; Version: 230901 ; # of entries: 2,685 ; ; Winapp2.ini is fully licensed under the CC-BY-SA-4.0 license agreement. Please refer to our license agreement before using Winapp2.ini: https://github.com/MoscaDotTo/Winapp2/blob/master/License.md ; You may copy, modify, remix, share, show, and transmit Winapp2 but you must redistribute under the same license and you must attribute the original work to the winapp2 project ; ; You can get the latest Winapp2.ini here: https://github.com/MoscaDotTo/Winapp2 ; Any contributions are appreciated. Please refer to our ReadMe to learn to make your own entries here: https://github.com/MoscaDotTo/Winapp2/blob/master/README.md ; ; Try out Winapp2ool for many useful additional features including updating and trimming Winapp2.ini: https://github.com/MoscaDotTo/Winapp2/raw/master/winapp2ool/bin/Release/winapp2ool.exe ; You can find the Winapp2ool ReadMe here: https://github.com/MoscaDotTo/Winapp2/blob/master/winapp2ool/Readme.md ; ; Chrome/Chromium based browsers [Chromium Auto Fill Data *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*|Web Data;Ya Autofill Data*;Ya Credit Cards*;Ya Passman Data* FileKey2=%LocalAppData%\CentBrowser\User Data\*\Autofill*|* FileKey3=%LocalAppData%\Chromium\User Data\*|Web Data FileKey4=%LocalAppData%\Chromium\User Data\*\Autofill*|Web Data FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*|Web Data FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Autofill*|Web Data FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*|Web Data FileKey8=%LocalAppData%\Comodo\Dragon\User Data\*\Autofill*|Web Data FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*|Web Data FileKey10=%LocalAppData%\Epic Privacy Browser\User Data\*\Autofill*|Web Data FileKey11=%LocalAppData%\Google\Chrome*\User Data\*|Web Data FileKey12=%LocalAppData%\Google\Chrome*\User Data\*\Autofill*|Web Data FileKey13=%LocalAppData%\Iridium\User Data\*|Web Data FileKey14=%LocalAppData%\Iridium\User Data\*\Autofill*|Web Data FileKey15=%LocalAppData%\Slimjet\User Data\*|Web Data FileKey16=%LocalAppData%\Slimjet\User Data\*\Autofill*|Web Data FileKey17=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Web Data;Ya Autofill Data*;Ya Credit Cards*;Ya Passman Data* FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Autofill*|* [Chromium Bookmark Backup *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*|*Bookmarks.bak FileKey2=%LocalAppData%\Chromium\User Data\*|*Bookmarks.bak FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*|*Bookmarks.bak FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*|*Bookmarks.bak FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*|*Bookmarks.bak FileKey6=%LocalAppData%\Google\Chrome*\User Data\*|*Bookmarks.bak FileKey7=%LocalAppData%\Iridium\User Data\*|*Bookmarks.bak FileKey8=%LocalAppData%\Slimjet\User Data\*|*Bookmarks.bak FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*Bookmarks.bak [Chromium Bookmark Favicons *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*|favicons* FileKey2=%LocalAppData%\Chromium\User Data\*|favicons* FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*|favicons* FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*|favicons* FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*|favicons* FileKey6=%LocalAppData%\Google\Chrome*\User Data\*|favicons* FileKey7=%LocalAppData%\Iridium\User Data\*|favicons* FileKey8=%LocalAppData%\Slimjet\User Data\*|favicons* FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*|favicons* [Chromium Caches *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey2=%LocalAppData%\CentBrowser\User Data\*|*-journal|RECURSE FileKey3=%LocalAppData%\CentBrowser\User Data\*\*Cache*|*|REMOVESELF FileKey4=%LocalAppData%\CentBrowser\User Data\*\blob_storage|*|REMOVESELF FileKey5=%LocalAppData%\CentBrowser\User Data\*\BudgetDatabase|*|REMOVESELF FileKey6=%LocalAppData%\CentBrowser\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey7=%LocalAppData%\CentBrowser\User Data\*\File System|*|REMOVESELF FileKey8=%LocalAppData%\CentBrowser\User Data\*\GCM Store|*|REMOVESELF FileKey9=%LocalAppData%\CentBrowser\User Data\*\JumpListIcons*|*|REMOVESELF FileKey10=%LocalAppData%\CentBrowser\User Data\*\optimization_guide*|*|REMOVESELF FileKey11=%LocalAppData%\CentBrowser\User Data\*\Platform Notifications|*|REMOVESELF FileKey12=%LocalAppData%\CentBrowser\User Data\*\Service Worker\*|*|REMOVESELF FileKey13=%LocalAppData%\CentBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey14=%LocalAppData%\CentBrowser\User Data\*Cache*|*|REMOVESELF FileKey15=%LocalAppData%\Chromium\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey16=%LocalAppData%\Chromium\User Data\*|*-journal|RECURSE FileKey17=%LocalAppData%\Chromium\User Data\*\*Cache*|*|REMOVESELF FileKey18=%LocalAppData%\Chromium\User Data\*\blob_storage|*|REMOVESELF FileKey19=%LocalAppData%\Chromium\User Data\*\BudgetDatabase|*|REMOVESELF FileKey20=%LocalAppData%\Chromium\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey21=%LocalAppData%\Chromium\User Data\*\File System|*|REMOVESELF FileKey22=%LocalAppData%\Chromium\User Data\*\GCM Store|*|REMOVESELF FileKey23=%LocalAppData%\Chromium\User Data\*\JumpListIcons*|*|REMOVESELF FileKey24=%LocalAppData%\Chromium\User Data\*\optimization_guide*|*|REMOVESELF FileKey25=%LocalAppData%\Chromium\User Data\*\Platform Notifications|*|REMOVESELF FileKey26=%LocalAppData%\Chromium\User Data\*\Service Worker\*|*|REMOVESELF FileKey27=%LocalAppData%\Chromium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey28=%LocalAppData%\Chromium\User Data\*Cache*|*|REMOVESELF FileKey29=%LocalAppData%\CocCoc\Browser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey30=%LocalAppData%\CocCoc\Browser\User Data\*|*-journal|RECURSE FileKey31=%LocalAppData%\CocCoc\Browser\User Data\*\*Cache*|*|REMOVESELF FileKey32=%LocalAppData%\CocCoc\Browser\User Data\*\blob_storage|*|REMOVESELF FileKey33=%LocalAppData%\CocCoc\Browser\User Data\*\BudgetDatabase|*|REMOVESELF FileKey34=%LocalAppData%\CocCoc\Browser\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey35=%LocalAppData%\CocCoc\Browser\User Data\*\File System|*|REMOVESELF FileKey36=%LocalAppData%\CocCoc\Browser\User Data\*\GCM Store|*|REMOVESELF FileKey37=%LocalAppData%\CocCoc\Browser\User Data\*\JumpListIcons*|*|REMOVESELF FileKey38=%LocalAppData%\CocCoc\Browser\User Data\*\optimization_guide*|*|REMOVESELF FileKey39=%LocalAppData%\CocCoc\Browser\User Data\*\Platform Notifications|*|REMOVESELF FileKey40=%LocalAppData%\CocCoc\Browser\User Data\*\Service Worker\*|*|REMOVESELF FileKey41=%LocalAppData%\CocCoc\Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey42=%LocalAppData%\CocCoc\Browser\User Data\*Cache*|*|REMOVESELF FileKey43=%LocalAppData%\CocCoc\Browser\User Data\Coccoc Notifications|* FileKey44=%LocalAppData%\CocCoc\Browser\User Data\Sidebar|Ad Icons