norton Online Backup|*.log.txt;*.log|RECURSE

[Norton Power Eraser *]
LangSecRef=3024
DetectFile=%CommonAppData%\Norton\NPE\NPEsettings.dat
Warning=This removes all files of Norton Power Eraser. This tool should be re-downloaded from Symantec after each run.
FileKey1=%CommonAppData%\Norton\NPE|*.*|REMOVESELF
FileKey2=%LocalAppData%\NPE|*.*|REMOVESELF
FileKey3=%UserProfile%\Desktop|NPE.exe

[Norton Utilities *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Norton Utilities*
FileKey1=%AppData%\Norton Utilities *\cleanreports|pgscan_*.html
FileKey2=%AppData%\Norton Utilities\log|pgscan_*.html

[Notepad++ *]
LangSecRef=3021
Detect=HKLM\Software\Notepad++
FileKey1=%AppData%\Notepad++\plugins\config\plugin_install_temp|*.*|REMOVESELF

[Notifications *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog

[NowSmart Cut *]
LangSecRef=3023
Detect=HKLM\Software\NowSmart\Cut
FileKey1=%LocalAppData%\Cut|log.txt;*.dmp

[Nox *]
LangSecRef=3024
Detect=HKLM\Software\BigNox
DetectFile=%UserProfile%\.BigNox
FileKey1=%LocalAppData%\Nox|Nox.log.*;*.log
FileKey2=%UserProfile%\.BigNox|*.log;*.log.*
FileKey3=%UserProfile%\vmlogs|Nox.log;Nox.log.*

[Npcap Loopback Adapter *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Npcap
FileKey1=%ProgramFiles%\NpCap|*.log|RECURSE

[NSIS *]
LangSecRef=3021
Detect=HKLM\Software\NSIS
RegKey1=HKLM\Software\NSIS\MRU

[NT Registry Optimizer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NT Registry Optimizer\NTREGOPT.EXE
FileKey1=%LocalAppData%\Microsoft\Windows|UsrClass.bak
FileKey2=%WinDir%\ServiceProfiles\LocalService|NTUSER.bak
FileKey3=%WinDir%\ServiceProfiles\NetworkService|NTUSER.bak
FileKey4=%WinDir%\System32\config|COMPONENTS.bak;SYSTEM.bak;DEFAULT.bak;SAM.bak;SECURITY.bak;Software.bak

[NTI Backup Now *]
LangSecRef=3024
DetectFile=%ProgramFiles%\New Tech Infosystems\NTI Backup Now 5
FileKey1=%ProgramFiles%\New Tech Infosystems\NTI Backup Now 5\logs|*.*

[Nuance Dragon Natually Speaking 12 *]
LangSecRef=3021
Detect=HKCU\Software\ScanSoft\NaturallySpeaking12
FileKey1=%AppData%\Nuance\NaturallySpeaking12\RIA|*DragonNatuallySpeakingRIA_IE_Shim_log_*.txt

[Nuclear Dawn Cache *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\config\html|*.*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\cache|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\downloads|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\temp|*.vtf|RECURSE

[Nuclear Dawn Custom Content *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*corner*;*roadwork*;*rock*;*frost*;*mars*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\models|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\sprites|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\models|*.*|RECURSE
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\sound\quake|*.*|RECURSE

[Nuclear Dawn Developer Files *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
Warning=This will remove content used by game, map and community developers.
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\bin|*bsp*;*vtex*;SDKLauncher.exe;modelbrowser.exe|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*example*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps\ai_data|nd_codetest.nav|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\scripted_props|*.*|REMOVESELF
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\units|*.*|REMOVESELF
FileKey6=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\vehicles|*.*|REMOVESELF
FileKey7=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\platform\AddOns|*.*|RECURSE
FileKey8=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\sdk_content|*.*|REMOVESELF
FileKey9=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\sdk_tools|*.*|REMOVESELF

[Nuclear Dawn Mac/Linux Binaries *]
DetectOS=6.0|
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
Warning=This will remove mac and linux binaries.
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\bin|client.so;client.dylib|RECURSE

[Nuclear Dawn SK Gamemode *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
Warning=Redownload of skrimish gamemode required to play. Not supported by all servers.
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*sk_*|RECURSE

[Nuclear Dawn Tutorials *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17710
Warning=This will prevent running of Nuclear Dawn Tutorials but will free over 850MB of disk space.
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*training*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps\ai_data|*training*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\media|*tutorial*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\sound\voices\tutorial|*.*|REMOVESELF

[NVIDIA *]
LangSecRef=3024
Detect=HKLM\Software\NVIDIA Corporation
FileKey1=%AppData%\NVIDIA\*Cache|*.*|RECURSE
FileKey2=%CommonAppData%|DisplaySessionContainer*.log;DisplaySessionContainer*.log_backup*;NvcDispCorePlugin.log;NvcDispCorePlugin.log_backup*;NVDisplay.ContainerLocalSystem.log;NVDisplay.ContainerLocalSystem.log_backup*;NVDisplayContainerWatchdog.log;NVDisplayContainerWatchdog.log_backup*
FileKey3=%CommonAppData%\NVIDIA|*.bak;*.log*;Resource.old|RECURSE
FileKey4=%CommonAppData%\NVIDIA Corporation|*.log;*bak;*log.*;*.old;*.stat|RECURSE
FileKey5=%CommonAppData%\NVIDIA Corporation\Downloader|*.*|RECURSE
FileKey6=%CommonAppData%\NVIDIA Corporation\GeForce Experience\Update|*.*|RECURSE
FileKey7=%CommonAppData%\NVIDIA Corporation\NV_Cache|*.*
FileKey8=%CommonAppData%\NVIDIA Corporation\NvFBCPlugin|log*.txt
FileKey9=%CommonAppData%\NVIDIA\NvBackend\Updatus\DownloadManager|*.*
FileKey10=%CommonAppData%\NVIDIA\Updatus|*.bak;*.log
FileKey11=%CommonAppData%\NVIDIA\Updatus\DownloadManager|*.*
FileKey12=%LocalAppData%\NVIDIA Corporation|*.log;*.bak;*.old|RECURSE
FileKey13=%LocalAppData%\NVIDIA Corporation\*\CefCache|Cookies*;QuotaManager*
FileKey14=%LocalAppData%\NVIDIA Corporation\*\CefCache\*Cache|*.*|RECURSE
FileKey15=%LocalAppData%\NVIDIA Corporation\NV_Cache|*.*
FileKey16=%LocalAppData%\NVIDIA\NvBackend|*.log;*.bak
FileKey17=%LocalAppData%\Packages\*\AC\*\NVIDIA Corporation\NV_Cache|*.*
FileKey18=%LocalAppData%\Packages\*\AC\NVIDIA Corporation\NV_Cache|*.*
FileKey19=%ProgramFiles%\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs|*.*
FileKey20=%SystemDrive%\NvidiaLogging\GFExperience|GridClientLog.log*|RECURSE
ExcludeKey1=PATH|%LocalAppData%\NVIDIA Corporation\*\CefCache\IndexedDB\|*.log

[O&O Defrag *]
LangSecRef=3024
Detect=HKCU\Software\O&O\O&O Defrag
FileKey1=%Documents%\O&O\O&O Defrag\data\reports|*.*|RECURSE

[O&O SafeErase *]
LangSecRef=3024
Detect=HKCU\Software\O&O\O&O SafeErase\7
FileKey1=%Documents%\O&O\O&O SafeErase\7\Reports|*.html
RegKey1=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisAdditionalErrorMessage
RegKey2=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisDateTime
RegKey3=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisReportPath
RegKey4=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisResultString

[OBS *]
LangSecRef=3023
DetectFile1=%AppData%\OBS
DetectFile2=%AppData%\obs-studio
FileKey1=%AppData%\OBS|*.log|RECURSE
FileKey2=%AppData%\OBS\crashDumps|*.*
FileKey3=%AppData%\obs-studio\crashes|*.*
FileKey4=%AppData%\obs-studio\logs|*.*
FileKey5=%AppData%\obs-studio\profiler_data|*.*

[Observer *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\514900
FileKey1=%LocalAppData%\TheObserver\Saved\Logs|*.*

[Observer Cache *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\514900
FileKey1=%AppData%\Aspyr Media\Game Guide 3\Cache|*.*|RECURSE

[OcenAudio MRU *]
LangSecRef=3023
Detect1=HKCU\Software\OcenAudio
Detect2=HKLM\Software\OcenAudio
FileKey1=%LocalAppData%\OcenAudio|ocen.database

[Octoshape *]
LangSecRef=3023
DetectFile=%LocalAppData%\Octoshape\Octoshape Streaming Services
FileKey1=%LocalAppData%\Octoshape\Octoshape Streaming Services\temp|*.*

[OE Classic *]
LangSecRef=3022
Detect=HKCU\Software\OEClassic
FileKey1=%LocalAppData%\OEClassic\Prg\Res|*.*|RECURSE
FileKey2=%LocalAppData%\OEClassic\Prg\T|*.*|RECURSE
ExcludeKey1=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.aff
ExcludeKey2=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.dic
ExcludeKey3=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.license

[OEM Logs *]
LangSecRef=3021
DetectFile1=%CommonAppData%\oem
DetectFile2=%SystemDrive%\OEM
DetectFile3=%WinDir%\System32\OEM
DetectFile4=%WinDir%\SysWOW64\OEM
FileKey1=%CommonAppData%\oem|*.log|RECURSE
FileKey2=%SystemDrive%\OEM|*.log|RECURSE
FileKey3=%WinDir%\oem|*.log;*.log.txt|RECURSE
FileKey4=%WinDir%\System32\OEM|*.log
FileKey5=%WinDir%\SysWOW64\OEM|*.log

[Off-Road Drive *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\200230
FileKey1=%Documents%\My Games\PP3\PP3WorkGame\Logs|*.*

[Office *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\CLR_v4.0|*.Log|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\ServiceWorkerFiles|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Temp|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\AppData\Local\Office\16.0\WebServiceCache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\Cache|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\Internet Explorer\DOMStore\*\|www.office[1].xml

[Office Password Recovery *]
LangSecRef=3024
Detect=HKCU\Software\Intelore\Office Password Recovery
FileKey1=%AppData%\Intelore\Password Recovery\logs|*.*

[OMNITRACKER *]
LangSecRef=3021
Detect=HKCU\Software\OmniNet\OmniTracker
FileKey1=%LocalAppData%\OMNINET GmbH\OMNITRACKER\Temp|*.*|RECURSE
RegKey1=HKCU\Software\OmniNet\OmniTracker\MRU
RegKey2=HKCU\Software\OmniNet\OmniTracker\SearchTextHistory

[OneDrive *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\LocalState\Logs|*.log
FileKey5=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\TempState|*.*|RECURSE

[OneNote *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.OneNote_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local|msodata*.dat
FileKey6=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\office*client.microsoft.com|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\Office\OTele|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\OneNote\16.0|*.onecache
FileKey9=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\OneNote\16.0\OneNote*Cache_Files|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.OneNote_8wekyb3d8bbwe\SearchHistory

[OneTeam *]
LangSecRef=3022
Detect=HKCU\Software\OneTeam
FileKey1=%AppData%\oneteam\profiles\*\oneteamcachefiles|*.*|RECURSE
FileKey2=%LocalAppData%\oneteam\profiles\*\cache|*.*|RECURSE

[Online Armor *]
LangSecRef=3021
Detect=HKLM\Software\Tall Emu\Online Armor
FileKey1=%ProgramFiles%\Tall Emu\Online Armor\Logs|*.*

[Ontrack EasyRecovery *]
LangSecRef=3024
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{668CC71A-C2AD-4D56-866D-CF300BD1D5BE}_is1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AE695CA4-8847-4462-98CC-023874D29E72}_is1
FileKey1=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery*|*erent_log.txt;*erpro_log.txt

[Ookla Speed Test *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Ookla.SpeedtestbyOokla_43tkc6nmykmb6
FileKey1=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey3=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\LocalState|*.tmp|RECURSE
FileKey5=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\LocalState\Unity\Local.*\Analytics\ArchivedEvents\*|*.*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\TempState|*.*|RECURSE

[OpalCalc *]
LangSecRef=3021
DetectFile1=%AppData%\OpalCalc_prefs
DetectFile2=%ProgramFiles%\OpalCalc
FileKey1=%AppData%\OpalCalc_prefs|lastSession.txt

[Open Blu-ray to DVD *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Blu-ray to DVD Pro_is1
FileKey1=%ProgramFiles%\Blu-ray to DVD*|*.log;*.txt
FileKey2=%ProgramFiles%\Blu-ray to DVD*\ReadCache|*.*

[Open Blu-ray/DVD Ripper *]
LangSecRef=3023
Detect1=HKCU\Software\OpenCloner\BDRipper
Detect2=HKCU\Software\OpenCloner\DVDRipper
FileKey1=%AppData%\Open * Ripper|O*R_LOG_FILE.txt
FileKey2=%AppData%\Open * Ripper\ReadCache|*.*|REMOVESELF

[Open Freely *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Open Freely\OpenFreely.exe
FileKey1=%ProgramFiles%\Open Freely|mostRecentFiles.ini
FileKey2=%ProgramFiles%\Open Freely\NGEN|*.log|RECURSE

[Open with Arguments *]
LangSecRef=3024
Detect=HKCU\Software\OpenArgs
RegKey1=HKCU\Software\OpenArgs\History

[OpenDNS Updater *]
LangSecRef=3021
Detect=HKCU\Software\OpenDNS Updater
Warning=You must exit OpenDNS Updater in the System Tray to clear log files.
FileKey1=%AppData%\OpenDNS Updater|*.txt

[OpenFire *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Openfire
FileKey1=%ProgramFiles%\Openfire\Logs|*.*

[OpenMG *]
LangSecRef=3023
DetectFile=%CommonAppData%\Sony Corporation\OpenMG
FileKey1=%CommonAppData%\Sony Corporation\OpenMG|*.log

[OpenMG CD Backups *]
LangSecRef=3023
DetectFile=%CommonAppData%\Sony Corporation\OpenMG
FileKey1=%CommonAppData%\Sony Corporation\OpenMG\CD Walkman\Temp|*.*|REMOVESELF

[OpenMG Jukebox *]
LangSecRef=3023
DetectFile=%AppData%\Sony\OpenMG Jukebox
FileKey1=%AppData%\Sony\OpenMG Jukebox\Temp|*.*

[OpenOffice.org *]
LangSecRef=3021
Detect1=HKLM\Software\OpenOffice
Detect2=HKLM\Software\OpenOffice.org
FileKey1=%AppData%\OpenOffice*\*\user|*.log;*.log.txt;*.tmp;registrymodifications.xcu;registration.xml|RECURSE
FileKey2=%AppData%\OpenOffice*\*\user\config\imagecache|*.*
FileKey3=%AppData%\OpenOffice*\*\user\registry\cache|*.*
FileKey4=%AppData%\OpenOffice*\*\user\registry\data\org\openoffice\Office|Views.xcu;Writer.xcu;Common.xcu;Histories.xcu
FileKey5=%AppData%\OpenOffice*\*\user\registry\data\org\openoffice\ucb|Hierarchy.xcu;Store.xcu
FileKey6=%ProgramFiles%\OpenOffice*\program|*.log|RECURSE
FileKey7=%ProgramFiles%\OpenOffice*\program_old*|*.*|REMOVESELF
FileKey8=%ProgramFiles%\OpenOffice*\share\uno_packages\cache\uno_packages|*.tmp;*.log;log.txt

[OpenOffice.org Setup Files *]
LangSecRef=3021
Detect1=HKLM\Software\OpenOffice
Detect2=HKLM\Software\OpenOffice.org
FileKey1=%UserProfile%\Desktop\OpenOffice.org * Installation Files|*.*|REMOVESELF

[OpenRA *]
Section=Games
DetectFile=%Documents%\OpenRA
FileKey1=%Documents%\OpenRA\Logs|*.*

[OpenVPN *]
LangSecRef=3024
Detect=HKLM\Software\OpenVPN
FileKey1=%ProgramFiles%\OpenVPN\Log|*.log
FileKey2=%UserProfile%\OpenVPN\log|*.*|RECURSE

[Optimizer Pro *]
LangSecRef=3024
Detect=HKCU\Software\Optimizer Pro
FileKey1=%AppData%\Optimizer Pro\Log|*.*

[OptimumLink *]
LangSecRef=3021
DetectFile=%AppData%\OptimumLink
FileKey1=%AppData%\OptimumLink|TrayLogs*.*

[Orbit Downloader *]
LangSecRef=3022
Detect=HKLM\Software\Orbit
FileKey1=%AppData%\Orbit|history.dat;DownloadList.dat;unfinish.dat;softI.dat;updateslist.xml
FileKey2=%AppData%\Orbit\flink|*.*
FileKey3=%AppData%\Orbit\icon|*.*|RECURSE

[Orca *]
LangSecRef=3024
Detect=HKCU\Software\Microsoft\Orca
RegKey1=HKCU\Software\Microsoft\Orca\Recent File List

[Orcs Must Die! Unchained *]
Section=Games
Detect1=HKCU\Software\Robot Entertainment\Orcs Must Die! Unchained
Detect2=HKCU\Software\Valve\Steam\Apps\427270
FileKey1=%Documents%\My Games\Orcs Must Die Unchained\SpitfireGame\Logs|*.log;*.dmg|RECURSE

[Origin *]
Section=Games
Detect=HKLM\Software\Classes\Origin
FileKey1=%AppData%\Origin\Logs|*.data
FileKey2=%CommonAppData%\Origin\*Cache|*.*|RECURSE
FileKey3=%CommonAppData%\Origin\Logs|*.*
FileKey4=%CommonAppData%\Origin\Telemetry|*.*
FileKey5=%LocalAppData%\Origin\Logs|*.txt
FileKey6=%LocalAppData%\Origin\Origin\cache|*.*|RECURSE
FileKey7=%LocalAppData%\Origin\ThinSetup|*_Log.txt
FileKey8=%LocalAppData%\Origin\Web Cache|*.*|RECURSE
FileKey9=%SystemDrive%|shared.log

[Origin Installers *]
Section=Games
Detect=HKLM\Software\Classes\Origin
FileKey1=%LocalAppData%\Origin\ThinSetup|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Origin Games|*.cab;dotnetfx3setup;dotNetFx*.exe;dsetup*.dll;DXSETUP.EXE;dxwebsetup.exe;eula.*.txt;GamesExplorerIntegrationTool.exe;gfwlivesetup.exe;globdata.ini;install.exe;install.ini;install.res.*.dll;oalinst.exe;vc_red.exe;vc_red.msi;vcredist.bmp;vc*redist*x*.exe;xnafx*_redist.msi|RECURSE

[Osmos *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\29180
FileKey1=%Documents%\Osmos|osmos.log

[osu! *]
Section=Games
Detect=HKCU\Software\Osu!
FileKey1=%LocalAppData%\osu!\logs|*.*
FileKey2=%ProgramFiles%\Osu!|debug-import.txt

[Outlast *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\238320
Detect2=HKCU\Software\Valve\Steam\Apps\414700
FileKey1=%Documents%\My Games\Outlast*\OLGame\Logs|*.*

[Outlook 2003 *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\11.0\Outlook
FileKey1=%AppData%\Microsoft\Outlook|Outlook.NK2
RegKey1=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|MRU 1
RegKey2=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|MRU 2
RegKey3=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|MRU 3

[Outlook Appointment Location *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\9.0\Outlook
Detect2=HKCU\Software\Microsoft\Office\11.0\Outlook
Detect3=HKCU\Software\Microsoft\Office\12.0\Outlook
Detect4=HKCU\Software\Microsoft\Office\14.0\Outlook
Detect5=HKCU\Software\Microsoft\Office\15.0\Outlook
Detect6=HKCU\Software\Microsoft\Office\16.0\Outlook
Warning=This will remove the most frequent appointment locations from all Outlook versions.
RegKey1=HKCU\Software\Microsoft\Office\9.0\Outlook\Preferences|LocationMRU
RegKey2=HKCU\Software\Microsoft\Office\11.0\Outlook\Preferences|LocationMRU
RegKey3=HKCU\Software\Microsoft\Office\12.0\Outlook\Preferences|LocationMRU
RegKey4=HKCU\Software\Microsoft\Office\14.0\Outlook\Preferences|LocationMRU
RegKey5=HKCU\Software\Microsoft\Office\15.0\Outlook\Preferences|LocationMRU
RegKey6=HKCU\Software\Microsoft\Office\16.0\Outlook\Preferences|LocationMRU

[Overwatch *]
Section=Games
DetectFile=%Documents%\Overwatch
FileKey1=%Documents%\Overwatch\Logs|*.*|RECURSE
FileKey2=%ProgramFiles%\Overwatch\WebBrowserProxy\cache\browser|*.*
FileKey3=%ProgramFiles%\Overwatch\WebBrowserProxy\logs\browser|*.*

[OVH HubiC *]
LangSecRef=3021
Detect=HKCU\Software\OVH\hubiC-browser
FileKey1=%LocalAppData%\OVH\hubiC-browser\cache\data7|*.*|RECURSE

[Oxygen 14 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Oxygen XML Editor 14
FileKey1=%ProgramFiles%\Oxygen XML Editor 14|*.properties;*.log
FileKey2=%ProgramFiles%\Oxygen XML Editor 14\.install4j|*.log
FileKey3=%ProgramFiles%\Oxygen XML Editor 14\dicts|*.txt;*.html
FileKey4=%ProgramFiles%\Oxygen XML Editor 14\lib|*.txt|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\Oxygen XML Editor 14\.install4j\|files.log

[Pacific Storm *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\11250
DetectFile=%ProgramFiles%\Buka\Pacific Storm
FileKey1=%ProgramFiles%\Buka\Pacific Storm|*.log|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Pacific Storm*|*.log|RECURSE

[Painkiller Hell & Damnation *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\214870
FileKey1=%Documents%\My Games\Painkiller Hell and Damnation\PKHDGame\Logs|*.*

[Paint 3D *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSPaint_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MSPaint_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MSPaint_*\TempState|*.*|RECURSE

[Paint.NET *]
LangSecRef=3021
Detect=HKCU\Software\Paint.NET
FileKey1=%LocalAppData%\Paint.NET|*.*|RECURSE
RegKey1=HKCU\Software\Paint.NET|LastFileDialogDirectory

[Paltalk Messenger *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Paltalk Messenger\paltalk.exe
FileKey1=%AppData%\Paltalk|*.*|RECURSE

[Panda Antivirus *]
LangSecRef=3024
Detect=HKLM\Software\Panda Security
FileKey1=%CommonAppData%\Panda Security\Panda Devices Agent\Logs|*.*
FileKey2=%CommonAppData%\Panda Security\Panda Security Protection|*.log
FileKey3=%CommonAppData%\Panda Security\Panda Security Protection\Logs|*.*
FileKey4=%CommonAppData%\Panda Security\Panda Security Protection\SRFRepository|*.bak
FileKey5=%CommonAppData%\Panda Security\PSLogs|*.log

[Pandion *]
LangSecRef=3022
Detect=HKCU\Software\Pandion
FileKey1=%AppData%\Pandion\Avatars|*.*|RECURSE
FileKey2=%AppData%\Pandion\Message Cache|*.*|RECURSE

[Pandion Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Pandion
FileKey1=%AppData%\Pandion\Profiles|*.log;*.buffer|RECURSE

[Pando *]
LangSecRef=3024
Detect=HKCU\Software\Pando Networks\Pando
Warning=Make sure Pando is totally shut down before using this.
FileKey1=%LocalAppData%\Pando\Pando Files|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Pando\Pando Files\|pando.log
ExcludeKey2=FILE|%LocalAppData%\Pando\Pando Files\|pando.prev.log
ExcludeKey3=FILE|%LocalAppData%\Pando\Pando Files\|pando.sav
ExcludeKey4=FILE|%LocalAppData%\Pando\Pando Files\|pando.save
ExcludeKey5=FILE|%LocalAppData%\Pando\Pando Files\|pando.txt
ExcludeKey6=PATH|%LocalAppData%\Pando\Pando Files\Cert\|*.*

[Pando Media Booster *]
Section=Games
Detect=HKCU\Software\Pando Networks\PMB
FileKey1=%CommonAppData%\PMB Files|*.TOK;*.log
FileKey2=%LocalAppData%\PMB Files\*|*.CT1;*.CT2;*.dat;*.log|RECURSE

[Paragon Hard Disk Manager 12 Suite *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Paragon Software\Hard Disk Manager 12 Suite
FileKey1=%ProgramFiles%\Paragon Software\Hard Disk Manager 12 Suite|*.log

[Paragon Hard Disk Manager 14 Suite *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Paragon Software\Hard Disk Manager 14 Suite
FileKey1=%CommonAppData%\clonehdd|*.log
FileKey2=%CommonAppData%\createpart|*.log
FileKey3=%CommonAppData%\deletepart|*.log
FileKey4=%CommonAppData%\explauncher|*.log
FileKey5=%CommonAppData%\ftw|*.log
FileKey6=%CommonAppData%\launcher|*.log
FileKey7=%CommonAppData%\logsaver|*.log
FileKey8=%CommonAppData%\migrateos|*.log
FileKey9=%CommonAppData%\redistpart|*.log
FileKey10=%CommonAppData%\vmadjust|*.log
FileKey11=%CommonAppData%\vmcreate|*.log
FileKey12=%CommonAppData%\wipe|*.log
FileKey13=%ProgramFiles%\Paragon Software\Hard Disk Manager 14 Suite\*|BioNtLog.txt;cdb.log;fdisk.txt;pwlog.txt;stubact.log
FileKey14=%ProgramFiles%\Paragon Software\Hard Disk Manager 14 Suite\*\symmpi*|*.txt
FileKey15=%SystemDrive%\Documents and Settings\LocalService|objsrv.log

[Paragon Partition Manager 2014 *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Paragon Software\Partition Manager 2014
FileKey1=%CommonAppData%\converthfs|*.log
FileKey2=%CommonAppData%\createpart|*.log
FileKey3=%CommonAppData%\deletepart|*.log
FileKey4=%CommonAppData%\explauncher|*.log
FileKey5=%CommonAppData%\formatpart|*.log
FileKey6=%CommonAppData%\launcher|*.log
FileKey7=%CommonAppData%\logsaver|*.log
FileKey8=%CommonAppData%\redistpart|*.log
FileKey9=%ProgramFiles%\Paragon Software\*\program|BioNtLog.txt;cdb.log;fdisk.txt;pwlog.txt;stubact.log
FileKey10=%SystemDrive%\Documents and Settings\LocalService|objsrv.log

[Paragon Total Defrag 2010 *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Paragon Software\Total Defrag 2010
FileKey1=%ProgramFiles%\Paragon Software\Total Defrag 2010|*.log;biontlog.txt|RECURSE

[Paramount Dynamic *]
LangSecRef=3023
DetectFile=%LocalAppData%\Microsoft\Windows\Themes\ParamountDynamic.theme
Warning=This will cause you to redownload the Paramount Dynamic RSS file.
FileKey1=%LocalAppData%\Microsoft\Feeds|http~c~f~fthemeserver~dmicrosoft~dcom~fdefault~daspx~mp*Paramount*

[Paranormal *]
Section=Games
DetectFile=%ProgramFiles%\Desura\Common\paranormal
FileKey1=%ProgramFiles%\Desura\Common\paranormal\UDKGame\Logs|*.*

[Paranormal Agency *]
Section=Games
DetectFile=%AppData%\Shape Games\Paranormal_v*
FileKey1=%AppData%\Shame Games\Paranormal_v*\logs|*.*

[Partner Application *]
LangSecRef=3022
DetectFile=%CommonAppData%\Partner
FileKey1=%CommonAppData%\Partner|*.log

[Passware Encryption Analyzer *]
LangSecRef=3021
DetectFile1=%AppData%\Passware\EncryptionAnalyzer
DetectFile2=%ProgramFiles%\Passware\Encryption Analyzer*
FileKey1=%AppData%\EncryptionAnalyzer\logs|*.*
FileKey2=%AppData%\Passware\EncryptionAnalyzer\*|config.json
FileKey3=%AppData%\Passware\EncryptionAnalyzer\*\*Cache|*.*|RECURSE
FileKey4=%AppData%\Passware\EncryptionAnalyzer\*\Local Storage\leveldb|*.old;LOG
FileKey5=%AppData%\Passware\EncryptionAnalyzer\*\logs|*.*
FileKey6=%AppData%\Passware\EncryptionAnalyzer\*\Session Storage|*.old;LOG
FileKey7=%AppData%\PasswareEncryptionAnalyzer\logs|*.*

[Passware Search Index Examiner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Passware\Search Index Examiner*
FileKey1=%AppData%\Passware\SearchIndexExaminer|Settings.bin

[Patch My PC *]
LangSecRef=3024
DetectFile=%LocalAppData%\Patch_My_PC,_LLC
FileKey1=%LocalAppData%\Patch_My_PC,_LLC|*.*|RECURSE

[Path of Exile *]
Section=Games
Detect1=HKCU\Software\GrindingGearGames\Path of Exile
Detect2=HKCU\Software\Valve\Steam\Apps\238960
FileKey1=%Documents%\My Games\Path of Exile\Minimap|*.*
FileKey2=%ProgramFiles%\Grinding Gear Games\Path of Exile\Logs|*.*
FileKey3=%ProgramFiles%\Steam\steamapps\common\Path of Exile\logs|*.*

[PAYDAY 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\218620
DetectFile=%LocalAppData%\PAYDAY 2
FileKey1=%LocalAppData%\PAYDAY 2|crash.txt;crashlog.txt

[PC Doctor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PC-Doctor For Windows
FileKey1=%ProgramFiles%\PC-Doctor For Windows\Logs|*.*

[PC Optimizer Pro *]
LangSecRef=3024
DetectFile=%CommonAppData%\PC optimizer pro
FileKey1=%CommonAppData%\PC Optimizer Pro\Logs|*.*

[PC TechZone Merlin InstantFeedback *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PC TechZone\Merlin InstantFeedback
FileKey1=%ProgramFiles%\PC TechZone\Merlin InstantFeedback|Log.txt;seller.txt;InstantFeedback.exe.UnhandledExceptionLog.txt;*.tmp
FileKey2=%ProgramFiles%\PC TechZone\Merlin InstantFeedback\Logs|*.*

[PC Tools Performance Toolkit *]
LangSecRef=3024
DetectFile=%AppData%\PC Tools Performance Toolkit
FileKey1=%AppData%\PC Tools Performance Toolkit\CleanReports|*.*
FileKey2=%CommonAppData%\PC Tools\Performance Toolkit\Defrag\Logs|*.*
FileKey3=%CommonAppData%\PC Tools\Performance Toolkit\Repair\Logs|*.*
FileKey4=%ProgramFiles%\PC Tools\*\~tmp|*.*
FileKey5=%ProgramFiles%\PC Tools\*\Log|*.*

[PC Tools sMonitor *]
LangSecRef=3024
DetectFile=%CommonProgramFiles%\PC Tools\sMonitor
FileKey1=%CommonProgramFiles%\PC Tools\sMonitor|cputime.xml;logfile.etl

[PC Trek Advanced Password Recovery Suite *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Advanced Password Recovery Suite\aprs.exe
FileKey1=%ProgramFiles%\Advanced Password Recovery Suite|dscnt.exe

[PCFresh Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\PCFresh
FileKey1=%LocalAppData%\Abelssoft\PCFresh\Backup|*.*

[PCMark 10 Logs *]
LangSecRef=3024
DetectFile=%Documents%\PCMark 10
FileKey1=%Documents%\PCMark 10|*.*|REMOVESELF

[PCSX2 *]
Section=Games
DetectFile=%Documents%\PCSX2
FileKey1=%Documents%\PCSX2\logs|*.*|RECURSE

[PCSX2 Snaps *]
Section=Games
DetectFile=%Documents%\PCSX2
FileKey1=%Documents%\PCSX2\snaps|*.*|RECURSE

[PDF-XChange Editor *]
LangSecRef=3021
Detect=HKCU\Software\Tracker Software\PDFXEditor
FileKey1=%CommonAppData%\Tracker Software\TrackerUpdate|TrackerUpdate.exe.del
FileKey2=%CommonAppData%\Tracker Software\TrackerUpdate\Download|*.*

[PDF-XChange Viewer *]
LangSecRef=3021
Detect=HKCU\Software\Tracker Software\PDFViewer
FileKey1=%CommonAppData%\Tracker Software\TrackerUpdate|TrackerUpdate.exe.del
FileKey2=%LocalAppData%\Tracker Software\LiveUpdate\Updates|*.*
RegKey1=HKCU\Software\Tracker Software\PDFViewer\Documents\LastOpened
RegKey2=HKCU\Software\Tracker Software\PDFViewer\Documents\LatestView\Bars
RegKey3=HKCU\Software\Tracker Software\PDFViewer\Documents\LatestView\Panes

[PDF Annotator *]
LangSecRef=3021
Detect=HKCU\Software\GRAHL\PDFAnnotator
RegKey1=HKCU\Software\GRAHL\PDFAnnotator\3.0\Files\MRUItems
RegKey2=HKCU\Software\GRAHL\PDFAnnotator\4.0\Files\MRUItems

[PDF Editor 4 *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDF Editor 4
FileKey1=%ProgramFiles%\PDF Editor 4|*.log;*.diz

[PDF Explorer *]
LangSecRef=3021
Detect=HKCU\Software\PDFExplorer
RegKey1=HKCU\Software\PDFExplorer\Options|LastDiskTreeFolder
RegKey2=HKCU\Software\PDFExplorer\Options|ScanGridStartupFolder

[PDF Plus *]
LangSecRef=3021
DetectFile=%AppData%\Zeon\DocuCom\PDF Plus
FileKey1=%AppData%\Zeon\DocuCom\PDF Plus\Log|*.*

[PDF24 Creator *]
LangSecRef=3021
DetectFile=%ProgramFiles%\PDF24
FileKey1=%ProgramFiles%\PDF24|*.log

[PE Module Explorer *]
LangSecRef=3024
Detect=HKCU\Software\Woozle\PE Module Explorer
RegKey1=HKCU\Software\Woozle\PE Module Explorer\Recent Files

[Peerblock *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Peerblock
FileKey1=%ProgramFiles%\Peerblock|*.log;History.db;*.bak;cache.p2b
FileKey2=%ProgramFiles%\Peerblock\lists|*.list.failed*

[PeerNetworking *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%SystemDrive%\Documents and Settings\LocalService\Application Data\PeerNetworking|*.*|RECURSE
FileKey2=%WinDir%\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking|*.*|RECURSE

[Pegasus Mail *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pegasus Mail
FileKey1=%SystemDrive%\PMAIL\MAIL|SYSLOG.PM
FileKey2=%SystemDrive%\PMAIL\Programs|*.log

[Pelles C *]
LangSecRef=3021
Detect=HKCU\Software\Pelle Orinius\PellesC
RegKey1=HKCU\Software\Pelle Orinius\PellesC\Recent File List
RegKey2=HKCU\Software\Pelle Orinius\PellesC\Recent Project List
RegKey3=HKCU\Software\Pelle Orinius\PellesC\Recent Search List

[Penumbra Black Plague *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\22120
Detect2=HKCU\Software\Valve\Steam\Apps\22140
Detect3=HKCU\Software\Valve\Steam\Apps\22180
FileKey1=%Documents%\Penumbra*\*|*.log

[People *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.People_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.People_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.People_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.People_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.People_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.People_*\LocalState\DiagOutputDir|*.etl
FileKey6=%LocalAppData%\Packages\Microsoft.People_*\TempState|*.*|RECURSE

[PerfectDisk *]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectDisk
FileKey1=%CommonAppData%\Raxco\PerfectDisk\*|*.log;*.txt;PDBootLog

[PerfectRegistry *]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectRegistry
DetectFile=%ProgramFiles%\Raxco\PerfectRegistry\PerfectRegistry.exe
FileKey1=%AppData%\Raxco\PerfectRegistry|*.log;TempHLList.rcp

[PerfectUpdater *]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectUpdater
Warning=This cleans the installation logs, backup files after updating, and the downloads for new updates used for updating your drivers.
FileKey1=%AppData%\Raxco\PerfectUpdater|*.log
FileKey2=%AppData%\Raxco\PerfectUpdater\Backup|*.*
FileKey3=%AppData%\Raxco\PerfectUpdater\Download|*.*

[Performance Maintainer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\PC Starters\Performance Maintainer
FileKey1=%ProgramFiles%\PC Starters\Performance Maintainer\Backups|*.*|RECURSE
FileKey2=%ProgramFiles%\PC Starters\Performance Maintainer\log*|*.*|RECURSE