FileKey45=%LocalAppData%\Comodo\Dragon\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey46=%LocalAppData%\Comodo\Dragon\User Data\*|*-journal|RECURSE FileKey47=%LocalAppData%\Comodo\Dragon\User Data\*\*Cache*|*|REMOVESELF FileKey48=%LocalAppData%\Comodo\Dragon\User Data\*\blob_storage|*|REMOVESELF FileKey49=%LocalAppData%\Comodo\Dragon\User Data\*\BudgetDatabase|*|REMOVESELF FileKey50=%LocalAppData%\Comodo\Dragon\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey51=%LocalAppData%\Comodo\Dragon\User Data\*\File System|*|REMOVESELF FileKey52=%LocalAppData%\Comodo\Dragon\User Data\*\GCM Store|*|REMOVESELF FileKey53=%LocalAppData%\Comodo\Dragon\User Data\*\JumpListIcons*|*|REMOVESELF FileKey54=%LocalAppData%\Comodo\Dragon\User Data\*\optimization_guide*|*|REMOVESELF FileKey55=%LocalAppData%\Comodo\Dragon\User Data\*\Platform Notifications|*|REMOVESELF FileKey56=%LocalAppData%\Comodo\Dragon\User Data\*\Service Worker\*|*|REMOVESELF FileKey57=%LocalAppData%\Comodo\Dragon\User Data\*Cache*|*|REMOVESELF FileKey58=%LocalAppData%\Epic Privacy Browser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey59=%LocalAppData%\Epic Privacy Browser\User Data\*|*-journal|RECURSE FileKey60=%LocalAppData%\Epic Privacy Browser\User Data\*\*Cache*|*|REMOVESELF FileKey61=%LocalAppData%\Epic Privacy Browser\User Data\*\blob_storage|*|REMOVESELF FileKey62=%LocalAppData%\Epic Privacy Browser\User Data\*\BudgetDatabase|*|REMOVESELF FileKey63=%LocalAppData%\Epic Privacy Browser\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey64=%LocalAppData%\Epic Privacy Browser\User Data\*\File System|*|REMOVESELF FileKey65=%LocalAppData%\Epic Privacy Browser\User Data\*\GCM Store|*|REMOVESELF FileKey66=%LocalAppData%\Epic Privacy Browser\User Data\*\JumpListIcons*|*|REMOVESELF FileKey67=%LocalAppData%\Epic Privacy Browser\User Data\*\optimization_guide*|*|REMOVESELF FileKey68=%LocalAppData%\Epic Privacy Browser\User Data\*\Platform Notifications|*|REMOVESELF FileKey69=%LocalAppData%\Epic Privacy Browser\User Data\*\Service Worker\*|*|REMOVESELF FileKey70=%LocalAppData%\Epic Privacy Browser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey71=%LocalAppData%\Epic Privacy Browser\User Data\*Cache*|*|REMOVESELF FileKey72=%LocalAppData%\Google\Chrome*\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey73=%LocalAppData%\Google\Chrome*\User Data\*|*-journal|RECURSE FileKey74=%LocalAppData%\Google\Chrome*\User Data\*\*Cache*|*|REMOVESELF FileKey75=%LocalAppData%\Google\Chrome*\User Data\*\blob_storage|*|REMOVESELF FileKey76=%LocalAppData%\Google\Chrome*\User Data\*\BudgetDatabase|*|REMOVESELF FileKey77=%LocalAppData%\Google\Chrome*\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey78=%LocalAppData%\Google\Chrome*\User Data\*\File System|*|REMOVESELF FileKey79=%LocalAppData%\Google\Chrome*\User Data\*\GCM Store|*|REMOVESELF FileKey80=%LocalAppData%\Google\Chrome*\User Data\*\JumpListIcons*|*|REMOVESELF FileKey81=%LocalAppData%\Google\Chrome*\User Data\*\optimization_guide*|*|REMOVESELF FileKey82=%LocalAppData%\Google\Chrome*\User Data\*\Platform Notifications|*|REMOVESELF FileKey83=%LocalAppData%\Google\Chrome*\User Data\*\Service Worker\*|*|REMOVESELF FileKey84=%LocalAppData%\Google\Chrome*\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey85=%LocalAppData%\Google\Chrome*\User Data\*Cache*|*|REMOVESELF FileKey86=%LocalAppData%\Iridium\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey87=%LocalAppData%\Iridium\User Data\*|*-journal|RECURSE FileKey88=%LocalAppData%\Iridium\User Data\*\*Cache*|*|REMOVESELF FileKey89=%LocalAppData%\Iridium\User Data\*\blob_storage|*|REMOVESELF FileKey90=%LocalAppData%\Iridium\User Data\*\BudgetDatabase|*|REMOVESELF FileKey91=%LocalAppData%\Iridium\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey92=%LocalAppData%\Iridium\User Data\*\File System|*|REMOVESELF FileKey93=%LocalAppData%\Iridium\User Data\*\GCM Store|*|REMOVESELF FileKey94=%LocalAppData%\Iridium\User Data\*\JumpListIcons*|*|REMOVESELF FileKey95=%LocalAppData%\Iridium\User Data\*\optimization_guide*|*|REMOVESELF FileKey96=%LocalAppData%\Iridium\User Data\*\Platform Notifications|*|REMOVESELF FileKey97=%LocalAppData%\Iridium\User Data\*\Service Worker\*|*|REMOVESELF FileKey98=%LocalAppData%\Iridium\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey99=%LocalAppData%\Iridium\User Data\*Cache*|*|REMOVESELF FileKey100=%LocalAppData%\Slimjet\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey101=%LocalAppData%\Slimjet\User Data\*|*-journal|RECURSE FileKey102=%LocalAppData%\Slimjet\User Data\*\*Cache*|*|REMOVESELF FileKey103=%LocalAppData%\Slimjet\User Data\*\blob_storage|*|REMOVESELF FileKey104=%LocalAppData%\Slimjet\User Data\*\BudgetDatabase|*|REMOVESELF FileKey105=%LocalAppData%\Slimjet\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey106=%LocalAppData%\Slimjet\User Data\*\File System|*|REMOVESELF FileKey107=%LocalAppData%\Slimjet\User Data\*\GCM Store|*|REMOVESELF FileKey108=%LocalAppData%\Slimjet\User Data\*\JumpListIcons*|*|REMOVESELF FileKey109=%LocalAppData%\Slimjet\User Data\*\optimization_guide*|*|REMOVESELF FileKey110=%LocalAppData%\Slimjet\User Data\*\Platform Notifications|*|REMOVESELF FileKey111=%LocalAppData%\Slimjet\User Data\*\Service Worker\*|*|REMOVESELF FileKey112=%LocalAppData%\Slimjet\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey113=%LocalAppData%\Slimjet\User Data\*Cache*|*|REMOVESELF FileKey114=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Tablo;Media History FileKey115=%LocalAppData%\Yandex\YandexBrowser\User Data\*|*-journal|RECURSE FileKey116=%LocalAppData%\Yandex\YandexBrowser\User Data\*\*Cache*|*|REMOVESELF FileKey117=%LocalAppData%\Yandex\YandexBrowser\User Data\*\blob_storage|*|REMOVESELF FileKey118=%LocalAppData%\Yandex\YandexBrowser\User Data\*\BudgetDatabase|*|REMOVESELF FileKey119=%LocalAppData%\Yandex\YandexBrowser\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey120=%LocalAppData%\Yandex\YandexBrowser\User Data\*\File System|*|REMOVESELF FileKey121=%LocalAppData%\Yandex\YandexBrowser\User Data\*\GCM Store|*|REMOVESELF FileKey122=%LocalAppData%\Yandex\YandexBrowser\User Data\*\JumpListIcons*|*|REMOVESELF FileKey123=%LocalAppData%\Yandex\YandexBrowser\User Data\*\optimization_guide*|*|REMOVESELF FileKey124=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Platform Notifications|*|REMOVESELF FileKey125=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Service Value Store|*|REMOVESELF FileKey126=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Service Worker\*|*|REMOVESELF FileKey127=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey128=%LocalAppData%\Yandex\YandexBrowser\User Data\*\TabPreviewScreenshots|*|REMOVESELF FileKey129=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Wallpapers|*|REMOVESELF FileKey130=%LocalAppData%\Yandex\YandexBrowser\User Data\*Cache*|*|REMOVESELF FileKey131=%LocalAppData%\Yandex\YandexBrowser\User Data\YandexStore|YS_* FileKey132=%ProgramFiles%\Google\Chrome*\Temp|*|REMOVESELF FileKey133=%ProgramFiles%\Google\Temp|*|REMOVESELF [Chromium Cookies *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*\IndexedDB\https*|* FileKey2=%LocalAppData%\CentBrowser\User Data\*\Network|Cookies FileKey3=%LocalAppData%\Chromium\User Data\*\IndexedDB\https*|* FileKey4=%LocalAppData%\Chromium\User Data\*\Network|Cookies FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*\IndexedDB\https*|* FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\Network|Cookies FileKey7=%LocalAppData%\Comodo\Dragon\User Data\*\IndexedDB\https*|* FileKey8=%LocalAppData%\Comodo\Dragon\User Data\*\Network|Cookies FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\IndexedDB\https*|* FileKey10=%LocalAppData%\Epic Privacy Browser\User Data\*\Network|Cookies FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\IndexedDB\https*|* FileKey12=%LocalAppData%\Google\Chrome*\User Data\*\Network|Cookies FileKey13=%LocalAppData%\Iridium\User Data\*\IndexedDB\https*|* FileKey14=%LocalAppData%\Iridium\User Data\*\Network|Cookies FileKey15=%LocalAppData%\Slimjet\User Data\*\IndexedDB\https*|* FileKey16=%LocalAppData%\Slimjet\User Data\*\Network|Cookies FileKey17=%LocalAppData%\Yandex\YandexBrowser\User Data\*\IndexedDB\https*|* FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Network|Cookies [Chromium History *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey2=%LocalAppData%\Chromium\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey6=%LocalAppData%\Google\Chrome*\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey7=%LocalAppData%\Iridium\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey8=%LocalAppData%\Slimjet\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts [Chromium Login Data *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*|Login Data FileKey2=%LocalAppData%\Chromium\User Data\*|Login Data FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*|Login Data FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*|Login Data FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*|Login Data FileKey6=%LocalAppData%\Google\Chrome*\User Data\*|Login Data FileKey7=%LocalAppData%\Iridium\User Data\*|Login Data FileKey8=%LocalAppData%\Slimjet\User Data\*|Login Data FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Login Data [Chromium Session *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*\Extension State|* FileKey2=%LocalAppData%\CentBrowser\User Data\*\session*|* FileKey3=%LocalAppData%\Chromium\User Data\*\Extension State|* FileKey4=%LocalAppData%\Chromium\User Data\*\session*|* FileKey5=%LocalAppData%\CocCoc\Browser\User Data\*\Extension State|* FileKey6=%LocalAppData%\CocCoc\Browser\User Data\*\session*|* FileKey7=%LocalAppData%\Comodo\Dragon\User Data\Extension State|* FileKey8=%LocalAppData%\Comodo\Dragon\User Data\session*|* FileKey9=%LocalAppData%\Epic Privacy Browser\User Data\*\Extension State|* FileKey10=%LocalAppData%\Epic Privacy Browser\User Data\*\session*|* FileKey11=%LocalAppData%\Google\Chrome*\User Data\*\Extension State|* FileKey12=%LocalAppData%\Google\Chrome*\User Data\*\session*|* FileKey13=%LocalAppData%\Iridium\User Data\*\Extension State|* FileKey14=%LocalAppData%\Iridium\User Data\*\session*|* FileKey15=%LocalAppData%\Slimjet\User Data\*\Extension State|* FileKey16=%LocalAppData%\Slimjet\User Data\*\session*|* FileKey17=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Extension State|* FileKey18=%LocalAppData%\Yandex\YandexBrowser\User Data\*\session*|* [Chromium Sync Data *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*\Sync Data|*|REMOVESELF FileKey2=%LocalAppData%\Chromium\User Data\*\Sync Data|*|REMOVESELF FileKey3=%LocalAppData%\CocCoc\Browser\User Data\*\Sync Data|*|REMOVESELF FileKey4=%LocalAppData%\Comodo\Dragon\User Data\*\Sync Data|*|REMOVESELF FileKey5=%LocalAppData%\Epic Privacy Browser\User Data\*\Sync Data|*|REMOVESELF FileKey6=%LocalAppData%\Google\Chrome*\User Data\*\Sync Data|*|REMOVESELF FileKey7=%LocalAppData%\Iridium\User Data\*\Sync Data|*|REMOVESELF FileKey8=%LocalAppData%\Slimjet\User Data\*\Sync Data|*|REMOVESELF FileKey9=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Sync Data|*|REMOVESELF [Chromium Telemetry *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\Application|debug.log FileKey2=%LocalAppData%\CentBrowser\Application\SetupMetrics|*|REMOVESELF FileKey3=%LocalAppData%\CentBrowser\User Data|*.pma;LOG;LOG.old|RECURSE FileKey4=%LocalAppData%\CentBrowser\User Data|chrome_shutdown_ms.txt;last* FileKey5=%LocalAppData%\CentBrowser\User Data\*\BrowserMetrics|*|REMOVESELF FileKey6=%LocalAppData%\CentBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey7=%LocalAppData%\CentBrowser\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey8=%LocalAppData%\CentBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey9=%LocalAppData%\CentBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey10=%LocalAppData%\CentBrowser\User Data\Crashpad|metadata FileKey11=%LocalAppData%\CentBrowser\User Data\Crashpad\reports|* FileKey12=%LocalAppData%\CentBrowser\User Data\Stability|*|REMOVESELF FileKey13=%LocalAppData%\Chromium\Application|debug.log FileKey14=%LocalAppData%\Chromium\Application\SetupMetrics|*|REMOVESELF FileKey15=%LocalAppData%\Chromium\User Data|*.pma;LOG;LOG.old|RECURSE FileKey16=%LocalAppData%\Chromium\User Data|chrome_shutdown_ms.txt;last* FileKey17=%LocalAppData%\Chromium\User Data\*\BrowserMetrics|*|REMOVESELF FileKey18=%LocalAppData%\Chromium\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey19=%LocalAppData%\Chromium\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey20=%LocalAppData%\Chromium\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey21=%LocalAppData%\Chromium\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey22=%LocalAppData%\Chromium\User Data\Crashpad|metadata FileKey23=%LocalAppData%\Chromium\User Data\Crashpad\reports|* FileKey24=%LocalAppData%\Chromium\User Data\Stability|*|REMOVESELF FileKey25=%LocalAppData%\CocCoc\Browser\Application|debug.log FileKey26=%LocalAppData%\CocCoc\Browser\Application\SetupMetrics|*|REMOVESELF FileKey27=%LocalAppData%\CocCoc\Browser\User Data|*.pma;LOG;LOG.old|RECURSE FileKey28=%LocalAppData%\CocCoc\Browser\User Data|chrome_shutdown_ms.txt;last* FileKey29=%LocalAppData%\CocCoc\Browser\User Data\*\BrowserMetrics|*|REMOVESELF FileKey30=%LocalAppData%\CocCoc\Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey31=%LocalAppData%\CocCoc\Browser\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey32=%LocalAppData%\CocCoc\Browser\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey33=%LocalAppData%\CocCoc\Browser\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey34=%LocalAppData%\CocCoc\Browser\User