[Pet Pals: Animal Doctor *]
Section=Games
Detect=HKLM\Software\Legacy Interactive\Pet Pals
FileKey1=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor|*.log
FileKey2=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre|*.*
FileKey3=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\temp|*.*|REMOVESELF
ExcludeKey1=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\bin\|*.*
ExcludeKey2=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\lib\|*.*

[pgAdmin *]
LangSecRef=3024
DetectFile=%AppData%\pgAdmin
FileKey1=%AppData%\pgAdmin|pgadmin4.log

[phase-6 *]
LangSecRef=3021
DetectFile=%UserProfile%\.phase-6
FileKey1=%UserProfile%\.phase-6|window-position.txt
FileKey2=%UserProfile%\.phase-6\logs|phase-6.log

[Phone *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.CommsPhone_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.CommsPhone_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.CommsPhone_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.CommsPhone_*\TempState|*.*|RECURSE

[Phone Companion *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsPhone_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\TempState|*.*|RECURSE

[Phorest *]
LangSecRef=3024
Detect=HKCU\Software\FutureFog\Phorest\Options
RegKey1=HKCU\Software\FutureFog\Phorest\Layout|SelectionHeight
RegKey2=HKCU\Software\FutureFog\Phorest\Layout|SelectionLeft
RegKey3=HKCU\Software\FutureFog\Phorest\Layout|SelectionTop
RegKey4=HKCU\Software\FutureFog\Phorest\Layout|SelectionWidth
RegKey5=HKCU\Software\FutureFog\Phorest\Options|LastUsedFolder

[Photo Print Calendar 3.00E Beta *]
LangSecRef=3021
Detect=HKLM\Software\Computer Institute of Japan, Ltd.\Photo Print Calendar from YOKOHAMA Ver.3.00E beta\3.00E beta
FileKey1=%ProgramFiles%\Photo Print Calendar|update.bmp

[Photo Stamp Remover *]
LangSecRef=3023
Detect=HKCU\Software\softorbits\PhotoStampRemover
RegKey1=HKCU\Software\softorbits\PhotoStampRemover|currentFile

[Photo! Editor *]
LangSecRef=3024
Detect=HKCU\Software\VicMan Software\Photo! Editor
FileKey1=%ProgramFiles%\Photo!\Photo! Editor|*.log
RegKey1=HKCU\Software\VicMan Software\Photo! Editor|LastFolder

[Photodex ProShow Producer *]
LangSecRef=3021
Detect=HKCU\Software\Photodex\ProShow
FileKey1=%CommonAppData%\Photodex\ProShow|*.log|RECURSE
FileKey2=%CommonAppData%\Photodex\ProShow\FontCache|*.*|REMOVESELF
FileKey3=%CommonAppData%\Photodex\ProShow\Styles\Cache|*.*|REMOVESELF
FileKey4=%CommonAppData%\Photodex\ProShow\Transitions\Cache|*.*|REMOVESELF
FileKey5=%ProgramFiles%\Photodex\ProShow Producer|*.log|RECURSE
FileKey6=%UserProfile%|proshow-burn.log
ExcludeKey1=FILE|%ProgramFiles%\Photodex\ProShow Producer\pxf\images\|xicons.txt

[PhotoPad *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\PhotoPad
RegKey1=HKCU\Software\NCH Software\PhotoPad\RecentFileList

[Photos *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\LocalState|*.etl;*.sqlite*;*.xml
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\LocalState\PhotosAppTile|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedPickerData\Microsoft.Windows.Photos_8wekyb3d8bbwe!App\DefaultSaveFileSingle
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp
RegKey3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed

[PhotoScissors *]
LangSecRef=3021
Detect=HKCU\Software\Teorex\PhotoScissors
RegKey1=HKCU\Software\Teorex\PhotoScissors\Recent File List
RegKey2=HKCU\Software\Teorex\PhotoScissors\RecentFileList

[PhotoToFilm *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\PhotoToFilm
FileKey1=%AppData%\KC Softwares\PhotoToFilm|*.log

[PhotoZoom Pro 6 *]
LangSecRef=3023
Detect=HKCU\Software\BenVista\PhotoZoom Pro 6
RegKey1=HKCU\Software\BenVista\PhotoZoom Pro 6|FileDir
RegKey2=HKCU\Software\BenVista\PhotoZoom Pro 6\Recent Images

[PHPStorm *]
LangSecRef=3024
DetectFile=%UserProfile%\.WebIde40
FileKey1=%UserProfile%\.WebIde40\LocalHistory|*.*|RECURSE
FileKey2=%UserProfile%\.WebIde40\Log|*.*|RECURSE
FileKey3=%UserProfile%\.WebIde40\system\caches|*.*|RECURSE
FileKey4=%UserProfile%\.WebIde40\tmp|*.*|RECURSE

[PhraseExpress *]
LangSecRef=3024
DetectFile=%Documents%\PhraseExpress
FileKey1=%Documents%\PhraseExpress|*.bak

[PhrozenSoft Databases *]
LangSecRef=3024
DetectFile=%AppData%\PhrozenSoft
FileKey1=%AppData%\PhrozenSoft\PVTUploader|phrzvtu.db

[Phyxion.net Driver Sweeper *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Phyxion.net\Driver Sweeper\Logs
FileKey1=%ProgramFiles%\Phyxion.net\Driver Sweeper\Logs|*.*|RECURSE

[Phyxion.net Driver Sweeper Backups *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Phyxion.net\Driver Sweeper\Backup
FileKey1=%ProgramFiles%\Phyxion.net\Driver Sweeper\Backup|*.*|RECURSE

[PictureTrail Photo Editor *]
LangSecRef=3023
Detect=HKCU\Software\PictureTrail Photo Editor\PictureTrail Photo Editor
RegKey1=HKCU\Software\Local AppWizard-Generated Applications\PictureTrail Photo Editor\Recent File List
RegKey2=HKCU\Software\PictureTrail Photo Editor\PictureTrail Photo Editor\Recent File List

[Pictus *]
LangSecRef=3023
Detect=HKLM\Software\Poppeman\Pictus
DetectFile=%AppData%\Poppeman\Pictus
FileKey1=%AppData%\Poppeman\Pictus|runlog.txt;setup.txt

[PicView *]
LangSecRef=3023
DetectFile=%ProgramFiles%\PicView\PicView.exe
FileKey1=%LocalAppData%\Ruben2776\PicView_StrongName_*\*|Recent.txt

[Pidgin *]
LangSecRef=3022
Detect=HKCU\Software\Pidgin
FileKey1=%AppData%\.purple|*.xml~
FileKey2=%UserProfile%|Recently-Used.xbel

[Pidgin Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Pidgin
FileKey1=%AppData%\.purple\logs|*.*|REMOVESELF

[Pipy *]
LangSecRef=3021
DetectFile=%AppData%\Pipy
FileKey1=%AppData%\Pipy\Logs|*.*

[Pixillion *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\Pixillion
RegKey1=HKCU\Software\NCH Software\Pixillion\Options|Image path
RegKey2=HKCU\Software\NCH Software\Pixillion\Options|Input folder
RegKey3=HKCU\Software\NCH Software\Pixillion\Options|Output folder
RegKey4=HKCU\Software\NCH Software\Pixillion\Options|Output format

[PKZip *]
LangSecRef=3024
Detect1=HKCU\Software\PKWARE\PKZIP for Windows
Detect2=HKCU\Software\PKWARE\PKZIP70
Detect3=HKCU\Software\PKWARE\ZIPReader 0
FileKey1=%ProgramFiles%\PKWARE\PKZIPW|*.log

[Planet Horse *]
Section=Games
Detect=HKLM\Software\Big Fish Games\Persistence\Install\F6023T1L1
DetectFile=%ProgramFiles%\Planet Horse
FileKey1=%ProgramFiles%\Planet Horse|output_log.txt|RECURSE

[Planets Under Attack *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\218510
FileKey1=%Documents%\My Games\Planets Under Attack|*.log

[Plants vs. Zombies *]
Section=Games
DetectFile=%ProgramFiles%\Popcap Games\Plants vs Zombies
FileKey1=%ProgramFiles%\Popcap Games\Plants vs Zombies|Install.log

[PlayFirst Games *]
Section=Games
DetectFile=%AppData%\PlayFirst
FileKey1=%AppData%\PlayFirst|logfile.txt|RECURSE

[Plex Media Server *]
LangSecRef=3023
Detect=HKCU\Software\Plex, Inc.\Plex Media Server
FileKey1=%LocalAppData%\Plex Media Server\Cache\PhotoTranscoder|*.*|RECURSE
FileKey2=%LocalAppData%\Plex Media Server\Crash Reports|*.*|RECURSE
FileKey3=%LocalAppData%\Plex Media Server\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\Plex Media Server\Updates|*.*|RECURSE
FileKey5=%ProgramFiles%\Plex\Plex Media Server|*.txt;*.log|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Plex Media Server\Logs|*.*|RECURSE
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Plex Media Server\Logs|*.*|RECURSE

[Plus500 *]
LangSecRef=3021
Detect=HKCU\Software\Plus500
DetectFile=%ProgramFiles%\Plus500\Plus500.exe
FileKey1=%LocalAppData%\Plus500\Main|*.log;*.log.*

[Pocket Killbox *]
LangSecRef=3024
DetectFile=%SystemDrive%\!Killbox
FileKey1=%SystemDrive%\!Killbox\Logs|*.*

[Pogo Games *]
Section=Games
DetectFile=%AppData%\Pogo Games
FileKey1=%AppData%\Pogo Games\*\Cache|*.*|REMOVESELF

[Pointstone Registry Cleaner *]
LangSecRef=3024
DetectFile=%AppData%\Pointstone\Registry Cleaner
FileKey1=%AppData%\Pointstone\Registry Cleaner|*.bak;Statistics.xml
FileKey2=%AppData%\Pointstone\Registry Cleaner\Logs|*.txt

[Pointstone Total Privacy *]
LangSecRef=3024
Detect=HKCU\Software\Pointstone\Total Privacy
FileKey1=%ProgramFiles%\Pointstone\Total Privacy*|*.txt

[Pok3D *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Pok3d
FileKey1=%AppData%\Pok3d|*.log;*.dmp

[PokerStars *]
Section=Games
DetectFile=%LocalAppData%\PokerStars
FileKey1=%LocalAppData%\PokerStars\ImgCache|*.*
FileKey2=%LocalAppData%\PokeStars|*.log.*

[Pokki *]
LangSecRef=3022
Detect=HKCU\Software\Pokki
FileKey1=%LocalAppData%\Pokki|*.log|RECURSE
FileKey2=%LocalAppData%\Pokki\PokkiIconCache|*.*|RECURSE
FileKey3=%LocalAppData%\Pokki\UserData\*|*.bak|RECURSE

[Pokki Internet Traces *]
LangSecRef=3022
Detect=HKCU\Software\Pokki
FileKey1=%LocalAppData%\Pokki\UserData\*|Cookies*;Favicons*;*History*;Top Sites*;Visited Links;Web Data*
FileKey2=%LocalAppData%\Pokki\UserData\*\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Pokki\UserData\*\LocalStorage|*.*

[Polarity *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Polarity
FileKey1=%ProgramFiles%\Polarity|*.log

[Polarity Internet Traces *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Polarity
FileKey1=%AppData%\Stanley Lim\Polarity\Cache|*.*|RECURSE
FileKey2=%AppData%\Stanley Lim\Polarity\Favicon|*.*
FileKey3=%UserProfile%\Polarity_Config|downloads_names.ini;downloads_times.ini;downloads_urls.ini;history.ini;history_names.ini;history_times.ini;savedTabs.ini

[PolyView *]
LangSecRef=3021
Detect=HKCU\Software\Polybytes\PolyView
RegKey1=HKCU\Software\Polybytes\PolyView\Recent File List

[Popcorn Time *]
LangSecRef=3022
Detect1=HKCU\Software\Popcorn Time
Detect2=HKCU\Software\PopcornTime
DetectFile=%LocalAppData%\Popcorn-Time*
FileKey1=%LocalAppData%\Popcorn Time\node_modules\peerflix\node_modules\torrent-stream\node_modules\parse-torrent\node_modules\magnet-uri|*log.txt
FileKey2=%LocalAppData%\Popcorn*Time*\*Cache|*.*|RECURSE
FileKey3=%LocalAppData%\popcorn-time\User Data\*\*Cache|*.*
FileKey4=%ProgramFiles%\Popcorn Time\plugins|plugins.dat.*

[Portfolio Performance *]
LangSecRef=3021
DetectFile=%LocalAppData%\PortfolioPerformance
FileKey1=%LocalAppData%\PortfolioPerformance\workspace\.metadata|*.lock;*.log

[PortScan & Stuff *]
LangSecRef=3022
Detect=HKCU\Software\CompSoft\PortScan
RegKey1=HKCU\Software\CompSoft\PortScan|ScanEnd
RegKey2=HKCU\Software\CompSoft\PortScan|ScanStart
RegKey3=HKCU\Software\CompSoft\PortScan\MRUDNSQuery
RegKey4=HKCU\Software\CompSoft\PortScan\MRUDNSServer
RegKey5=HKCU\Software\CompSoft\PortScan\MRUPing
RegKey6=HKCU\Software\CompSoft\PortScan\MRUTraceroute
RegKey7=HKCU\Software\CompSoft\PortScan\MRUWhoIs

[PostBox *]
LangSecRef=3021
DetectFile=%LocalAppData%\PostBox
FileKey1=%AppData%\PostBox|*.log|RECURSE
FileKey2=%AppData%\PostBox\Crash Reports|*.*|REMOVESELF
FileKey3=%LocalAppData%\PostBox\Profiles\*\Cache|*.*|REMOVESELF

[PotPlayer *]
LangSecRef=3023
Detect1=HKCU\Software\Daum\PotPlayerMini
Detect2=HKCU\Software\Daum\PotPlayerMini64
FileKey1=%AppData%\Daum\PotPlayer\Log|*.*
FileKey2=%ProgramFiles%\PotPlayer\History|*.txt
RegKey1=HKCU\Software\Daum\PotPlayerMini\RememberFiles
RegKey2=HKCU\Software\Daum\PotPlayerMini64\RememberFiles

[Power Efficiency Diagnostics *]
LangSecRef=3025
DetectFile=%CommonAppData%\Microsoft\Windows\Power Efficiency Diagnostics
FileKey1=%CommonAppData%\Microsoft\Windows\Power Efficiency Diagnostics|*.xml
ExcludeKey1=FILE|%CommonAppData%\Microsoft\Windows\Power Efficiency Diagnostics\|energy-report-latest.xml

[PowerISO *]
LangSecRef=3024
Detect=HKCU\Software\PowerISO
FileKey1=%AppData%\PowerISO\Upgrade|*.*|RECURSE

[PowerZip *]
LangSecRef=3024
Detect=HKCU\Software\Trident Software\PowerZip
RegKey1=HKCU\Software\Trident Software\PowerZip\Recent File List

[Predator *]
LangSecRef=3021
Detect=HKLM\Software\Predator-Usb
FileKey1=%CommonAppData%\Predator-Usb\PredatorACE\data|*.log

[Presentation Foundation *]
LangSecRef=3025
DetectFile1=%WinDir%\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
DetectFile2=%WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
DetectFile3=%WinDir%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
DetectFile4=%WinDir%\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
DetectFile5=%WinDir%\winsxs\x86_wpf-presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_056fecf27381a72b\PresentationFontCache.exe
FileKey1=%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data|FontCache*.dat;~FontCache*.dat;WPFFontCache_v0400-*.dat
FileKey2=%WinDir%\ServiceProfiles\LocalService\AppData\Local|FontCache*.dat;~FontCache*.dat;WPFFontCache_v0400-*.dat

[Presto Transfer Ultimate *]
LangSecRef=3024
Detect=HKCU\Software\Perception\Presto Transfer Ultimate
FileKey1=%AppData%\Presto Transfer Ultimate|lastlog.html

[PriceGong *]
LangSecRef=3022
DetectFile=%AppData%\PriceGong
FileKey1=%AppData%\PriceGong\tmp|*.*|RECURSE

[Prince of Persia *]
Section=Games
Detect1=HKLM\Software\Ubisoft\Prince of Persia The Sands of Time
Detect2=HKLM\Software\Ubisoft\Prince of Persia Warrior Within
DetectFile=%ProgramFiles%\Ubisoft\Prince of Persia T2T
FileKey1=%LocalAppData%\Ubisoft\Prince of Persia *|*.log
FileKey2=%ProgramFiles%\Ubisoft\Prince of Persia *|*.log;POPError.DAT

[Print 3D *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Print3D_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Print3D_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Print3D_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Print3D_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Print3D_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Print3D_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Print3D_*\TempState|*.*|RECURSE

[Print Dialog *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Windows.PrintDialog_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Windows.PrintDialog_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Windows.PrintDialog_*\AC\Temp|*.*|RECURSE

[Print Queue *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=You may need to halt the print spooler.
FileKey1=%WinDir%\System32\Spool\Printers|*.*

[Prison Architect *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\233450
FileKey1=%LocalAppData%\Introversion\Prison Architect|debug.txt

[Privacy Suite *]
LangSecRef=3024
Detect=HKCU\Software\CyberScrub\Privacy Suite
FileKey1=%AppData%\CyberScrub\Privacy Suite|cybscrub.log

[Private Internet Access VPN *]
LangSecRef=3022
DetectFile=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn
FileKey1=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn|*.log
FileKey2=%ProgramFiles%\pia_manager\log|*.*
FileKey3=%ProgramFiles%\pia_manager\tmp|*.*
FileKey4=%UserProfile%|.pia_manager_crash.log

[PrivaZer *]
LangSecRef=3024
Detect=HKCU\Software\PrivaZer
FileKey1=%LocalAppData%\PrivaZer|*.txt

[Privoxy *]
LangSecRef=3022
Detect=HKCU\Software\Privoxy
FileKey1=%ProgramFiles%\Vidalia Bundle\Privoxy|privoxy.log

[Procaster *]
LangSecRef=3023
DetectFile=%LocalAppData%\Procaster
FileKey1=%LocalAppData%\Procaster|*.log|RECURSE

[Process Hacker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Process Hacker
FileKey1=%AppData%\Process Hacker\Cache|*.*|RECURSE
FileKey2=%ProgramFiles%\Process Hacker|processhacker-setup.exe

[Processing 2.0 *]
LangSecRef=3024
DetectFile=%AppData%\Processing
FileKey1=%AppData%\Processing\Console|*.*
FileKey2=%AppData%\Processing\Debug|*.*

[ProcessLasso *]
LangSecRef=3024
Detect=HKCU\Software\ProcessLasso
FileKey1=%AppData%\ProcessLasso|prolasso.log
FileKey2=%ProgramFiles%\Process Lasso|.logtype5

[ProDiscover *]
LangSecRef=3024
Detect=HKLM\Software\Technology Pathways\ProDiscover
RegKey1=HKLM\Software\Technology Pathways\ProDiscover\Recent File List

[ProFantasy Software CC3 View *]
LangSecRef=3023
Detect=HKCU\Software\EvolutionComputing
RegKey1=HKCU\Software\EvolutionComputing\CC3View|1
RegKey2=HKCU\Software\EvolutionComputing\CC3View|2
RegKey3=HKCU\Software\EvolutionComputing\CC3View|3
RegKey4=HKCU\Software\EvolutionComputing\CC3View|4
RegKey5=HKCU\Software\EvolutionComputing\CC3View|WorkingDrawing

[ProgDVB *]
LangSecRef=3023
DetectFile=%ProgramFiles%\ProgDVB
FileKey1=%ProgramFiles%\ProgDVB\Logs|*.*|RECURSE

[Programmer's Notepad *]
LangSecRef=3024
Detect=HKCU\Software\Echo Software\PN2
FileKey1=%AppData%\Echo Software\PN2|User*.xml
RegKey1=HKCU\Software\Echo Software\PN2\Find|FindText
RegKey2=HKCU\Software\Echo Software\PN2\Find|ReplaceText
RegKey3=HKCU\Software\Echo Software\PN2\MRU
RegKey4=HKCU\Software\Echo Software\PN2\MRUProjects

[Project64 *]
Section=Games
Detect=HKCU\Software\N64 Emulation
DetectFile=%ProgramFiles%\Project64*
FileKey1=%ProgramFiles%\Project64 2.*\Logs|*.*
RegKey1=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile1
RegKey2=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile2
RegKey3=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile3
RegKey4=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile4
RegKey5=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile5
RegKey6=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile6
RegKey7=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile7
RegKey8=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile8
RegKey9=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile9
RegKey10=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile10

[PropertyList Editor *]
LangSecRef=3024
Detect=HKCU\Software\pledit\PropertyList Editor
RegKey1=HKCU\Software\pledit\PropertyList Editor\Recent File List

[Proteus *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219680
FileKey1=%Documents%\Proteus\logs|*.*
ExcludeKey1=FILE|%Documents%\Proteus\logs\|rng.txt

[PS3 Media Server *]
LangSecRef=3023
Detect=HKCU\Software\PS3 Media Server
FileKey1=%ProgramFiles%\PS3 Media Server|*log;*.md|RECURSE

[Psi Avatar Cache *]
LangSecRef=3022
Detect=HKCU\Software\psi-im.org\Psi
DetectFile=%LocalAppData%\Psi+
FileKey1=%LocalAppData%\Psi+\Avatars|*.*|RECURSE
FileKey2=%UserProfile%\PsiData\avatars|*.*

[Psi Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\psi-im.org\Psi
DetectFile=%LocalAppData%\Psi+
FileKey1=%AppData%\Psi+\profiles\*\history|*.*|RECURSE
FileKey2=%UserProfile%\PsiData\profiles\*\history|*.*

[PSoC Designer 5.4 *]
LangSecRef=3021
DetectFile=%AppData%\Cypress_Semiconductor\PSoC_Designer_54
FileKey1=%AppData%\Cypress_Semiconductor\PSoC_Designer_54|debug.log;debug.log.*

[PSPad *]
LangSecRef=3024
DetectFile=%AppData%\PSpad
FileKey1=%AppData%\PSpad|Recent.ini

[PunkBuster *]
Section=Games
DetectFile=%LocalAppData%\PunkBuster
FileKey1=%LocalAppData%\PunkBuster|pbcl.log|RECURSE
FileKey2=%WinDir%\System32\LogFiles\PunkBuster|*.*

[Puran Defrag *]
LangSecRef=3024
Detect=HKLM\Software\Puran Software\Puran Defrag
FileKey1=%ProgramFiles%\Puran Defrag|PuranDefrag.html

[Puran Delete Empty Folders *]
LangSecRef=3024
Detect=HKLM\Software\Puran Software\Delete Empty Folders
RegKey1=HKLM\Software\Puran Software\Delete Empty Folders|Drives
RegKey2=HKLM\Software\Wow6432Node\Puran Software\Delete Empty Folders|Drives

[Puran Fix Shortcuts *]
LangSecRef=3024
Detect=HKLM\Software\Puran Software\Fix Shortcuts
RegKey1=HKLM\Software\Puran Software\Fix Shortcuts|Drives
RegKey2=HKLM\Software\Wow6432Node\Puran Software\Fix Shortcuts|Drives

[Pure Networks *]
LangSecRef=3022
Detect=HKCU\Software\Pure Networks
FileKey1=%CommonAppData%\Pure Networks\Log|*.*
FileKey2=%CommonAppData%\Pure Networks\Platform|*.bak
FileKey3=%CommonAppData%\Pure Networks\Platform\minidumps|*.*

[PureRa *]
LangSecRef=3024
DetectFile=%SystemDrive%\PureRa.txt
FileKey1=%SystemDrive%|PureRa.txt

[Puritan File Destroyer Elite *]
LangSecRef=3023
Detect=HKCU\Software\Puritan\File Destroyer Elite
FileKey1=%CommonAppData%\Puritan\File Destroyer Elite|*.log|RECURSE

[Push Notifications *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm
RegKey2=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm

[Pushbullet *]
LangSecRef=3022
DetectFile=%AppData%\Pushbullet
FileKey1=%AppData%\Pushbullet\pushbullet|*.log

[Pycharm *]
LangSecRef=3021
Detect=HKCU\Software\JetBrains\PyCharm
FileKey1=%UserProfile%\.PyCharm*\system\caches|*.*
FileKey2=%UserProfile%\.PyCharm*\system\log|*.*

[Python *]
LangSecRef=3021
Detect=HKCU\Software\Python
FileKey1=%ProgramFiles%\Python*|*.icns|RECURSE
FileKey2=%SystemDrive%\Python*|*.icns|RECURSE

[qBittorrent *]
LangSecRef=3022
DetectFile=%LocalAppData%\qBittorrent
FileKey1=%LocalAppData%\qBittorrent\cache|*.*
FileKey2=%LocalAppData%\qBittorrent\logs|*.*

[QIP 2012 *]
LangSecRef=3022
Detect=HKCU\Software\QIP
DetectFile=%AppData%\QIP
FileKey1=%AppData%\QIP\Profiles\*\*Avatars|*.*
FileKey2=%AppData%\QIP\Profiles\*\Jabber|*.*
FileKey3=%AppData%\QIP\Profiles\*\Logs|*.*
FileKey4=%AppData%\QIP\Profiles\*\PicHashes|*.*

[QIP 2012 Privacy Items *]
LangSecRef=3022
Detect=HKCU\Software\QIP
DetectFile=%AppData%\QIP
Warning=Selecting this will delete any contact list backups, chat history, received files, opened tabs settings and other non-encrypted privacy items.
FileKey1=%AppData%\QIP\Profiles\*|session.tabs
FileKey2=%AppData%\QIP\Profiles\*\BackupCL|*.*
FileKey3=%AppData%\QIP\Profiles\*\History|*.*|RECURSE
FileKey4=%AppData%\QIP\Profiles\*\ICQ|*.*|RECURSE
FileKey5=%AppData%\QIP\Profiles\*\RcvdFiles|*.*|RECURSE

[Qt Framework *]
LangSecRef=3021
Detect1=HKCU\Software\QtProject
Detect2=HKCU\Software\Trolltech
DetectFile=%LocalAppData%\cache\qtshadercache*
FileKey1=%LocalAppData%\cache\qtshadercache*|*.*
RegKey1=HKCU\Software\QtProject\OrganizationDefaults\FileDialog|lastVisited
RegKey2=HKCU\Software\Trolltech\OrganizationDefaults

[QTTabBar *]
LangSecRef=3024
Detect=HKCU\Software\Quizo\QTTabBar
FileKey1=%AppData%\QTTabBar|*.log
RegKey1=HKCU\Software\Quizo\QTTabBar|TabsOnLastClosedWindow
RegKey2=HKCU\Software\Quizo\QTTabBar\Cache
RegKey3=HKCU\Software\Quizo\QTTabBar\RecentlyClosed

[Quality Windows Audio/Video Experience *]
DetectOS=6.0|
LangSecRef=3025
Detect=HKLM\System\CurrentControlSet\services\QWAVE
FileKey1=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows|qwavecache.dat
FileKey2=%WinDir%\System32|qwavecache.dat

[Quick Batch File Compiler *]
LangSecRef=3024
Detect1=HKCU\Software\Abyssmedia\Quick Batch File Compiler
Detect2=HKCU\Software\qbfc
RegKey1=HKCU\Software\Abyssmedia\Quick Batch File Compiler\Settings|savedir
RegKey2=HKCU\Software\qbfc\RecentFiles

[QuickBooks *]
LangSecRef=3021
Detect=HKLM\Software\Intuit\QuickBooks
FileKey1=%CommonAppData%\Common Files\Intuit\Quickbooks\qbupdate\log|*.*
FileKey2=%CommonAppData%\Intuit\QBWebConnector\log|*.*
FileKey3=%CommonAppData%\Intuit\Quickbooks|*.log;qbsdklog.txt
FileKey4=%CommonAppData%\Intuit\QuickBooks DB Server Manager|*.log;*.old
FileKey5=%CommonProgramFiles%\Intuit\Quickbooks\QBUpdate\Log|*.*
FileKey6=%LocalAppData%\Intuit\QuickBooks\Log|*.*|RECURSE

[QuickDic History *]
LangSecRef=3021
DetectFile=%ProgramFiles%\QuickDic
FileKey1=%ProgramFiles%\QuickDic|QuickDic.ini

[Quicken *]
LangSecRef=3021
Detect1=HKLM\Software\Intuit\Quicken
Detect2=HKLM\Software\Quicken
FileKey1=%AppData%\Intuit\Quicken\Log|*.txt;*.log
FileKey2=%AppData%\Quicken\Log|*.txt;*.log
FileKey3=%CommonAppData%\Intuit\Quicken\Log|*.log
FileKey4=%CommonAppData%\Intuit\Quicken\Log\installer|*.*|REMOVESELF
FileKey5=%CommonAppData%\Intuit\SendError|*.log
FileKey6=%CommonAppData%\Quicken\Inet\QWWebData|Log.old
FileKey7=%CommonAppData%\Quicken\Inet\QWWebData\Cache|*.*
FileKey8=%CommonAppData%\Quicken\Inet\QWWebData\File System\Origins|Log.old
FileKey9=%CommonAppData%\Quicken\Inet\QWWebData\IndexedDB\*|Log.old
FileKey10=%CommonAppData%\Quicken\Inet\QWWebData\Local Storage\leveldb|Log.old;*tmp
FileKey11=%CommonAppData%\Quicken\Log|*.log
FileKey12=%CommonAppData%\Quicken\Log\installer|*.*|REMOVESELF
FileKey13=%CommonAppData%\Quicken\SendError|*.log
FileKey14=%LocalAppData%\Intuit\Common\Authorization\V1\Logs|*.txt
FileKey15=%LocalAppData%\Quicken\Common\Authorization\V1\Logs|*.txt
FileKey16=%ProgramFiles%\Quicken\PDFDrv|install.log;InstallPDFConverter.log

[Quicken WillMaker Plus *]
LangSecRef=3021
DetectFile=%LocalAppData%\Quicken WillMaker Plus*
FileKey1=%LocalAppData%\Quicken WillMaker Plus *|web update log.txt

[QuickPAR *]
LangSecRef=3024
Detect=HKCU\Software\QuickPar
FileKey1=%LocalAppData%\QuickPar|*.*

[QuickTime Player *]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.\QuickTime
RegKey1=HKLM\Software\Apple Computer, Inc.\QuickTime\Favorite Movies
RegKey2=HKLM\Software\Apple Computer, Inc.\QuickTime\Recent Movies
RegKey3=HKLM\Software\Wow6432Node\Apple Computer, Inc.\QuickTime\Favorite Movies
RegKey4=HKLM\Software\Wow6432Node\Apple Computer, Inc.\QuickTime\Recent Movies

[QuizUp *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\QuizUp.QuizUp_n36z36qeaxk8a
FileKey1=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Temp|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\QuizUp.QuizUp_*\LocalCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\QuizUp.QuizUp_*\LocalState\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\QuizUp.QuizUp_*\TempState|*.*|RECURSE

[QupZilla Portable Cookies *]
LangSecRef=3022
DetectFile=%SystemDrive%\PortableApps\QupZillaPortable\QupZillaPortable.exe
FileKey1=%SystemDrive%\PortableApps\QupZillaPortable\Data\profile|cookies.dat

[QupZilla Portable Local App Data *]
LangSecRef=3022
DetectFile=%SystemDrive%\PortableApps\QupZillaPortable\QupZillaPortable.exe
FileKey1=%SystemDrive%\PortableApps\QupZillaPortable\Data\QupZillaLocalAppData|*.*|RECURSE

[QupZilla Portable Network Cache *]
LangSecRef=3022
DetectFile=%SystemDrive%\PortableApps\QupZillaPortable\QupZillaPortable.exe
FileKey1=%SystemDrive%\PortableApps\QupZillaPortable\Data\profile\networkcache|*.*|RECURSE

[QupZilla Portable Session *]
LangSecRef=3022
DetectFile=%SystemDrive%\PortableApps\QupZillaPortable\QupZillaPortable.exe
FileKey1=%SystemDrive%\PortableApps\QupZillaPortable\Data\profile|session.dat*

[QupZilla Portable Thumbnails *]
LangSecRef=3022
DetectFile=%SystemDrive%\PortableApps\QupZillaPortable\QupZillaPortable.exe
FileKey1=%SystemDrive%\PortableApps\QupZillaPortable\Data\profile\thumbnails|*.*

[QupZilla Portable Webpage Icons *]
LangSecRef=3022
DetectFile=%SystemDrive%\PortableApps\QupZillaPortable\QupZillaPortable.exe
FileKey1=%SystemDrive%\PortableApps\QupZillaPortable\Data\profile|WebpageIcons.db

[Quran *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\57100Goheer.TheQuran_s6gg0ptmhrgye
FileKey1=%LocalAppData%\Packages\*Goheer.TheQuran_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*Goheer.TheQuran_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*Goheer.TheQuran_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*Goheer.TheQuran_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*Goheer.TheQuran_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*Goheer.TheQuran_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*Goheer.TheQuran_*\LocalState|*.*|RECURSE

[Qurb4 *]
LangSecRef=3021
DetectFile=%LocalAppData%\Qurb4
FileKey1=%LocalAppData%\Qurb4|*.log|RECURSE

[qutIM *]
LangSecRef=3022
Detect=HKCU\Software\qutIM
FileKey1=%AppData%\qutIM\avatars\*|*.*|RECURSE

[qutIM Chat History *]
LangSecRef=3022
Detect=HKCU\Software\qutIM
FileKey1=%AppData%\qutIM\history|*.*|RECURSE

[QwertyLab RunAsSystem *]
LangSecRef=3024
Detect=HKCU\Software\QwertyLab\RunAsSystem
RegKey1=HKCU\Software\QwertyLab\RunAsSystem\mru

[Qwest QuickCare *]
LangSecRef=3022
Detect=HKLM\Software\QuickCare
FileKey1=%CommonAppData%\Support.com|*.tmp|RECURSE
FileKey2=%LocalAppData%\SupportSoft|*.tmp|RECURSE

[R-Wipe & Clean *]
LangSecRef=3024
Detect=HKLM\Software\R-TT\RWC
FileKey1=%AppData%\R-TT|*.*|RECURSE
ExcludeKey1=PATH|%AppData%\R-TT\RWC\WL\|*.*

[RadeonPro *]
LangSecRef=3024
DetectFile=%AppData%\RadeonPro
FileKey1=%AppData%\RadeonPro|*.old;*.bak;*_bak.*;*.bkp
FileKey2=%AppData%\RadeonPro\Cache|*.*|RECURSE
FileKey3=%AppData%\RadeonPro\Temp|*.*|RECURSE

[Radialix 2 *]
LangSecRef=3021
Detect=HKCU\Software\Radialix
FileKey1=%ProgramFiles%\Radialix 2|*diz;*.txt;*.url

[RadioSure *]
LangSecRef=3023
Detect=HKCU\Software\RadioSure
FileKey1=%LocalAppData%\RadioSure\Log|*.*
FileKey2=%ProgramFiles%\RadioSure\Log|*.*

[Rage *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\9200
FileKey1=%AppData%\id software\rage|*.*|RECURSE

[Rainlendar 2 *]
LangSecRef=3021
DetectFile=%UserProfile%\.rainlendar2
FileKey1=%UserProfile%\.rainlendar2|rainlendar2.log

[Rainlendar 2 Backups *]
LangSecRef=3021
DetectFile=%UserProfile%\.rainlendar2
FileKey1=%UserProfile%\.rainlendar2\backups|*.*|RECURSE

[RAMExpert *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\RAMExpert
FileKey1=%AppData%\KC Softwares\RAMExpert|*.log

[Ranch Rush *]
Section=Games
Detect1=HKLM\Software\Big Fish Games\Persistence\Install\F2580T1L1
Detect2=HKLM\Software\Big Fish Games\Persistence\Install\F5659T1L1
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ranch Rush1.0
DetectFile=%ProgramFiles%\Ranch Rush
FileKey1=%CommonAppData%\FreshGames\RanchRush\*|*.log;temp_data.ssp
FileKey2=%ProgramFiles%\Ranch Rush*|*.html;*.nfo

[Razer Software *]
LangSecRef=3024
DetectFile=%CommonAppData%\Razer
FileKey1=%CommonAppData%\Razer\*|DiagnoseReport*.*.txt
FileKey2=%CommonAppData%\Razer\*\Logs|*.*
FileKey3=%CommonAppData%\Razer\Synapse\Accounts\*\DataSync|SyncDate.txt
FileKey4=%CommonAppData%\Razer\Synapse\ProductUpdates\Downloads|*.*
FileKey5=%LocalAppData%\Razer\RzUninstallation\Logs|*.*
FileKey6=%ProgramFiles%\Razer\*|*.log

[RCleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RCleaner\RCleaner.exe
FileKey1=%ProgramFiles%\RCleaner|log.txt

[Reader *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Reader_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Temp|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.Reader_*\TempState|*.*|RECURSE