Data\Crashpad|metadata FileKey35=%LocalAppData%\CocCoc\Browser\User Data\Crashpad\reports|* FileKey36=%LocalAppData%\CocCoc\Browser\User Data\Stability|*|REMOVESELF FileKey37=%LocalAppData%\CocCoc\CrashReports|* FileKey38=%LocalAppData%\Comodo\Dragon\User Data|*.pma;LOG;LOG.old|RECURSE FileKey39=%LocalAppData%\Comodo\Dragon\User Data|chrome_shutdown_ms.txt;last* FileKey40=%LocalAppData%\Comodo\Dragon\User Data\*\BrowserMetrics|*|REMOVESELF FileKey41=%LocalAppData%\Comodo\Dragon\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey42=%LocalAppData%\Comodo\Dragon\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey43=%LocalAppData%\Comodo\Dragon\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey44=%LocalAppData%\Comodo\Dragon\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey45=%LocalAppData%\Comodo\Dragon\User Data\Crashpad|metadata FileKey46=%LocalAppData%\Comodo\Dragon\User Data\Crashpad\reports|* FileKey47=%LocalAppData%\Comodo\Dragon\User Data\Stability|*|REMOVESELF FileKey48=%LocalAppData%\Epic Privacy Browser\Application|debug.log FileKey49=%LocalAppData%\Epic Privacy Browser\Application\SetupMetrics|*|REMOVESELF FileKey50=%LocalAppData%\Epic Privacy Browser\CrashReports|* FileKey51=%LocalAppData%\Epic Privacy Browser\User Data|*.pma;LOG;LOG.old|RECURSE FileKey52=%LocalAppData%\Epic Privacy Browser\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey53=%LocalAppData%\Epic Privacy Browser\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey54=%LocalAppData%\Epic Privacy Browser\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey55=%LocalAppData%\Epic Privacy Browser\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey56=%LocalAppData%\Epic Privacy Browser\User Data\BrowserMetrics|*|REMOVESELF FileKey57=%LocalAppData%\Epic Privacy Browser\User Data\Crashpad|metadata FileKey58=%LocalAppData%\Epic Privacy Browser\User Data\Crashpad\reports|* FileKey59=%LocalAppData%\Epic Privacy Browser\User Data\Stability|*|REMOVESELF FileKey60=%LocalAppData%\Google\*Tool|*.log FileKey61=%LocalAppData%\Google\Chrome*\Application|debug.log FileKey62=%LocalAppData%\Google\Chrome*\Application\SetupMetrics|*|REMOVESELF FileKey63=%LocalAppData%\Google\Chrome*\User Data|*.pma;LOG;LOG.old|RECURSE FileKey64=%LocalAppData%\Google\Chrome*\User Data|chrome_shutdown_ms.txt;last* FileKey65=%LocalAppData%\Google\Chrome*\User Data\*|Affiliation Database;BrowsingTopics*;DIPS;InterestGroups FileKey66=%LocalAppData%\Google\Chrome*\User Data\*\BrowserMetrics|*|REMOVESELF FileKey67=%LocalAppData%\Google\Chrome*\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey68=%LocalAppData%\Google\Chrome*\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey69=%LocalAppData%\Google\Chrome*\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey70=%LocalAppData%\Google\Chrome*\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey71=%LocalAppData%\Google\Chrome*\User Data\Crashpad|metadata FileKey72=%LocalAppData%\Google\Chrome*\User Data\Crashpad\reports|* FileKey73=%LocalAppData%\Google\Chrome*\User Data\Stability|*|REMOVESELF FileKey74=%LocalAppData%\Google\CrashReports|* FileKey75=%LocalAppData%\Iridium\User Data|*.pma;LOG;LOG.old|RECURSE FileKey76=%LocalAppData%\Iridium\User Data|chrome_shutdown_ms.txt;last* FileKey77=%LocalAppData%\Iridium\User Data\*\BrowserMetrics|*|REMOVESELF FileKey78=%LocalAppData%\Iridium\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey79=%LocalAppData%\Iridium\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey80=%LocalAppData%\Iridium\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey81=%LocalAppData%\Iridium\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey82=%LocalAppData%\Iridium\User Data\Crashpad|metadata FileKey83=%LocalAppData%\Iridium\User Data\Crashpad\reports|* FileKey84=%LocalAppData%\Iridium\User Data\Stability|*|REMOVESELF FileKey85=%LocalAppData%\Slimjet\User Data|*.pma;LOG;LOG.old|RECURSE FileKey86=%LocalAppData%\Slimjet\User Data|chrome_shutdown_ms.txt;last* FileKey87=%LocalAppData%\Slimjet\User Data\*\BrowserMetrics|*|REMOVESELF FileKey88=%LocalAppData%\Slimjet\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey89=%LocalAppData%\Slimjet\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey90=%LocalAppData%\Slimjet\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey91=%LocalAppData%\Slimjet\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey92=%LocalAppData%\Slimjet\User Data\Crashpad|metadata FileKey93=%LocalAppData%\Slimjet\User Data\Crashpad\reports|* FileKey94=%LocalAppData%\Slimjet\User Data\Stability|*|REMOVESELF FileKey95=%LocalAppData%\Yandex\SearchBand|*.log FileKey96=%LocalAppData%\Yandex\YandexBrowser\Application|debug.log FileKey97=%LocalAppData%\Yandex\YandexBrowser\Application\SetupMetrics|*|REMOVESELF FileKey98=%LocalAppData%\Yandex\YandexBrowser\User Data|*.pma;LOG;LOG.old|RECURSE FileKey99=%LocalAppData%\Yandex\YandexBrowser\User Data|Last*;Local State;Tab Lifetime;update*.rss;Variations;chrome_shutdown_ms.txt FileKey100=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Bookmarks Log;Passman Logs;Session Log;Tabs Log;Ya Autofill Logs;WebApp Logs FileKey101=%LocalAppData%\Yandex\YandexBrowser\User Data\*\BrowserMetrics|*|REMOVESELF FileKey102=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey103=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey104=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey105=%LocalAppData%\Yandex\YandexBrowser\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey106=%LocalAppData%\Yandex\YandexBrowser\User Data\Crashpad|metadata;uploads.log FileKey107=%LocalAppData%\Yandex\YandexBrowser\User Data\Crashpad\reports|* FileKey108=%LocalAppData%\Yandex\YandexBrowser\User Data\Stability|*|REMOVESELF FileKey109=%ProgramData%\Epic Privacy Browser\Installer\Log|*.log FileKey110=%ProgramData%\Yandex\YandexBrowser|service_update.log FileKey111=%ProgramFiles%\CocCoc\Browser\Application\SetupMetrics|*|REMOVESELF FileKey112=%ProgramFiles%\Comodo\Dragon|debug.log FileKey113=%ProgramFiles%\Google\Chrome*\Application|debug.log FileKey114=%ProgramFiles%\Google\CrashReports|* FileKey115=%ProgramFiles%\Iridium|debug.log FileKey116=%ProgramFiles%\Slimjet|debug.log FileKey117=%ProgramFiles%\SRWare Iron|debug.log FileKey118=%ProgramFiles%\Yandex\YandexBrowser\*|debug.log RegKey1=HKCU\Software\CentBrowser\BlBeacon|failed_count RegKey2=HKCU\Software\CentBrowser\BlBeacon|state RegKey3=HKCU\Software\CentBrowser\StabilityMetrics RegKey4=HKCU\Software\Chromium\BlBeacon|failed_count RegKey5=HKCU\Software\Chromium\BlBeacon|state RegKey6=HKCU\Software\Chromium\StabilityMetrics RegKey7=HKCU\Software\CocCoc\BlBeacon|failed_count RegKey8=HKCU\Software\CocCoc\BlBeacon|state RegKey9=HKCU\Software\CocCoc\StabilityMetrics RegKey10=HKCU\Software\Comodo\Dragon\BlBeacon|failed_count RegKey11=HKCU\Software\Comodo\Dragon\BlBeacon|state RegKey12=HKCU\Software\Comodo\Dragon\StabilityMetrics RegKey13=HKCU\Software\Epic Privacy Browser\BlBeacon|failed_count RegKey14=HKCU\Software\Epic Privacy Browser\BlBeacon|state RegKey15=HKCU\Software\Epic Privacy Browser\StabilityMetrics RegKey16=HKCU\Software\Google\Chrome Beta\BlBeacon|failed_count RegKey17=HKCU\Software\Google\Chrome Beta\BlBeacon|state RegKey18=HKCU\Software\Google\Chrome Beta\StabilityMetrics RegKey19=HKCU\Software\Google\Chrome Dev\BlBeacon|failed_count RegKey20=HKCU\Software\Google\Chrome Dev\BlBeacon|state RegKey21=HKCU\Software\Google\Chrome Dev\StabilityMetrics RegKey22=HKCU\Software\Google\Chrome SxS\BlBeacon|failed_count RegKey23=HKCU\Software\Google\Chrome SxS\BlBeacon|state RegKey24=HKCU\Software\Google\Chrome SxS\StabilityMetrics RegKey25=HKCU\Software\Google\Chrome\BlBeacon|failed_count RegKey26=HKCU\Software\Google\Chrome\BlBeacon|state RegKey27=HKCU\Software\Google\Chrome\StabilityMetrics RegKey28=HKCU\Software\Iridium\BlBeacon|failed_count RegKey29=HKCU\Software\Iridium\BlBeacon|state RegKey30=HKCU\Software\Iridium\StabilityMetrics RegKey31=HKCU\Software\Slimjet\BlBeacon|failed_count RegKey32=HKCU\Software\Slimjet\BlBeacon|state RegKey33=HKCU\Software\Slimjet\StabilityMetrics RegKey34=HKCU\Software\Yandex\YandexBrowser\BlBeacon|failed_count RegKey35=HKCU\Software\Yandex\YandexBrowser\BlBeacon|state RegKey36=HKCU\Software\Yandex\YandexBrowser\StabilityMetrics [Chromium Updates *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\Installer\Download|*|RECURSE FileKey2=%LocalAppData%\CentBrowser\Installer\Install|*|RECURSE FileKey3=%LocalAppData%\CentBrowser\Installer\Offline|*|RECURSE FileKey4=%LocalAppData%\Chromium\Installer\Download|*|RECURSE FileKey5=%LocalAppData%\Chromium\Installer\Install|*|RECURSE FileKey6=%LocalAppData%\Chromium\Installer\Offline|*|RECURSE FileKey7=%LocalAppData%\CocCoc\Update\Download|*|RECURSE FileKey8=%LocalAppData%\CocCoc\Update\Install|*|RECURSE FileKey9=%LocalAppData%\CocCoc\Update\Offline|*|RECURSE FileKey10=%LocalAppData%\Comodo\Installer\Download|*|RECURSE FileKey11=%LocalAppData%\Comodo\Installer\Install|*|RECURSE FileKey12=%LocalAppData%\Comodo\Installer\Offline|*|RECURSE FileKey13=%LocalAppData%\Epic Privacy Browser\Installer\Download|*|RECURSE FileKey14=%LocalAppData%\Epic Privacy Browser\Installer\Install|*|RECURSE FileKey15=%LocalAppData%\Epic Privacy Browser\Installer\Offline|*|RECURSE FileKey16=%LocalAppData%\Google\Installer\Download|*|RECURSE FileKey17=%LocalAppData%\Google\Installer\Install|*|RECURSE FileKey18=%LocalAppData%\Google\Installer\Offline|*|RECURSE FileKey19=%LocalAppData%\Iridium\Installer\Download|*|RECURSE FileKey20=%LocalAppData%\Iridium\Installer\Install|*|RECURSE FileKey21=%LocalAppData%\Iridium\Installer\Offline|*|RECURSE FileKey22=%LocalAppData%\Slimjet\Installer\Download|*|RECURSE FileKey23=%LocalAppData%\Slimjet\Installer\Install|*|RECURSE FileKey24=%LocalAppData%\Slimjet\Installer\Offline|*|RECURSE FileKey25=%LocalAppData%\Yandex\Installer\Download|*|RECURSE FileKey26=%LocalAppData%\Yandex\Installer\Install|*|RECURSE FileKey27=%LocalAppData%\Yandex\Installer\Offline|*|RECURSE [Chromium Web Storage *] LangSecRef=3029 Detect1=HKCU\Software\CentBrowser Detect2=HKCU\Software\Chromium\PreferenceMACs Detect3=HKCU\Software\CocCoc\Browser Detect4=HKCU\Software\Comodo\Dragon Detect5=HKCU\Software\Epic Privacy Browser Detect6=HKCU\Software\Iridium Detect7=HKCU\Software\Slimjet Detect8=HKCU\Software\Yandex\YandexBrowser DetectFile=%LocalAppData%\Google\Chrome* FileKey1=%LocalAppData%\CentBrowser\User Data\*\Local Storage\leveldb|* FileKey2=%LocalAppData%\CentBrowser\User Data\*\Session Storage|* FileKey3=%LocalAppData%\CentBrowser\User Data\*\Storage\ext\*\def\Session Storage|* FileKey4=%LocalAppData%\CentBrowser\User Data\*\WebStorage|*|RECURSE FileKey5=%LocalAppData%\Chromium\User Data\*\Local Storage\leveldb|* FileKey6=%LocalAppData%\Chromium\User Data\*\Session Storage|* FileKey7=%LocalAppData%\Chromium\User Data\*\Storage\ext\*\def\Session Storage|* FileKey8=%LocalAppData%\Chromium\User Data\*\WebStorage|*|RECURSE FileKey9=%LocalAppData%\CocCoc\Browser\User Data\*\Local Storage\leveldb|* FileKey10=%LocalAppData%\CocCoc\Browser\User Data\*\Session Storage|* FileKey11=%LocalAppData%\CocCoc\Browser\User Data\*\Storage\ext\*\def\Session Storage|* FileKey12=%LocalAppData%\CocCoc\Browser\User Data\*\WebStorage|*|RECURSE FileKey13=%LocalAppData%\Comodo\Dragon\User Data\*\Local Storage\leveldb|* FileKey14=%LocalAppData%\Comodo\Dragon\User Data\*\Session Storage|* FileKey15=%LocalAppData%\Comodo\Dragon\User Data\*\Storage\ext\*\def\Session Storage|* FileKey16=%LocalAppData%\Comodo\Dragon\User Data\*\WebStorage|*|RECURSE FileKey17=%LocalAppData%\Epic Privacy Browser\User Data\*\Local Storage\leveldb|* FileKey18=%LocalAppData%\Epic Privacy Browser\User Data\*\Session Storage|* FileKey19=%LocalAppData%\Epic Privacy Browser\User Data\*\Storage\ext\*\def\Session Storage|* FileKey20=%LocalAppData%\Epic Privacy Browser\User Data\*\WebStorage|*|RECURSE FileKey21=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\leveldb|* FileKey22=%LocalAppData%\Google\Chrome*\User Data\*\Session Storage|* FileKey23=%LocalAppData%\Google\Chrome*\User Data\*\Storage\ext\*\def\Session Storage|* FileKey24=%LocalAppData%\Google\Chrome*\User Data\*\WebStorage|*|RECURSE FileKey25=%LocalAppData%\Iridium\User Data\*\Local Storage\leveldb|* FileKey26=%LocalAppData%\Iridium\User Data\*\Session Storage|* FileKey27=%LocalAppData%\Iridium\User Data\*\Storage\ext\*\def\Session Storage|* FileKey28=%LocalAppData%\Iridium\User Data\*\WebStorage|*|RECURSE FileKey29=%LocalAppData%\Slimjet\User Data\*\Local Storage\leveldb|* FileKey30=%LocalAppData%\Slimjet\User Data\*\Session Storage|* FileKey31=%LocalAppData%\Slimjet\User Data\*\Storage\ext\*\def\Session Storage|* FileKey32=%LocalAppData%\Slimjet\User Data\*\WebStorage|*|RECURSE FileKey33=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Local Storage\leveldb|* FileKey34=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Session Storage|* FileKey35=%LocalAppData%\Yandex\YandexBrowser\User Data\*\Storage\ext\*\def\Session Storage|* FileKey36=%LocalAppData%\Yandex\YandexBrowser\User Data\*\WebStorage|*|RECURSE ; End of Chrome/Chromium based browsers ; ; Edge Chromium [Microsoft Edge Auto Fill Data *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Web Data [Microsoft Edge Bookmark Backup *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|*Bookmarks.bak [Microsoft Edge Bookmark Favicons *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|favicons* [Microsoft Edge Caches *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;load_statistics.db*;Media History FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|*-journal|RECURSE FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*\*Cache*|*|REMOVESELF FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\*\blob_storage|*|REMOVESELF FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*\BudgetDatabase|*|REMOVESELF FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\*\EdgeCoupons\coupons_data.db|* FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\*\File System|*|REMOVESELF FileKey9=%LocalAppData%\Microsoft\Edge*\User Data\*\GCM Store|*|REMOVESELF FileKey10=%LocalAppData%\Microsoft\Edge*\User Data\*\JumpListIcons*|*|REMOVESELF FileKey11=%LocalAppData%\Microsoft\Edge*\User Data\*\optimization_guide*|*|REMOVESELF FileKey12=%LocalAppData%\Microsoft\Edge*\User Data\*\Pdf|pdfSQLite FileKey13=%LocalAppData%\Microsoft\Edge*\User Data\*\Platform Notifications|*|REMOVESELF FileKey14=%LocalAppData%\Microsoft\Edge*\User Data\*\Service Worker\*|*|REMOVESELF FileKey15=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey16=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\*cache*|*|RECURSE FileKey17=%LocalAppData%\Microsoft\Edge*\User Data\*Cache*|*|REMOVESELF FileKey18=%ProgramFiles%\Microsoft\Edge*\Temp|*|REMOVESELF FileKey19=%ProgramFiles%\Microsoft\Temp|*|REMOVESELF [Microsoft Edge Cookies *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\IndexedDB\https*|* FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|Cookies [Microsoft Edge History *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts [Microsoft Edge Login Data *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*|Login Data [Microsoft Edge Logs *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|LOG;LOG.old|RECURSE FileKey3=%ProgramFiles%\Microsoft\Edge*\Application|debug.log FileKey4=%UserProfile%\AppData\LocalLow\Microsoft\EdgeBho|*.log FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*|LOG;LOG.old|RECURSE [Microsoft Edge Session *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Extension State|* FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*\session*|* [Microsoft Edge Sync Data *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Sync Data|*|REMOVESELF [Microsoft Edge Telemetry *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\CrashReports|* FileKey2=%LocalAppData%\Microsoft\Edge*\Application\SetupMetrics|*|REMOVESELF FileKey3=%LocalAppData%\Microsoft\Edge*\User Data\*|DashTrackerDatabase;load_statistics*;WebAssistDatabase* FileKey4=%LocalAppData%\Microsoft\Edge*\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey5=%LocalAppData%\Microsoft\Edge*\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey6=%LocalAppData%\Microsoft\Edge*\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey7=%LocalAppData%\Microsoft\Edge*\User Data\*\Storage\ext\*\def\Network|* FileKey8=%LocalAppData%\Microsoft\Edge*\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey9=%LocalAppData%\Microsoft\Edge*\User Data\BrowserMetrics|*|REMOVESELF FileKey10=%LocalAppData%\Microsoft\Edge*\User Data\Crashpad|metadata FileKey11=%LocalAppData%\Microsoft\Edge*\User Data\Crashpad\reports|* FileKey12=%LocalAppData%\Microsoft\Edge*\User Data\Stability|*|REMOVESELF FileKey13=%ProgramFiles%\Microsoft\CrashReports|* FileKey14=%ProgramFiles%\Microsoft\Edge*\Application\SetupMetrics|*|REMOVESELF [Microsoft Edge Updates *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\EdgeUpdate\Download|*|RECURSE FileKey2=%LocalAppData%\Microsoft\EdgeUpdate\Install|*|RECURSE FileKey3=%LocalAppData%\Microsoft\EdgeUpdate\Offline|*|RECURSE FileKey4=%ProgramData%\Microsoft\EdgeUpdate\Log|* FileKey5=%ProgramFiles%\Microsoft\EdgeUpdate\Download|*|RECURSE FileKey6=%ProgramFiles%\Microsoft\EdgeUpdate\Install|*|RECURSE FileKey7=%ProgramFiles%\Microsoft\EdgeUpdate\Offline|*|RECURSE [Microsoft Edge Web Storage *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge FileKey1=%LocalAppData%\Microsoft\Edge\User Data\*\Local Storage\leveldb|* FileKey2=%LocalAppData%\Microsoft\Edge\User Data\*\Session Storage|* FileKey3=%LocalAppData%\Microsoft\Edge\User Data\*\Storage\ext\*\def\Session Storage|* FileKey4=%LocalAppData%\Microsoft\Edge\User Data\*\WebStorage|*|RECURSE ; End of Edge Chromium ; ; Vivaldi [Vivaldi Auto Fill Data *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*|Web Data [Vivaldi Bookmark Backup *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*|*Bookmarks.bak [Vivaldi Bookmark Favicons *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*|favicons* [Vivaldi Caches *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\Temp|*|REMOVESELF FileKey2=%LocalAppData%\Vivaldi\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey3=%LocalAppData%\Vivaldi\User Data\*|*-journal|RECURSE FileKey4=%LocalAppData%\Vivaldi\User Data\*\*Cache*|*|REMOVESELF FileKey5=%LocalAppData%\Vivaldi\User Data\*\blob_storage|*|REMOVESELF FileKey6=%LocalAppData%\Vivaldi\User Data\*\BudgetDatabase|*|REMOVESELF FileKey7=%LocalAppData%\Vivaldi\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey8=%LocalAppData%\Vivaldi\User Data\*\File System|*|REMOVESELF FileKey9=%LocalAppData%\Vivaldi\User Data\*\GCM Store|*|REMOVESELF FileKey10=%LocalAppData%\Vivaldi\User Data\*\JumpListIcons*|*|REMOVESELF FileKey11=%LocalAppData%\Vivaldi\User Data\*\optimization_guide*|*|REMOVESELF FileKey12=%LocalAppData%\Vivaldi\User Data\*\Platform Notifications|*|REMOVESELF FileKey13=%LocalAppData%\Vivaldi\User Data\*\Service Worker\*|*|REMOVESELF FileKey14=%LocalAppData%\Vivaldi\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey15=%LocalAppData%\Vivaldi\User Data\*Cache*|*|REMOVESELF [Vivaldi Cookies *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*\IndexedDB\https*|* FileKey2=%LocalAppData%\Vivaldi\User Data\*\Network|Cookies [Vivaldi History *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts [Vivaldi Login Data *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*|Login Data [Vivaldi Logs *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\Application|debug.log FileKey2=%LocalAppData%\Vivaldi\User Data\*|LOG;LOG.old|RECURSE FileKey3=%ProgramFiles%\Vivaldi\Application|debug.log [Vivaldi Session *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*\Extension State|* FileKey2=%LocalAppData%\Vivaldi\User Data\*\session*|* [Vivaldi Sync Data *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*\Sync Data|*|REMOVESELF [Vivaldi Telemetry *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\Application|debug.log FileKey2=%LocalAppData%\Vivaldi\Application\SetupMetrics|*|REMOVESELF FileKey3=%LocalAppData%\Vivaldi\User Data\*|*.pma;LOG;LOG.old|RECURSE FileKey4=%LocalAppData%\Vivaldi\User Data\*|chrome_shutdown_ms.txt;last*;Affiliation Database*;BrowsingTopics*;DIPS;InterestGroups FileKey5=%LocalAppData%\Vivaldi\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey6=%LocalAppData%\Vivaldi\User Data\*\Network|Media History;Network*;Reporting*;Transport* FileKey7=%LocalAppData%\Vivaldi\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey8=%LocalAppData%\Vivaldi\User