[Real Network Monitor *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Real Network Monitor
FileKey1=%ProgramFiles%\Real Network Monitor|*.xml

[Realms of Arkania: Blade of Destiny *]
Section=Games
DetectFile=%Documents%\BladeofDestiny
FileKey1=%Documents%\BladeofDestiny\Consolelog|*.*|RECURSE

[RealPlayer Converter *]
LangSecRef=3023
Detect=HKCU\Software\RealNetworks\RealConverter
RegKey1=HKCU\Software\RealNetworks\RealJukebox\1.0\Preferences\WatchFolders

[RealPlayer Database *]
LangSecRef=3023
Detect=HKCU\Software\RealNetworks\RealPlayer
FileKey1=%AppData%\Real\RealPlayer\db|*.*|RECURSE

[Realtek *]
LangSecRef=3024
Detect=HKLM\Software\Realtek
FileKey1=%ProgramFiles%\Realtek*|*.*log;*.txt|RECURSE
FileKey2=%ProgramFiles%\Temp|*.*|REMOVESELF
FileKey3=%SystemDrive%|RHDSetup.log
ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\|InstCtrl.txt
ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\|setupctrl.txt

[Reckless Racing *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_*\AC\Microsoft\CryptnetUrlCache\*|*.*

[RecollX *]
LangSecRef=3021
DetectFile=%AppData%\Advansys\RecollX
FileKey1=%AppData%\Advansys\RecollX\log|*.*|RECURSE

[RecordPad Sound Recorder *]
LangSecRef=3023
DetectFile1=%ProgramFiles%\NCH Software\Recordpad\recordpad.exe
DetectFile2=%ProgramFiles%\NCH Swift Sound\Recordpad\recordpad.exe
FileKey1=%AppData%\NCH Software\RecordPad\logs|*.txt

[Recuva *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\Recuva
FileKey1=%ProgramFiles%\Recuva|*.log;Recuva_log*.txt
FileKey2=%UserProfile%|Recuva_log*.txt

[Reddit To Go! *]
LangSecRef=3031
DetectFile=%LocalAppData%\Packages\*.RedditToGo_*
FileKey1=%LocalAppData%\Packages\*.RedditToGo_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.RedditToGo_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*.RedditToGo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\*.RedditToGo_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\*.RedditToGo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\*.RedditToGo_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*.RedditToGo_*\RoamingState|history.txt
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\55382ross456.RedditToGo_02dxdbb1qg9kw\SearchHistory

[Reflector *]
LangSecRef=3021
DetectFile=%AppData%\Reflector
FileKey1=%AppData%\Reflector|*.log;*.dmp

[Reg Organizer *]
LangSecRef=3024
Detect=HKCU\Software\ChemTable Software\Reg Organizer
FileKey1=%LocalAppData%\ChemTable Software\Reg Organizer|*.log|RECURSE
FileKey2=%ProgramFiles%\Reg Organizer|*.txt

[RegAlyzer *]
LangSecRef=3024
Detect1=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer
Detect2=HKCU\Software\Safer Networking Limited\RegAlyzer
Detect3=HKLM\Software\Safer Networking Limited\HiveManager
FileKey1=%AppData%\Safer Networking\RegAlyzer|history.sqlite
RegKey1=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|LastKey
RegKey2=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|RemoteListHistory
RegKey3=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|SearchTerm
RegKey4=HKCU\Software\Safer Networking Limited\RegAlyzer|LastKey
RegKey5=HKCU\Software\Safer Networking Limited\RegAlyzer|RemoteListHistory
RegKey6=HKCU\Software\Safer Networking Limited\RegAlyzer|SearchTerm

[RegClean Pro *]
LangSecRef=3024
Detect=HKCU\Software\Systweak\RegClean Pro
DetectFile=%ProgramFiles%\RegClean Pro\RegCleanPro.exe
FileKey1=%AppData%\Systweak\RegClean Pro\Version 6.1|*.log

[RegCure Pro *]
LangSecRef=3024
DetectFile=%ProgramFiles%\ParetoLogic\RegCure Pro\RegCurePro.exe
FileKey1=%ProgramFiles%\ParetoLogic\RegCure Pro\html|*.htm

[RegDoctor *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegDoctor\RegDoctor.exe
FileKey1=%ProgramFiles%\RegDoctor\Backup|log.txt

[RegEditX *]
LangSecRef=3024
Detect=HKLM\Software\DCSoft\RegEditX
RegKey1=HKLM\Software\4Developers\RCrawler\History
RegKey2=HKLM\Software\4Developers\RCrawler\Settings|LastSearch

[ReGet Deluxe *]
LangSecRef=3022
Detect=HKCU\Software\ReGet Software\ReGetDx
FileKey1=%ProgramFiles%\ReGet Deluxe\history|*.*
RegKey1=HKCU\Software\ReGet Software\ReGetDx\FtpExplorer\Hist
RegKey2=HKCU\Software\ReGet Software\ReGetDx\History
RegKey3=HKCU\Software\ReGet Software\ReGetDx\Search\HistFind

[Registrar Registry Manager *]
LangSecRef=3024
Detect=HKCU\Software\Resplendence Sp\Registrar Registry Manager
RegKey1=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|ExportForm.saveDialogExportFilename
RegKey2=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|ExportForm.saveDialogExportInitialDir
RegKey3=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|LastOpenedKey

[Registry Crawler *]
LangSecRef=3024
Detect=HKLM\Software\4Developers\RCrawler
RegKey1=HKLM\Software\4Developers\RCrawler\History
RegKey2=HKLM\Software\4Developers\RCrawler\Settings|LastSearch

[Registry Drill *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easy Desk Utilities\Registry Drill\RegDrill.exe
FileKey1=%ProgramFiles%\Easy Desk Utilities\Registry Drill|*.log
FileKey2=%WinDir%\System32\config|Regdrill Compact.txt

[Registry First Aid *]
LangSecRef=3024
Detect=HKCU\Software\KsL Software\RFA
FileKey1=%LocalAppData%\Microsoft\Windows|NTUSER.tmp;UsrClass.tmp
FileKey2=%UserProfile%|NTUSER.tmp;UsrClass.tmp
FileKey3=%WinDir%\ServiceProfiles\*Service|*.tmp;*.tmp.LOG1;*.tmp.LOG2
FileKey4=%WinDir%\System32\config|*.tmp;*.tmp.LOG1;*.tmp.LOG2
FileKey5=%WinDir%\System32\config\systemprofile|*.tmp;*.tmp.LOG1;*.tmp.LOG2
FileKey6=%WinDir%\SysWOW64\config\systemprofile|*.tmp;*.tmp.LOG1;*.tmp.LOG2

[Registry Help Pro *]
LangSecRef=3024
DetectFile=%AppData%\Registry Help Pro
FileKey1=%AppData%\Registry Help Pro|*Log.txt

[Registry Life *]
LangSecRef=3024
Detect=HKCU\Software\ChemTable Software\Registry Life
DetectFile=%ProgramFiles%\Registry Life\RegistryLife.exe
FileKey1=%ProgramFiles%\Registry Life|*.txt
FileKey2=%ProgramFiles%\Registry Life\Setup|*.exe
RegKey1=HKCU\Software\ChemTable Software\Registry Life\ExploredKeysEx

[Registry Mechanic *]
LangSecRef=3024
Detect=HKLM\Software\PCTools\Registry Mechanic
FileKey1=%AppData%\Registry Mechanic\log|*.html
FileKey2=%ProgramFiles%\Registry Mechanic\log*|*.*

[Registry Mighty *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Registry Mighty\RegistryMighty.exe
FileKey1=%ProgramFiles%\Registry Mighty|errorlist.txt;ScanResult

[Registry Recon *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Arsenal Recon\Registry Recon\RegistryRecon.exe
FileKey1=%ProgramFiles%\Arsenal Recon\Registry Recon|RegistryRecon.db
FileKey2=%ProgramFiles%\Arsenal Recon\Registry Recon\Log|*.log
FileKey3=%ProgramFiles%\Arsenal Recon\Registry Recon\OutputData|*.log|RECURSE

[Registry Recovery Toolbox *]
LangSecRef=3024
Detect=HKCU\Software\Registry Recovery Toolbox
FileKey1=%LocalAppData%\Recovery Toolbox for Registry|*.log
FileKey2=%LocalAppData%\Registry Recovery Toolbox|*.log
RegKey1=HKCU\Software\Registry Recovery Toolbox\List Source Registry Files Ext

[Registry Winner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Registry Winner\RegistryWinner.exe
FileKey1=%ProgramFiles%\Registry Winner|*.bak

[RegistryFix *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegistryFix\RegistryFix.exe
FileKey1=%ProgramFiles%\RegistryFix\logs|*.*

[RegScrubVistaXP *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegScrubVistaXP
FileKey1=%ProgramFiles%\RegScrubVistaXP|*.reg;*.rsf;RegEditX.sav

[RegServo *]
LangSecRef=3024
DetectFile=%CommonAppData%\regservo
FileKey1=%CommonAppData%\regservo\Logs|*.*|RECURSE

[RegToBat *]
LangSecRef=3024
Detect=HKLM\Software\BlueLife\RegToBat
RegKey1=HKLM\Software\BlueLife\RegToBat|LastRegFile

[RegVac Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\RegVac Registry Cleaner\regvac.exe
FileKey1=%ProgramFiles%\RegVac Registry Cleaner|*.xml;cantremove.txt;Undo*.reg
FileKey2=%WinDir%\System32\RegVac|*.*|REMOVESELF

[RegWork *]
LangSecRef=3021
DetectFile=%ProgramFiles%\RegWork
FileKey1=%ProgramFiles%\RegWork\Logs|*.*
FileKey2=%ProgramFiles%\RegWork\Tmp|*.*

[Reign: Conflict of Nations *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\46380
FileKey1=%LocalAppData%\1C\Reign Conflict of Nations|PSPLog.log

[Relic Downloader *]
Section=Games
DetectFile=%Documents%\My Games\Company of Heroes*
FileKey1=%Documents%\My Games\RelicDownloader|*.log

[Remote Desktop *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Terminal Server Client
Warning=This will reset all Remote Desktop Connection settings.
FileKey1=%Documents%|*.rdp

[Rename Us *]
LangSecRef=3024
Detect=HKCU\Software\Vitaliy Levchenko\Renamus
RegKey1=HKCU\Software\Vitaliy Levchenko\Renamus\Recent Projects
RegKey2=HKCU\Software\Vitaliy Levchenko\Renamus\Settings|LastFolder

[Replay Media Catcher *]
LangSecRef=3022
Detect=HKLM\Software\Applian Technologies\Replay Media Catcher 5
DetectFile=%AppData%\Replay Media Catcher 4
FileKey1=%AppData%\Replay Media Catcher 4|*.log
FileKey2=%AppData%\Replay Media Catcher 4\History|*.*|REMOVESELF
FileKey3=%LocalAppData%\Replay Media Catcher 5\History|*.*|REMOVESELF
FileKey4=%LocalAppData%\Replay Media Catcher 5\Temp|*.*|REMOVESELF
FileKey5=%LocalAppData%\Replay Media Catcher 5\UrlCache|*.*|REMOVESELF
FileKey6=%ProgramFiles%\Applian Technologies\Replay Media Catcher*|*.html;*.txt;*.rtf

[Resilio Sync *]
LangSecRef=3024
DetectFile=%AppData%\Resilio Sync
FileKey1=%AppData%\Resilio Sync|*.journal;*.journal.zip;*.log;*.old;history.dat

[Resource Hacker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Resource Hacker\ResHacker.exe
FileKey1=%ProgramFiles%\Resource Hacker|ResHacker.ini;reshacker.GID

[Restorator 2007 *]
LangSecRef=3021
Detect=HKCU\Software\Bomers\Restorator
RegKey1=HKCU\Software\Bomers\Restorator\Restorator\Current|LastSearchString
RegKey2=HKCU\Software\Bomers\Restorator\Restorator\FindDialog
RegKey3=HKCU\Software\Bomers\Restorator\Restorator\GrabDialog
RegKey4=HKCU\Software\Bomers\Restorator\Restorator\LastFoundFiles
RegKey5=HKCU\Software\Bomers\Restorator\Restorator\MRUList

[Restore Point Creator *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{CC48DE1C-8EC2-43BC-9201-29701CD9AE13}_is1
FileKey1=%CommonAppData%|Restore Point Creator.log
FileKey2=%ProgramFiles%\Restore Point Creator|*.log;*.txt

[ResumeMaker *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D2E80193-7318-4707-A9DE-49AF663ADA73}
FileKey1=%CommonAppData%\Individual Software\ResumeMaker\R12|*.log

[Reus *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\222730
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Reus|errorReport*.txt

[Revenge of the Titans *]
Section=Games
DetectFile=%UserProfile%\.revenge_of_the_titans_1.80
FileKey1=%UserProfile%\.revenge_of_the_titans_1.80|*.log

[Revo Uninstaller Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\VS Revo group
FileKey1=%LocalAppData%\VS Revo Group\Revo Uninstaller*\BackupsData|*.*|RECURSE
FileKey2=%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro|*.bak

[Ride! *]
Section=Games
Detect1=HKLM\Software\Big Fish Games\Persistence\Install\F2440T1L1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\BFG-Ride!
DetectFile=%ProgramFiles%\Ride!
FileKey1=%ProgramFiles%\Ride!|*.log;*.txt|RECURSE
FileKey2=%ProgramFiles%\Ride!\DirectX9|*.*|REMOVESELF

[Riding Academy 3D *]
Section=Games
Detect=HKCU\Software\Program-Ace\RidingAcademy3D
FileKey1=%LocalAppData%\Riding Academy 3D\logs|*.*

[Riding Star 3 *]
Section=Games
Detect=HKLM\Software\DTP\Riding Star 3
FileKey1=%ProgramFiles%\Riding Star 3|INSTALL.LOG;log.txt

[RIFT *]
Section=Games
DetectFile=%Documents%\RIFT
FileKey1=%AppData%\RIFT|*.log
FileKey2=%Documents%\RIFT|*.log
FileKey3=%ProgramFiles%\RIFT|*.log
FileKey4=%Public%\Games\RIFT|*.log
FileKey5=%SystemDrive%\RIFT|*.log

[Ring Central *]
LangSecRef=3022
DetectFile=%CommonAppData%\RingCentral
FileKey1=%CommonAppData%\RingCentral\LogFiles|*.*

[Rise of Nations *]
Section=Games
Detect1=HKCU\Software\Microsoft\Microsoft Games\Rise of Nations
Detect2=HKCU\Software\Microsoft\Microsoft Games\RiseofNationsExpansion
FileKey1=%AppData%\Microsoft Games\Rise of Nations\Logs|*.*
FileKey2=%ProgramFiles%\Microsoft Games\Rise of Nations\Logs|*.*

[Rise of the Tomb Raider *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\391220
FileKey1=%Documents%\Rise of the Tomb Raider|*.log

[Rkill *]
LangSecRef=3024
DetectFile1=%UserProfile%\Desktop\Rkill
DetectFile2=%UserProfile%\Desktop\Rkill.txt
FileKey1=%UserProfile%\Desktop|*rkill*.*
FileKey2=%UserProfile%\Desktop\Rkill|*.*|REMOVESELF

[Roadkil's Unstoppable Copier *]
LangSecRef=3024
Detect=HKCU\Software\Roadkil
RegKey1=HKCU\Software\Roadkil|Source_Unstp
RegKey2=HKCU\Software\Roadkil|Target_Unstp

[Roblox *]
Section=Games
DetectFile=%LocalAppData%\Roblox
FileKey1=%LocalAppData%\Roblox\Logs|*.*|RECURSE
FileKey2=%LocalLowAppData%\RbxLogs|*.*|RECURSE

[Roblox Downloads *]
Section=Games
DetectFile=%LocalAppData%\Roblox
FileKey1=%LocalAppData%\Roblox\Downloads|*.*|RECURSE

[RoboBasket3 *]
LangSecRef=3024
DetectFile=%AppData%\RoboBasket3
Warning=This may prompt you with an error upon trying to view the log. Just click continue.
FileKey1=%AppData%\RoboBasket3|log.database

[Rochard *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\107800
FileKey1=%LocalLowAppData%\Recoil Games\Rochard|journal.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Rochard\Rochard_Data|Output_log.txt

[Rock of Ages *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\22230
Detect2=HKLM\Software\ACE Team\Rock of Ages
FileKey1=%ProgramFiles%\ATLUS\Rock of Ages\Prerequisites|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Steam\steamapps\common\Rock of Ages\Prerequisites|*.*|REMOVESELF

[Rocket League *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252950
FileKey1=%Documents%\My Games\Rocket League\TAGame\Logs|*.*

[Rockstar Games Launcher *]
Section=Games
DetectFile=%Documents%\Rockstar Games
FileKey1=%Documents%\Rockstar Games\Launcher|*.log
FileKey2=%Documents%\Rockstar Games\Social Club|*.log

[RollBack Rx *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Shield
FileKey1=%ProgramFiles%\Shield|*.log

[ROM With a View - Director's Cut *]
LangSecRef=3023
Detect=HKCU\Software\Moon Valley Software
RegKey1=HKCU\Software\Moon Valley Software\CD Ultra\Recent File List
RegKey2=HKCU\Software\Moon Valley Software\ROM With a View - Director's Cut\Recent File List

[Rosegarden *]
LangSecRef=3023
Detect=HKCU\Software\Rosegardenmusic\Rosegarden
DetectFile=%ProgramFiles%\Xylgo\Rosegarden\rosegarden.exe
RegKey1=HKCU\Software\Rosegardenmusic\Rosegarden|recent-0
RegKey2=HKCU\Software\Rosegardenmusic\Rosegarden|recent-1
RegKey3=HKCU\Software\Rosegardenmusic\Rosegarden|recent-2
RegKey4=HKCU\Software\Rosegardenmusic\Rosegarden|recent-3
RegKey5=HKCU\Software\Rosegardenmusic\Rosegarden|recent-4
RegKey6=HKCU\Software\Rosegardenmusic\Rosegarden|recent-5
RegKey7=HKCU\Software\Rosegardenmusic\Rosegarden|recent-6
RegKey8=HKCU\Software\Rosegardenmusic\Rosegarden|recent-7
RegKey9=HKCU\Software\Rosegardenmusic\Rosegarden|recent-8
RegKey10=HKCU\Software\Rosegardenmusic\Rosegarden|recent-9

[Roxio *]
LangSecRef=3021
Detect=HKCU\Software\Roxio
FileKey1=%AppData%\Roxio Burn\Temp|*.*|RECURSE
FileKey2=%AppData%\Roxio Log Files|*.*|RECURSE
FileKey3=%AppData%\Roxio\Dragon\3.x\*Logs|*.log
FileKey4=%AppData%\Roxio\Dragon\3.x\DiscInfoCache|*.tmp
FileKey5=%CommonAppData%\Roxio|*.log;cardinfo.*
FileKey6=%LocalAppData%|rx_audio.Cache;rx_image32.Cache
FileKey7=%WinDir%\System32\config\systemprofile\AppData\Roaming\Roxio Log Files|*.*|RECURSE
FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Roxio Log Files|*.*|RECURSE

[Roxio Creator Pro *]
LangSecRef=3021
Detect1=HKCU\Software\Roxio\EMC13
Detect2=HKCU\Software\Roxio\EMC14
FileKey1=%Documents%\Roxio\Music Disc Creator|*.*
RegKey1=HKCU\Software\Roxio\EMC13\VideoUI\RecentFiles\Catalogs
RegKey2=HKCU\Software\Roxio\EMC14\Label Creator\Recent File List
RegKey3=HKCU\Software\Roxio\EMC14\MusicDiscCreator\Directories
RegKey4=HKCU\Software\Roxio\EMC14\MusicDiscCreator\MediaSelector
RegKey5=HKCU\Software\Roxio\EMC14\PhotoSuite\RoxioPhotoSuite\MRUFiles
RegKey6=HKCU\Software\Roxio\EMC14\SoundEdit\Directories
RegKey7=HKCU\Software\Roxio\EMC14\SoundEdit\MediaSelector
RegKey8=HKCU\Software\Roxio\EMC14\SoundEdit\WaveCache
RegKey9=HKCU\Software\Roxio\EMC14\VideoConvert\Directories
RegKey10=HKCU\Software\Roxio\EMC14\VideoConvert\MediaSelector
RegKey11=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Albums
RegKey12=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Catalogs
RegKey13=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\DVD Projects
RegKey14=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Productions
RegKey15=HKLM\Software\Roxio\EMC13\Common SDK\Users
RegKey16=HKLM\Software\Roxio\EMC14\Common SDK\Users
RegKey17=HKLM\Software\Wow6432Node\Roxio\EMC13\Common SDK\Users
RegKey18=HKLM\Software\Wow6432Node\Roxio\EMC14\Common SDK\Users

[RssBandit *]
LangSecRef=3022
DetectFile=%AppData%\RssBandit
FileKey1=%AppData%\RssBandit|*.bak;*.log

[rtmpGUI .swfinfo *]
LangSecRef=3024
DetectFile=%UserProfile%\.swfinfo
FileKey1=%UserProfile%|.swfinfo

[Rust *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252490
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Rust|debug_steamclient.txt

[SABnzbd *]
LangSecRef=3021
DetectFile=%LocalAppData%\sabnzbd
FileKey1=%LocalAppData%\sabnzbd\admin|history1.db;totals9.sab
FileKey2=%LocalAppData%\sabnzbd\logs|*.*

[SABnzbd Backups *]
LangSecRef=3022
Detect=HKCU\Software\SABnzbd
FileKey1=%LocalAppData%\SABnzbd|*.bak

[Safari *]
LangSecRef=3028
DetectFile=%ProgramFiles%\Safari\Safari.exe
FileKey1=%AppData%\Apple Computer\Logs|*.*
FileKey2=%LocalAppData%\Apple Computer\com.apple.Safari.PrivateBrowsing|Cache.db
FileKey3=%LocalAppData%\Apple Computer\Safari|WebpageIcons.db

[Sage ACT! *]
LangSecRef=3021
Detect=HKLM\Software\ACT
FileKey1=%CommonAppData%\Sage Software, Inc\ACT! by Sage\ActUpdate|*.*|RECURSE

[Sage Simply Accounting *]
LangSecRef=3021
Detect=HKLM\Software\Sage Software\Simply Accounting
FileKey1=%CommonAppData%\Sage Software\Simply Accounting\Download|*.*|RECURSE

[SageThumbs *]
LangSecRef=3021
DetectFile=%ProgramFiles%\SageThumbs\64\SageThumbs.dll
FileKey1=%LocalAppData%|SageThumbs.*

[SAM Broadcaster *]
LangSecRef=3023
Detect=HKCU\Software\SAMBC
FileKey1=%LocalAppData%\SpacialAudio\SAMBC|*.log|RECURSE
FileKey2=%LocalAppData%\SpacialAudio\SAMBC\backup|*.*|RECURSE

[Samsung Kies *]
LangSecRef=3023
Detect1=HKCU\Software\Samsung\Kies2.0
Detect2=HKCU\Software\Samsung\Kies3.0
Detect3=HKLM\Software\SAMSUNG\USB_DRIVER
FileKey1=%AppData%\Samsung\Kies|*.mlca;*.mlme;*.mlpb;*.mlpgb|RECURSE
FileKey2=%CommonAppData%\Samsung\Device Error Recovery|*.*
FileKey3=%CommonAppData%\Samsung\Kies|Kiesairmessage.log
FileKey4=%Documents%\samsung\Kies3\backup|*.dmp|RECURSE
FileKey5=%Documents%\SelfMV|*.log

[Samsung Kies Backups *]
LangSecRef=3023
Detect1=HKCU\Software\Samsung\Kies2.0
Detect2=HKCU\Software\Samsung\Kies3.0
Warning=Removing backups will prevent you from restoring your data later.
FileKey1=%Documents%\samsung\Kies*\backup|*.*|RECURSE

[Samsung Magician *]
LangSecRef=3024
Detect=HKLM\Software\Samsung Magician
FileKey1=%CommonAppData%\Samsung\Backup|*.exe
FileKey2=%CommonAppData%\Samsung\Samsung Magician|*.exe|RECURSE
FileKey3=%CommonAppData%\Samsung\Samsung Magician\PB|*.txt
FileKey4=%ProgramFiles%\Samsung Magician\Logs|*.*
FileKey5=%ProgramFiles%\Samsung\Samsung Magician\Log*|*.*
FileKey6=%SystemDrive%\MagicianPerf*|*.*|REMOVESELF
RegKey1=HKCU\Software\Local AppWizard-Generated Applications\SamsungMagician

[Sanctum *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\91600
FileKey1=%Documents%\My Games\Sanctum\SanctumGame\Logs|*.*

[Santa Ride! 2 *]
Section=Games
Detect=HKLM\Software\Invictus-Games\Santa Ride 2
DetectFile=%ProgramFiles%\Invictus Games\Santa Ride! 2\SR2.exe
FileKey1=%ProgramFiles%\Invictus Games\Santa Ride! 2|*.log

[Santa's Rampage *]
Section=Games
DetectFile=%ProgramFiles%\*Santa* Rampage
FileKey1=%ProgramFiles%\*Santa* Rampage|*.diz;*.nfo;*.txt;*.url;dotNetFx40_Full_setup.exe|RECURSE
FileKey2=%ProgramFiles%\*Santa* Rampage\Redist|*.*|REMOVESELF
FileKey3=%ProgramFiles%\*Santa* Rampage\UDKGame\Logs|*.*|REMOVESELF
ExcludeKey1=FILE|%ProgramFiles%\*Santa* Rampage\UDKGame\CookedPC\|Manifest.txt
ExcludeKey2=PATH|%ProgramFiles%\*Santa* Rampage\Binaries\Win32\|*.*
ExcludeKey3=PATH|%ProgramFiles%\*Santa* Rampage\Binaries\Win64\|*.*
ExcludeKey4=PATH|%ProgramFiles%\*Santa* Rampage\UDKGame\Script\|*.*

[Sauerbraten *]
Section=Games
DetectFile=%ProgramFiles%\Sauerbraten\bin\sauerbraten.exe
FileKey1=%Documents%\My Games\Crash|*.log
FileKey2=%Documents%\My Games\Sauerbraten|log.txt
FileKey3=%ProgramFiles%\Sauerbraten\packages\base|*.bak|RECURSE

[SavingsBull *]
LangSecRef=3022
DetectFile=%ProgramFiles%\SavingsBullFilter
FileKey1=%WinDir%\System32|SavingsBullFilterService.log

[SBCleaner *]
LangSecRef=3024
DetectFile=%CommonAppData%\CzechMex LLC\SBCleaner*
FileKey1=%CommonAppData%\CzechMex LLC\SBCleaner\Logs|*.LOG
FileKey2=%CommonAppData%\CzechMex LLC\SBCleanerFree\Logs|*.LOG

[SBMAV Disk Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\SBMAV Software\Disk Cleaner
FileKey1=%AppData%\SBMAV Disk Cleaner|dcleaner.log
FileKey2=%ProgramFiles%\SBMAV Disk Cleaner|*.rtf

[Scan *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsScan_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsScan_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsScan_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsScan_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsScan_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp

[ScanDefrag *]
LangSecRef=3024
Detect=HKLM\Software\ScanDefrag
FileKey1=%SystemDrive%\ScanDefrag|*.log
FileKey2=%SystemDrive%\ScanDefrag\logs|*.txt

[ScanSnap *]
LangSecRef=3021
Detect=HKCU\Software\PFU\ScanToOffice
DetectFile1=%CommonProgramFiles%\PFU\ScanSnap\ScanToOffice
DetectFile2=%ProgramFiles%\PFU\ScanSnap
FileKey1=%CommonProgramFiles%\PFU\ScanSnap\ScanToOffice|*.log|RECURSE
FileKey2=%LocalAppData%\PFU|*.log|RECURSE
FileKey3=%LocalAppData%\PFU\SSFolderTemp|*.*|RECURSE
FileKey4=%ProgramFiles%\PFU|*.log|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\PFU|*.log|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\PFU\SSFolderTemp|*.*|RECURSE
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\PFU|*.log|RECURSE
FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\PFU\SSFolderTemp|*.*|RECURSE
RegKey1=HKCU\Software\PFU\ScanToOffice\History

[Screenpresso *]
LangSecRef=3024
DetectFile=%AppData%\Learnpulse\Screenpresso
FileKey1=%AppData%\Learnpulse\Screenpresso|settings.copy.xml
FileKey2=%Pictures%\Screenpresso\Thumbnails|*.*|RECURSE

[Screenshot Index *]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=This resets screenshot naming back to "Screenshot (1).png".
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer|ScreenshotIndex

[Scribe Finished Jobs *]
LangSecRef=3021
Detect=HKCU\Software\NCH Software\Scribe
Warning=This will delete copies of files related you have run through Scribe.
FileKey1=%AppData%\NCH Software\Scribe\Done|*.*

[Scribus *]
LangSecRef=3023
DetectFile=%AppData%\Scribus
FileKey1=%AppData%\Scribus\scrapbook\tmp|*.*|RECURSE

[ScummVM *]
Section=Games
DetectFile=%AppData%\ScummVM
FileKey1=%AppData%\ScummVM\logs|*.*

[SdfBrowser *]
LangSecRef=3024
DetectFile=%AppData%\BokorBéla\SdfBrowser
FileKey1=%AppData%\BokorBéla\SdfBrowser|*.log

[Seagate Dashboard *]
LangSecRef=3024
Detect=HKLM\Software\Seagate\Seagate Dashboard\CurrentVersion
FileKey1=%AppData%\Seagate\Seagate Dashboard\logs|MemeoLauncher.exe.log;SeagateDashboard-*.log;MemeoLauncher.exe.log-*.log;MemeoUpdater.exe.log;MemeoUpdater.exe.log-*.log
FileKey2=%WinDir%\System32\config\systemprofile\AppData\Roaming\Seagate\Seagate Dashboard\logs|SeagateDashboardService;SeagateDashboardService-*.log
FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Seagate\Seagate Dashboard\logs|SeagateDashboardService;SeagateDashboardService-*.log

[Seagate SeaTools for Windows *]
LangSecRef=3024
Detect=HKLM\Software\SeaToolsforWindows
FileKey1=%AppData%\Dexpot|*.log
FileKey2=%ProgramFiles%\Seagate\SeaTools for Windows|*.log

[Search History *]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps

[Second Copy *]
LangSecRef=3024
Detect=HKCU\Software\Centered Systems\Second Copy 2000
DetectFile=%LocalAppData%\Centered Systems\Second Copy
FileKey1=%LocalAppData%\Centered Systems\Second Copy|log*.*
FileKey2=%ProgramFiles%\SecCopy|log.rtf;log-old.rtf
RegKey1=HKCU\Software\Centered Systems\Second Copy 2000\MRU

[SecondLife *]
LangSecRef=3021
DetectFile=%AppData%\SecondLife
FileKey1=%AppData%\SecondLife\*|*.log;*.txt;screen_last.bmp;url_history.xml|RECURSE
FileKey2=%AppData%\SecondLife\Logs|*.*

[SecondLife Cache *]
LangSecRef=3021
DetectFile=%AppData%\SecondLife
FileKey1=%AppData%\SecondLife\*\Browser_Profile\Cache|*.*|RECURSE
FileKey2=%AppData%\SecondLife\*\cache|*.*|RECURSE
FileKey3=%AppData%\SecondLife\cache|*.*|RECURSE

[SecureCRT *]
LangSecRef=3021
Detect=HKCU\Software\VanDyke\SecureCRT
FileKey1=%AppData%\VanDyke\SecureCRT\Config|Recent File List.ini;Recent Script List.ini

[SecureDownloadManager *]
LangSecRef=3022
Detect=HKCU\Software\e-academy Inc.\SecureDownloadManager
FileKey1=%LocalAppData%\e-academy Inc\SecureDownloadManager|*.log
RegKey1=HKCU\Software\e-academy Inc.\SecureDownloadManager\Recent File list

[SecurityXploded Directory Scanner *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\DirectoryScanner
RegKey1=HKCU\Software\SecurityXploded\DirectoryScanner|EndHostAddress
RegKey2=HKCU\Software\SecurityXploded\DirectoryScanner|StartHostAddress

[SecurityXploded FTP Password Kracker *]
LangSecRef=3024
Detect=HKCU\Software\FTP Password Kracker
RegKey1=HKCU\Software\FTP Password Kracker|File
RegKey2=HKCU\Software\FTP Password Kracker|Port
RegKey3=HKCU\Software\FTP Password Kracker|ServerAddress
RegKey4=HKCU\Software\FTP Password Kracker|Username

[SecurityXploded Hash Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\HashKracker
RegKey1=HKCU\Software\SecurityXploded\HashKracker|File
RegKey2=HKCU\Software\SecurityXploded\HashKracker|Hash
RegKey3=HKCU\Software\SecurityXploded\HashKracker|Type

[SecurityXploded LDAP Password Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\LDAPPasswordKracker
RegKey1=HKCU\Software\SecurityXploded\LDAPPasswordKracker|File
RegKey2=HKCU\Software\SecurityXploded\LDAPPasswordKracker|Port
RegKey3=HKCU\Software\SecurityXploded\LDAPPasswordKracker|ServerAddress
RegKey4=HKCU\Software\SecurityXploded\LDAPPasswordKracker|Username

[SecurityXploded LDAP Search *]
LangSecRef=3024
Detect=HKCU\Software\LDAPSearch_Nag
RegKey1=HKCU\Software\LDAPSearch_Nag|BaseDN
RegKey2=HKCU\Software\LDAPSearch_Nag|CertPath
RegKey3=HKCU\Software\LDAPSearch_Nag|IPAddress
RegKey4=HKCU\Software\LDAPSearch_Nag|LoginDN
RegKey5=HKCU\Software\LDAPSearch_Nag|Port

[SecurityXploded Mysql Password Auditor *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\MysqlPasswordAuditor
RegKey1=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|File
RegKey2=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|Port
RegKey3=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|ServerAddress
RegKey4=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|Username

[SecurityXploded Net Database Scanner *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\NetDatabaseScanner
RegKey1=HKCU\Software\SecurityXploded\NetDatabaseScanner|DatabaseType
RegKey2=HKCU\Software\SecurityXploded\NetDatabaseScanner|EndHostAddress
RegKey3=HKCU\Software\SecurityXploded\NetDatabaseScanner|StartHostAddress

[SecurityXploded Router Password Kracker *]
LangSecRef=3024
Detect1=HKCU\Software\RouterPasswordKracker
Detect2=HKCU\Software\SecurityXploded\RouterPasswordDecryptor
RegKey1=HKCU\Software\RouterPasswordKracker|File
RegKey2=HKCU\Software\RouterPasswordKracker|ServerAddress
RegKey3=HKCU\Software\RouterPasswordKracker|Username
RegKey4=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|File
RegKey5=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|ServerAddress
RegKey6=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|Username

[SecurityXploded Salted Hash Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\SaltedHashKracker
RegKey1=HKCU\Software\SecurityXploded\SaltedHashKracker|File
RegKey2=HKCU\Software\SecurityXploded\SaltedHashKracker|Hash
RegKey3=HKCU\Software\SecurityXploded\SaltedHashKracker|Salt
RegKey4=HKCU\Software\SecurityXploded\SaltedHashKracker|Type

[SecurityXploded SSL Certificate Scanner *]
LangSecRef=3024
Detect1=HKCU\Software\SecurityXploded\SSLCertScanner
Detect2=HKCU\Software\SSLCertScanner
RegKey1=HKCU\Software\SecurityXploded\SSLCertScanner|Port
RegKey2=HKCU\Software\SecurityXploded\SSLCertScanner|ServerAddress
RegKey3=HKCU\Software\SSLCertScanner|Port
RegKey4=HKCU\Software\SSLCertScanner|ServerAddress

[SecurityXploded Virus Total Scanner *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\VirusTotalScanner
RegKey1=HKCU\Software\SecurityXploded\VirusTotalScanner|File

[SecurityXploded Wi-Fi Network Monitor *]
LangSecRef=3024
Detect1=HKCU\Software\SecurityXploded\WiFiNetworkMonitor
Detect2=HKCU\Software\WiFi Network Monitor
RegKey1=HKCU\Software\SecurityXploded\WiFiNetworkMonitor|EndHostAddress
RegKey2=HKCU\Software\SecurityXploded\WiFiNetworkMonitor|StartHostAddress
RegKey3=HKCU\Software\WiFi Network Monitor|EndHostAddress
RegKey4=HKCU\Software\WiFi Network Monitor|StartHostAddress

[SecurityXploded Windows Password Kracker *]
LangSecRef=3024
Detect=HKCU\Software\SecurityXploded\WindowsPasswordKracker
RegKey1=HKCU\Software\SecurityXploded\WindowsPasswordKracker|File
RegKey2=HKCU\Software\SecurityXploded\WindowsPasswordKracker|Hash