Data\*\VideoDecodeStats|*|REMOVESELF FileKey9=%LocalAppData%\Vivaldi\User Data\BrowserMetrics|*|REMOVESELF FileKey10=%LocalAppData%\Vivaldi\User Data\Crashpad|metadata FileKey11=%LocalAppData%\Vivaldi\User Data\Crashpad\reports|* FileKey12=%LocalAppData%\Vivaldi\User Data\Stability|*|REMOVESELF FileKey13=%ProgramFiles%\Vivaldi\Application\SetupMetrics|*|REMOVESELF FileKey14=%UserProfile%|.vivaldi_reporting_data RegKey1=HKCU\Software\Yandex\YandexBrowser\BlBeacon|failed_count RegKey2=HKCU\Software\Yandex\YandexBrowser\BlBeacon|state RegKey3=HKCU\Software\Yandex\YandexBrowser\StabilityMetrics [Vivaldi Updates *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\Installer\Download|*|RECURSE FileKey2=%LocalAppData%\Vivaldi\Installer\Install|*|RECURSE FileKey3=%LocalAppData%\Vivaldi\Installer\Offline|*|RECURSE [Vivaldi Web Storage *] LangSecRef=3033 Detect=HKCU\Software\Vivaldi FileKey1=%LocalAppData%\Vivaldi\User Data\*\Local Storage\leveldb|* FileKey2=%LocalAppData%\Vivaldi\User Data\*\Session Storage|* FileKey3=%LocalAppData%\Vivaldi\User Data\*\Storage\ext\*\def\Session Storage|* FileKey4=%LocalAppData%\Vivaldi\User Data\*\WebStorage|*|RECURSE ; End of Vivaldi ; ; Brave [Brave Auto Fill Data *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Web Data [Brave Bookmark Backup *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*Bookmarks.bak [Brave Bookmark Favicons *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Favicons* [Brave Caches *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|*-journal|RECURSE FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\*Cache*|*|REMOVESELF FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\blob_storage|*|REMOVESELF FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\BudgetDatabase|*|REMOVESELF FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\File System|*|REMOVESELF FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\GCM Store|*|REMOVESELF FileKey9=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\JumpListIcons*|*|REMOVESELF FileKey10=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\optimization_guide*|*|REMOVESELF FileKey11=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Platform Notifications|*|REMOVESELF FileKey12=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Service Worker\*|*|REMOVESELF FileKey13=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey14=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*Cache*|*|REMOVESELF FileKey15=%LocalAppData%\BraveSoftware\Temp|*|REMOVESELF [Brave Cookies *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\IndexedDB\https*|* FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Network|Cookies [Brave History *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts [Brave Login Data *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Login Data [Brave Logs *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|LOG;LOG.old|RECURSE FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\tor\data|*.log;*.new FileKey3=%ProgramFiles%\BraveSoftware\Brave-Browser*\Application|debug.log RegKey1=HKCU\Software\BraveSoftware\Promo|StubInstallerPath [Brave Session *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Extension State|* FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\session*|* [Brave Sync Data *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Sync Data|*|REMOVESELF [Brave Telemetry *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data|chrome_shutdown_ms.txt;last* FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*|Media History;Network Persistent State FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Feature Engagement Tracker|*|REMOVESELF FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Network|Network Persistent State FileKey5=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Site Characteristics Database|*|REMOVESELF FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\BrowserMetrics|*|REMOVESELF FileKey7=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crashpad|metadata FileKey8=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\Crashpad\reports|* FileKey9=%LocalAppData%\BraveSoftware\CrashReports|* FileKey10=%ProgramFiles%\BraveSoftware\Brave-Browser*\Application\SetupMetrics|*|REMOVESELF FileKey11=%ProgramFiles%\BraveSoftware\CrashReports|* [Brave Updates *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%ProgramFiles%\BraveSoftware\Update\Download|*|RECURSE FileKey2=%ProgramFiles%\BraveSoftware\Update\Install|*|RECURSE FileKey3=%ProgramFiles%\BraveSoftware\Update\Offline|*|RECURSE [Brave Web Storage *] LangSecRef=3034 Detect=HKCU\Software\BraveSoftware FileKey1=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Local Storage\leveldb|* FileKey2=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Session Storage|* FileKey3=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\Storage\ext\*\def\Session Storage|* FileKey4=%LocalAppData%\BraveSoftware\Brave-Browser*\User Data\*\WebStorage|*|RECURSE ; End of Brave ; ; Opera [Opera 9 Classic *] LangSecRef=3027 DetectFile=%ProgramFiles%\Opera 9 FileKey1=%ProgramFiles%\Opera 9\profile|cookies4.dat;vlink4.dat;global.dat FileKey2=%ProgramFiles%\Opera 9\profile\cache*|* [Opera Auto Fill Data *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*|Web Data [Opera Bookmark Backup *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*|bookmarks.bak [Opera Bookmark Favicons *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*|favicons* [Opera Caches *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*|*.ldb;*.log;CURRENT;LOCK;MANIFEST-*;Media History FileKey2=%AppData%\Opera Software\Opera*|*-journal|RECURSE FileKey3=%AppData%\Opera Software\Opera*\*Cache*|*|REMOVESELF FileKey4=%AppData%\Opera Software\Opera*\blob_storage|*|REMOVESELF FileKey5=%AppData%\Opera Software\Opera*\BudgetDatabase|*|REMOVESELF FileKey6=%AppData%\Opera Software\Opera*\data_reduction_proxy_leveldb|*|REMOVESELF FileKey7=%AppData%\Opera Software\Opera*\File System|*|REMOVESELF FileKey8=%AppData%\Opera Software\Opera*\GCM Store|*|REMOVESELF FileKey9=%AppData%\Opera Software\Opera*\JumpListIcons*|*|REMOVESELF FileKey10=%AppData%\Opera Software\Opera*\optimization_guide*|*|REMOVESELF FileKey11=%AppData%\Opera Software\Opera*\Pdf|pdfSQLite FileKey12=%AppData%\Opera Software\Opera*\Platform Notifications|*|REMOVESELF FileKey13=%AppData%\Opera Software\Opera*\Service Worker\*Cache*|*|REMOVESELF FileKey14=%AppData%\Opera Software\Opera*\Storage\ext\*\def\Platform Notifications|*|REMOVESELF FileKey15=%LocalAppData%\Opera Software\Opera*\*Cache*|*|REMOVESELF FileKey16=%ProgramFiles%\Opera\Opera*\Temp|*|REMOVESELF FileKey17=%ProgramFiles%\Opera\Temp|*|REMOVESELF [Opera Cookies *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*\IndexedDB\https*|* FileKey2=%AppData%\Opera