[SecuROM Diagnostics Tool *]
Section=Games
DetectFile1=%SystemDrive%\AnalysisLog.sr0
DetectFile2=%UserProfile%\Desktop\AnalysisLog.sr0
FileKey1=%SystemDrive%|AnalysisLog.sr0
FileKey2=%UserProfile%\Desktop|AnalysisLog.sr0

[Sendori *]
LangSecRef=3022
DetectFile=%CommonAppData%\Sendori
FileKey1=%CommonAppData%\Sendori|*.log

[Serious Sam *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\41000
Detect2=HKCU\Software\Valve\Steam\Apps\41010
Detect3=HKCU\Software\Valve\Steam\Apps\41014
Detect4=HKCU\Software\Valve\Steam\Apps\41050
Detect5=HKCU\Software\Valve\Steam\Apps\41060
Detect6=HKCU\Software\Valve\Steam\Apps\41070
Detect7=HKCU\Software\Valve\Steam\Apps\204340
Detect8=HKCU\Software\Valve\Steam\Apps\227780
Detect9=HKCU\Software\Valve\Steam\Apps\564310
FileKey1=%ProgramFiles%\Steam\steamApps\Common\Serious Sam *|*.log
FileKey2=%ProgramFiles%\Steam\steamApps\Common\Serious Sam *\Log|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\steamApps\Common\Serious Sam *\Temp|*.*

[ServeToMe *]
LangSecRef=3023
DetectFile=%AppData%\ProjectsWithLove\ServeToMe
FileKey1=%AppData%\ProjectsWithLove\ServeToMe\Fontcache|*.*

[Serviio *]
LangSecRef=3024
Detect=HKLM\Software\Serviio
FileKey1=%ProgramFiles%\Serviio\log|*.*

[SetRegistryKey Leftovers *]
LangSecRef=3025
Detect=HKCU\Software\Local AppWizard-Generated Applications
Warning=Running this entry will cause it to self destruct and no longer appear. This is the intended behavior.
RegKey1=HKCU\Software\Local AppWizard-Generated Applications

[Settings *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SearchHistory

[Shareaza *]
LangSecRef=3022
Detect=HKCU\Software\BHO Shareaza
FileKey1=%LocalAppData%\Shareaza\Incomplete|*.*

[ShareX *]
LangSecRef=3021
DetectFile=%ProgramFiles%\ShareX
FileKey1=%Documents%\ShareX|History.xml
FileKey2=%Documents%\ShareX\Backup|*.*|RECURSE
FileKey3=%Documents%\ShareX\Logs|*.*|RECURSE

[ShareX App *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\19568ShareX.ShareX_egrzcvs15399j
FileKey1=%Documents%\ShareX|History.xml
FileKey2=%Documents%\ShareX\Backup|*.*|RECURSE
FileKey3=%Documents%\ShareX\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\19568ShareX.ShareX_*\AC\INet*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\19568ShareX.ShareX_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\19568ShareX.ShareX_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\19568ShareX.ShareX_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\19568ShareX.ShareX_*\TempState|*.*|RECURSE

[Sharing MFU *]
DetectOS=6.2|6.3
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Warning=This will remove the frequently shared list. This does not remove the apps listed under sharing.
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU

[Shark Dash *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\GAMELOFTSA.SharkDashByGameloft_0pp20fcewvvtj
FileKey1=%LocalAppData%\Packages\GAMELOFTSA.SharkDashByGameloft_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\GAMELOFTSA.SharkDashByGameloft_*\AC\Microsoft\CryptnetUrlCache\*|*.*

[Shatter *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\20820
FileKey1=%ProgramFiles%\Steam\steamapps\common\Shatter|log.txt

[Shattered Horizon *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\18110
DetectFile=%LocalAppData%\Futuremark\Shattered Horizon
FileKey1=%LocalAppData%\Futuremark\Shattered Horizon\cache|*.*|REMOVESELF
FileKey2=%LocalAppData%\Futuremark\Shattered Horizon\crash_dumps|*.*

[Shell Experience Host *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\Microsoft\Windows\*|*.*|REMOVESELF
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\TempState|*.*|RECURSE

[Shipping Assistant *]
LangSecRef=3021
DetectFile=%LocalAppData%\ShippingAssistant
FileKey1=%LocalAppData%\ShippingAssistant\Logs|*.*|RECURSE

[ShortKeys *]
LangSecRef=3021
Detect=HKCU\Software\Insight Software Solutions\ShortKeys
RegKey1=HKCU\Software\Insight Software Solutions\ShortKeys\MRU

[Should I Remove It? *]
LangSecRef=3024
Detect=HKCU\Software\Reason
FileKey1=%ProgramFiles%\Reason\Should I Remove It|programdata.dat
RegKey1=HKCU\Software\Reason\ShouldIRemoveIt\Cache

[Shuffle Party *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ShuffleParty_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\TempState|*.*|RECURSE

[Signature Verification *]
DetectOS=|5.1
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%|SIGVERIF.TXT

[SigParser *]
LangSecRef=3024
DetectFile=%ProgramFiles%\UpdateStar\SigParser\SigParser.exe
FileKey1=%AppData%\UpdateStar GmbH\SigParser\3.0.4898.22300|*.log

[Silent Hunter III *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\15210
DetectFile=%ProgramFiles%\Ubisoft\SilentHunterIII
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\SilentHunterIII|*.log|RECURSE
FileKey2=%ProgramFiles%\Ubisoft\SilentHunterIII|*.log|RECURSE

[SimCity 4 *]
Section=Games
Detect=HKLM\Software\Maxis\SimCity 4
FileKey1=%Documents%\SimCity 4\Exception Reports|*.mdmp;*.txt
FileKey2=%Documents%\SimCity 4\HTTPCache|*.*
FileKey3=%ProgramFiles%\Maxis\Exception Reports|*.mdmp;*.txt
FileKey4=%ProgramFiles%\Maxis\HTTPCache|*.*
FileKey5=%ProgramFiles%\Maxis\SimCity 4 Deluxe|*-log.txt
FileKey6=%ProgramFiles%\Maxis\SimCity 4 Deluxe\Apps|*.txt

[SimCity Societies *]
Section=Games
Detect1=HKLM\Software\Electronic Arts\SimCity Societies
Detect2=HKLM\Software\Electronic Arts\SimCity Societies (tm) Destinations
FileKey1=%Documents%\SimCity Societies\Logs|*.*

[Similarity *]
LangSecRef=3023
DetectFile=%AppData%\Similarity
FileKey1=%AppData%\Similarity|cache.dat
FileKey2=%AppData%\Similarity\logs|*.*|RECURSE

[SIMS RACER *]
Section=Games
DetectFile1=%CommonAppData%\SIMS\RACER
DetectFile2=%ProgramFiles%\SIMS\RACER
DetectFile3=%SystemDrive%\SIMS\RACER
FileKey1=%CommonAppData%\SIMS\RACER|QLOG.txt
FileKey2=%ProgramFiles%\SIMS\RACER|QLOG.txt
FileKey3=%SystemDrive%\SIMS\RACER|QLOG.txt

[SiSense *]
LangSecRef=3021
DetectFile=%AppData%\SiSense
FileKey1=%AppData%\SiSense\Prism\logs|*.*
FileKey2=%CommonAppData%\SiSense|*.slog;*.log|RECURSE
FileKey3=%CommonAppData%\SiSense\Logs|*.*|RECURSE

[SketchUp Make *]
LangSecRef=3021
Detect=HKCU\Software\SketchUp
FileKey1=%AppData%\SketchUp\SketchUp *\SketchUp|~*.tmp
RegKey1=HKCU\Software\SketchUp\SketchUp 2013\Recent File List
RegKey2=HKCU\Software\SketchUp\SketchUp 2014\Recent File List
RegKey3=HKCU\Software\SketchUp\SketchUp 2015\Recent File List
RegKey4=HKCU\Software\SketchUp\SketchUp 2016\Recent File List

[SkyDrive *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\PersistedPickerData\microsoft.microsoftskydrive_8wekyb3d8bbwe!Microsoft.MicrosoftSkyDrive\DefaultOpenFileMultiple|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\SearchHistory

[Skype *]
LangSecRef=3022
Detect=HKCU\Software\Skype
DetectFile=%ProgramFiles%\Skype For Salesforce
FileKey1=%AppData%\Skype|*.tmp;*.db-journal;*.lck;*.lock;cookies.dat|RECURSE
FileKey2=%AppData%\Skype\*\*cache|*.*|RECURSE
FileKey3=%AppData%\Skype\*\httpfe|*.*
FileKey4=%AppData%\Skype\*\logs|*.*
FileKey5=%AppData%\Skype\*\media_messaging\*\asyncdb\tmp|*.*
FileKey6=%AppData%\Skype\*\media_messaging\media_cache*|*.*
FileKey7=%AppData%\Skype\*\qikdb\tmp|*.*
FileKey8=%AppData%\Skype\DataRv|*.*
FileKey9=%AppData%\Skype\DbTemp|*.*|RECURSE
FileKey10=%AppData%\SkypePM|*.ezlog
FileKey11=%CommonAppData%\Skype|SkypeToolbars.msi;Skype.msi|RECURSE
FileKey12=%UserProfile%\Tracing\WPPMedia|*.*|RECURSE

[Skype App *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SkypeApp_kzf8qxf38zg5c
FileKey1=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalCache\Roaming\Microsoft\Skype for Store\*Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalCache\Roaming\Microsoft\Skype for Store\Logs|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState\DiagOutputDir|*.txt
FileKey9=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState\logs|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.SkypeApp_*\TempState|*.*|RECURSE

[Skype for Desktop *]
LangSecRef=3021
DetectFile=%AppData%\Microsoft\Skype for Desktop
FileKey1=%AppData%\Microsoft\Skype for Desktop|Skype-Setup.exe
FileKey2=%AppData%\Microsoft\Skype for Desktop\Code Cache|*.*|RECURSE
FileKey3=%AppData%\Microsoft\Skype for Desktop\Logs|*.*
FileKey4=%AppData%\Microsoft\Skype for Desktop\Media-stack|*.bak;*.etl

[Skype Messages *]
LangSecRef=3022
Detect=HKCU\Software\Skype
Warning=This will delete your chat message history.
FileKey1=%AppData%\Skype|offline-storage.data;dc.db|RECURSE
FileKey2=%AppData%\Skype\*\chatsync|*.*|RECURSE

[SkypeAlyzer *]
LangSecRef=3024
Detect=HKCU\Software\Raize\CodeSite
FileKey1=%LocalAppData%\Raize\CodeSite\5.0|CSDispatcherLog.txt

[Skyrim Script Extender *]
Section=Games
DetectFile=%Documents%\My Games\Skyrim\SKSE
FileKey1=%Documents%\My Games\Skyrim\SKSE|*.log

[Sleeping Dogs *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\202170
FileKey1=%ProgramFiles%\Steam\Steamapps\common\SleepingDogs|LogBoot.txt;LogShaders.txt

[Slender: The Arrival *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252330
FileKey1=%ProgramFiles%\Steam\steamapps\common\Slender - The Arrival\Slender - The Arrival_Data|output_log.txt

[SlimBoat *]
LangSecRef=3022
DetectFile=%ProgramFiles%\SlimBoat\SlimBoat.exe
FileKey1=%LocalAppData%\FlashPeak\SlimBoat\cache|*.*|RECURSE
FileKey2=%LocalAppData%\FlashPeak\SlimBoat\cookies|*.*|RECURSE
FileKey3=%LocalAppData%\FlashPeak\SlimBoat\history|*.*|RECURSE
FileKey4=%LocalAppData%\FlashPeak\SlimBoat\iconcache|*.*|RECURSE
FileKey5=%LocalAppData%\FlashPeak\SlimBoat\LocalStorage|*.*|RECURSE

[SlimBrowser *]
LangSecRef=3022
DetectFile=%ProgramFiles%\SlimBrowser\sbframe.exe
FileKey1=%AppData%\SlimBrowser|freqsite.txt;RecentCloseW.ini;freqform.txt
FileKey2=%AppData%\SlimBrowser\iconcache|*.*|RECURSE

[SlimCleaner *]
LangSecRef=3024
Detect1=HKCU\Software\SlimWare Utilities Inc\SlimCleaner
Detect2=HKCU\Software\SlimWare Utilities Inc\SlimCleaner Plus
FileKey1=%CommonAppData%\SlimWare Utilities Inc\Services\SlimService*\Logs|*.log
FileKey2=%LocalAppData%\SlimWare Utilities Inc\SlimCleaner*\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\SlimWare Utilities Inc\SlimCleaner*\Logs|*.*|RECURSE
FileKey4=%ProgramFiles%\SlimCleaner*|*.txt

[SlimComputer *]
LangSecRef=3024
DetectFile=%LocalAppData%\SlimWare Utilities Inc\SlimComputer
FileKey1=%LocalAppData%\SlimWare Utilities Inc\SlimComputer\Logs|*.log

[SlimDrivers *]
LangSecRef=3024
Detect=HKCU\Software\SlimWare Utilities Inc\SlimDrivers
FileKey1=%LocalAppData%\SlimWare Utilities Inc\SlimDrivers\Logs|*.*|RECURSE

[SlimDrivers Backups *]
LangSecRef=3024
Detect=HKCU\Software\SlimWare Utilities Inc\SlimDrivers
FileKey1=%LocalAppData%\SlimWare Utilities Inc\SlimDrivers\Backups|*.*|RECURSE

[SlimDrivers Downloads *]
LangSecRef=3024
Detect=HKCU\Software\SlimWare Utilities Inc\SlimDrivers
FileKey1=%LocalAppData%\SlimWare Utilities Inc\SlimDrivers\Downloads|*.*|RECURSE
FileKey2=%LocalAppData%\SlimWare Utilities Inc\SlimDrivers\Images|*.*|RECURSE

[Smart Explorer *]
LangSecRef=3021
Detect=HKCU\Software\Smartque\Smart Explorer
RegKey1=HKCU\Software\Smartque\Smart Explorer\Opened Pages
RegKey2=HKCU\Software\Smartque\Smart Explorer\Recent Pages

[Smart Installer Maker *]
LangSecRef=3024
Detect=HKCU\Software\InstallBuilders\Smart Install Maker
RegKey1=HKCU\Software\InstallBuilders\Smart Install Maker\Reopen

[Smart PDF Creator Pro *]
LangSecRef=3024
DetectFile=%AppData%\Smart PDF Creator Pro
FileKey1=%AppData%\Smart PDF Creator Pro|Smart PDF Creator Pro_log*.*

[SmartScreen App Reputation *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Apprep.ChxApp_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Apprep.ChxApp_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Apprep.ChxApp_*\TempState|*.*|RECURSE

[Smileys We Love Toolbar for IE *]
LangSecRef=3022
Detect=HKCU\Software\SmileysWeLove
DetectFile=%ProgramFiles%\SqueekyChocolate, LLC\Smileys We Love Toolbar for IE\adxregistrator.exe
FileKey1=%Documents%\Add-in Express|adxregistrator.log

[SMPlayer File Settings *]
LangSecRef=3023
DetectFile=%UserProfile%\.smplayer\smplayer.ini
FileKey1=%UserProfile%\.smplayer\file_settings|*.*|RECURSE

[Snagit *]
LangSecRef=3021
Detect=HKCU\Software\TechSmith\Snagit
FileKey1=%CommonAppData%\TechSmith\Uploader|*.log
FileKey2=%Documents%|SnagitDebug.log
FileKey3=%LocalAppData%\TechSmith\Logs|*.log
FileKey4=%LocalAppData%\TechSmith\Snagit|Tray.bin
FileKey5=%LocalAppData%\TechSmith\Snagit\*\NativeCrashReporting\Reports|*.dmp|RECURSE
FileKey6=%LocalAppData%\TechSmith\Snagit\CrashDumps|*.*|RECURSE
FileKey7=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico
FileKey8=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico
FileKey9=%LocalAppData%\TechSmith\Snagit\Thumbnails|*.*|RECURSE
FileKey10=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log;*.logtmp
RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder
RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder
RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount
RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount
RegKey5=HKCU\Software\TechSmith\Snagit\11|OutputDirLastUsed
RegKey6=HKCU\Software\TechSmith\Snagit\11|VidOutputDirLastUsed
RegKey7=HKCU\Software\TechSmith\Snagit\11\SnagItEditor\Tray|Thumbnailsize
RegKey8=HKCU\Software\TechSmith\Snagit\12|CaptureCount
RegKey9=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount
RegKey10=HKCU\Software\TechSmith\Snagit\12|OutputDirLastUsed
RegKey11=HKCU\Software\TechSmith\Snagit\12|VidOutputDirLastUsed
RegKey12=HKCU\Software\TechSmith\Snagit\12\SnagItEditor\Tray|Thumbnailsize
RegKey13=HKCU\Software\TechSmith\Snagit\13|CaptureCount
RegKey14=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount
RegKey15=HKCU\Software\TechSmith\Snagit\13|OutputDirLastUsed
RegKey16=HKCU\Software\TechSmith\Snagit\13|VidOutputDirLastUsed
RegKey17=HKCU\Software\TechSmith\Snagit\13\Recent Captures
RegKey18=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List
RegKey19=HKCU\Software\TechSmith\Snagit\13\SnagItEditor\Tray|Thumbnailsize
RegKey20=HKCU\Software\TechSmith\Snagit\18|CaptureCount
RegKey21=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount
RegKey22=HKCU\Software\TechSmith\Snagit\18|OutputDirLastUsed
RegKey23=HKCU\Software\TechSmith\Snagit\18|VidOutputDirLastUsed
RegKey24=HKCU\Software\TechSmith\Snagit\18\Recent Captures
RegKey25=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List
RegKey26=HKCU\Software\TechSmith\Snagit\18\SnagItEditor\Tray|Thumbnailsize
RegKey27=HKCU\Software\TechSmith\Snagit\19|CaptureCount
RegKey28=HKCU\Software\TechSmith\Snagit\19|CaptureOpenCount
RegKey29=HKCU\Software\TechSmith\Snagit\19|OutputDirLastUsed
RegKey30=HKCU\Software\TechSmith\Snagit\19|VidOutputDirLastUsed
RegKey31=HKCU\Software\TechSmith\Snagit\19\Recent Captures
RegKey32=HKCU\Software\TechSmith\Snagit\19\SnagitEditor\Recent File List
RegKey33=HKCU\Software\TechSmith\Snagit\19\SnagItEditor\Tray|Thumbnailsize
RegKey34=HKCU\Software\TechSmith\Snagit\20|CaptureCount
RegKey35=HKCU\Software\TechSmith\Snagit\20|CaptureOpenCount
RegKey36=HKCU\Software\TechSmith\Snagit\20|OutputDirLastUsed
RegKey37=HKCU\Software\TechSmith\Snagit\20|VidOutputDirLastUsed
RegKey38=HKCU\Software\TechSmith\Snagit\20\Recent Captures
RegKey39=HKCU\Software\TechSmith\Snagit\20\SnagitEditor\Recent File List
RegKey40=HKCU\Software\TechSmith\Snagit\20\SnagItEditor\Tray|Thumbnailsize
RegKey41=HKCU\Software\TechSmith\Snagit\21|CaptureCount
RegKey42=HKCU\Software\TechSmith\Snagit\21|CaptureOpenCount
RegKey43=HKCU\Software\TechSmith\Snagit\21|OutputDirLastUsed
RegKey44=HKCU\Software\TechSmith\Snagit\21|VidOutputDirLastUsed
RegKey45=HKCU\Software\TechSmith\Snagit\21\Recent Captures
RegKey46=HKCU\Software\TechSmith\Snagit\21\SnagitEditor\Recent File List
RegKey47=HKCU\Software\TechSmith\Snagit\21\SnagItEditor\Tray|Thumbnailsize
RegKey48=HKCU\Software\TechSmith\Snagit\Stamps|StampCustomFolder

[Snapfish Picture Mover *]
LangSecRef=3023
DetectFile=%AppData%\PictureMover
FileKey1=%AppData%\PictureMover\Log|*.*

[Snip & Sketch *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\AppSnipAndSketchFileSaveSettings|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\DefaultOpenFileSingle|LastLocation

[Sniper: Art of Victory *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\271500
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Sniper Art of Victory\logs|*.*

[Sniper: Ghost Warrior *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\34830
FileKey1=%Documents%\Sniper - Ghost Warrior\out\logs|*.*

[Snuggle Truck *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\111100
FileKey1=%ProgramFiles%\Steam\steamapps\common\snuggle truck\Snuggle Truck_Data|output_log.txt

[Sobees *]
LangSecRef=3022
DetectFile=%AppData%\sobees Ltd\Sobees
FileKey1=%AppData%\sobees Ltd\Sobees\tmp\imagecache|*.*|RECURSE

[SocialFolders *]
LangSecRef=3022
DetectFile=%LocalAppData%\ftopia\SocialFolders
FileKey1=%LocalAppData%\ftopia\SocialFolders\Cache|*.*|RECURSE
FileKey2=%LocalAppData%\ftopia\SocialFolders\Dumps|*.*|RECURSE

[Soda Player *]
LangSecRef=3023
DetectFile=%LocalAppData%\sodaplayer
FileKey1=%AppData%\Soda Player|Cookies*
FileKey2=%AppData%\Soda Player\*Cache|*.*
FileKey3=%AppData%\Soda Player\acestream\engine|*.log
FileKey4=%AppData%\Soda Player\Local Storage|*.*
FileKey5=%LocalAppData%\sodaplayer|SquirrelSetup.log
FileKey6=%SystemDrive%\_acestream_cache_|*.*|REMOVESELF

[Soft Organizer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Soft Organizer\SoftOrganizer.exe
FileKey1=%ProgramFiles%\Soft Organizer|*.txt

[SoftCafe MenuPRo *]
LangSecRef=3021
DetectFile=%AppData%\SoftCafe\MenuPro
FileKey1=%AppData%\SoftCafe\MenuPro|*.tmp

[SoftEther VPN *]
LangSecRef=3024
Detect=HKCU\Software\SoftEther Project\SoftEther VPN
Warning=Exclude installer.cache if you're using SoftEther VPN Client Web Installer.
FileKey1=%ProgramFiles%\SoftEther VPN Client|installer.cache
FileKey2=%ProgramFiles%\SoftEther VPN Client\backup.vpn_client.config|*.config
FileKey3=%ProgramFiles%\SoftEther VPN Client\client_log|*.*
FileKey4=%ProgramFiles%\SoftEther VPN Client\vpn_debug|*.*

[SoftGrid Client *]
LangSecRef=3022
DetectFile=%AppData%\SoftGrid Client
FileKey1=%AppData%\SoftGrid Client|*.tmp|RECURSE
FileKey2=%AppData%\SoftGrid Client\Icon Cache|*.*
FileKey3=%CommonAppData%\Microsoft\Application Virtualization Client\SoftGrid Client|*.tmp|RECURSE
FileKey4=%LocalAppData%\SoftGrid Client|*.tmp|RECURSE

[Softonic *]
LangSecRef=3021
DetectFile=%LocalAppData%\Softonic\Softonic.exe
FileKey1=%LocalAppData%\Softonic\cache|*.*|RECURSE

[Softros Process Blocker *]
LangSecRef=3024
Detect=HKLM\Software\Policies\Softros\Process Blocker
FileKey1=%ProgramFiles%\Softros Systems\Process Blocker|*Log.txt

[SoftThinks CD Creator *]
LangSecRef=3021
Detect=HKLM\Software\SoftThinks
FileKey1=%WinDir%\CREATOR|*.log

[Software Informer *]
LangSecRef=3023
DetectFile=%AppData%\Software Informer
FileKey1=%AppData%\Software Informer\cache\icons|*.tmp

[Solarix *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\284990
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Solarix\UDKGame\Logs|*.*

[SolidWorks *]
LangSecRef=3021
Detect1=HKCU\Software\Solidworks\SolidWorks 2012
Detect2=HKCU\Software\SolidWorks\SolidWorks 2013
Detect3=HKCU\Software\Solidworks\SolidWorks 2014
Detect4=HKCU\Software\SolidWorks\Solidworks 2015
Detect5=HKCU\Software\SolidWorks\Solidworks 2016
Detect6=HKCU\Software\SolidWorks\SOLIDWORKS 2017
Detect7=HKCU\Software\Solidworks\SOLIDWORKS 2018
Detect8=HKCU\Software\Solidworks\SOLIDWORKS 2019
Detect9=HKCU\Software\SolidWorks\SOLIDWORKS 2020
RegKey1=HKCU\Software\Solidworks\SolidWorks 2012\Recent File List
RegKey2=HKCU\Software\SolidWorks\SolidWorks 2013\Recent File List
RegKey3=HKCU\Software\Solidworks\SolidWorks 2014\Recent File List
RegKey4=HKCU\Software\SolidWorks\Solidworks 2015\Recent File List
RegKey5=HKCU\Software\SolidWorks\Solidworks 2016\Recent File List
RegKey6=HKCU\Software\SolidWorks\SOLIDWORKS 2017\Recent File List
RegKey7=HKCU\Software\Solidworks\SOLIDWORKS 2018\Recent File List
RegKey8=HKCU\Software\Solidworks\SOLIDWORKS 2018\Recent Folder List
RegKey9=HKCU\Software\Solidworks\SOLIDWORKS 2019\Recent File List
RegKey10=HKCU\Software\Solidworks\SOLIDWORKS 2019\Recent Folder List
RegKey11=HKCU\Software\SolidWorks\SOLIDWORKS 2020\Recent File List
RegKey12=HKCU\Software\SolidWorks\SOLIDWORKS 2020\Recent Folder List

[Solway Password Kernel *]
LangSecRef=3021
Detect=HKCU\Software\SolwaySoftware\PasswordKernel
RegKey1=HKCU\Software\SolwaySoftware\PasswordKernel|LastFile

[SOMA *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\282140
FileKey1=%Documents%\My Games\Soma\Main|*.log

[Sonata *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Sonata
FileKey1=%LocalAppData%\Sonata\temp|*.*|RECURSE
FileKey2=%ProgramFiles%\Sonata\update|*.*|RECURSE

[SongKong *]
LangSecRef=3023
DetectFile=%AppData%\SongKong
FileKey1=%AppData%\SongKong\Logs|*.*|RECURSE

[Sonic Visualiser *]
LangSecRef=3023
Detect=HKCU\Software\sonic-visualiser
DetectFile=%UserProfile%\.Sonic Visualiser
FileKey1=%AppData%\sonic-visualiser\Sonic Visualiser\cache|*.*
FileKey2=%AppData%\sonic-visualiser\Sonic Visualiser\log|*.*
FileKey3=%UserProfile%\.Sonic Visualiser\cache|*.*
RegKey1=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-0
RegKey2=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-1
RegKey3=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-2
RegKey4=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-3
RegKey5=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-4
RegKey6=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-5
RegKey7=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-6
RegKey8=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-7
RegKey9=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-8
RegKey10=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-9
RegKey11=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-10
RegKey12=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-11
RegKey13=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-12
RegKey14=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-13
RegKey15=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-14
RegKey16=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-15
RegKey17=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-16
RegKey18=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-17
RegKey19=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-18
RegKey20=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-19

[Sonique *]
LangSecRef=3023
Detect=HKCU\Software\MediaScience\Sonique
RegKey1=HKCU\Software\MediaScience\Sonique\Play_History
RegKey2=HKCU\Software\MediaScience\Sonique\URL_History

[Sony Magic Update *]
LangSecRef=3024
DetectFile=%AppData%\Sony Corporation\Auto Magic Update Client
FileKey1=%AppData%\Sony Corporation\Auto Magic Update Client|*.log

[Sony Media Go *]
LangSecRef=3021
Detect=HKCU\Software\Sony Corporation\Media Go
FileKey1=%AppData%\Sony\Media Go|*.bkd
FileKey2=%AppData%\Sony\Media Go Installer|*.log
FileKey3=%AppData%\Sony\Media Go\gnsdk|*.log
FileKey4=%LocalAppData%\Sony\ErrorReport|*.*
FileKey5=%LocalAppData%\Sony\Media Go Video Playback engine\logging|*.cflog

[Sony Media Manager *]
LangSecRef=3023
DetectFile=%AppData%\Sony\Media Manager
FileKey1=%AppData%\Sony\Media Manager|*.log;*log.txt
FileKey2=%AppData%\Sony\Media Manager\Thumbnails|*.*|RECURSE

[Sony Mobile Emma *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Emma
FileKey1=%ProgramFiles%\Sony Mobile\Emma\log|*.*
FileKey2=%ProgramFiles%\Sony Mobile\Emma\temp|*.*
FileKey3=%ProgramFiles%\Sony Mobile\Emma\workspace\.metadata|.log

[Sony SonicStage *]
LangSecRef=3021
DetectFile=%AppData%\Sony\SonicStage
FileKey1=%AppData%\Sony\SonicStage|*.log
FileKey2=%AppData%\Sony\SonicStage\Temp|*.*

[Sony Sound Organizer *]
LangSecRef=3024
DetectFile=%AppData%\Sony Corporation\Sound Organizer
FileKey1=%AppData%\Sony Corporation\Sound Organizer|*.log

[Sony VAIO *]
LangSecRef=3024
Detect=HKLM\Software\Sony Corporation
FileKey1=%CommonAppData%\Sony Corporation\VAIO *|*.log;Log.txt

[Sony Vegas Pro *]
LangSecRef=3023
Detect1=HKLM\Software\Sony Creative Software\Vegas
Detect2=HKLM\Software\Sony Media Software\Vegas
FileKey1=%AppData%\Sony|*.log
FileKey2=%LocalAppData%\Sony\Vegas Pro\*|*.log

[Sony Xperia Flashtool *]
LangSecRef=3024
Detect=HKLM\Software\Flashtool
FileKey1=%SystemDrive%\Flashtool|*.log

[SopCast *]
LangSecRef=3022
DetectFile=%ProgramFiles%\SopCast\SopCast.exe
FileKey1=%ProgramFiles%\SopCast\adv|sopadver.dat

[Sorcery! Parts 1 and 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105430
FileKey1=%LocalAppData%\inkle\Sorcery|*.log

[Soulseek *]
LangSecRef=3022
Detect1=HKCU\Software\SoulSeek
Detect2=HKCU\Software\Soulseek2
Detect3=HKLM\Software\SoulseekQt
DetectFile=%ProgramFiles%\Soulseek*
Warning=This will delete your chat history.
FileKey1=%Documents%\Soulseek Chat Logs\Private|*.txt
FileKey2=%LocalAppData%\Soulseek Chat Logs\*|*.log
FileKey3=%LocalAppData%\SoulseekQt\Soulseek Chat Logs|*.log|RECURSE
FileKey4=%ProgramFiles%\Soulseek*|search.cfg
FileKey5=%ProgramFiles%\Soulseek*\Private_Chat_Logs|*.txt
FileKey6=%ProgramFiles%\Soulseek*\Room_Chat_Logs|*.txt
RegKey1=HKCU\Software\SoulSeek\SoulSeek\Recent File List
RegKey2=HKCU\Software\Soulseek2\config|search

[SoundMAX *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Analog Devices\SoundMAX
FileKey1=%ProgramFiles%\Analog Devices\SoundMAX|SMax.log;SMax.log.bak

[Space Engineers *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\244850
FileKey1=%AppData%\SpaceEngineers|*.log

[SpeedFan *]
LangSecRef=3024
Detect=HKCU\Software\SpeedFan
FileKey1=%ProgramFiles%\SpeedFan|debug.nfo;SFLog*.csv
FileKey2=%WinDir%\System32|initdebug.nfo
FileKey3=%WinDir%\SysWOW64|initdebug.nfo

[SpeedRunners *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\207140
FileKey1=%AppData%|SpeedRunnersLog.txt;TargetInvocationLog.txt

[SpeedyComputer *]
LangSecRef=3024
DetectFile=%AppData%\SpeedyComputer
FileKey1=%AppData%\SpeedyComputer\Log|*.*|RECURSE

[SpiderOak *]
LangSecRef=3024
DetectFile=%AppData%\SpiderOak
FileKey1=%AppData%\SpiderOak|*.log|RECURSE
FileKey2=%AppData%\SpiderOak\download_cache|*.*

[Spiral Knights *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\99900
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Spiral Knights|*.log

[Splice *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\209790
FileKey1=%Documents%|GALog.txt
FileKey2=%ProgramFiles%\Steam\steamapps\common\splice|output_log.txt
FileKey3=%ProgramFiles%\Steam\steamapps\common\Splice\Splice_Data|output_log.txt

[SpongeBob Diner Dash *]
Section=Games
DetectFile=%ProgramFiles%\SpongeBob Diner Dash
FileKey1=%ProgramFiles%\SpongeBob Diner Dash|logfile.*

[Spooky Mall *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spooky Mall1.0
FileKey1=%CommonAppData%\SpookyMall|*.xml_log
FileKey2=%ProgramFiles%\Foxy Games\Spooky Mall|*.log

[Sports *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingSports_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingSports_*\LocalState\Cache\Images|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.BingSports_*\TempState|*.*|RECURSE

[SporTV *]
LangSecRef=3021
DetectFile=%LocalAppData%\SporTV
FileKey1=%LocalAppData%\SporTV\Logs|*.*

[Spotflux *]
LangSecRef=3021
Detect=HKLM\Software\Spotflux
DetectFile=%ProgramFiles%\Spotflux\spotflux.exe
FileKey1=%AppData%\.spotflux|*.log

[Spoutcraft *]
Section=Games
DetectFile=%AppData%\.spoutcraft
FileKey1=%AppData%\.spoutcraft|*.log
FileKey2=%AppData%\.spoutcraft\logs|*.*

[Sprint Hero RUU Installer *]
LangSecRef=3023
DetectFile=%SystemDrive%\ruu_log
FileKey1=%SystemDrive%\ruu_log|*.*|REMOVESELF

[Spybot AntiBeacon *]
LangSecRef=3024
DetectFile=%LocalAppData%\Safer-Networking Ltd\Spybot*
FileKey1=%LocalAppData%\Safer-Networking Ltd\Spybot *|*.log

[Spybot Search and Destroy 2 *]
LangSecRef=3024
Detect=HKCU\Software\Safer Networking Limited\Spybot - Search & Destroy 2
FileKey1=%CommonAppData%\Spybot - Search & Destroy\Logs|*.*|RECURSE
FileKey2=%CommonAppData%\Spybot - Search & Destroy\System Configuration Snapshots|*.*|REMOVESELF
FileKey3=%Documents%\ProcAlyzer Dumps|*.*|REMOVESELF

[Spybot Search and Destroy History *]
LangSecRef=3024
Detect=HKLM\Software\Safer Networking Limited\SpybotSnD
FileKey1=%CommonAppData%\Spybot - Search & Destroy\Backups|*.*|RECURSE
FileKey2=%CommonAppData%\Spybot - Search & Destroy\Recovery|*.*|RECURSE
FileKey3=%CommonAppData%\Spybot - Search & Destroy\Snapshots*|*.*|RECURSE

[Spybot Search and Destroy Hosts Backups *]
LangSecRef=3024
Detect1=HKCU\Software\Safer Networking Limited\Spybot - Search & Destroy 2
Detect2=HKLM\Software\Safer Networking Limited\SpybotSnD
FileKey1=%WinDir%\System32\drivers\etc|hosts.*.backup

[Spybot Search and Destroy Updates *]
LangSecRef=3024
Detect1=HKCU\Software\Safer Networking Limited\Spybot - Search & Destroy 2
Detect2=HKLM\Software\Safer Networking Limited\SpybotSnD
FileKey1=%ProgramFiles%\Spybot - Search & Destroy 2\Updates|*.*|RECURSE
FileKey2=%ProgramFiles%\Spybot - Search & Destroy\Updates|*.zip
ExcludeKey1=FILE|%ProgramFiles%\Spybot - Search & Destroy 2\Updates\Downloads\|updates.uid

[SpyDefense *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Everest Labs\Spydefense\sdc.exe
FileKey1=%AppData%\Everest Labs\Spydefense|SpyDefense.log;History.ini;Backups.ini
FileKey2=%AppData%\Everest Labs\Spydefense\Backups|BF7.tmp

[Spyware Doctor *]
LangSecRef=3024
Detect=HKCU\Software\PCTools\Spyware Doctor
FileKey1=%AppData%\pctsGui|bugreport.*
FileKey2=%ProgramFiles%\Spyware Doctor\Log|*.*

[Spyware Terminator *]
LangSecRef=3024
Detect=HKCU\Software\Spyware Terminator
FileKey1=%ProgramFiles%\Spyware Terminator|*.err;*.old|RECURSE

[SpywareBlaster Update File *]
LangSecRef=3024
DetectFile=%ProgramFiles%\SpywareBlaster\sbautoupdate.exe
Warning=This deletes SWB program updater file, which is no longer needed once a SWB program version update occurs.
FileKey1=%ProgramFiles%\SpywareBlaster|spywareblasterupgrade_latest.exe

[SQL Anywhere 11 *]
LangSecRef=3021
DetectFile=%CommonAppData%\SQL Anywhere 11
FileKey1=%CommonAppData%\SQL Anywhere 11\Diagnostics|*.dmp;*.crash_log

[SQLite Expert 3 *]
LangSecRef=3024
Detect1=HKCU\Software\SQLite Expert\Personal\3.x
Detect2=HKCU\Software\SQLite Expert\Professional\3.x
RegKey1=HKCU\Software\SQLite Expert\Personal\3.x\DB
RegKey2=HKCU\Software\SQLite Expert\Professional\3.x\DB

[SSD Fresh Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\SSD Fresh
FileKey1=%LocalAppData%\Abelssoft\SSD Fresh|backup.*

[Star Citizen *]
Section=Games
DetectFile1=%AppData%\rsilauncher
DetectFile2=%LocalAppData%\Star Citizen
FileKey1=%AppData%\RSI Launcher|*.*|RECURSE
FileKey2=%AppData%\rsilauncher|*.log;*.jpg
FileKey3=%AppData%\rsilauncher\*Cache|*.*
FileKey4=%AppData%\rsilauncher\*update*|*.*
FileKey5=%LocalAppData%\Star Citizen|*.*
FileKey6=%ProgramFiles%\Roberts Space Industries\StarCitizen\LIVE|*.log|RECURSE

[Star Downloader *]
LangSecRef=3021
Detect=HKCU\Software\Star Downloader
FileKey1=%ProgramFiles%\Star Downloader|serverstats.txt;LastURLs
FileKey2=%ProgramFiles%\Star Downloader\Partial Downloads|*.*|RECURSE

[Star Swarm Stress Test *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\267130
FileKey1=%Documents%\Star Swarm|output*.txt

[Star Trek Online *]
Section=Games
Detect1=HKCU\Software\Cryptic\Star Trek Online
Detect2=HKCU\Software\Valve\Steam\Apps\9900
FileKey1=%ProgramFiles%\Steam\Steamapps\Common\star trek online\Star Trek Online\*\cache|*.*
FileKey2=%ProgramFiles%\steam\steamapps\common\star trek online\star trek online\*\logs\GameClient|*.*
FileKey3=%Public%\Games\Cryptic Studios\Star Trek Online\*\Cache|*.*
FileKey4=%Public%\Games\Cryptic Studios\Star Trek Online\*\Logs\GameClient|*.*

[Star Wars: Battlefront II *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\6060
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Star Wars BattleFront II|update*.txt

[Star Wars: The Force Unleashed *]
Section=Games
DetectFile=%LocalAppData%\LucasArts\Star Wars The Force Unleashed*
FileKey1=%LocalAppData%\LucasArts\Star Wars The Force Unleashed*|*.*

[Star Wars: The Old Republic *]
Section=Games
Detect=HKLM\Software\BioWare\Star Wars-The Old Republic
FileKey1=%Documents%|*Install STAR WARS The Old Republic.log
FileKey2=%LocalAppData%\SWTOR\CrashDump\swtor|*.*
FileKey3=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\betatest\retailclient\Temp|*.log
FileKey4=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\logs|*.log
FileKey5=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\swtor\retailclient\swtor\logs|*.log
FileKey6=%ProgramFiles%\Origin Games\Star Wars - The Old Republic\__Installer|InstallLog.txt
FileKey7=%ProgramFiles%\Origin Games\Star Wars - The Old Republic\logs|*.*
FileKey8=%ProgramFiles%\Origin Games\Star Wars - The Old Republic\swtor\retailclient\swtor\logs|*.*

[StarCraft *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\Starcraft
FileKey1=%AppData%\Blizzard\StarCraft|*Log.txt
FileKey2=%Documents%\StarCraft\Errors|*.*

[StarCraft II *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\StarCraft II
FileKey1=%Documents%\StarCraft II\*Logs|*.*|RECURSE

[StarCraft II Editor *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\StarCraft II Editor
RegKey1=HKCU\Software\Blizzard Entertainment\StarCraft II Editor\Recent Files

[Stardock Fences *]
LangSecRef=3024
Detect1=HKLM\Software\Stardock\Misc\Fences
Detect2=HKLM\Software\Stardock\Misc\Fences2
DetectFile=%LocalAppData%\Stardock\Fences*
FileKey1=%AppData%\Stardock\Fences\TroubleshootingLog|*.dat;*.txt
FileKey2=%CommonAppData%\Stardock\Fences*|Cache.dat
FileKey3=%LocalAppData%\Stardock\Fences*|*Log.txt
FileKey4=%ProgramFiles%\Stardock\Fences|*.txt

[Stardock ObjectDock Plus *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Stardock\ObjectDock Plus\ObjectDock.exe
FileKey1=%AppData%\Stardock|*.*|REMOVESELF
FileKey2=%CommonAppData%\Stardock|*.*|RECURSE
FileKey3=%LocalAppData%\ODUI|*.*|REMOVESELF
FileKey4=%LocalAppData%\Stardock\ObjectDockPlus|*Backup.ini

[StarMoney *]
LangSecRef=3021
DetectFile=%CommonAppData%\StarMoney*
FileKey1=%CommonAppData%\StarMoney *|*.log|RECURSE

[StarOffice *]
LangSecRef=3021
DetectFile1=%ProgramFiles%\Sun\StarOffice 8\program\soffice.exe
DetectFile2=%ProgramFiles%\Sun\StarOffice 9\program\soffice.exe
FileKey1=%AppData%\StarOffice*\user\registry\data\org\openoffice\Office|Common.xcu

[Start Menu Cache *]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC
RegKey2=HKLM\Software\Microsoft\Windows\CurrentVersion\UFH\ARP

[Start Menu Experience Host *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_*\TempState|*.*|RECURSE

[Start Menu Programs Cache *]
LangSecRef=3025
Detect1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Detect2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCache
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCacheSMP
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCacheTBP
RegKey5=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache
RegKey6=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache

[Start Menu Reviver *]
LangSecRef=3024
Detect=HKLM\Software\Start Menu Reviver
FileKey1=%ProgramFiles%\ReviverSoft\Start Menu Reviver\Logs|*.*

[StartMenu8 *]
LangSecRef=3024
Detect=HKLM\Software\IObit\StartMenu
FileKey1=%AppData%\IObit\StartMenu 8|*.log

[Startup Sentinel *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\Startup Sentinel
FileKey1=%AppData%\KC Softwares\Startup Sentinel|*.log

[StartupStar *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\StartupStar
FileKey1=%AppData%\AbelsSoft\StartupStar|*.log

[StartupStar Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\StartupStar
FileKey1=%LocalAppData%\Abelssoft\StartupStar|backup.xml

[Staxel *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\405710
FileKey1=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\crashlogs|*.*

[Staxel Web Data *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\405710
FileKey1=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\cache|*.*
FileKey2=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\cookies|*.*

[Steam *]
Section=Games
Detect=HKCU\Software\Valve\Steam
FileKey1=%AppData%\SteamVR\Logs|*.*|REMOVESELF
FileKey2=%CommonProgramFiles%\Steam|*_log.txt
FileKey3=%ProgramFiles%\Steam|*.old
FileKey4=%ProgramFiles%\Steam|*log.last;*.log;*_log.txt;connection_log_*.txt;remote_connections.txt|RECURSE
FileKey5=%ProgramFiles%\Steam\vr\runtime\logs|*.*|RECURSE

[Steam Cache *]
Section=Games
Detect=HKCU\Software\Valve\Steam
FileKey1=%LocalAppData%\Steam\htmlcache|*.*|RECURSE
FileKey2=%ProgramFiles%\Steam\appcache\httpcache|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\config\cookies|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\config\htmlcache|*.*|RECURSE
FileKey5=%ProgramFiles%\Steam\config\overlay*|*.*|RECURSE
FileKey6=%ProgramFiles%\Steam\depotcache|*.*
FileKey7=%ProgramFiles%\Steam\steamapps\shadercache|*.*|RECURSE
FileKey8=%ProgramFiles%\Steam\tenfoot\config\httpcache|*.*|RECURSE
FileKey9=%ProgramFiles%\Steam\tenfoot\config\images\web|*.*|RECURSE
FileKey10=%ProgramFiles%\Steam\userdata\*\ugcmsgcache|*.*|RECURSE

[Steam Games *]
Section=Games
Detect=HKCU\Software\Valve\Steam
FileKey1=%ProgramFiles%\Steam\steamapps|*.dmp;.DS_Store;*.icns;logfile.*;*.log;*.mdmp;*.tmp;*log.txt;log*.txt;text.txt|RECURSE
FileKey2=%ProgramFiles%\Steam\steamapps\common\*\*\downloads|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\steamapps\common\*\Cache|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\steamapps\common\*\config\html|*.*|RECURSE
FileKey5=%ProgramFiles%\Steam\steamapps\common\*\DebugData|*.*|RECURSE
FileKey6=%ProgramFiles%\Steam\Steamapps\temp|*.*|RECURSE
ExcludeKey1=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler 1936\Cache\|*.*
ExcludeKey2=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler Cold War\Cache\|*.*
ExcludeKey3=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler Ultimate\Cache\|*.*

[Steam Installers *]
Section=Games
Detect=HKCU\Software\Valve\Steam
Warning=This entry should only be enabled after you have launched each of your installed Steam games at least once. Deleting these files before then may cause Steam to think the game's installation is broken. After the first launch, these files become useless.
FileKey1=%ProgramFiles%\Steam\Steamapps\common|*redist.msi*;dosbox*.tar.gz;*redist*.exe;*setup*.msi;*pbsvc*.exe;*UPlay*Installer*.exe;WMFADist.exe;SPInstaller.exe;python*.msi;bitmap2substance_installer.exe;perforce*.exe;p4vinst*.exe;mcpp*.*;firewallinstallhelper.dll;gameuxinstallhelper.dll;eadm-installer.exe;wmpappcompat.exe;umdf.exe;Microsoft .NET Framework*.cmd;Microsoft .NET Framework*.bat;NDP*.exe;WMFDist*.exe;PhysX*.msi;PhysX*.exe;*d3dx11*.cat;*d3dx11*.inf;prompt.bat;GDFInstall.exe;DSInstaller.exe;d3d*.exe;directx*.exe;*.msu;Windows*-KB*.exe;cmp.bat;PVRTexTool.exe;wmp11-windowsxp-x86-enu.exe;*.vdk;RGB9RAST*.msi;WIC*.exe;XPSEPC*.exe;msxml6.msi;AdbeRdr*.*;*inst*.vdf;*.cab;*.msp;ac3filter*.exe;GamesExplorerIntegrationTool.exe;install.ini;globdata.ini;install.exe;install.res.*.dll;eula.*.*;DSETUP.DLL;oalinst.exe;dsetup32.dll;D3D*Install.exe;D3D*Install*.dll;dotnetfx*.exe;*vc*red*.exe;*vc*red.msi;WindowsInstaller*.exe;locdata.*.ini;setupres.*.dll;*setup*.exe;wapres.*.dll;*NetFx*.*;Microsoft Visual C++ *.cmd|RECURSE

[Steam Packages *]
Section=Games
Detect=HKCU\Software\Valve\Steam
Warning=Running this entry is not recommended if you run Steam Client Beta.
FileKey1=%ProgramFiles%\Steam\package|*.zip.*

[SteamWorld Dig *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\252410
FileKey1=%ProgramFiles%\Steam\Steamapps\common\SteamWorld Dig|*.mdmp

[Steed *]
LangSecRef=3022
DetectFile=%CommonAppData%\Steed
FileKey1=%CommonAppData%\Steed\Logs|*.*|REMOVESELF

[SteelSeries *]
LangSecRef=3024
DetectFile=%CommonAppData%\SteelSeries
FileKey1=%CommonAppData%\SteelSeries\SteelSeries Engine *\Logs|*.*|REMOVESELF
FileKey2=%ProgramFiles%\SteelSeries\SteelSeries Engine *|*.log

[Stellar Phoenix Registry Manager *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Stellar Phoenix Registry Manager\StellarPhoenixRegistryManager.exe
FileKey1=%SystemDrive%|LogReport.txt

[Stellarium *]
LangSecRef=3021
DetectFile=%AppData%\Stellarium
FileKey1=%AppData%\Stellarium|log.txt
FileKey2=%LocalAppData%\Stellarium\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\stellarium\stellarium\cache|*.*|RECURSE

[StepMania *]
Section=Games
DetectFile=%AppData%\StepMania*
FileKey1=%AppData%\Stepmania*\Logs|*.*

[SterJo NetStalker *]
LangSecRef=3022
DetectFile=%LocalAppData%\SterJo NetStalker
FileKey1=%LocalAppData%\SterJo NetStalker|dscnt.exe;History.sjh
FileKey2=%LocalAppData%\SterJo NetStalker\Logs|*.*

[Sticky Notes *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\TempState|*.*|RECURSE

[Stocks and Futures *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\24877CutthroatSoftware.StocksandFutures_xgnzh3xnefnqe
FileKey1=%LocalAppData%\Packages\24877CutthroatSoftware.StocksandFutures_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\24877CutthroatSoftware.StocksandFutures_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey3=%LocalAppData%\Packages\24877CutthroatSoftware.StocksandFutures_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\24877CutthroatSoftware.StocksandFutures_*\AppData\Indexed DB|*.log
FileKey5=%LocalAppData%\Packages\24877CutthroatSoftware.StocksandFutures_*\LocalState|*.tmp|RECURSE
FileKey6=%LocalAppData%\Packages\24877CutthroatSoftware.StocksandFutures_*\TempState|*.*|RECURSE

[STOIK Smart Resizer *]
LangSecRef=3023
Detect1=HKCU\Software\STOIK Smart Resizer 1.0\STOIK Smart Resizer
Detect2=HKCU\Software\STOIK Smart Resizer 2.0\STOIK Smart Resizer
Detect3=HKCU\Software\STOIK Smart Resizer 3.0\STOIK Smart Resizer
RegKey1=HKCU\Software\STOIK Smart Resizer 1.0\STOIK Smart Resizer\Recent File List
RegKey2=HKCU\Software\STOIK Smart Resizer 2.0\STOIK Smart Resizer\Recent File List
RegKey3=HKCU\Software\STOIK Smart Resizer 3.0\STOIK Smart Resizer\Recent File List

[STOIK Video Converter 2 *]
LangSecRef=3023
Detect=HKCU\Software\STOIK
FileKey1=%AppData%\STOIK\videopak2|*.ini

[Store *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsStore_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsStore_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsStore_*\LocalState\Cache|*.*|RECURSE

[Store Install Service Cache *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\InstallService|*.*|RECURSE
RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\InstallService\State\CategoryCache

[Store Policy Check Cache *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PolicyCache

[Store Purchase *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.StorePurchaseApp_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC\AppCache\*|*.*|REMOVESELF
FileKey2=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|REMOVESELF
FileKey5=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\TempState|*.*|RECURSE

[Stored Media Player Paths *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Keyboard\Native Media Players

[Stored MIME Types *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Classes\MIME\Database\Content Type

[Stored UWP Programs Information *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Phone\ShellUI\WindowSizing
RegKey2=HKCU\Software\Microsoft\UserData\UninstallTimes

[Stranglehold *]
Section=Games
DetectFile=%LocalAppData%\Midway\Stranglehold
FileKey1=%LocalAppData%\Midway\Stranglehold|*.log|RECURSE
FileKey2=%LocalAppData%\Midway\Stranglehold\Cache|*.*|REMOVESELF

[Stream-Cloner *]
LangSecRef=3023
Detect=HKCU\Software\Stream-Cloner
FileKey1=%AppData%\Stream-Cloner|*.log;IeRecentVisit.txt
FileKey2=%AppData%\Stream-Cloner\Cap_images|*.*|REMOVESELF
FileKey3=%AppData%\Stream-Cloner\thumbs|*.*|REMOVESELF

[Streamripper Winamp *]
LangSecRef=3023
Detect=HKCU\Software\Streamripper
FileKey1=%AppData%\Streamripper|*.*|REMOVESELF

[Stronghold Crusader *]
Section=Games
DetectFile=%ProgramFiles%\Firefly Studios\Stronghold Crusader
FileKey1=%ProgramFiles%\Firefly Studios\Stronghold Crusader\gfx|*log.txt

[StudioLine Photo Basic *]
LangSecRef=3023
Detect=HKCU\Software\StudioLine\StudioLine Photo Basic
DetectFile=%ProgramFiles%\StudioLine Photo Basic
FileKey1=%CommonAppData%\H&M System Software\StudioLine Photo Basic 3|*.bak;*.dmp;*.log
RegKey1=HKCU\Software\H&&M System Software\Twain\Recent File List
RegKey2=HKCU\Software\StudioLine\StudioLine Photo Basic\WindowPositions

[Style Jukebox *]
LangSecRef=3023
DetectFile=%AppData%\Style Jukebox Settings
FileKey1=%AppData%\Style Jukebox Settings|*.bmp|RECURSE

[Sublime Text Backups *]
LangSecRef=3024
DetectFile=%AppData%\Sublime Text*
FileKey1=%AppData%\Sublime Text 3\Backup|*.*|REMOVESELF

[Sublime Text Session *]
LangSecRef=3024
DetectFile=%AppData%\Sublime Text*
FileKey1=%AppData%\Sublime Text 2\Settings|*.sublime_session
FileKey2=%AppData%\Sublime Text 3\Local|Session.sublime_session
FileKey3=%AppData%\Sublime Text\Options|*.*

[Success Story *]
Section=Games
DetectFile=%AppData%\Shape Games\SuccessStory
FileKey1=%AppData%\Shape Games\SuccessStory\logs|*.*

[Suggested UWP Programs *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps

[SumatraPDF *]
LangSecRef=3024
DetectFile=%AppData%\SumatraPDF
FileKey1=%AppData%\SumatraPDF\sumatrapdfcache|*.*

[SUMo *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\SUMo
FileKey1=%AppData%\KC Softwares\SUMo|db.bak;SUMo.cache;*.log;errlst.txt

[SUMo Database *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\SUMo
FileKey1=%AppData%\KC Softwares\SUMo|db.sumo

[SuniSoft Registry Clean Expert *]
LangSecRef=3024
Detect=HKCU\Software\SuniSoft\IncUpdate\Registry Clean Expert
FileKey1=%ProgramFiles%\Registry Clean Expert|fixlog.ini

[SUPERAntiSpyware *]
LangSecRef=3024
Detect1=HKCU\Software\SUPERAntiSpyware.com\SUPERAntiSpyware
Detect2=HKLM\Software\SUPERAntiSpyware.com\SUPERAntiSpyware
FileKey1=%CommonAppData%\!SASCORE\AppLogs|*.dmp;*.SDB
FileKey2=%CommonAppData%\SUPERAntiSpyware.com\SUPERAntiSpyware\Applogs|*.dmp;*.SDB;*.ZIP
FileKey3=%ProgramFiles%\SUPERAntiSpyware|*.tmp

[SuperMP3Download *]
LangSecRef=3023
DetectFile=%ProgramFiles%\SuperMp3Download\SuperMp3Download.exe
FileKey1=%CommonAppData%\SuperMP3Download|downloadlist.sav
FileKey2=%CommonAppData%\SuperMP3Download\Downloading|*.*|RECURSE

[Superstar Racing *]
Section=Games
DetectFile=%LocalAppData%\Chat Republic Games\Superstar Racing
FileKey1=%LocalAppData%\Chat Republic Games\Superstar Racing|log*.*

[SuperSync *]
LangSecRef=3023
DetectFile=%AppData%\SuperSync
FileKey1=%AppData%\SuperSync\logs|*.*
FileKey2=%AppData%\SuperSync\tmp|*.*|RECURSE

[SuperWinMenu *]
LangSecRef=3024
DetectFile=%AppData%\SuperWinMenu
FileKey1=%AppData%\SuperWinMenu|*.lastused

[Sway *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.Sway_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|REMOVESELF
FileKey5=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Office.Sway_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Office.Sway_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Office.Sway_*\TempState|*.*|RECURSE

[Swiff Player *]
LangSecRef=3023
Detect=HKCU\Software\GlobFX Technologies\Swiff Player
RegKey1=HKCU\Software\GlobFX Technologies\Swiff Player\Recent File List

[Swift *]
LangSecRef=3022
Detect=HKCU\Software\Swift
FileKey1=%AppData%\Swift\Avatars|*.*|RECURSE
FileKey2=%AppData%\Swift\Crashes|*.*|RECURSE

[Switch Audio-Converter *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\Switch
FileKey1=%AppData%\NCH Software\Switch\Logs|*.*|RECURSE

[Syberfix Helpdesk *]
LangSecRef=3021
DetectFile=%LocalAppData%\Syberfix\UserSaved\Helpdesk*
FileKey1=%LocalAppData%\SyberFix\UserSaved\Helpdesk *|*.log

[Sylpheed *]
LangSecRef=3022
DetectFile=%AppData%\Sylpheed
FileKey1=%AppData%\Sylpheed|*.bak;*.bak.*;*.log

[Symantec Ghost *]
LangSecRef=3024
Detect=HKCU\Software\Symantec\Symantec Ghost
RegKey1=HKCU\Software\Symantec\Symantec Ghost\Explorer\Ghost Explorer\Recent File List

[Symantec SymSilent *]
LangSecRef=3024
DetectFile=%Public%\Symantec\SymSilent
FileKey1=%Public%\Symantec\SymSilent\ccLog|*.*

[Synchronize It! *]
LangSecRef=3021
Detect=HKCU\Software\grigsoft.com\Synchronize It!
RegKey1=HKCU\Software\grigsoft.com\Synchronize It!\Combos
RegKey2=HKCU\Software\grigsoft.com\Synchronize It!\Synchronize It!\Combos

[Syncios Cell Phone Backup & Manage *]
LangSecRef=3024
Detect1=HKCU\Software\Syncios
Detect2=HKCU\Software\Syncios Data Transfer
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Syncios Data Transfer.exe
FileKey1=%AppData%\app_sycnios_transfer_loader|*.*|REMOVESELF
FileKey2=%AppData%\Syncios|android.log;log.txt
FileKey3=%AppData%\Syncios Data Transfer|*.log|RECURSE
FileKey4=%AppData%\Syncios Data Transfer\GPUCache|*.*
FileKey5=%AppData%\Syncios Data Transfer\Local Storage\Leveldb|Log.Old
FileKey6=%AppData%\Syncios Toolkit\Local Storage\leveldb|Log.Old
FileKey7=%AppData%\Syncios Toolkit\Logs|*.*
FileKey8=%AppData%\Syncios\Local Storage\leveldb|Log.old
FileKey9=%Documents%\Syncios Data Transfer|preference_conf.ini.old.bak
FileKey10=%SystemDrive%\temp|*.*|REMOVESELF

[Syncovery *]
LangSecRef=3024
Detect=HKCU\Software\Syncovery
FileKey1=%CommonAppData%\Syncovery\Logs|*.log|RECURSE

[Syncthing *]
LangSecRef=3022
DetectFile=%LocalAppData%\Syncthing
FileKey1=%LocalAppData%\Syncthing|*.log;*.xml.v*
FileKey2=%ProgramFiles%\Syncthing|*.old

[Synthesia *]
Section=Games
Detect=HKCU\Software\Classes\synthesia
FileKey1=%AppData%\Synthesia|log.txt;log-configuration.txt

[System Explorer *]
LangSecRef=3024
DetectFile=%ProgramFiles%\System Explorer\SystemExplorer.exe
FileKey1=%CommonAppData%\SystemExplorer\snapshots|*.ses

[System Mechanic *]
LangSecRef=3024
Detect=HKCU\Software\iolo\System Mechanic
FileKey1=%AppData%\iolo\SafetyNet\Temp|*.*
FileKey2=%AppData%\ioloGovernor\logs|*.*|REMOVESELF
FileKey3=%CommonAppData%\iolo|*.xml;*.txt
FileKey4=%CommonAppData%\iolo\ACRSummaryFiles|*.*|REMOVESELF
FileKey5=%CommonAppData%\iolo\logs|*.*|REMOVESELF
FileKey6=%CommonAppData%\iolo\TempResources|*.*|REMOVESELF
FileKey7=%ProgramFiles%\iolo\System Mechanic|*.txt;*.xml
FileKey8=%SystemDrive%\Documents and Settings\LocalService\*\iolo|*.*|REMOVESELF
FileKey9=%WinDir%\System32\config|iolo App.evt

[System Mechanic Snapshots *]
LangSecRef=3024
Detect=HKCU\Software\iolo\System Mechanic
Warning=This will delete system snapshots data.
FileKey1=%AppData%\iolo\System Snapshots Data|*.*

[System Profile Temp Folders *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\tw-*.tmp|empty.check|REMOVESELF

[System Tray Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\Innovative Solutions\System Tray Cleaner
DetectFile=%ProgramFiles%\Innovative Solutions\System Tray Cleaner\stc.exe
FileKey1=%LocalAppData%\Innovative Solutions\System Tray Cleaner\Process_information_cache|*.*
FileKey2=%ProgramFiles%\Innovative Solutions\System Tray Cleaner\Process_information_database|*.iscrt
RegKey1=HKCU\Software\Innovative Solutions\System Tray Cleaner\TrayApplications

[SysTracer *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SysTracer
FileKey1=%ProgramFiles%\SysTracer|SysTracerLog.txt
FileKey2=%ProgramFiles%\SysTracer\tmp|*.*|REMOVESELF

[Systweak Advanced PC Cleanup *]
LangSecRef=3024
Detect=HKCU\Software\Systweak\Advanced PC Cleanup
DetectFile=%ProgramFiles%\Advanced PC Cleanup\AdvancedPCCleanup.exe
FileKey1=%AppData%\Advanced PC Cleanup|*Log.txt
FileKey2=%ProgramFiles%\Advanced PC Cleanup|*log.txt

[Tag&Rename *]
LangSecRef=3024
Detect1=HKCU\Software\Softpointer\Tag&Rename
Detect2=HKCU\Software\Softpointer\Tag&Rename2
Detect3=HKCU\Software\Softpointer\Tag&Rename3
RegKey1=HKCU\Software\Softpointer\Tag&Rename\Config|FCurrentFolder
RegKey2=HKCU\Software\Softpointer\Tag&Rename\Config|FHistoryList
RegKey3=HKCU\Software\Softpointer\Tag&Rename2\Config|FCurrentFolder
RegKey4=HKCU\Software\Softpointer\Tag&Rename2\Config|FHistoryList
RegKey5=HKCU\Software\Softpointer\Tag&Rename3\Config|FCurrentFolder
RegKey6=HKCU\Software\Softpointer\Tag&Rename3\Config|FHistoryList
RegKey7=HKCU\Software\Softpointer\Tag&Rename3\Config|FileListHeader

[Taskbar Favorites Statistics *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband|FavoritesChanges

[Taskbar Programs Statistics *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

[Tasks Migrated *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%\System32\Tasks_Migrated|*.*|REMOVESELF

[TAudio Converter *]
LangSecRef=3023
DetectFile=%AppData%\TAC
FileKey1=%AppData%\TAC|log_main.txt

[TDIMon *]
LangSecRef=3024
Detect=HKCU\Software\Systems Internals\Tdimon
RegKey1=HKCU\Software\Systems Internals\Tdimon|Recent

[Team Crossword *]
Section=Games
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.TeamCrossword_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\TempState|*.*|RECURSE

[Team Fortress 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\440
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\download\user_custom|*.*|RECURSE
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\materials\temp|*.vtf|RECURSE

[TeamSpeak 3 *]
LangSecRef=3022
Detect=HKCU\Software\TeamSpeak 3 Client
FileKey1=%LocalAppData%\TeamSpeak 3 Client\config\logs|*.*
FileKey2=%ProgramFiles%\TeamSpeak 3 Client\config\logs|*.*

[TeamSpeak 3 Chats *]
LangSecRef=3022
Detect=HKCU\Software\TeamSpeak 3 Client
FileKey1=%AppData%\TS3Client\chats|*.*|REMOVESELF

[TeamViewer *]
LangSecRef=3024
Detect=HKCU\Software\TeamViewer
DetectFile1=%AppData%\TeamViewer
DetectFile2=%ProgramFiles%\TeamViewer\Version*
FileKey1=%AppData%\TeamViewer|*.log;*.mdmp
FileKey2=%LocalAppData%\TeamViewer\*Cache|*.*|RECURSE
FileKey3=%ProgramFiles%\TeamViewer|*.log
FileKey4=%ProgramFiles%\TeamViewer\Version*|*.log
FileKey5=%WinDir%\System32|TeamViewer*_Hooks.log
RegKey1=HKCU\Software\TeamViewer\Version5|Last_Machine_Connections
RegKey2=HKCU\Software\TeamViewer\Version5.1|Last_Machine_Connections
RegKey3=HKCU\Software\TeamViewer\Version6|Last_Machine_Connections
RegKey4=HKCU\Software\TeamViewer\Version7|Last_Machine_Connections
RegKey5=HKCU\Software\TeamViewer\Version8|Last_Machine_Connections
RegKey6=HKCU\Software\TeamViewer\Version9|Last_Machine_Connections

[Technic Launcher *]
Section=Games
DetectFile=%AppData%\.technic*
FileKey1=%AppData%\.technic*|*.old;*.log;*.tmp|RECURSE
FileKey2=%AppData%\.technic*\*\logs|*.*|RECURSE
FileKey3=%AppData%\.technic*\cache|*.*
FileKey4=%AppData%\.technic*\temp|*.*|RECURSE

[Technic Launcher Backups *]
Section=Games
DetectFile=%AppData%\.technic*
FileKey1=%AppData%\.technic*\*\Backups|*.*|RECURSE

[TechSmith DubIt *]
LangSecRef=3023
Detect=HKCU\Software\TechSmith\DubIt
FileKey1=%ProgramFiles%\TechSmith\DubIt|*.gid
RegKey1=HKCU\Software\TechSmith\DubIt\Recent Audio Files
RegKey2=HKCU\Software\TechSmith\DubIt\Recent Video Files

[TEdit *]
Section=Games
DetectFile=%AppData%\TEdit
FileKey1=%AppData%\TEdit\undo|*.*|RECURSE

[Teeworlds *]
Section=Games
DetectFile=%AppData%\Teeworlds
FileKey1=%AppData%\Teeworlds\dumps|*.*|REMOVESELF
FileKey2=%AppData%\Teeworlds\tmp|*.*|REMOVESELF

[Teeworlds Downloads/Maps *]
Section=Games
DetectFile=%AppData%\Teeworlds
FileKey1=%AppData%\Teeworlds\downloaded*|*.*|REMOVESELF
FileKey2=%AppData%\Teeworlds\maps|*.*|REMOVESELF

[Tele2 Mobile Partner *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Tele2 Mobile Partner\Tele2 Mobile Partner.exe
FileKey1=%CommonAppData%\Tele2 Mobile Partner\log|*.*
FileKey2=%ProgramFiles%\Tele2 Mobile Partner\Log|*.txt

[Telegram Desktop *]
LangSecRef=3022
DetectFile=%AppData%\Telegram Desktop\Telegram.exe
FileKey1=%AppData%\Telegram Desktop|log*.txt
FileKey2=%AppData%\Telegram Desktop\tdata\dumps|*.dmp
FileKey3=%AppData%\Telegram Desktop\tdata\User_Data\*Cache|*.*|RECURSE
FileKey4=%AppData%\Telegram Desktop\tupdates\Temp|*.*|RECURSE

[Temporary Files *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temp|*.*|RECURSE
FileKey2=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temp|*.*|RECURSE
FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Temp|*.*|RECURSE
FileKey4=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Temp|*.*|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\Local Settings\Temp|*.*|RECURSE

[Tencent QQ *]
LangSecRef=3022
DetectFile=%Documents%\Tencent Files
FileKey1=%CommonAppData%\Tencent Files\QQ\Misc|*.*|RECURSE
FileKey2=%Documents%\Tencent Files|*.*|RECURSE

[Tencent WeChat *]
LangSecRef=3022
DetectFile=%AppData%\Tencent\WeChat
FileKey1=%AppData%\Tencent\WeChat\Log|*.dump|RECURSE

[TeraCopy *]
LangSecRef=3024
Detect=HKCU\Software\Code Sector\TeraCopy
FileKey1=%AppData%\TeraCopy|FileList.dat;Transfer.log
FileKey2=%AppData%\TeraCopy\History|*.*
FileKey3=%ProgramFiles%\TeraCopy|FileList.dat;Transfer.log
RegKey1=HKCU\Software\Code Sector\TeraCopy|LastTargetFolder

[Terasology *]
Section=Games
DetectFile=%AppData%\.terasology
FileKey1=%AppData%\.terasology|*.log
FileKey2=%AppData%\.terasology\logs|*.*|REMOVESELF

[Terraria *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\105600
FileKey1=%Documents%\My Games\Terraria|*.bak;*.wld.bak|RECURSE
FileKey2=%ProgramFiles%\Steam\steamapps\common\terraria|client-crashlog.txt

[Tesla Legacy *]
Section=Games
DetectFile=%LocalAppData%\Astar Games\Tesla Legacy
FileKey1=%LocalAppData%\Astar Games\Tesla Legacy|*.log

[TeXnicCenter *]
LangSecRef=3021
Detect1=HKCU\Software\ToolsCenter\TeXnicCenter
Detect2=HKCU\Software\ToolsCenter\TeXnicCenterNT
RegKey1=HKCU\Software\ToolsCenter\TeXnicCenter\Recent File List
RegKey2=HKCU\Software\ToolsCenter\TeXnicCenter\Recent Project List
RegKey3=HKCU\Software\ToolsCenter\TeXnicCenter\Session
RegKey4=HKCU\Software\ToolsCenter\TeXnicCenter\Settings\Options|LastOpenedFolder
RegKey5=HKCU\Software\ToolsCenter\TeXnicCenterNT\Recent File List
RegKey6=HKCU\Software\ToolsCenter\TeXnicCenterNT\Recent Project List
RegKey7=HKCU\Software\ToolsCenter\TeXnicCenterNT\Session
RegKey8=HKCU\Software\ToolsCenter\TeXnicCenterNT\Settings\Options|LastOpenedFolder

[Text Input *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\InputApp_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\InputApp_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\InputApp_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\InputApp_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\InputApp_*\TempState|*.*|RECURSE

[TGCM *]
LangSecRef=3023
DetectFile=%AppData%\TGCMLog
FileKey1=%AppData%\TGCMLog|*log.txt

[The Bat *]
LangSecRef=3022
Detect=HKCU\Software\RIT\The Bat!
FileKey1=%AppData%\The Bat!\cache|*.*

[The Binding of Isaac *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\250900
Detect2=HKCU\Software\Valve\Steam\Apps\570660
FileKey1=%Documents%\My Games\Binding of Isaac *|*.dmp;isaacv*.txt;log.txt

[The Cleaner *]
LangSecRef=3024
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cleaner8.exe
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cleaner9.exe
FileKey1=%AppData%\thecleaner|*.log
FileKey2=%ProgramFiles%\The Cleaner|*.log;*.tmp;*.bak|RECURSE

[The Clumsys 2: The Butterfly Effect *]
Section=Games
DetectFile=%LocalAppData%\BanzaiInteractive\Clumsys2
FileKey1=%AppData%\BanzaiInteractive\Clumsys2|logfile.txt

[The Dream Machine *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\94300
FileKey1=%ProgramFiles%\Steam\steamapps\common\The Dream Machine\the_dream_machine.app|*.*|REMOVESELF

[The Elder Scrolls Online *]
Section=Games
DetectFile=%Documents%\Elder Scrolls Online
FileKey1=%Documents%\Elder Scrolls Online\Errors|*.*
FileKey2=%Documents%\Elder Scrolls Online\Logs|*.*

[The Lord of the Rings Online Launcher *]
Section=Games
DetectFile=%LocalAppData%\Turbine\The Lord of the Rings Online\Launcher
FileKey1=%LocalAppData%\The Lord Of The Rings Online|*.log
FileKey2=%LocalAppData%\Turbine|*.log|RECURSE

[The Mighty Quest for Epic Loot *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\239220
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\The Mighty Quest For Epic Loot\CrashReport|*.*
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\The Mighty Quest For Epic Loot\Log|*.*

[The Mystery of the Mary Celeste *]
Section=Games
DetectFile=%AppData%\Merscom\The Mystery of the Mary Celeste
FileKey1=%AppData%\Merscom\The Mystery of the Mary Celeste|logfile.txt

[The Rise of Atlantis *]
Section=Games
DetectFile=%CommonAppData%\TERMINAL Studio\The Rise of Atlantis
FileKey1=%CommonAppData%\Terminal Studio\The Rise of Atlantis|log.html

[The SemWare Editor Professional *]
LangSecRef=3024
DetectFile=%SystemDrive%\TSEPro\g32.exe
FileKey1=%SystemDrive%\TSEPro|tsefiles.dat;tsehist.dat

[The Sims 3 *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Sims 3
FileKey1=%Documents%\Electronic Arts\The Sims 3|*.log;*.mdmp;xcpt*.txt|RECURSE

[The Sims 3 Cache *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Sims 3
FileKey1=%Documents%\Electronic Arts\The Sims 3|socialCache.package;CASPartCache.package;scriptCache.package;compositorCache.package;simCompositorCache.package
FileKey2=%Documents%\Electronic Arts\The Sims 3\Thumbnails|*.*
FileKey3=%Documents%\Electronic Arts\The Sims 3\WorldCaches|*.*

[The Sims 3 DCBackup *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Sims 3
Warning=This may make premium content buggy if deleted.
FileKey1=%Documents%\Electronic arts\The sims 3\DCBackup|*.package
ExcludeKey1=FILE|%Documents%\electronic arts\The sims 3\DCBackup\|ccmerged.package

[The Sims 4 *]
Section=Games
DetectFile=%Documents%\Electronic Arts\The Sims 4
FileKey1=%Documents%\Electronic Arts\The Sims 4|*.txt;*.log

[The Sims Medieval *]
Section=Games
Detect=HKLM\Software\Electronic Arts\The Sims Medieval
FileKey1=%Documents%\Electronic Arts\The Sims Medieval|*.log;*.xml|RECURSE

[The Sims Resource Merlin *]
Section=Games
DetectFile=%ProgramFiles%\The Sims Resource\TSR Merlin
FileKey1=%ProgramFiles%\The Sims Resource\TSR Merlin\Logs|*.*

[The Surge *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\378540
FileKey1=%Documents%\The Surge\logs|*.txt

[The Talos Principle *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\257510
FileKey1=%ProgramFiles%\Steam\steamapps\common\The Talos Principle\Log|*.*|RECURSE

[The Tiny Bang Story *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\96000
FileKey1=%AppData%\Colibri Games\The Tiny Bang Story|logfile.txt

[The Weather Channel *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\TheWeatherChannel_t3yemqpq4kp7p
FileKey1=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\LocalState|*.tmp
FileKey5=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\TempState\Bing.Maps\Cache|*.*|RECURSE

[The Witcher *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\20900
Detect2=HKCU\Software\Valve\Steam\Apps\20920
FileKey1=%LocalAppData%\The Witcher 2\temp|*.*
FileKey2=%LocalAppData%\The Witcher\logs|*.*

[The Witcher 3 Backups *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\292030
Warning=You will not be able to restore old settings configurations.
FileKey1=%Documents%\The Witcher 3|*.bak

[Thinstall Database *]
LangSecRef=3021
DetectFile1=%AppData%\Thinstall
DetectFile2=%LocalAppData%\Thinstall
Warning=This will remove your Portable's settings. If settings are stored in the program's folder, this is fine.
FileKey1=%AppData%\Thinstall|*.*|REMOVESELF
FileKey2=%LocalAppData%\Thinstall|*.*|REMOVESELF

[Thomas Was Alone *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\220780
FileKey1=%ProgramFiles%\Steam\Steamapps\common\thomaswasalone\ThomasWasAlone_Data|output_log.txt

[ThumbsPlus *]
LangSecRef=3023
Detect=HKCU\Software\Cerious Software Inc.
FileKey1=%AppData%\Thumbsplus|*.log;*.bak;*.dmp;*.7z;*.exc;*.png
FileKey2=%ProgramFiles%\Thumbsplus *\Bin|*.log

[Tific Client *]
LangSecRef=3021
DetectFile=%LocalAppData%\Tific
FileKey1=%LocalAppData%\Tific|*.log|RECURSE

[TightVNC *]
LangSecRef=3022
DetectFile=%AppData%\TightVNC
FileKey1=%AppData%\TightVNC|*.log

[TikiOne Steam Cleaner *]
LangSecRef=3024
DetectFile=%UserProfile%\.tikione
FileKey1=%UserProfile%\.tikione\log|*.*

[Time Adjuster *]
LangSecRef=3021
Detect=HKCU\Software\IrekZielinskiSoft\TimeAdjuster
FileKey1=%ProgramFiles%\TimeAdjuster|*.cnt
RegKey1=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR1
RegKey2=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR2
RegKey3=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR3
RegKey4=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR4

[TimeRabbit *]
LangSecRef=3022
DetectFile=%AppData%\TimeRabbit
FileKey1=%AppData%\TimeRabbit\Cache|*.*|RECURSE

[Timeslips *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Timeslips
FileKey1=%ProgramFiles%\TimeSlips\Data01\logs|*.*
FileKey2=%ProgramFiles%\Timeslips\logs|*.*

[Tinder++ *]
LangSecRef=3021
DetectFile=%LocalAppData%\Tinder*
FileKey1=%LocalAppData%\Tinder*|*.*|RECURSE

[Tinseltown Dreams *]
Section=Games
DetectFile=%LocalAppData%\Namco Networks\Tinseltown Dreams
FileKey1=%LocalAppData%\Namco Networks\Tinseltown Dreams|errors*.*;log.txt

[Tipard Total Media Converter *]
LangSecRef=3023
Detect1=HKCU\Software\Tipard Studio\Tipard Total Media Converter
Detect2=HKCU\Software\Tipard Studio\Tipard Total Media Converter Platinum
FileKey1=%LocalAppData%\Tipard Studio\Tipard *|*.txt
RegKey1=HKCU\Software\Tipard Studio\Tipard Total Media Converter Platinum\Edit|LastVideoFilePath
RegKey2=HKCU\Software\Tipard Studio\Tipard Total Media Converter\Edit|LastVideoFilePath

[Tipard Video Converter *]
LangSecRef=3023
Detect1=HKCU\Software\Tipard Studio\Tipard Video Converter
Detect2=HKCU\Software\Tipard Studio\Tipard Video Converter Ultimate
FileKey1=%LocalAppData%\Tipard Studio\Tipard *|*.txt
RegKey1=HKCU\Software\Tipard Studio\Tipard Video Converter Ultimate\Edit|LastVideoFilePath
RegKey2=HKCU\Software\Tipard Studio\Tipard Video Converter\Edit|LastVideoFilePath

[Tips *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Getstarted_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Getstarted_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Getstarted_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Getstarted_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Getstarted_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Getstarted_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Getstarted_*\TempState|*.*|RECURSE

[Tixati *]
LangSecRef=3021
DetectFile=%AppData%\tixati
FileKey1=%AppData%\tixati|*.dat.lastloadok.dat;upnp_diagnostic_log.txt

[Tixati Incomplete Pieces *]
LangSecRef=3021
DetectFile=%AppData%\tixati
Warning=This will delete your incomplete pieces. Just delete, if you really need.
FileKey1=%AppData%\tixati\incomplete-pieces|*.*

[Tobit David *]
LangSecRef=3024
Detect=HKCU\Software\Tobit
FileKey1=%SystemDrive%\David\Apps\Dvgrab\Code|*.chk
FileKey2=%SystemDrive%\David\Apps\Postman\Code|*.chk
FileKey3=%SystemDrive%\David\Apps\Webbox\Code|*.log
FileKey4=%SystemDrive%\David\Archive\SYSTEM\DAVID\Errlog|*.*
FileKey5=%SystemDrive%\David\Archive\SYSTEM\pbxpense\log|*.*
FileKey6=%SystemDrive%\David\Archive\USER\*\system\trash|*.*
FileKey7=%SystemDrive%\David\Archive\USER\*\temp|*.*
FileKey8=%SystemDrive%\David\Code|*.old;*.chk;*.log
FileKey9=%SystemDrive%\David\Code\Database\MSSQL*DAVID\MSSQL\LOG|ERRORLOG;ERRORLOG.*;FDLAUNCHERRORLOG;FDLAUNCHERRORLOG.*;log_*.trc;SQL*.LOG*
FileKey10=%SystemDrive%\David\Code\Temp|*.*
FileKey11=%SystemDrive%\David\Import\System|I*.001
FileKey12=%SystemDrive%\David\Tld\COMMON|*DAVID.LOG
FileKey13=%SystemDrive%\David\Tld\Port\Extra|*.chk

[Tom Clancy's Ghost Recon *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\15300
DetectFile=%ProgramFiles%\Red Storm Entertainment\Ghost Recon
FileKey1=%ProgramFiles%\Red Storm Entertainment\Ghost Recon|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\Ghost Recon|*.log

[Tom Clancy's Rainbow Six 3: Raven Shield *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\19830
DetectFile=%ProgramFiles%\Red Storm Entertainment\RavenShield
FileKey1=%ProgramFiles%\Red Storm Entertainment\RavenShield|*.log
FileKey2=%ProgramFiles%\Steam\SteamApps\Common\RavenShield|*.log

[Tom Clancy's Rainbow Six: Vegas 2 *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\15120
DetectFile=%ProgramFiles%\Ubisoft\Tom Clancy's Rainbow Six Vegas 2
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Tom Clancy's Rainbow Six Vegas 2|CrashReport*.*;*.log|RECURSE
FileKey2=%ProgramFiles%\Ubisoft\Tom Clancy's Rainbow Six Vegas 2|CrashReport*.*;*.log|RECURSE

[Tomahawk *]
LangSecRef=3023
Detect=HKCU\Software\Tomahawk
FileKey1=%LocalAppData%\Tomahawk|*.log
FileKey2=%LocalAppData%\Tomahawk\Tomahawk\Cache|*.*|RECURSE

[Tomahawk PDF+ *]
LangSecRef=3021
Detect=HKCU\Software\NativeWinds\Tomahawk
RegKey1=HKCU\Software\NativeWinds\Tomahawk\MRU

[Tomb Raider *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\203160
FileKey1=%Documents%|TombRaider.log

[Tomboy *]
LangSecRef=3021
DetectFile=%LocalAppData%\Tomboy
FileKey1=%LocalAppData%\Tomboy|*.log
FileKey2=%LocalAppData%\Tomboy\Cache|*.*|RECURSE

[TomTom *]
LangSecRef=3021
Detect1=HKCU\Software\TomTom
Detect2=HKLM\Software\Classes\tomtomhome
FileKey1=%AppData%\TomTom\HOME\Profiles\*|Log.txt
FileKey2=%LocalAppData%\TomTom\HOME3|Log.txt
FileKey3=%LocalAppData%\TomTom\HOME3\cache|*.*|RECURSE

[ToniArts EasyCleaner Duplicates *]
LangSecRef=3024
Detect=HKLM\Software\ToniArts\EasyCleaner
FileKey1=%ProgramFiles%\ToniArts\EasyCleaner|Duplicat.*

[Toolbar Cleaner *]
LangSecRef=3024
Detect=HKLM\Software\Toolbar Cleaner
DetectFile=%ProgramFiles%\Toolbar Cleaner\ToolbarCleaner.exe
FileKey1=%ProgramFiles%\Toolbar Cleaner|*.txt

[Toontown *]
Section=Games
DetectFile=%LocalLowAppData%\Panda3D
FileKey1=%LocalLowAppData%\Panda3D\Log|*.*
FileKey2=%ProgramFiles%\Disney\Disney Online\ToontownOnline|*.log

[Toontown Rewritten *]
Section=Games
DetectFile=%ProgramFiles%\ToonTown Rewritten
FileKey1=%ProgramFiles%\ToonTown ReWritten\logs|*.*

[TopStyle 5 *]
LangSecRef=3021
Detect=HKCU\Software\Bradbury\TopStyle\5.0
RegKey1=HKCU\Software\Bradbury\TopStyle\5.0\RecentFiles

[Torchlight *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\41500
DetectFile=%AppData%\Runic Games\Torchlight
FileKey1=%AppData%\Runic Games\Torchlight|*.log

[Torchlight 2 *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\200710
Detect2=HKLM\Software\Runic Games\Torchlight II
FileKey1=%Documents%\My Games\runic games\torchlight 2|ogre.log
FileKey2=%Documents%\My Games\Runic Games\Torchlight 2\logs|*.*

[Torrent Search *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Torrent Search
FileKey1=%ProgramFiles%\Torrent Search|*.log

[TortoiseHg *]
LangSecRef=3021
Detect=HKCU\Software\tortoisemerge
FileKey1=%AppData%\TortoiseHg|*.log;*.old

[TortoiseSVN *]
LangSecRef=3024
Detect=HKCU\Software\TortoiseSVN
FileKey1=%AppData%\TortoiseSVN|*.*
FileKey2=%LocalAppData%\TSVNCache|*.*

[TortoiseSVN History *]
LangSecRef=3024
Detect=HKCU\Software\TortoiseSVN
Warning=This will remove your repo paths and last checkout location.
RegKey1=HKCU\Software\TortoiseSVN\History

[Toshiba BluetoothStack *]
LangSecRef=3024
Detect=HKLM\Software\Toshiba\BluetoothStack
FileKey1=%LocalAppData%\Toshiba\BluetoothStack\V1.0\tosOBEX\Temp|*.*

[Toshiba Book Place *]
LangSecRef=3021
DetectFile=%AppData%\Book Place
FileKey1=%AppData%\Book Place\Cache|*.*|RECURSE
FileKey2=%AppData%\Book Place\log|*.*|RECURSE

[Toshiba FlashCards *]
LangSecRef=3021
DetectFile=%LocalAppData%\TOSHIBA\FlashCards
FileKey1=%LocalAppData%\TOSHIBa\FlashCards|log.txt

[Total Recorder *]
LangSecRef=3023
Detect=HKCU\Software\HighCriteria\TotalRecorder\Recent File List
RegKey1=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File1
RegKey2=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File2
RegKey3=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File3
RegKey4=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File4
RegKey5=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File5
RegKey6=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File6
RegKey7=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File7
RegKey8=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File8
RegKey9=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File9

[Total Uninstall *]
LangSecRef=3024
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Total Uninstall 5_is1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Total Uninstall 6_is1
FileKey1=%CommonAppData%\Martau\Total Uninstall*|*.Folders;*.cache|RECURSE
FileKey2=%ProgramFiles%\Total Uninstall*|*.rtf;*.txt;*.GID|RECURSE

[Total Uninstall Backups *]
LangSecRef=3024
Detect1=HKCU\Software\MartS\Total Uninstall
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Total Uninstall 5_is1
Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Total Uninstall 6_is1
Warning=This will delete analyzed programs and backups.
FileKey1=%CommonAppData%\Martau\Total Uninstall*|*.tlg;*.zsns;*.zip|RECURSE
FileKey2=%CommonAppData%\Martau\Total Uninstall*\Analyzed Programs|*.*
FileKey3=%CommonAppData%\Martau\Total Uninstall*\Backup|*.zip
FileKey4=%CommonAppData%\Martau\Total Uninstall*\System Snapshots|*.zsns

[Towns *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\221020
FileKey1=%ProgramFiles%\Steam\Steamapps\common\towns|*.log

[TP-Link *]
LangSecRef=3022
DetectFile=%CommonAppData%\TP-Link
FileKey1=%CommonAppData%\TP-Link|*.log

[TrackMania Forever Cache *]
Section=Games
DetectFile=%CommonAppData%\TrackMania
FileKey1=%CommonAppData%\TrackMania\Cache|*.*
FileKey2=%CommonAppData%\TrackMania\Cache\ManiaCode|*.*

[TrackMania Forever Manialinks *]
Section=Games
DetectFile=%CommonAppData%\TrackMania
FileKey1=%CommonAppData%\TrackMania\Manialinks|*.*

[TrackMania Forever Scores *]
Section=Games
DetectFile=%CommonAppData%\TrackMania
FileKey1=%CommonAppData%\TrackMania\CampaignsScores|*.*
FileKey2=%CommonAppData%\TrackMania\CampaignsScores\General|*.*
FileKey3=%CommonAppData%\TrackMania\CampaignsScores\UnitedRace|*.*
FileKey4=%CommonAppData%\TrackMania\LadderScores|*.*

[Tracks Eraser Pro *]
LangSecRef=3024
Detect=HKLM\Software\Acesoft\tracks eraser pro
FileKey1=%ProgramFiles%\Acesoft\Tracks Eraser Pro|te.log

[Trade Manager *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Trademanager
FileKey1=%ProgramFiles%\Trademanager|OneClickEnd.log

[Treesize *]
LangSecRef=3024
Detect1=HKCU\Software\JAM Software\TreeSize Free
Detect2=HKCU\Software\JAM Software\TreeSize Professional
FileKey1=%AppData%\JAM Software\TreeSize *|GlobalOptions.bak0

[Trend Micro *]
LangSecRef=3023
Detect1=HKCU\Software\Trend Micro
Detect2=HKLM\Software\TrendMicro
DetectFile=%CommonAppData%\Trend Micro
FileKey1=%CommonAppData%\Trend Micro|*.log
FileKey2=%ProgramFiles%\Trend Micro|*.log;URLLog.dat|RECURSE

[Trend Micro AntiRansomware Tool *]
LangSecRef=3021
DetectFile=%ProgramFiles%\AntiRansomware2.0
FileKey1=%CommonAppData%\AntiRansomware|*.log

[Trend Micro HijackThis Backups *]
LangSecRef=3024
Detect=HKLM\Software\TrendMicro\HijackThis
FileKey1=%ProgramFiles%\Trend Micro\HijackThis\backups|*.*

[Trend Micro RUBotted *]
LangSecRef=3024
Detect=HKLM\Software\TrendMicro\RUBotted
FileKey1=%CommonAppData%\Trend Micro\RUBotted\Logs|*.*|REMOVESELF
FileKey2=%ProgramFiles%\Trend Micro\RUBotted\DebugLogs|*.*|REMOVESELF

[Tribes: Ascend *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\17080
FileKey1=%CommonAppData%\Hi-Rez Studios\BrowserCacheTribes\Default\Cache|*.*|RECURSE
FileKey2=%Documents%\My Games\Tribes Ascend\TribesGame\Logs|*.*
FileKey3=%ProgramFiles%\Steam\steamapps\common\tribes\Binaries\Logs|*.*

[Trillian *]
LangSecRef=3022
Detect=HKLM\Software\Clients\IM\Trillian
FileKey1=%AppData%\Trillian\Crash Files|*.*|RECURSE
FileKey2=%AppData%\Trillian\users\*|buddies.*.xml
FileKey3=%AppData%\Trillian\users\*\cache|*.*
FileKey4=%AppData%\Trillian\users\*\instantlookup|*.*
FileKey5=%AppData%\Trillian\users\*\logs|*.*|RECURSE
FileKey6=%AppData%\Trillian\users\global\skin_cache|*.*
FileKey7=%ProgramFiles%\Trillian\Crash Files|*.*|RECURSE
FileKey8=%ProgramFiles%\Trillian\Users\Default\buddyicons|*.*|RECURSE
FileKey9=%ProgramFiles%\Trillian\Users\Default\instantlookup|*.*

[Trine *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\35700
Detect2=HKCU\Software\Valve\Steam\Apps\35720
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Trine*\log*|*.*
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Trine\_enchanted_edition_\log|*.*

[TrojanHunter *]
LangSecRef=3024
Detect=HKCU\Software\TrojanHunter
FileKey1=%ProgramFiles%\TrojanHunter*|Debug.log;DebugLog.txt
FileKey2=%ProgramFiles%\TrojanHunter*\Scan Reports|*.*

[Tropico *]
Section=Games
Detect1=HKCU\Software\Haemimont Games\Tropico 4
Detect2=HKLM\Software\Haemimont Games\Tropico3
FileKey1=%AppData%\Tropico*\logs|*.*|REMOVESELF
FileKey2=%AppData%\Tropico*\ShaderCache|*.*|REMOVESELF
FileKey3=%ProgramFiles%\Kalypso Media\*|dotnetfx3.exe;dotnetfx35.exe
FileKey4=%ProgramFiles%\Kalypso Media\*\DirectXRedist|*.*|REMOVESELF

[Trusteer Rapport *]
LangSecRef=3022
Detect=HKCU\Software\Trusteer\Rapport
FileKey1=%CommonAppData%\Trusteer\Rapport\logs|*.*
FileKey2=%LocalAppData%\Trusteer\Rapport\user\logs|*.*
FileKey3=%WinDir%\System32\config\systemprofile\AppData\Local\Trusteer\Rapport\user\logs|*.*

[TuneDroid *]
LangSecRef=3023
DetectFile=%AppData%\TuneDroid
FileKey1=%AppData%\TuneDroid\Logs|*.*

[TuneXP *]
LangSecRef=3021
DetectFile=%ProgramFiles%\TuneXP
FileKey1=%ProgramFiles%\TuneXP\docs|*.bak

[TunnelBear *]
LangSecRef=3022
DetectFile=%ProgramFiles%\TunnelBear
FileKey1=%ProgramFiles%\TunnelBear|*.log

[TV-Browser *]
LangSecRef=3021
DetectFile=%ProgramFiles%\TV-Browser\tvbrowser.exe
FileKey1=%AppData%\TV-Browser\*|java.searchplugin.SearchPlugin.dat*

[TV_Net *]
LangSecRef=3023
DetectFile=%LocalLowAppData%\TV_Net
FileKey1=%LocalLowAppData%\TV_Net\CacheIcons|*.*|RECURSE
FileKey2=%LocalLowAppData%\TV_Net\Logs|*.*|RECURSE

[TVersity *]
LangSecRef=3023
Detect=HKLM\Software\TVersity\Media Server
FileKey1=%ProgramFiles%\TVersity Codec Pack|*.exe;*.url
FileKey2=%ProgramFiles%\TVersity\Media Server|*.rtf;*.url;*TVersityCodecPackSetup*
FileKey3=%ProgramFiles%\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE
FileKey4=%WinDir%\System32|tversity.cookies;TVersityMediaServer.log;*.1;*.2;*.3
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\TVersity Media Server|*.*|REMOVESELF
FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Temp\TVersity Media Server|*.*|REMOVESELF
ExcludeKey1=FILE|%ProgramFiles%\TVersity Codec Pack\|uninst.exe
ExcludeKey2=FILE|%ProgramFiles%\TVersity\Media Server\|HOWTO Share Media.txt
ExcludeKey3=FILE|%ProgramFiles%\TVersity\Media Server\|version.txt

[TVUPlayer *]
LangSecRef=3023
Detect=HKCU\Software\TVU networks
FileKey1=%ProgramFiles%\TVUPlayer|log.txt

[TWC Desktop Weather *]
LangSecRef=3021
DetectFile=%LocalAppData%\The Weather Channel\Desktop\patch
FileKey1=%LocalAppData%\The Weather Channel\Desktop\patch|*.*

[Tweaking.com Windows Repair *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Tweaking.com - Windows Repair (All in One)
DetectFile1=%ProgramFiles%\Tweaking.com
DetectFile2=%SystemDrive%\Tweaking.com_Windows_Repair_Logs
FileKey1=%ProgramFiles%\Tweaking.com\Windows Repair (All in One)\Logs|*.*|REMOVESELF
FileKey2=%SystemDrive%\Tweaking.com_Windows_Repair_Logs|*.*|REMOVESELF

[TweakNow PowerPack Backups *]
LangSecRef=3024
Detect=HKCU\Software\TweakNow PowerPack
FileKey1=%ProgramFiles%\TweakNow PowerPack\Backup|*.*

[TweetDeck *]
LangSecRef=3022
Detect=HKCU\Software\Twitter\TweetDeck
Warning=May delete your password and require you to log in again.
FileKey1=%LocalAppData%\Twitter\TweetDeck\localStorage|*.*
FileKey2=%ProgramFiles%\Twitter\TweetDeck|*.log

[Tweetro *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\27761LazywormApplications.Tweetro_5tydn77rr51qw
FileKey1=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\AC\Microsoft\*|*.LOG|RECURSE
FileKey2=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\AC\Microsoft\*\Native Images\Assembly\Temp|*.*
FileKey3=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\AC\Microsoft\*\Native Images\Temp|*.*
FileKey4=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\LocalState\*\PhotoTweets|*.*
FileKey8=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\LocalState\Logs|*.*
FileKey9=%LocalAppData%\Packages\*LazywormApplications.tweetro_*\TempState|*.*

[Tweetro+ *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\27761LazywormApplications.135450F141EEE_5tydn77rr51qw
FileKey1=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\AC\Microsoft\*|*.LOG|RECURSE
FileKey2=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\AC\Microsoft\*\Native Images\Assembly\Temp|*.*
FileKey3=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\AC\Microsoft\*\Native Images\Temp|*.*
FileKey4=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\LocalState\*\PhotoTweets|*.*
FileKey8=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\LocalState\Logs|*.*
FileKey9=%LocalAppData%\Packages\*LazywormApplications.135450F141EEE_*\TempState|*.*

[Twitch *]
Section=Games
DetectFile=%AppData%\Twitch
FileKey1=%AppData%\Twitch|updater.log
FileKey2=%AppData%\Twitch\Games\Dumps|*.*|REMOVESELF
FileKey3=%AppData%\Twitch\logs\*|*.json;*.log|REMOVESELF

[Twitch Cache *]
Section=Games
DetectFile=%AppData%\Twitch
FileKey1=%AppData%\Twitch\Electron|cookies*
FileKey2=%AppData%\Twitch\Electron\*cache|*.*|REMOVESELF
FileKey3=%AppData%\Twitch\Electron\local storage|*.*

[Twitch Minecraft *]
Section=Games
DetectFile=%UserProfile%\Twitch\Minecraft
FileKey1=%UserProfile%\Twitch\Minecraft\Install|launcher_log.txt
FileKey2=%UserProfile%\Twitch\Minecraft\Install\logs|*.*
FileKey3=%UserProfile%\Twitch\Minecraft\Instances\*|*.log
FileKey4=%UserProfile%\Twitch\Minecraft\Instances\*\crash-reports|*.*
FileKey5=%UserProfile%\Twitch\Minecraft\Instances\*\logs|*.*

[Twitter *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\9E2F88E3.Twitter_wgeqdkkx372wm
FileKey1=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\Microsoft\Internet Explorer\DOMStore\*|*.*|REMOVESELF
FileKey5=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AppData\Indexed DB|*.log
FileKey7=%LocalAppData%\Packages\9E2F88E3.Twitter_*\LocalState|*.*|RECURSE

[Twitter Metro *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\9E2F88E3.Twitter_wgeqdkkx372wm
FileKey1=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\INetC*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\Microsoft\*|*.LOG|RECURSE
FileKey3=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\9E2F88E3.Twitter_*\LocalState|*.*|RECURSE

[Two Worlds Epic Edition *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\1930
FileKey1=%Documents%\TwoWorlds Files\FontsCache|*.tmp

[Tzip *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Tzip
FileKey1=%ProgramFiles%\Tzip|*.temp

[Ubisoft Game Launcher *]
Section=Games
DetectFile=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher
FileKey1=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher|*.log;orbitdll_*_log.txt;launcher_log.txt;Installed_files.txt;version.txt
FileKey2=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\assets|*.*
FileKey3=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\http*|*.*|RECURSE
FileKey4=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Logs|*.*

[Ubisoft Game Launcher Installers *]
Section=Games
DetectFile=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher
Warning=Make sure to launch all of your installed UPlay games at least once before running this, or they may not launch properly.
FileKey1=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\Installers|*.*|REMOVESELF

[Ulead GIF Animator 5.05 *]
LangSecRef=3024
Detect=HKCU\Software\Ulead Systems\Ulead GIF Animator\5.05
RegKey1=HKCU\Software\Ulead Systems\Ulead GIF Animator\5.05\Recent File List

[Ultimate Defrag *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Disktrix\UltimateDefrag\Udefrag.exe
FileKey1=%ProgramFiles%\Disktrix\UltimateDefrag|*.db;*Crash.dmp

[UltraDefrag *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraDefrag
DetectFile1=%SystemDrive%\PortableApps\UltraDefragPortable\UltraDefragPortable.exe
DetectFile2=%WinDir%\UltraDefrag\ultradefrag.exe
FileKey1=%ProgramFiles%\UltraDefrag\logs|*.*
FileKey2=%SystemDrive%|fraglist.luar
FileKey3=%SystemDrive%\PortableApps\UltraDefragPortable\Data|UltraDefragPortable.log
FileKey4=%WinDir%\UltraDefrag\logs|*.log

[UltraEdit *]
LangSecRef=3021
Detect=HKCU\Software\IDM Computer Solutions\UltraEdit
FileKey1=%AppData%\IDMComp\UltraEdit\autorec|*.*|RECURSE
FileKey2=%ProgramFiles%\IDM Computer Solutions\UltraEdit|*.txt

[UltraISO *]
LangSecRef=3024
Detect=HKCU\Software\EasyBoot Systems
FileKey1=%ProgramFiles%\UltraISO\backup|*.*|REMOVESELF
RegKey1=HKCU\Software\EasyBoot Systems\UltraISO\5.0|LogFile
RegKey2=HKCU\Software\EasyBoot Systems\UltraISO\5.0|OpenFolder

[Ultratron *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\219190
FileKey1=%UserProfile%\.ultratron*|*.log

[UMPlayer *]
LangSecRef=3023
DetectFile=%UserProfile%\.umplayer
FileKey1=%SystemDrive%\MININT|*.log|RECURSE

[UMPlayer File Settings *]
LangSecRef=3023
DetectFile=%UserProfile%\.umplayer
FileKey1=%UserProfile%\.umplayer\file_settings|*.*|RECURSE

[Unchecky *]
LangSecRef=3024
Detect=HKCU\Software\Unchecky
FileKey1=%CommonAppData%\Unchecky|*.log;uclogfile*.bin

[UnHackMe *]
LangSecRef=3024
Detect=HKLM\Software\Greatis
FileKey1=%Documents%\RegRun2|*.txt
FileKey2=%ProgramFiles%\UnHackMe|*.err;*.txt;*.log|RECURSE

[Unicenta Open POS *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Unicentaopos*
FileKey1=%ProgramFiles%\Unicentaopos*|*.log

[Unified Remote *]
LangSecRef=3023
Detect=HKCU\Software\Unified Remote
FileKey1=%AppData%\Unified Remote\Logs|*.*

[Unigine Heaven DX11 Benchmark *]
LangSecRef=3021
DetectFile=%UserProfile%\Unigine Heaven
FileKey1=%UserProfile%\Unigine Heaven|log.html;*.cache
FileKey2=%UserProfile%\Unigine Heaven\save|*.*|REMOVESELF

[Uninstall Tool *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool_is1
FileKey1=%ProgramFiles%\Uninstall Tool|*.dmp

[Unity Web Player *]
LangSecRef=3023
Detect=HKCU\Software\Unity\WebPlayer
FileKey1=%LocalLowAppData%\Unity\*Player\Cache|*.*|RECURSE

[Universal Share Downloader *]
LangSecRef=3022
DetectFile=%ProgramFiles%\USDownloader\USDownloader.exe
FileKey1=%ProgramFiles%\USDownloader|USDownloader.log;*.bak;*.bmp;*.jpg;*.png

[Unlocker *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Unlocker\Unlocker.exe
FileKey1=%ProgramFiles%\Unlocker|Unlocker-List.txt

[Unlockroot *]
LangSecRef=3024
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\unlockroot.exe
Detect2=HKLM\Software\UnlockrootPro
FileKey1=%ProgramFiles%\Unlockroot*|*.txt
FileKey2=%ProgramFiles%\Unlockroot*\tools|*.zip

[UPX Shell *]
LangSecRef=3024
Detect=HKCU\Software\ION Tek\UPX Shell
RegKey1=HKCU\Software\ION Tek\UPX Shell\3.x|History

[USA Today *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\USATODAY.USATODAY_wy7mw3214mat8
FileKey1=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\CLR_v4.0|*.log
FileKey3=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\USATODAY.USATODAY_*\TempState|*.*|RECURSE

[USB Disk Security *]
LangSecRef=3024
DetectFile=%ProgramFiles%\USB Disk Security\USBGuard.exe
FileKey1=%AppData%\Zbshareware Lab|*.*|REMOVESELF

[USB Redirector *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{FB9376AC-5253-42a5-AC0A-D306F32FFAD2}
FileKey1=%ProgramFiles%\USB Redirector|*.log;*.txt

[USB Safely Remove *]
LangSecRef=3024
Detect=HKCU\Software\SafelyRemove
FileKey1=%AppData%\USBSafelyRemove|*.txt
FileKey2=%AppData%\USBSRService|*.txt
FileKey3=%CommonAppData%\USBSRService|*.txt
FileKey4=%ProgramFiles%\USB Safely Remove|*.DIZ;*.rtf;*.url

[USBChargerPlus *]
LangSecRef=3021
DetectFile=%CommonAppData%\USBChargerPlus
FileKey1=%CommonAppData%|AsACPLog.*

[UsbFix *]
LangSecRef=3023
Detect=HKCU\Software\UsbFix
FileKey1=%SystemDrive%\UsbFix\Log|*.*|REMOVESELF
FileKey2=%SystemDrive%\UsbFix\Quarantine|*.*|REMOVESELF
FileKey3=%UserProfile%\Desktop|UsbFix_Report.txt
RegKey1=HKCU\Software\UsbFix\LastReport

[User Benchmark *]
LangSecRef=3024
DetectFile=%ProgramFiles%\User Benchmark\UserBenchMark.exe
FileKey1=%SystemDrive%\UserBenchmark|*.*|REMOVESELF

[uTorrent *]
LangSecRef=3022
Detect=HKCU\Software\BitTorrent\uTorrent
FileKey1=%AppData%\utorrent|*.log;*.dmp;*.bad;*.older;*.benc;updates.dat
FileKey2=%AppData%\utorrent\updates|*.exe
FileKey3=%LocalAppData%\BitTorrentHelper|*.log
FileKey4=%LocalAppData%\BitTorrentHelper\crashdumps|*.*|RECURSE
FileKey5=%LocalLowAppData%\uTorrent|uTorrent_*
FileKey6=%LocalLowAppData%\uTorrentBar\Logs|*.*
FileKey7=%ProgramFiles%\uTorrent|*.tmp;*.old
RegKey1=HKCU\Software\BitTorrent|computerID

[uTorrent IPFilter Backups *]
LangSecRef=3022
DetectFile=%AppData%\uTorrent
FileKey1=%AppData%\utorrent|*ipfilter.bak

[UWP PRI Files Scan Cache *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKU\.DEFAULT\Software\Classes\Local Settings\MrtCache

[V - The File Viewer *]
LangSecRef=3024
Detect=HKCU\Software\Prineas\FileViewer
FileKey1=%AppData%\V|*.log
RegKey1=HKCU\Software\Prineas\FileViewer\History
RegKey2=HKCU\Software\Prineas\FileViewer\PathC
RegKey3=HKCU\Software\Prineas\FileViewer\QathH
RegKey4=HKCU\Software\Prineas\FileViewer\VCurrentPath
RegKey5=HKCU\Software\Prineas\FileViewer\VCurrentPath1

[V&V Messenger Chat History *]
LangSecRef=3022
DetectFile=%AppData%\AJabber
FileKey1=%AppData%\AJabber\*\Contacts|*.*|RECURSE

[Vampix *]
LangSecRef=3023
Detect=HKCU\Software\KC Softwares\Vampix
FileKey1=%AppData%\KC Softwares\Vampix|*.jpg;*.log

[Vbs2Exe *]
LangSecRef=3024
Detect=HKCU\Software\enkeladress\vbs2exe
DetectFile=%ProgramFiles%\Vbs2Exe\vbs2exe.exe
FileKey1=%ProgramFiles%\Vbs2Exe|recentlist.rlt

[VCast *]
LangSecRef=3023
DetectFile=%LocalAppData%\V Cast Media Manager
FileKey1=%LocalAppData%\V Cast Media Manager|*.log;backuplog.txt;logfile.txt;*.tmp|RECURSE

[VCRedist Temp Setup Files *]
LangSecRef=3021
DetectFile=%SystemDrive%\VC_RED.*
FileKey1=%SystemDrive%|eula.*.txt;globdata.ini;install.exe;install.ini;install.res.*.dll;VC_RED.cab;VC_RED.MSI;vcredist.bmp

[VCW VicMan's Photo Editor *]
LangSecRef=3023
DetectFile=%ProgramFiles%\VCW VicMan's Photo Editor\vcwphoto.exe
FileKey1=%ProgramFiles%\VCW VicMan's Photo Editor|recent.ini

[Venis IX *]
LangSecRef=3021
Detect=HKCU\Software\Spaceblue\Venis IX
RegKey1=HKCU\Software\Spaceblue\Venis IX\FileHistory

[Ventrilo Chat Logs *]
LangSecRef=3022
Detect=HKCU\Software\Ventrilo
FileKey1=%AppData%\ventrilo\chatlogs|*.*|REMOVESELF

[Verizon Download Manager *]
LangSecRef=3022
DetectFile=%LocalAppData%\SupportSoft\Verizondm
FileKey1=%LocalAppData%\SupportSoft\verizondm\*\*\logs|*.*

[Verizon In-Home Assistant *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Verizon\IHA_MessageCenter
FileKey1=%ProgramFiles%\Verizon\IHA_MessageCenter\Log|mc-log;mc-log*.*

[VeryPDF OCR to Any Converter *]
LangSecRef=3021
Detect=HKCU\Software\VietUnicode\VeryPDF OCR to Any Converter3
RegKey1=HKCU\Software\VietUnicode\VeryPDF OCR to Any Converter3|MruList

[VIA/S3G UniChrome Pro IGP *]
LangSecRef=3024
Detect=HKLM\Software\S3
FileKey1=%ProgramFiles%\S3\UChromeP|s3iscfg.log

[VideoGet *]
LangSecRef=3022
Detect=HKCU\Software\Nuclear Coffee\VideoGet
FileKey1=%ProgramFiles%\VideoGet\Temp|*.*

[VideoInspector *]
LangSecRef=3023
Detect=HKCU\Software\KC Softwares\VideoInspector
FileKey1=%AppData%\KC Softwares\VideoInspector|*.log

[VideoMach *]
LangSecRef=3023
Detect=HKCU\Software\Gromada\VideoMach
FileKey1=%Documents%|VideoMach_Log.txt

[Vim History *]
LangSecRef=3021
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vim
FileKey1=%UserProfile%|_viminfo

[Vindictus *]
Section=Games
Detect=HKLM\Software\Nexon\Vindictus
DetectFile=%SystemDrive%\Nexon\Vindictus EU\en-EU\Vindictus.exe
FileKey1=%CommonAppData%\NexonEU\601|*.log
FileKey2=%Documents%\Vindictus EU\Report Error|*.log;*.mdmp
FileKey3=%SystemDrive%\Nexon\Vindictus EU\en-EU|*.log;*.tmp
FileKey4=%SystemDrive%\Nexon\Vindictus EU\en-EU\HShield|*.log

[Violett *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\257830
FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Violett|crash.dmp;error.log;output_log.txt;report.ini|RECURSE

[Virtual Clone Drive *]
LangSecRef=3021
Detect=HKLM\Software\Elaborate Bytes\VirtualCloneDrive
RegKey1=HKLM\Software\Elaborate Bytes\VirtualCloneDrive\0

[VirtualBox *]
LangSecRef=3024
DetectFile=%UserProfile%\.VirtualBox
FileKey1=%CommonAppData%\VirtualBox|*.log;*.log.*
FileKey2=%UserProfile%\.VirtualBox|*.log;*.log.*
FileKey3=%UserProfile%\VirtualBox VMs\*\Logs|*.log;*.log.*

[VirtualDJ *]
LangSecRef=3023
Detect=HKCU\Software\VirtualDJ
FileKey1=%Documents%\VirtualDJ\Cache|*.*|RECURSE

[VirtualDJ Tracklist *]
LangSecRef=3023
Detect=HKCU\Software\VirtualDJ
FileKey1=%Documents%\VirtualDJ\TrackListing|*.*

[VirtualDub *]
LangSecRef=3023
Detect=HKCU\Software\VirtualDub.org\VirtualDub
RegKey1=HKCU\Software\VirtualDub.org\VirtualDub\MRU List
RegKey2=HKCU\Software\VirtualDub.org\VirtualDub\Saved filespecs

[VirtualDubMod *]
LangSecRef=3023
Detect=HKCU\Software\Freeware\VirtualDubMod
RegKey1=HKCU\Software\Freeware\VirtualDubMod\MRU List

[VirtualFDD *]
LangSecRef=3024
Detect=HKCU\Software\Korbos\VirtualFDD
RegKey1=HKCU\Software\Korbos\VirtualFDD\Recent File List

[VirtuaWin *]
LangSecRef=3021
DetectFile=%AppData%\VirtuaWin
FileKey1=%AppData%\VirtuaWin|virtuawin.log

[Vizible Player *]
LangSecRef=3023
Detect=HKLM\Software\Vizible
FileKey1=%AppData%\Vizible Player\3DClient|*.log
FileKey2=%ProgramFiles%\Vizible Player\Dependencies|*.log

[Vizzed Retro Game Room *]
LangSecRef=3023
DetectFile=%LocalLowAppData%\VizzedRgr
FileKey1=%LocalLowAppData%\VizzedRgr\Downloads|*.*|RECURSE
FileKey2=%LocalLowAppData%\VizzedRgr\Roms|*.*|RECURSE

[VLC Media Player *]
LangSecRef=3023
Detect=HKLM\Software\VideoLAN\VLC
FileKey1=%AppData%\vlc|*.cache-3;ml.xspf.tmp*;vlc-qt-interface.ini.*
FileKey2=%AppData%\vlc\art|*.*|RECURSE
FileKey3=%AppData%\vlc\crashdump*|*.*

[VMware Personal Desktop Virtualization *]
LangSecRef=3024
Detect1=HKLM\Software\VMware, Inc.\VMware Player
Detect2=HKLM\Software\VMware, Inc.\VMware Workstation
DetectFile=%Documents%\Virtual Machines
FileKey1=%CommonAppData%\VMware\hostd|*.log;*.gz|RECURSE
FileKey2=%CommonAppData%\VMware\Installer|*.*|REMOVESELF
FileKey3=%CommonAppData%\VMware\logs|*.log|RECURSE
FileKey4=%CommonAppData%\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE
FileKey5=%Documents%\*Virtual Machines|*.log|RECURSE
FileKey6=%LocalAppData%\VMware|*.log
FileKey7=%LocalAppData%\VMware\VMware vCenter Converter Standalone Client\Logs|*.log;*.gz

[Vodafone *]
LangSecRef=3022
Detect=HKCU\Software\Vodafone
FileKey1=%AppData%\Vodafone\Vodafone Mobile *\Log|*.*
FileKey2=%AppData%\Vodafone\Vodafone Mobile Connect\Temp|*.*
FileKey3=%CommonAppData%\Vodafone\Log|*.*
FileKey4=%ProgramFiles%\Vodafone\Vodafone Mobile Broadband\Bin|SwiHpAux.log
FileKey5=%WinDir%|ModemLog_*.txt

[Voice Recorder *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\TempState|*.*|RECURSE

[VoipBuster *]
LangSecRef=3022
DetectFile=%AppData%\VoipBuster
FileKey1=%AppData%\VoipBuster|*.log
FileKey2=%WinDir%\System32|VoipBuster*.log
FileKey3=%WinDir%\SysWOW64|VoipBuster*.log

[Vopt 9 *]
LangSecRef=3024
Detect=HKCU\Software\Golden Bow Systems\Vopt
FileKey1=%ProgramFiles%\Golden Bow\Vopt 9|Vopt.log

[VS Code *]
LangSecRef=3021
DetectFile=%AppData%\Code
FileKey1=%AppData%\Code|cookies*
FileKey2=%AppData%\Code\GPUCache|*.*
FileKey3=%AppData%\Code\Local Storage|*.*
FileKey4=%LocalAppData%\SquirrelTemp|*.log

[VSO Batcher *]
LangSecRef=3023
Detect=HKCU\Software\VSO\VSO Batcher
FileKey1=%AppData%\Vso\VSO Batcher\1|*.*|RECURSE
RegKey1=HKCU\Software\VSO\VSO Batcher\1|VideoFilesLastFlder

[VSO Blindwrite *]
LangSecRef=3021
Detect=HKCU\Software\VSO\Blindwrite
FileKey1=%AppData%|pcouffin.log;ezplay.log
FileKey2=%AppData%\VSO|*.log|REMOVESELF
FileKey3=%CommonAppData%\VSO\Blindwrite\*|*.log|REMOVESELF
FileKey4=%Documents%\PcSetup|*.log|REMOVESELF
FileKey5=%UserProfile%|timestamp.txt

[VSO Converter *]
LangSecRef=3023
Detect1=HKCU\Software\VSO\Blu-ray Converter Ultimate
Detect2=HKCU\Software\VSO\DVD Converter Ultimate
Detect3=HKCU\Software\VSO\VSO Video Converter
FileKey1=%AppData%|pcouffin.log
FileKey2=%CommonAppData%\VSO|*.cache
FileKey3=%CommonAppData%\VSO\*Converter*\*\Log|*.log;*.crashlist|REMOVESELF
FileKey4=%CommonAppData%\VSO\vsothumbs|*.*|REMOVESELF
FileKey5=%Documents%\PcSetup|*.log|REMOVESELF
FileKey6=%ProgramFiles%\VSO\*Converter*\*|*.txt
RegKey1=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|BDMVInputFolders
RegKey2=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|ISOInputFolders
RegKey3=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|MediaLabel
RegKey4=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_audio
RegKey5=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_bluray
RegKey6=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_dvd
RegKey7=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_iso
RegKey8=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_subtitle
RegKey9=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_video
RegKey10=HKCU\Software\VSO\DVD Converter Ultimate\2|BDMVInputFolders
RegKey11=HKCU\Software\VSO\DVD Converter Ultimate\2|ISOInputFolders
RegKey12=HKCU\Software\VSO\DVD Converter Ultimate\2|MediaLabel
RegKey13=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_audio
RegKey14=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_bluray
RegKey15=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_dvd
RegKey16=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_iso
RegKey17=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_subtitle
RegKey18=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_video
RegKey19=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_audio
RegKey20=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_bluray
RegKey21=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_dvd
RegKey22=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_iso
RegKey23=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_subtitle
RegKey24=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_video

[VSO ConvertXToDVD 5 *]
LangSecRef=3023
Detect=HKCU\Software\VSO\ConvertXtoDVD\5
FileKey1=%AppData%|pcouffin.log
FileKey2=%CommonAppData%\VSO\vsothumbs|*.*|REMOVESELF
FileKey3=%ProgramFiles%\VSO\ConvertX\5|*.log;*.rtf

[VSO CopyTo *]
LangSecRef=3021
Detect=HKCU\Software\VSO\CopyTo
FileKey1=%AppData%|pcouffin.log;ezplay.log
FileKey2=%AppData%\VSO|*.log|REMOVESELF
FileKey3=%CommonAppData%\VSO|*.cache;*.crashlist;*.log;*.vsothumb|RECURSE
FileKey4=%Documents%\PcSetup|*.log|REMOVESELF
FileKey5=%UserProfile%|timestamp.txt

[VSO Downloader *]
LangSecRef=3023
Detect=HKCU\Software\VSO\VSO Downloader
FileKey1=%AppData%\VSO|*.log
FileKey2=%AppData%\VSO\VSO Downloader\*\items|*.item|RECURSE
FileKey3=%CommonAppData%\VSO\VSO Downloader\*\items|*.item|RECURSE
FileKey4=%CommonAppData%\VSO\VSO Downloader\*\log|*.log

[VSO Media Player 1 *]
LangSecRef=3023
Detect=HKCU\Software\VSO\VSO Media Player\1
FileKey1=%AppData%\VSO\VSO Media Player\1|autoresume.xml
FileKey2=%CommonAppData%\VSO|font.cache
FileKey3=%CommonAppData%\VSO\VSO Media Player\1\log|*.log;*.crashlist
FileKey4=%CommonAppData%\VSO\vsothumbs|*.*|RECURSE
RegKey1=HKCU\Software\VSO\VSO Media Player\1\RecentlyOpenedFiles

[VueScan *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\VueScan
DetectFile2=%SystemDrive%\VueScan
FileKey1=%ProgramFiles%\VueScan|*.log|RECURSE
FileKey2=%SystemDrive%\VueScan|*.log|RECURSE

[Vuze *]
LangSecRef=3022
Detect=HKCU\Software\Azureus
FileKey1=%AppData%\Azureus|ipfilter.cache
FileKey2=%AppData%\Azureus\plugins\advancedstatistics|*.txt
FileKey3=%AppData%\Azureus\plugins\progressbar|*.txt
FileKey4=%ProgramFiles%\Vuze|*.log|RECURSE

[Vuze Dasu Reports *]
LangSecRef=3022
Detect=HKCR\Azureus
Warning=This will delete data from Dasu plugins. You should review the Dasu plugin reports before deleting it.
FileKey1=%AppData%\Azureus\plugins\dasu\reports|*.*

[W3i *]
LangSecRef=3022
DetectFile=%CommonAppData%\W3i
FileKey1=%CommonAppData%\W3i\InstallQUpdater|*.log

[Walgreens PhotoShow Express CD *]
LangSecRef=3021
DetectFile=%AppData%\Walgreens\PhotoShow Express CD
FileKey1=%AppData%\Walgreens\Photoshow Express CD\Cache|*.*|RECURSE

[Wallpaper Juggler *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Wallpaper Juggler
FileKey1=%ProgramFiles%\Wallpaper Juggler|*.log

[WallWatcher *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Wall Watcher\WallWatcher.exe
FileKey1=%ProgramFiles%\Wall Watcher\Logs|*.*

[Wanted Weapons of Fate *]
Section=Games
DetectFile=%LocalAppData%\wanted
FileKey1=%LocalAppData%\wanted|crash*.txt

[War of the Human Tanks *]
Section=Games
DetectFile=%ProgramFiles%\Desura\Common\war-of-the-human-tanks
FileKey1=%ProgramFiles%\Desura\Common\war-of-the-human-tanks\LOG|*.*

[War Thunder *]
Section=Games
Detect1=HKCU\Software\Gaijin\WarThunder
Detect2=HKCU\Software\Valve\Steam\Apps\236390
FileKey1=%ProgramFiles%\Steam\SteamApps\common\War Thunder\.launcher_log|*.txt
FileKey2=%ProgramFiles%\Steam\SteamApps\common\War Thunder\_debuginfo|*.clog
FileKey3=%ProgramFiles%\War Thunder\.launcher_log|*.txt
FileKey4=%ProgramFiles%\War Thunder\_debuginfo|*.clog

[Warcraft III *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Warcraft III
DetectFile=%ProgramFiles%\Warcraft III\Warcraft III.exe
FileKey1=%ProgramFiles%\Warcraft III|*.log;*.html
FileKey2=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt
ExcludeKey1=PATH|%ProgramFiles%\Warcraft III\|CustomKey*.txt

[Warcraft III Backups *]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Warcraft III
Warning=This will delete all your Warcraft III backup files. You won't be able to restore from them if something goes wrong.
FileKey1=%ProgramFiles%\Warcraft III|*.bak;*.old|RECURSE

[Warframe *]
Section=Games
Detect=HKCU\Software\Digital Extremes\Warframe
FileKey1=%LocalAppData%\Warframe|*.log

[Warhammer 40,000: Dawn of War Gold *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\4570
FileKey1=%ProgramFiles%\Steam\steamapps\common\Dawn of War Gold\Logfiles|*.*

[Warp Registry Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NCH Software\Warp\warp.exe
FileKey1=%AppData%\NCH Software\Warp\Logs|*.csv

[WashAndGo *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\WashAndGo
FileKey1=%AppData%\Abelssoft\WashAndGo\Log|*.log

[WashAndGo Backups *]
LangSecRef=3024
DetectFile=%LocalAppData%\Abelssoft\WashAndGo
FileKey1=%Documents%\Abelssoft\WashAndGo\Backups|*.*
FileKey2=%LocalAppData%\Abelssoft\WashAndGo\Backups|*.*

[Watto Studios Game Extractor *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Game Extractor
FileKey1=%ProgramFiles%\Game Extractor\extract|*.*
FileKey2=%ProgramFiles%\Game Extractor\logs|*.*
FileKey3=%ProgramFiles%\Game Extractor\previews|*.*
FileKey4=%ProgramFiles%\Game Extractor\temp|*.*

[Wave Systems Corp *]
LangSecRef=3021
DetectFile=%AppData%\Wave Systems Corp
FileKey1=%AppData%\Wave Systems Corp|DSM_AM.*
FileKey2=%CommonAppData%\Wave Systems Corp|*.log|RECURSE
FileKey3=%LocalAppData%\Wave Systems Corp\WCLIENTDLL|errors.txt

[WavePad *]
LangSecRef=3023
Detect=HKCU\Software\NCH Software\WavePad
RegKey1=HKCU\Software\NCH Software\WavePad\Recent

[Wavosaur *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Wavosaur\wavosaur.exe
FileKey1=%ProgramFiles%\Wavosaur|wavosaur.log

[Weather *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\CLR_v4.0|*.log
FileKey4=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState|*.tmp
FileKey10=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\Cache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\navigationHistory|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.BingWeather_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe\SearchHistory

[Weather It Up *]
LangSecRef=3024
Detect=HKLM\Software\Weather It Up
FileKey1=%ProgramFiles%\Weather It Up|*.log

[Weather Watcher Live *]
LangSecRef=3021
Detect=HKCU\Software\VB and VBA Program Settings\Weather Watcher Live
FileKey1=%AppData%\WeatherWatcherLive|WeatherWatcherLive.log
FileKey2=%AppData%\WeatherWatcherLive\Temp|*.*

[Web Photo Album *]
LangSecRef=3023
Detect=HKCU\Software\VicMan Software\Web Photo Album
DetectFile=%ProgramFiles%\Web Photo Album\webalbum.exe
FileKey1=%ProgramFiles%\Web Photo Album|*.log
RegKey1=HKCU\Software\VicMan Software\Web Photo Album|RecentFile0
RegKey2=HKCU\Software\VicMan Software\Web Photo Album|RecentFile1
RegKey3=HKCU\Software\VicMan Software\Web Photo Album|RecentFile2
RegKey4=HKCU\Software\VicMan Software\Web Photo Album|RecentFile3
RegKey5=HKCU\Software\VicMan Software\Web Photo Album|RecentFile4

[Web Sling Player *]
LangSecRef=3023
DetectFile=%AppData%\Sling Media\WebSlingPlayer
FileKey1=%AppData%\Sling Media\WebSlingPlayer|*.txt;*.log
FileKey2=%AppData%\Sling Media\WebSlingPlayer\*_cache|*.*|RECURSE
FileKey3=%AppData%\Sling Media\WebSlingPlayer\temp|*.*|RECURSE

[WebConnect *]
LangSecRef=3023
DetectFile=%LocalAppData%\Ericom
FileKey1=%LocalAppData%\Ericom\Ptagent|*.*
FileKey2=%LocalAppData%\Ericom\PtRdp|*.*

[WebFerret *]
LangSecRef=3021
Detect=HKCU\Software\FerretSoft\NetFerret
RegKey1=HKCU\Software\FerretSoft\NetFerret\CurrentVersion\Web|Search History

[WebMon *]
LangSecRef=3022
Detect=HKCU\Software\CM\WebMon
FileKey1=%ProgramFiles%\WebMon|UpdateLog.*

[WebPI Installer *]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft\Web Platform Installer\logs\webpi
FileKey1=%LocalAppData%\Microsoft\Web Platform Installer\logs\webpi|*.txt

[WebPictures Downloader *]
LangSecRef=3022
DetectFile=%ProgramFiles%\WebPictures Downloader
FileKey1=%ProgramFiles%\WebPictures Downloader\Projects|*.*|RECURSE

[WebReaper *]
LangSecRef=3022
Detect=HKCU\Software\BlueBeam\WebReaper
RegKey1=HKCU\Software\BlueBeam\WebReaper\URL History

[Webroot SecureAnywhere *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Webroot\WRSA.exe
FileKey1=%CommonAppData%\WRData|WRLog.log

[WebStorm *]
LangSecRef=3021
Detect=HKCU\Software\JetBrains\WebStorm
FileKey1=%UserProfile%\.WebIde50\system\Caches|*.*|RECURSE
FileKey2=%UserProfile%\.WebIde50\system\LocalHistory|*.*|RECURSE
FileKey3=%UserProfile%\.WebIde50\system\Log|*.*|RECURSE
FileKey4=%UserProfile%\.WebIde50\system\tmp|*.*|RECURSE

[WebTorrent *]
LangSecRef=3022
DetectFile=%AppData%\WebTorrent
FileKey1=%AppData%\WebTorrent\*Cache|*.*
FileKey2=%LocalAppData%\WebTorrent|*.log

[WebView Host *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Win32WebViewHost_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\AC\*\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\AC\*\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\AC\*\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\TempState|*.*|RECURSE

[WeFi *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WeFi
FileKey1=%CommonAppData%\WeFi\LogFiles|*.*|REMOVESELF

[West of Loathing *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\597220
FileKey1=%LocalLowAppData%\Asymmetric Software\West of Loathing|*output_log.txt
FileKey2=%LocalLowAppData%\Asymmetric Software\West of Loathing\Crashes|*.*

[Western Digital Firmware Updater *]
LangSecRef=3024
DetectFile=%CommonAppData%\Western Digital
FileKey1=%CommonAppData%\Western Digital\Logs\WD Firmware Updater|*.*|REMOVESELF

[Western Digital SmartWare *]
LangSecRef=3024
DetectFile=%CommonAppData%\Western Digital
FileKey1=%AppData%\Western Digital\WD SmartWare\Logs|*.*
FileKey2=%CommonAppData%\Western Digital\Logs\WD *\*|*.log
FileKey3=%CommonAppData%\Western Digital\WD SmartWare|*.log
FileKey4=%CommonAppData%\Western Digital\WDFME|*.*
FileKey5=%LocalAppData%\Western Digital\WD SmartWare|*log.txt
FileKey6=%Public%\Documents\Downloads\WD_SmartWare_Installer_*|*.*|REMOVESELF

[WhatPulse *]
LangSecRef=3021
Detect=HKCU\Software\WhatPulse
FileKey1=%AppData%\WhatPulse|*.log

[WhatPulse Backups *]
LangSecRef=3021
Detect=HKCU\Software\WhatPulse
FileKey1=%AppData%\WhatPulse|*.bak

[WhatsApp *]
LangSecRef=3022
DetectFile=%LocalAppData%\WhatsApp\WhatsApp.exe
FileKey1=%AppData%\WhatsApp|*.log*
FileKey2=%AppData%\WhatsApp\*Cache|*.*
FileKey3=%AppData%\WhatsApp\Logs|*.*
FileKey4=%LocalAppData%\WhatsApp|*.log
FileKey5=%LocalAppData%\WhatsApp\app-*|*.log
FileKey6=%LocalAppData%\WhatsApp\packages\SquirrelTemp|*.*|REMOVESELF

[Who's On My WiFi *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{010D45A1-093D-4534-8147-4E10E80F81CC}_is1
FileKey1=%ProgramFiles%\IO3O LLC\Who Is On My Wifi\logs|*.*

[WildTangent *]
LangSecRef=3021
DetectFile=%AppData%\WildTangent
FileKey1=%AppData%\WildTangent\Logs|*.*

[Winaero Tweaker *]
LangSecRef=3024
Detect=HKCU\Software\Winaero.com\Winaero Tweaker
RegKey1=HKCU\Software\Winaero.com\Winaero Tweaker|SetupDir

[Winamp *]
LangSecRef=3023
Detect=HKCU\Software\Winamp
FileKey1=%AppData%\Winamp\Plugins|*.dmp;*.log;feedback.ini;report.zip
FileKey2=%ProgramFiles%\Winamp|*log.txt

[Winamp Playlist *]
LangSecRef=3023
Detect=HKCU\Software\Winamp
Warning=This removes the current playlist.
FileKey1=%AppData%\Winamp|Winamp.m3u;Winamp.m3u8

[Winamp Playlist Undo Plug-in *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Winamp\Plugins\gen_undo.dll
FileKey1=%AppData%\Winamp\Plugins|undo.gul
FileKey2=%AppData%\Winamp\Plugins\gen_undo|*.m3u8

[WinAVI Video Converter *]
LangSecRef=3023
Detect=HKCU\Software\ZjSoft\WinAVI
FileKey1=%LocalAppData%\winavi|debug.log

[WinCHM *]
LangSecRef=3021
Detect=HKCU\Software\Softany\WinCHM
RegKey1=HKCU\Software\Softany\WinCHM|RecentFile1
RegKey2=HKCU\Software\Softany\WinCHM|RecentFile2
RegKey3=HKCU\Software\Softany\WinCHM|RecentFile3
RegKey4=HKCU\Software\Softany\WinCHM|RecentFile4
RegKey5=HKCU\Software\Softany\WinCHM|RecentFile5
RegKey6=HKCU\Software\Softany\WinCHM|RecentFile6

[WinDjView *]
LangSecRef=3024
Detect=HKCU\Software\Andrew Zhezherun\WinDjView
RegKey1=HKCU\Software\Andrew Zhezherun\WinDjView\Documents
RegKey2=HKCU\Software\Andrew Zhezherun\WinDjView\Recent File List

[Windows 7 Manager *]
LangSecRef=3024
Detect=HKCU\Software\Yamicsoft\Windows 7 Manager
FileKey1=%ProgramFiles%\Yamicsoft\Windows 7 Manager\DiskAnalyzerXML|*.*

[Windows 10 Update Reliability *]
LangSecRef=3025
DetectFile=%ProgramFiles%\rempl\*.exe
FileKey1=%ProgramFiles%\rempl\Logs|*.etl

[Windows Client *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\MicrosoftWindows.Client.CBS_*\TempState|*.*|RECURSE

[Windows Defender *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows Defender
FileKey1=%CommonAppData%\Microsoft\Windows Defender\Network Inspection System\Support|*.txt;NisLog.txt.bak
FileKey2=%CommonAppData%\Microsoft\Windows Defender\Scans\BackupStore|*.*|RECURSE
FileKey3=%CommonAppData%\Microsoft\Windows Defender\Scans\History\CacheManager|*.*|RECURSE
FileKey4=%CommonAppData%\Microsoft\Windows Defender\Scans\History\Service|*.log
FileKey5=%CommonAppData%\Microsoft\Windows Defender\Scans\MetaStore|*.*|RECURSE
FileKey6=%CommonAppData%\Microsoft\Windows Defender\Scans\RtSigs\Data|*.*|RECURSE
FileKey7=%CommonAppData%\Microsoft\Windows Defender\Support|*.*|RECURSE

[Windows DVD Maker *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings
RegKey1=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 2
RegKey2=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 5
RegKey3=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 7
RegKey4=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 128
RegKey5=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU0
RegKey6=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU1
RegKey7=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU2
RegKey8=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU3

[Windows Error Reporting *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\Windows Error Reporting
FileKey1=%LocalAppData%\PCHealth\ErrorRep\QSignoff|*.*
FileKey2=%WinDir%\pchealth\ERRORREP|*.*|RECURSE
FileKey3=%WinDir%\pchealth\helpctr\DataColl|*.xml
FileKey4=%WinDir%\pchealth\helpctr\OfflineCache|*.*|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE
FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE
FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE
FileKey8=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE
RegKey1=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports|LastFullLiveReport
RegKey2=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports\win32k.sys
RegKey3=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports\win32k.sys
RegKey4=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
RegKey5=HKU\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation

[Windows ESENT *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\ESENT
RegKey1=HKLM\Software\Microsoft\ESENT\Process

[Windows Experience Index *]
DetectOS=10.0|
LangSecRef=3025
DetectFile=%WinDir%\Performance\WinSAT
FileKey1=%WinDir%\Performance\WinSAT|*.*
FileKey2=%WinDir%\Performance\WinSAT\DataStore|*.*

[Windows Feedback *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFeedback_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\LocalCache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\LocalState\Cache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\TempState|*.*|RECURSE

[Windows File Manager *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFileManager_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\Local\*|*.*|REMOVESELF
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\LocalLow\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\Roaming\*|*.*|REMOVESELF
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\Temp|*.*|REMOVESELF
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\TempState|*.*|RECURSE

[Windows Grep *]
LangSecRef=3024
Detect=HKCU\Software\Windows Grep\Windows Grep
RegKey1=HKCU\Software\Windows Grep\Windows Grep\Current Version\Replace Options|Replace String
RegKey2=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Filespecs
RegKey3=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Folders
RegKey4=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Strings

[Windows Image Acquisition *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\WIA
FileKey1=%UserProfile%|Sti_Trace.log
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\WIA

[Windows Installer *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer
FileKey1=%SystemDrive%\Config.msi|*.*|REMOVESELF
FileKey2=%WinDir%\Installer|*.tmp|RECURSE
FileKey3=%WinDir%\Installer|SourceHash{*};wix{*}.SchedServiceConfig.rmi
FileKey4=%WinDir%\Installer\MSI*.tmp-|*.*|REMOVESELF

[Windows Library for JavaScript *]
LangSecRef=3031
DetectFile=%LocalAppData%\Packages\Microsoft.WinJS.*.0_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\LocalState\*Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\TempState|*.*|RECURSE

[Windows Live Mail *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows Live Mail
Warning=This will reset the read counts, which will be recalculated when WLMail is started.
FileKey1=%LocalAppData%\Microsoft\Windows*Mail|*.log;*.jrs;*.chk;*.rss;*.tmp|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows*Mail\*|*.MSMessageStore|RECURSE
FileKey3=%LocalAppData%\Microsoft\Windows*Mail\*.tmp|*.*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Windows*Mail\*\Backup|*.*|REMOVESELF
FileKey5=%LocalAppData%\Microsoft\Windows*Mail\Backup|*.*|REMOVESELF
RegKey1=HKCU\Software\Microsoft\Windows Live Mail|SearchFolderVersion

[Windows Live Movie Maker *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows Live\Movie Maker
FileKey1=%LocalAppData%\Microsoft\Windows Live Movie Maker|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows Live\Movie Maker|browseformusicdirectory
RegKey2=HKCU\Software\Microsoft\Windows Live\Movie Maker|browseforpicturesdirectory
RegKey3=HKCU\Software\Microsoft\Windows Live\Movie Maker|browseforprojectsdirectory
RegKey4=HKCU\Software\Microsoft\Windows Live\Movie Maker|rendertofiledirectory
RegKey5=HKCU\Software\Microsoft\Windows Live\Movie Maker|snapshotfiledirectory
RegKey6=HKCU\Software\Microsoft\Windows Live\Movie Maker\recent

[Windows Live Photo Gallery *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows Live\Photo Gallery
FileKey1=%LocalAppData%\Microsoft\Windows Live Photo Gallery|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|FinenameTemplate
RegKey2=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|RootDirectory
RegKey3=HKCU\Software\Microsoft\Windows Live\Photo Gallery|galleryscopedfolders

[Windows Live Setup *]
LangSecRef=3022
Detect1=HKCU\Software\Microsoft\Windows Live Mail
Detect2=HKLM\Software\Microsoft\Windows Live
FileKey1=%CommonAppData%\Microsoft\WLSetup|*.tmp
FileKey2=%CommonAppData%\Microsoft\WLSetup\*logs|*.*|RECURSE
FileKey3=%CommonAppData%\WLInstaller|*.log
FileKey4=%CommonProgramFiles%\Windows Live\.cache|*.tmp
FileKey5=%LocalAppData%\Microsoft\WLSetup\*logs|*.*|RECURSE

[Windows Live Setup Files *]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows Live
Warning=After running this, you will not be able to uninstall Windows Live Essentials components without downloading the installer again.
FileKey1=%LocalLowAppData%\Microsoft\Windows Live\Setup|*.*|REMOVESELF

[Windows Live Writer *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows Live Writer
FileKey1=%LocalAppData%\Windows Live Writer|*.log

[Windows Logs *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%CommonAppData%\Microsoft\Diagnosis\DownloadedSettings|*.json.bk
FileKey2=%CommonAppData%\Microsoft\DiagnosticLogCSP\Collectors|*.etl;*.etl.merged
FileKey3=%CommonAppData%\Microsoft\Network\Downloader|*.*|RECURSE
FileKey4=%CommonAppData%\Microsoft\WDF|*.*|RECURSE
FileKey5=%CommonAppData%\Microsoft\Windows Security Health\Logs|*.*|RECURSE
FileKey6=%CommonAppData%\USOShared\Logs|*.*|RECURSE
FileKey7=%LocalAppData%\ConnectedDevicesPlatform|*.log
FileKey8=%LocalAppData%\Diagnostics|*.*|RECURSE
FileKey9=%ProgramFiles%\UNP\*Logs|*.*
FileKey10=%SystemDrive%\PerfLogs\System\Diagnostics|*.*|RECURSE
FileKey11=%SystemDrive%\PerfLogs\System\Performance|*.*|RECURSE
FileKey12=%WinDir%\AppCompat\Programs|*.txt;*.xml
FileKey13=%WinDir%\AppCompat\Programs\Install|*.txt;*.xml
FileKey14=%WinDir%\debug\WIA|*.log
FileKey15=%WinDir%\inf|*.log*
FileKey16=%WinDir%\Logs\CBS|*.cab
FileKey17=%WinDir%\Logs\dosvc|*.*|RECURSE
FileKey18=%WinDir%\Logs\NetSetup|*.*|RECURSE
FileKey19=%WinDir%\Logs\SIH|*.*|RECURSE
FileKey20=%WinDir%\Logs\WindowsBackup|*.etl
FileKey21=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.log
FileKey22=%WinDir%\Panther\FastCleanup|*.log
FileKey23=%WinDir%\Panther\Rollback|*.txt
FileKey24=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml
FileKey25=%WinDir%\repair|setup.log
FileKey26=%WinDir%\security\logs|*.*|RECURSE
FileKey27=%WinDir%\System32\CatRoot|*.tmp
FileKey28=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt
FileKey29=%WinDir%\System32\LogFiles\HTTPERR|*.log
FileKey30=%WinDir%\System32\LogFiles\Scm|*.*|RECURSE
FileKey31=%WinDir%\System32\LogFiles\setupcln|*.*|RECURSE
FileKey32=%WinDir%\System32\LogFiles\Srt|*.*|RECURSE
FileKey33=%WinDir%\System32\LogFiles\WMI|*.*|RECURSE
FileKey34=%WinDir%\System32\SleepStudy|*.etl
FileKey35=%WinDir%\System32\SleepStudy\ScreenOn|*.etl
FileKey36=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log
FileKey37=%WinDir%\System32\WDI\*|snapshot.etl|REMOVESELF
FileKey38=%WinDir%\System32\WDI\LogFiles\StartupInfo|*.*|RECURSE
RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey2=HKLM\Software\Microsoft\Tracing
RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing

[Windows Mail *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows Mail
FileKey1=%LocalAppData%\Microsoft\Windows Mail|*.log;*.jrs;*.chk|RECURSE

[Windows Media Center *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Media Center
FileKey1=%CommonAppData%\Microsoft\eHome\thmb|TVThumb.db
FileKey2=%LocalAppData%\Microsoft\Ehome|Image.db;Video.db;musicThumbs.db
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Media Center\MRU\SettingsMRU

[Windows Media Player *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\MediaPlayer
RegKey1=HKCU\Software\Microsoft\MediaPlayer\Preferences|MostRecentFileAddOrRemove

[Windows Movie Maker *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\MovieMaker
FileKey1=%LocalAppData%\Microsoft\Movie Maker|MEDIATAB*.DAT

[Windows Movie Maker 2.0 *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\MM20
Warning=This will remove Windows Movie Maker 2.0 recent activity.
RegKey1=HKCU\Software\Microsoft\MM20\ImportDirAllMedia
RegKey2=HKCU\Software\Microsoft\MM20\ImportDirAudio
RegKey3=HKCU\Software\Microsoft\MM20\ImportDirStills
RegKey4=HKCU\Software\Microsoft\MM20\ImportDirVideo
RegKey5=HKCU\Software\Microsoft\MM20\OpenProjectDir
RegKey6=HKCU\Software\Microsoft\MM20\Publish Wizard\MRU List
RegKey7=HKCU\Software\Microsoft\MM20\Recent Document List

[Windows MUICache *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
RegKey2=HKCU\Software\Microsoft\Windows\Shell\MUICache
RegKey3=HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache

[Windows Password Reset Audit *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WPRAudit\WPR.exe
FileKey1=%Documents%|Splash.htm;WPRF.htm

[Windows Photo Gallery *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows Photo Gallery
RegKey1=HKCU\Software\Microsoft\Windows Photo Gallery\Library\PreviewAssignment\MRU
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|FilenameTemplate
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|RootDirectory
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\DestinationMru
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|FilenameTemplate
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|RootDirectory
RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|FilenameTemplate
RegKey8=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|RootDirectory

[Windows Photo Viewer *]
LangSecRef=3025
DetectFile=%AppData%\Microsoft\Windows Photo Viewer
FileKey1=%AppData%\Microsoft\Windows Photo Viewer|*.*

[Windows Photos *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowsphotos_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\BackgroundTransferApi|*.down_data;*.up_meta
FileKey3=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\INet*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey6=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\PRICache|*.*
FileKey8=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Temp|*.*
FileKey9=%LocalAppData%\Packages\microsoft.windowsphotos_*\LocalState|*.log;*.jpg
FileKey10=%LocalAppData%\Packages\microsoft.windowsphotos_*\LocalState\bici|*.sqm
FileKey11=%LocalAppData%\Packages\microsoft.windowsphotos_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowsphotos_8wekyb3d8bbwe\SearchHistory

[Windows PowerShell *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\PowerShell
Warning=This will reset the Windows PowerShell ISE to its defaults.
FileKey1=%AppData%\Microsoft\Windows\PowerShell\PSReadline|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\PowerShell|ModuleAnalysisCache
FileKey3=%LocalAppData%\Microsoft\Windows\PowerShell\CommandAnalysis|*.*|RECURSE
FileKey4=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*|user.config
FileKey5=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*\AutoSaveFiles|*.*|RECURSE
FileKey6=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*\AutoSaveInformation|*.*|RECURSE

[Windows Retail Demo *]
LangSecRef=3025
DetectFile=%CommonAppData%\Microsoft\Windows\RetailDemo
FileKey1=%CommonAppData%\Microsoft\Windows\RetailDemo|*.*|REMOVESELF

[Windows Search *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalState\AppIconCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalState\DeviceSearchCache|*.tmp;*.txt
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.Search_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalState\DeviceSearchCache\|SettingsCache.txt

[Windows Security *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\TempState|*.*|RECURSE

[Windows Sidebar *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows Sidebar
FileKey1=%LocalAppData%\Microsoft\Windows Sidebar\Cache|*.*|RECURSE

[Windows Store *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\winstore_cw5n1h2txyewy
FileKey1=%LocalAppData%\Packages\winstore_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\winstore_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\winstore_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\winstore_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\winstore_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\winstore_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\winstore_*\LocalState\LiveTile|*.*|RECURSE

[Windows Subsystems *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%CommonAppData%\Microsoft\PlayReady|*.hds
FileKey2=%CommonAppData%\Microsoft\PlayReady\Cache|*.*
FileKey3=%CommonAppData%\Microsoft\RAC\PublishedData|*.log;*.jrs
FileKey4=%CommonAppData%\Microsoft\RAC\StateData|*.log;*.jrs
FileKey5=%CommonAppData%\Microsoft\RAC\Temp|*.*
FileKey6=%CommonAppData%\Microsoft\Windows\DRM|*.log
FileKey7=%CommonAppData%\Microsoft\Windows\DRM\Cache|*.*|RECURSE
FileKey8=%CommonAppData%\Microsoft\Windows\DRM\PreUpgrade|*.log
FileKey9=%CommonAppData%\Microsoft\Windows\Sqm\Manifest|*.bin
FileKey10=%CommonAppData%\Microsoft\Windows\Sqm\Sessions|*.psqm;*.sqm
FileKey11=%LocalAppData%\Microsoft\Windows\PRICache|*.*|RECURSE
FileKey12=%LocalAppData%\Microsoft\Windows\SettingSync\metastore|*.jrs
FileKey13=%LocalAppData%\Microsoft\Windows\SettingSync\remotemetastore\*|*.jrs
FileKey14=%SystemDrive%\spoolerlogs|spooler.xml
FileKey15=%WinDir%\ehome|PRDMOWrapper.log
FileKey16=%WinDir%\System32|PRDMOWrapper.log
FileKey17=%WinDir%\System32\spool|spooler.xml
FileKey18=%WinDir%\System32\sru|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Direct3D\MostRecentApplication
RegKey2=HKLM\Software\Microsoft\Direct3D\MostRecentApplication
RegKey3=HKLM\Software\Microsoft\DirectDraw\MostRecentApplication
RegKey4=HKLM\Software\Microsoft\Windows\CurrentVersion\Setup|Installation Sources
RegKey5=HKLM\Software\Wow6432Node\Microsoft\Direct3D\MostRecentApplication
RegKey6=HKLM\Software\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication

[Windows Update *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%WinDir%\Logs\waasmedic|*.*|RECURSE
FileKey2=%WinDir%\Logs\WindowsUpdate|*.*|RECURSE
FileKey3=%WinDir%\SoftwareDistribution\DataStore\Logs|*.*|RECURSE

[Windows Washer Backups *]
LangSecRef=3024
Detect=HKCU\Software\Webroot\Window Washer
FileKey1=%AppData%\Webroot\Washer\Backup|*.*|RECURSE

[Windows XP ARPCache *]
DetectOS=|5.1
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Warning=This cleans the "Add/Remove Programs" cache and will fix very large areas of black gaps in it. Using this will cause "Add/Remove Programs" to take a very long time to load since it will have to rebuild the cache.
RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache

[Winemaker Extraordinaire *]
Section=Games
DetectFile=%AppData%\UClick\Winemaker Extraordinaire
FileKey1=%AppData%\UClick\Winemaker Extraordinaire|logfile.txt

[WinGate *]
LangSecRef=3021
Detect=HKCU\Software\Qbik Software\GateKeeper
DetectFile=%ProgramFiles%\WinGate\WinGate.exe
FileKey1=%ProgramFiles%\WinGate|*Log.txt;*.log|RECURSE
FileKey2=%ProgramFiles%\WinGate\Logs\Global|*.idx

[WinGuides Tweak Manager *]
LangSecRef=3024
Detect=HKCU\Software\WinGuides\WinGuides Tweak Manager
RegKey1=HKCU\Software\WinGuides\WinGuides Tweak Manager\Settings|RecentTweaks

[WinHasher *]
LangSecRef=3024
Detect=HKCU\Software\GPF Comics\WinHasher
RegKey1=HKCU\Software\GPF Comics\WinHasher|LastDirectory

[WinHTTrack *]
LangSecRef=3022
Detect=HKCU\Software\WinHTTrack Website Copier
FileKey1=%ProgramFiles%\WinHTTrack|winhttrack.log

[WinImage *]
LangSecRef=3024
Detect=HKCU\Software\WinImage
RegKey1=HKCU\Software\WinImage|File1
RegKey2=HKCU\Software\WinImage|File2
RegKey3=HKCU\Software\WinImage|File3
RegKey4=HKCU\Software\WinImage|File4
RegKey5=HKCU\Software\WinImage|File5
RegKey6=HKCU\Software\WinImage|File6
RegKey7=HKCU\Software\WinImage|File7
RegKey8=HKCU\Software\WinImage|File8
RegKey9=HKCU\Software\WinImage|File9
RegKey10=HKCU\Software\WinImage|PathExtract

[WinMerge *]
LangSecRef=3024
Detect=HKCU\Software\Thingamahoochie\WinMerge\Files
RegKey1=HKCU\Software\Thingamahoochie\WinMerge\Files\Ext
RegKey2=HKCU\Software\Thingamahoochie\WinMerge\Files\Left
RegKey3=HKCU\Software\Thingamahoochie\WinMerge\Files\Option
RegKey4=HKCU\Software\Thingamahoochie\WinMerge\Files\Right

[WinMount *]
LangSecRef=3024
Detect=HKCU\Software\WinMount Applications\WinMount
FileKey1=%AppData%\WinMount|*.dat
RegKey1=HKCU\Software\WinMount Applications\WinMount\Recent File List

[WinPcap *]
LangSecRef=3022
Detect=HKLM\Software\WinPcap
FileKey1=%ProgramFiles%\WinPcap|*.log

[WinRAR *]
LangSecRef=3024
Detect=HKCU\Software\WinRAR
FileKey1=%ProgramFiles%\WinRAR|*.tmp;*.diz|RECURSE
RegKey1=HKCU\Software\WinRAR SFX
RegKey2=HKCU\Software\WinRAR\DialogEditHistory
RegKey3=HKCU\Software\WinRAR\General\Info|CommentFile

[WinRemote *]
LangSecRef=3021
DetectFile=%CommonAppData%\Banamalon\WinRemoteService
FileKey1=%CommonAppData%\Banamalon\WinRemoteService\log|*.*

[WinSAT Shader Cache *]
DetectOS=|6.2
LangSecRef=3025
DetectFile=%WinDir%\Performance\WinSAT
FileKey1=%WinDir%\Performance\WinSAT|shadercache*.*

[WinSetupFromUSB *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\WinSetupFromUSB
DetectFile2=%SystemDrive%\WinSetupFromUSB
FileKey1=%ProgramFiles%\WinSetupFromUSB|*.log|RECURSE
FileKey2=%SystemDrive%\WinSetupFromUSB|*.log|RECURSE

[WinSysClean *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WinSysClean*
FileKey1=%ProgramFiles%\WinSysClean *|*.log;*scanlog.dat;RegBackup.reg

[WinTK *]
LangSecRef=3024
DetectFile=%Documents%\WinTK
FileKey1=%Documents%\WinTK|ExLog.txt

[WinToUSB *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinToUSB_is1
FileKey1=%ProgramFiles%\WinToUSB\bin|*.log

[WinWAP *]
LangSecRef=3022
Detect=HKCU\Software\Winwap Technologies
FileKey1=%UserProfile%\WinWAP Temporary Files|*.*

[WinX YouTube Downloader *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinX YouTube Downloader_is1
DetectFile=%ProgramFiles%\Digiarty\WinX_YouTube_Downloader\WinX_YouTube_Downloader.exe
FileKey1=%AppData%\Digiarty\WinX YouTube Downloader|*.jpg

[WinZip MRU *]
LangSecRef=3024
Detect=HKCU\Software\Nico Mak Computing\WinZip
RegKey1=HKCU\Software\Nico Mak Computing\WinZip\Mru

[WinZip Registry Optimizer *]
LangSecRef=3024
DetectFile=%AppData%\Nico Mak Computing\WinZip Registry Optimizer
FileKey1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer\*|log*.*

[Wipe *]
LangSecRef=3024
Detect=HKLM\Software\privacyroot.com\wipe
DetectFile=%AppData%\Wipe*
FileKey1=%AppData%\Wipe*\Temp\CachedImages|*.png
RegKey1=HKLM\Software\privacyroot.com\wipe|SETUP-EXE

[Wire *]
LangSecRef=3022
DetectFile=%LocalAppData%\wire
FileKey1=%AppData%\Wire\*Cache|*.*
FileKey2=%AppData%\Wire\Service Worker|*.*|REMOVESELF

[Wirecast *]
LangSecRef=3023
DetectFile=%AppData%\Wirecast
FileKey1=%AppData%\Wirecast|*.txt

[Wise Care 365 *]
LangSecRef=3024
Detect=HKLM\Software\WiseCleaner\WiseCare365
FileKey1=%AppData%\Wise Care 365|Errorlog.txt;FailToRemove.dat

[Wise Video/YouTube Downloader *]
LangSecRef=3023
Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wise Video Downloader_is1
Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wise Youtube Downloader_is1
DetectFile1=%ProgramFiles%\Wise\Wise Video Downloader\WiseDownloader.exe
DetectFile2=%ProgramFiles%\Wise\Wise YouTube Downloader\WiseDownloader.exe
FileKey1=%AppData%\Wise * Downloader|DownloadList.ini;FileListConfig.ini
FileKey2=%SystemDrive%|urlinfo.txt
FileKey3=%SystemDrive%\ThumbnailCache|*.*

[Wistron Corp Launch Manager *]
LangSecRef=3024
Detect=HKLM\Software\Wistron Corp\Launch Manager
FileKey1=%ProgramFiles%\Launch Manager|*.log

[WM Recorder *]
LangSecRef=3023
Detect1=HKCU\Software\WMR10
Detect2=HKCU\Software\WMR11
Detect3=HKCU\Software\WMR12
Detect4=HKCU\Software\WMR13
Detect5=HKCU\Software\WMR14
FileKey1=%ProgramFiles%\WM Recorder*|log.txt;urls.txt

[Wolfenstein: MP *]
Section=Games
DetectFile=%LocalAppData%\id Software\WolfMP
FileKey1=%LocalAppData%\id Software\WolfMP|*.log|RECURSE

[WolfQuest *]
Section=Games
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9E6AD6CF-1EFF-43E4-86C4-5C00254C3D8E}
FileKey1=%ProgramFiles%\WolfQuest|*.txt|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\WolfQuest\|Help.txt

[Wondershare AllMyTube *]
LangSecRef=3022
Detect=HKLM\Software\Wondershare\Wondershare AllMyTube
FileKey1=%AppData%\Wondershare AllMyTube|*.*|RECURSE
FileKey2=%CommonAppData%\Wondershare AllMyTube\ConvertedLibPic|*.*|RECURSE
FileKey3=%CommonAppData%\Wondershare Application Common Data\Download|*.bak;*.xml
FileKey4=%CommonAppData%\Wondershare Application Common Data\Download\MediaLibPic|*.*|RECURSE
FileKey5=%CommonAppData%\Wondershare Application Common Data\Download\SiteLogo|*.*|RECURSE
FileKey6=%CommonAppData%\Wondershare Application Common Data\Download\TempThumbDir|*.*|RECURSE
FileKey7=%CommonAppData%\Wondershare\AllMyTube|*.bak;*.xml
FileKey8=%ProgramFiles%\Wondershare\AllMyTube\Log|*.*|RECURSE

[Wondershare dr.fone *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Wondershare\dr*fone
FileKey1=%CommonAppData%\Wondershare\dr*fone\log|*.*|RECURSE
FileKey2=%CommonAppData%\Wondershare\WAF\Log|*.*|RECURSE
FileKey3=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE
FileKey4=%CommonAppData%\Wondershare\WSRoot|*.tmp
FileKey5=%CommonAppData%\Wondershare\WSRoot\Logs|*.*|RECURSE

[Wondershare Filmora *]
LangSecRef=3023
Detect1=HKLM\Software\Wondershare\Wondershare Filmora
Detect2=HKLM\Software\Wondershare\Wondershare FilmoraPro
FileKey1=%CommonAppData%\Wondershare\ProductFeatures\*Logs|*.*|RECURSE
FileKey2=%CommonAppData%\Wondershare\RemoteLogs\*Logs|*.*|RECURSE
FileKey3=%ProgramFiles%\Wondershare\Wondershare Filmora\log|*.*|RECURSE
FileKey4=%Public%\Documents\Wondershare|*.*|REMOVESELF

[Wondershare Helper Compact *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\Wondershare Helper Compact
FileKey1=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact|ProductUpdateLists.xml;WSHelper.exe_temp;WSHelperSetup.exe_temp
FileKey2=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\DATADICT|*.*|RECURSE
FileKey3=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\Log|*.*|RECURSE
FileKey4=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\Temp|*.*|RECURSE

[Wondershare MobileGo *]
LangSecRef=3021
Detect=HKCU\Software\Wondershare\MobileGo
DetectFile=%AppData%\Wondershare\MobileGo for iOS
FileKey1=%AppData%\se_tmp|*.*|REMOVESELF
FileKey2=%AppData%\Wondershare\*Go*|*.log
FileKey3=%AppData%\Wondershare\DataEraser|*.log
FileKey4=%AppData%\Wondershare\Dr.FoneTool\log|*.log
FileKey5=%AppData%\Wondershare\DrFoneAndroidTool\log|*.log
FileKey6=%AppData%\Wondershare\MirrorGo\ImageCache\ADImage|*.*|RECURSE
FileKey7=%AppData%\Wondershare\MobileGo\DeviceImageCache|*.*|RECURSE
FileKey8=%AppData%\Wondershare\MobileGo\iOSTemp|*.*|REMOVESELF
FileKey9=%AppData%\Wondershare\MobileGo\Logs\DeviceConnection|*.*|RECURSE
FileKey10=%AppData%\Wondershare\MobileTransTool|*.log
FileKey11=%AppData%\Wondershare\WsRoot\Logs|*.*|RECURSE
FileKey12=%CommonAppData%\Wondershare\Dr.FoneTool\Log|*.txt
FileKey13=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE
FileKey14=%ProgramFiles%\Wondershare\MobileGo|*.log

[Wondershare PDF Editor *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\Wondershare PDF Editor
FileKey1=%AppData%\Wondershare\PDF Editor|HistoryDatas.dat
FileKey2=%AppData%\Wondershare\PDF Editor\Log|*.log

[Wondershare SafeEraser *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\SafeEraser
FileKey1=%AppData%\HMYGSetting|*.*|REMOVESELF
FileKey2=%AppData%\HYXDevPsnList|*.*|REMOVESELF
FileKey3=%AppData%\se_tmp|*.*|REMOVESELF
FileKey4=%AppData%\se_tmp_win|*.*|REMOVESELF
FileKey5=%AppData%\Wondershare\SafeEraser|*.log
FileKey6=%AppData%\Wondershare\SafeEraser\Logs\DeviceConnection|*.*|RECURSE
FileKey7=%AppData%\Wondershare\SafeEraser\Logs\iOSTemp|*.*|RECURSE
FileKey8=%ProgramFiles%\Wondershare\SafeEraser\se_tmp_win|*.*|REMOVESELF
FileKey9=%SystemDrive%\se_tmp|*.*|REMOVESELF

[Wondershare UniConverter *]
LangSecRef=3023
Detect=HKLM\Software\Wondershare\Wondershare UniConverter
FileKey1=%CommonAppData%\Wondershare\ProductFeatures\*Logs|*.*|RECURSE
FileKey2=%CommonAppData%\Wondershare\UniConverter\DataTrack|tmp;*.bak;*.log
FileKey3=%CommonAppData%\Wondershare\UniConverter\TempThumbDir|*.*|RECURSE
FileKey4=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE
FileKey5=%ProgramFiles%\Wondershare\UniConverter\Log|*.*|RECURSE
FileKey6=%Public%\Documents\Wondershare|*.*|REMOVESELF
FileKey7=%SystemDrive%|logWSVCUUpdateHelper.log
FileKey8=%SystemDrive%\Wondershare UniConverter\Downloaded\temp|*.*|REMOVESELF
FileKey9=%UserProfile%\.cache|*.*|REMOVESELF

[Wondershare Video Converter *]
LangSecRef=3023
Detect1=HKLM\Software\Wondershare\Wondershare Video Converter Pro
Detect2=HKLM\Software\Wondershare\Wondershare Video Converter Ultimate
FileKey1=%CommonAppData%\Wondershare MediaServer|*.txt
FileKey2=%CommonAppData%\Wondershare\ProductFeatures\*Logs|*.*|RECURSE
FileKey3=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE
FileKey4=%Documents%\Wondershare MediaServer\log|*.*|RECURSE
FileKey5=%ProgramFiles%\Wondershare Video Converter Ultimate\TempThumbDir|*.*|RECURSE
FileKey6=%Public%\Documents\Wondershare|*.*|REMOVESELF
FileKey7=%SystemDrive%|logWSVCUUpdateHelper.log
FileKey8=%UserProfile%\.cache|*.*|REMOVESELF

[Wordweb *]
LangSecRef=3021
Detect=HKCU\Software\WordWeb
FileKey1=%AppData%\WordWeb|History.txt

[World of Warcraft *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\World of Warcraft
FileKey1=%ProgramFiles%\World of Warcraft\Cache|*.*|REMOVESELF
FileKey2=%ProgramFiles%\World of Warcraft\Errors|*.*|REMOVESELF
FileKey3=%ProgramFiles%\World of Warcraft\Logs|*.log
FileKey4=%Public%\Games\World of Warcraft\Cache|*.*|REMOVESELF
FileKey5=%Public%\games\World of Warcraft\Errors|*.*|REMOVESELF
FileKey6=%Public%\games\World of Warcraft\Logs|*.log
FileKey7=%SystemDrive%\World of Warcraft\Cache|*.*|REMOVESELF
FileKey8=%SystemDrive%\World of Warcraft\Errors|*.*|REMOVESELF
FileKey9=%SystemDrive%\World of Warcraft\Logs|*.log

[World of Warcraft Backups *]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\World of Warcraft
Warning=This will delete all your World of Warcraft backup files. You won't be able to restore from them if something goes wrong.
FileKey1=%ProgramFiles%\World of Warcraft|*.bak;*.old|RECURSE
FileKey2=%Public%\games\World of Warcraft|*.bak;*.old|RECURSE
FileKey3=%SystemDrive%\World of Warcraft|*.bak;*.old|RECURSE

[WorldWide Telescope *]
LangSecRef=3021
Detect=HKCU\Software\Classes\WorldWideTelescope.wtml
FileKey1=%LocalAppData%\Microsoft\WorldWideTelescope\dem|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\WorldWideTelescope\Imagery|*.*|RECURSE
FileKey3=%LocalAppData%\Microsoft\WorldWideTelescope\tourcache|*.*|RECURSE

[Wowhead Client *]
Section=Games
Detect=HKCU\Software\Wowhead\WowHead Client
FileKey1=%CommonAppData%\wowhead\wowhead client\cache|*.*|REMOVESELF
FileKey2=%CommonAppData%\wowhead\wowhead client\log|*.*|REMOVESELF
RegKey1=HKCU\Software\Wowhead\WowHead Client|Statistics

[WRAL Desktop Alert *]
LangSecRef=3024
DetectFile=%ProgramFiles%\WRAL Desktop Alert
FileKey1=%ProgramFiles%\WRAL Desktop Alert|*.log

[WS FTP Pro *]
LangSecRef=3022
Detect=HKCU\Software\Ipswitch\WS_FTP
FileKey1=%AppData%\Ipswitch\WS_FTP\Logs|*.*

[Wunderlist *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Wunderlist
FileKey1=%AppData%\Titanium\appdata\com.wunderkinder.wunderlistdesktop|*.log

[X-Chat 2 *]
LangSecRef=3022
DetectFile=%AppData%\X-Chat 2
Warning=This removes Chat Scrollback and Logs.
FileKey1=%AppData%\X-Chat 2\scrollback|*.*|REMOVESELF
FileKey2=%AppData%\X-Chat 2\xchatlogs|*.*|REMOVESELF

[X-Cleaner *]
LangSecRef=3024
DetectFile=%ProgramFiles%\X-Cleaner
FileKey1=%ProgramFiles%\X-Cleaner|XCL_LOG.txt

[X-NetStat *]
LangSecRef=3024
DetectFile=%ProgramFiles%\X-NetStat Professional\xns5.exe
FileKey1=%AppData%\X-NetStat\Logs|*.*

[Xara Photo & Graphic Designer *]
LangSecRef=3023
Detect=HKCU\Software\Xara\Xtreme_SE
FileKey1=%LocalAppData%\Xara\Xtreme\9.2\Backups|*.*|RECURSE
FileKey2=%LocalAppData%\Xara\Xtreme_SE\6.1\Backups|*.txt
RegKey1=HKCU\Software\Xara\Xtreme\9.2\Options\Recent File List
RegKey2=HKCU\Software\Xara\Xtreme_SE\6.1\Options\Recent File List
RegKey3=HKCU\Software\Xara\Xtreme_SE\6.1\Workspace

[Xara WebDesigner Backups *]
LangSecRef=3024
Detect=HKCU\Software\Xara\WebDesigner
FileKey1=%LocalAppData%\Xara\WebDesigner\*\Backups|*.*|RECURSE

[Xara WebDesigner Session *]
LangSecRef=3024
Detect=HKCU\Software\Xara\WebDesigner
RegKey1=HKCU\Software\Xara\WebDesigner\8.0\Workspace\MDI

[Xbox Console Companion *]
DetectOS=10.0|
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxApp_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGameOverlay_8wekyb3d8bbwe
Detect3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState|*.log*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\*Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\DiagOutputDir|*.txt
FileKey9=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\SmartGlass|*.log
FileKey10=%LocalAppData%\Packages\Microsoft.XboxApp_*\TempState|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\AC\INet*|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\AC\Temp|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\LocalCache|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\LocalState\Cache|*.*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\LocalState\DiagOutputDir|*.txt
FileKey17=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\TempState|*.*|RECURSE
FileKey18=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\INet*|*.*|RECURSE
FileKey19=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey20=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey21=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey22=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey23=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Temp|*.*|RECURSE
FileKey24=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey25=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\LocalCache|*.*|RECURSE
FileKey26=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\LocalState\Cache|*.*|RECURSE
FileKey27=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\TempState|*.*|RECURSE

[Xbox Game Bar *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\LocalState\DiagOutputDir|*.txt
FileKey8=%LocalAppData%\Packages\Microsoft.XboxGamingOverlay_*\TempState|*.*|RECURSE

[Xbox LIVE Games *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxLIVEGames_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\LocalState\*Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\LocalState\PlayReady|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxLIVEGames_8wekyb3d8bbwe\SearchHistory

[XCOM *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\200510
Detect2=HKCU\Software\Valve\Steam\Apps\268500
FileKey1=%Documents%\My Games\XCOM*\XComGame\Logs|*.*

[Xenocode Sandbox *]
LangSecRef=3021
Detect=HKCU\Software\Xenocode\SandboxCache
FileKey1=%LocalAppData%\Xenocode\Sandbox|*.*|REMOVESELF
FileKey2=%WinDir%\XSxS|*.*|REMOVESELF
RegKey1=HKCU\Software\Xenocode\SandboxCache

[XeroBank Browser *]
LangSecRef=3022
DetectFile=%ProgramFiles%\XeroBank
FileKey1=%ProgramFiles%\XeroBank\App\Browser\temp|*.*|RECURSE
FileKey2=%UserProfile%\Desktop|xBBrowser_Client.log

[Xerox Printer Driver *]
LangSecRef=3021
DetectFile=%CommonAppData%\Xerox\PrinterDriver
FileKey1=%CommonAppData%\Xerox\PrinterDriver|*.tmp|RECURSE

[Xilisoft AVI to DVD Converter *]
LangSecRef=3023
DetectFile=%LocalAppData%\Xilisoft\AVI to DVD Converter
FileKey1=%LocalAppData%\Xilisoft\AVI to DVD Converter|log_testing.txt

[Xmarks *]
LangSecRef=3024
Detect=HKCU\Software\Xmarks
FileKey1=%LocalAppData%\Xmarks|xmarks.log

[XMind *]
LangSecRef=3021
DetectFile=%AppData%\XMind
FileKey1=%AppData%\XMind|*.log|RECURSE

[XN Resource Editor *]
LangSecRef=3024
Detect=HKCU\Software\Woozle\XN Resource Editor
RegKey1=HKCU\Software\Woozle\XN Resource Editor\Recent Files

[XnView *]
LangSecRef=3023
Detect1=HKCU\Software\XnView
Detect2=HKCU\Software\XnView\XnViewMP
Detect3=HKLM\Software\XnView
FileKey1=%AppData%\XnView\cache|*.db
FileKey2=%AppData%\XnViewMP|*.db;category.bak
FileKey3=%ProgramFiles%\XnViewMP|category.bak;*.db
RegKey1=HKCU\Software\XnView\Start|DirName_0
RegKey2=HKCU\Software\XnView\Start|DirName_1
RegKey3=HKCU\Software\XnView\Start|DirName_2
RegKey4=HKCU\Software\XnView\Start|DirName_3
RegKey5=HKCU\Software\XnView\Start|DirName_4
RegKey6=HKCU\Software\XnView\Start|DirName_5
RegKey7=HKCU\Software\XnView\Start|DirName_6
RegKey8=HKCU\Software\XnView\Start|DirName_7
RegKey9=HKCU\Software\XnView\Start|DirName_8
RegKey10=HKCU\Software\XnView\Start|DirName_9
RegKey11=HKCU\Software\XnView\Start|FileName_0
RegKey12=HKCU\Software\XnView\Start|FileName_1
RegKey13=HKCU\Software\XnView\Start|FileName_2
RegKey14=HKCU\Software\XnView\Start|FileName_3
RegKey15=HKCU\Software\XnView\Start|FileName_4
RegKey16=HKCU\Software\XnView\Start|FileName_5
RegKey17=HKCU\Software\XnView\Start|FileName_6
RegKey18=HKCU\Software\XnView\Start|FileName_7
RegKey19=HKCU\Software\XnView\Start|FileName_8
RegKey20=HKCU\Software\XnView\Start|FileName_9
RegKey21=HKCU\Software\XnView\XnViewMP\Start|customPath
RegKey22=HKCU\Software\XnView\XnViewMP\Start|History
RegKey23=HKCU\Software\XnView\XnViewMP\Start|PathBrowser
RegKey24=HKCU\Software\XnView\XnViewMP\Start|RecentFiles
RegKey25=HKCU\Software\XnView\XnViewMP\Strip|list_folder
RegKey26=HKCU\Software\XnView\XnViewMP\Viewer|saveFolder

[XPhone *]
LangSecRef=3021
Detect=HKCU\Software\C4B\Log
FileKey1=%LocalAppData%\C4B\Log|*.*

[Xplorer2 *]
LangSecRef=3024
Detect=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings
RegKey1=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings\Folder History

[XPort 360 *]
LangSecRef=3021
DetectFile=%AppData%\Datel\XPort 360
FileKey1=%AppData%\Datel\XPort 360\Temp|*.*|REMOVESELF

[XPressUpdate *]
LangSecRef=3023
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\XPressUpdate.exe
FileKey1=%CommonProgramFiles%\XpressUpdate|*.log;*old

[XRayz LinkStash *]
LangSecRef=3024
Detect=HKCU\Software\XRayz\LinkStash
RegKey1=HKCU\Software\XRayz\LinkStash\Recent File List

[Xsplit *]
LangSecRef=3023
Detect=HKLM\Software\Splitmedialabs\XSplit
FileKey1=%AppData%\SplitMediaLabs\XSplit*|*.log|RECURSE
FileKey2=%CommonAppData%\SplitMediaLabs\XSplit\LocalStore\Temp|*.*
FileKey3=%CommonAppData%\SplitMediaLabs\XSplit\Temp|*.*
FileKey4=%LocalAppData%\SplitMediaLabs\XSplit\*|bwtestlogs.txt

[XviD *]
LangSecRef=3023
Detect=HKCU\Software\GNU\Xvid
RegKey1=HKCU\Software\GNU\Xvid|stats

[XWidget *]
LangSecRef=3021
DetectFile=%Documents%\XWidget
FileKey1=%Documents%\XWidget\Cache|*.*|RECURSE

[XWidget Backups *]
LangSecRef=3021
DetectFile=%Documents%\XWidget
FileKey1=%Documents%\XWidget\Backup|*.*|RECURSE

[Yahoo Autosync *]
LangSecRef=3022
Detect=HKCU\Software\Yahoo!\Autosync for Yahoo!
FileKey1=%ProgramFiles%\Yahoo!\Yahoo! Autosync\Logs|*.*

[Yahoo Companion *]
LangSecRef=3022
DetectFile=%CommonAppData%\Yahoo! Companion
FileKey1=%CommonAppData%\Yahoo! Companion\Cache|*.*

[Yet Another Cleaner *]
LangSecRef=3024
Detect=HKLM\Software\iSafe
DetectFile=%ProgramFiles%\iSafe\iSafe.exe
FileKey1=%AppData%\eCyber\sysicons|*.ico
FileKey2=%AppData%\iSafe\ico|*.ico
FileKey3=%AppData%\iSafe\log|*.log
FileKey4=%ProgramFiles%\iSafe\log|.log;*.zip
FileKey5=%ProgramFiles%\iSafe\tws|*log.txt
FileKey6=%ProgramFiles%\iSafe\tws\logs|*.log

[Your Freedom *]
LangSecRef=3022
DetectFile=%ProgramFiles%\Your Freedom\freedom.exe
FileKey1=%LocalAppData%\Your Freedom|*.old

[Your Phone *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.YourPhone_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.YourPhone_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.YourPhone_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.YourPhone_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.YourPhone_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.YourPhone_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.YourPhone_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.YourPhone_*\TempState|*.*|RECURSE

[YouTube-DL *]
LangSecRef=3024
DetectFile=%UserProfile%\.cache\youtube-dl
FileKey1=%UserProfile%\.cache\youtube-dl|*.*|RECURSE

[YPOPs *]
LangSecRef=3021
DetectFile=%ProgramFiles%\YPOPs\ypops.exe
FileKey1=%ProgramFiles%\YPOPs|ypops.log

[yWriter5 *]
LangSecRef=3021
DetectFile=%AppData%\Spacejock Software\yWriter5
FileKey1=%AppData%\Spacejock Software\yWriter5|log.txt
FileKey2=%Documents%\Logs|*.txt

[Zemana AntiMalware Reports *]
LangSecRef=3024
Detect1=HKCU\Software\Zemana\AntiMalware
Detect2=HKLM\Software\Zemana\AntiMalware
FileKey1=%LocalAppData%\Zemana\Zemana AntiMalware\reports|*.txt

[Zend Studio 10 *]
LangSecRef=3021
Detect=HKCU\Software\Zend\ZendStudio
FileKey1=%ProgramFiles%\Zend\Zend Studio 10.0.0|*.html
FileKey2=%ProgramFiles%\Zend\Zend Studio 10.0.0|*.log|RECURSE
FileKey3=%ProgramFiles%\Zend\Zend Studio 10.0.0\docs|*.txt|REMOVESELF
FileKey4=%ProgramFiles%\Zend\Zend Studio 10.0.0\features|*.html|RECURSE

[Zer0 *]
LangSecRef=3024
Detect=HKCU\Software\KC Softwares\Zer0
FileKey1=%AppData%\KC Softwares\Zer0|*.log

[Zimbra Desktop *]
LangSecRef=3022
Detect=HKCU\Software\Zimbra
FileKey1=%LocalAppData%\Zimbra\Zimbra Desktop\data\*log|*.*
FileKey2=%LocalAppData%\Zimbra\Zimbra Desktop\data\tmp\diskcache|*.*|RECURSE

[ZipGenius *]
LangSecRef=3024
Detect=HKCU\Software\M.Dev Software\ZG5
FileKey1=%AppData%\ZipGenius|mru.dat
RegKey1=HKCU\Software\M.Dev Software\ZG5\MRU Items

[ZoneAlarm Internet *]
LangSecRef=3021
Detect=HKLM\Software\Zone Labs\ZoneAlarm
FileKey1=%WinDir%\Internet Logs|*.dmp;*.log;*.tmp;*.zip

[ZoneIDTrimmer *]
LangSecRef=3021
Detect=HKLM\Software\Gasanov.net\ZoneIDTrimmer
DetectFile=%ProgramFiles%\Gasanov.net\ZoneIDTrimmer\ZoneIDTrimmer.Tool.exe
FileKey1=%AppData%\ZoneIDTrimmer\Logs|ZoneIDTrimmer.log

[Zoner Photo Studio *]
LangSecRef=3022
Detect1=HKCU\Software\ZONER\Zoner Photo Studio 15
Detect2=HKCU\Software\ZONER\Zoner Photo Studio 16
Detect3=HKCU\Software\ZONER\Zoner Photo Studio 18
DetectFile=%LocalAppData%\Zoner\ZPS 14
FileKey1=%LocalAppData%\Zoner\ZPS *\Cache|*.*|RECURSE
FileKey2=%LocalAppData%\Zoner\ZPS *\CEF|*.log
FileKey3=%LocalAppData%\Zoner\ZPS *\ZPSCache.dat|*.*
FileKey4=%Pictures%|*.uid-zps

[Zoner Photo Studio AutoSaves *]
LangSecRef=3023
Detect1=HKCU\Software\ZONER\Zoner Photo Studio 15
Detect2=HKCU\Software\ZONER\Zoner Photo Studio 16
Detect3=HKCU\Software\ZONER\Zoner Photo Studio 18
FileKey1=%LocalAppData%\Zoner\OriginalsRepository|*.JPG.info;*.JPG.original|RECURSE

[ZookaWare *]
LangSecRef=3024
Detect=HKCU\Software\ZookaWare
FileKey1=%LocalAppData%\ZookaWare\ScanLogs|*.log

[Zoom *]
LangSecRef=3022
DetectFile=%AppData%\Zoom\bin\Zoom.exe
FileKey1=%AppData%\Zoom|*.txt
FileKey2=%AppData%\Zoom\data|*.tmp.db;*.zmdownload;zmonitorlog.bin
FileKey3=%AppData%\Zoom\data\ConfAvatar|*.*
FileKey4=%AppData%\Zoom\Logs|*.*|RECURSE
FileKey5=%AppData%\Zoom\reports|*.*
FileKey6=%AppData%\Zoom\ZoomDownload|*.exe;*.msi

[Zune Transcoded Files Cache *]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Zune
FileKey1=%LocalAppData%\Microsoft\Zune\Transcoded Files Cache|*.*

[Zuse *]
LangSecRef=3023
DetectFile=%AppData%\Zuse
FileKey1=%AppData%\Zuse\logs|*.*

[ZX32 ZX Spectrum Emulator v1.03 *]
LangSecRef=3021
Detect=HKCU\Software\VK\zx32\1.03
RegKey1=HKCU\Software\VK\zx32\1.03\FileMRU

[Zynga Games *]
Section=Games
DetectFile=%LocalAppData%\Zynga
FileKey1=%LocalAppData%\Zynga\Logs|*.*|RECURSE