Software\Opera*\*\Network|Cookies [Opera History *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*|History*;Visited Links*;Top Sites*;Network Action Predictor*;Shortcuts [Opera Login Data *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*|Login Data [Opera Logs *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*|LOG;LOG.old|RECURSE FileKey2=%AppData%\Opera Software\Opera*\Application|debug.log FileKey3=%LocalAppData%\Programs\Opera*|*.log|REMOVESELF FileKey4=%ProgramFiles%\Opera*|*.log|RECURSE FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Opera Software\Opera*\*|LOG;LOG.old|RECURSE [Opera Presto *] LangSecRef=3027 DetectFile=%LocalAppData%\Opera\Opera* FileKey1=%LocalAppData%\Opera\Opera*|*.log FileKey2=%LocalAppData%\Opera\Opera*\application_cache|*|REMOVESELF FileKey3=%LocalAppData%\Opera\Opera*\icons|*|REMOVESELF FileKey4=%LocalAppData%\Opera\Opera*\logs|*|REMOVESELF FileKey5=%LocalAppData%\Opera\Opera*\temporary_downloads|*|REMOVESELF FileKey6=%LocalAppData%\Opera\Opera*\thumbnails|*|REMOVESELF FileKey7=%LocalAppData%\Opera\Opera*\vps|*|REMOVESELF FileKey8=%UserProfile%\.opera|*|REMOVESELF FileKey9=%UserProfile%\Downloads\.opera|*|REMOVESELF FileKey10=%UserProfile%\Downloads\Opera Autoupdate|*.log FileKey11=%UserProfile%\Opera Autoupdate|*.log RegKey1=HKCU\Software\Opera Software|Last CommandLine v2 [Opera Session *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\Extension State|* FileKey2=%AppData%\Opera Software\Opera*\session*|* [Opera Sync Data *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\Sync Data|*|REMOVESELF [Opera Telemetry *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*|DashTrackerDatabase;load_statistics*;WebAssistDatabase* FileKey2=%AppData%\Opera Software\Opera*\Application\SetupMetrics|*|REMOVESELF FileKey3=%AppData%\Opera Software\Opera*\BrowserMetrics|*|REMOVESELF FileKey4=%AppData%\Opera Software\Opera*\Crashpad|metadata FileKey5=%AppData%\Opera Software\Opera*\Crashpad\reports|* FileKey6=%AppData%\Opera Software\Opera*\Feature Engagement Tracker|*|REMOVESELF FileKey7=%AppData%\Opera Software\Opera*\Network|Media History;Network*;Reporting*;Transport* FileKey8=%AppData%\Opera Software\Opera*\Site Characteristics Database|*|REMOVESELF FileKey9=%AppData%\Opera Software\Opera*\Stability|*|REMOVESELF FileKey10=%AppData%\Opera Software\Opera*\StatsSessions|* FileKey11=%AppData%\Opera Software\Opera*\Storage\ext\*\def|Network Persistent State FileKey12=%AppData%\Opera Software\Opera*\VideoDecodeStats|*|REMOVESELF FileKey13=%LocalAppData%\Opera\CrashReports|* FileKey14=%ProgramFiles%\Opera\CrashReports|* FileKey15=%ProgramFiles%\Opera\Opera*\Application\SetupMetrics|*|REMOVESELF [Opera Update *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*|ssdfp* FileKey2=%LocalAppData%\Programs\Opera*|*.backup;*.old;*.tmp|RECURSE FileKey3=%ProgramData%\Opera\OperaUpdate\Log|* [Opera Web Storage *] LangSecRef=3027 DetectFile=%AppData%\Opera Software\Opera* FileKey1=%AppData%\Opera Software\Opera*\*\Local Storage\leveldb|* FileKey2=%AppData%\Opera Software\Opera*\*\Session Storage|* FileKey3=%AppData%\Opera Software\Opera*\*\Storage\ext\*\def\Session Storage|* FileKey4=%AppData%\Opera Software\Opera*\*\WebStorage|*|RECURSE ; End of Opera ; ; Firefox/Mozilla based browsers [Firefox Autocomplete History *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|formhistory* FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|formhistory* FileKey3=%AppData%\LibreWolf\Profiles\*|formhistory* FileKey4=%AppData%\Moonchild Productions\*\Profiles\*|formhistory* FileKey5=%AppData%\Mozilla\*\Profiles\*|formhistory* FileKey6=%AppData%\Waterfox\Profiles\*|formhistory* FileKey7=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|formhistory* [Firefox Autofill Data *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|autofill-profiles.json FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|autofill-profiles.json FileKey3=%AppData%\LibreWolf\Profiles\*|autofill-profiles.json FileKey4=%AppData%\Moonchild Productions\*\Profiles\*|autofill-profiles.json FileKey5=%AppData%\Mozilla\*\Profiles\*|autofill-profiles.json FileKey6=%AppData%\Waterfox\Profiles\*|autofill-profiles.json FileKey7=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|autofill-profiles.json [Firefox Bookmark Backups *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\bookmarkbackups|* FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*\bookmarkbackups|* FileKey3=%AppData%\LibreWolf\Profiles\*\bookmarkbackups|* FileKey4=%AppData%\Moonchild Productions\*\Profiles\*\bookmarkbackups|* FileKey5=%AppData%\Mozilla\*\Profiles\*\bookmarkbackups|* FileKey6=%AppData%\Waterfox\Profiles\*\bookmarkbackups|* FileKey7=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\bookmarkbackups|* [Firefox Bookmark Favicons *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|favicons* FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|favicons* FileKey3=%AppData%\LibreWolf\Profiles\*|favicons* FileKey4=%AppData%\Moonchild Productions\*\Profiles\*|favicons* FileKey5=%AppData%\Mozilla\*\Profiles\*|favicons* FileKey6=%AppData%\Waterfox\Profiles\*|favicons* FileKey7=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|favicons* [Firefox Caches *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\ComodoGroup\IceDragon Detect3=HKLM\Software\FlashPeak\SlimBrowser Detect4=HKLM\Software\Mozilla\Basilisk Detect5=HKLM\Software\Mozilla\Pale Moon Detect6=HKLM\Software\Mozilla\SeaMonkey Detect7=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|*.corrupt|RECURSE FileKey2=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey3=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\notificationstore|* FileKey4=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\security_state|* FileKey5=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\shader-cache|* FileKey6=%AppData%\ArtistScope\ArtisBrowser\Profiles\*\storage\temporary|*|RECURSE FileKey7=%AppData%\Comodo\IceDragon\Profiles\*|*.corrupt|RECURSE FileKey8=%AppData%\Comodo\IceDragon\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey9=%AppData%\Comodo\IceDragon\Profiles\*\notificationstore|* FileKey10=%AppData%\Comodo\IceDragon\Profiles\*\security_state|* FileKey11=%AppData%\Comodo\IceDragon\Profiles\*\shader-cache|* FileKey12=%AppData%\Comodo\IceDragon\Profiles\*\storage\temporary|*|RECURSE FileKey13=%AppData%\FlashPeak\SlimBrowser\Profiles\*|*.corrupt|RECURSE FileKey14=%AppData%\FlashPeak\SlimBrowser\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey15=%AppData%\FlashPeak\SlimBrowser\Profiles\*\notificationstore|* FileKey16=%AppData%\FlashPeak\SlimBrowser\Profiles\*\security_state|* FileKey17=%AppData%\FlashPeak\SlimBrowser\Profiles\*\shader-cache|* FileKey18=%AppData%\FlashPeak\SlimBrowser\Profiles\*\storage\temporary|*|RECURSE FileKey19=%AppData%\LibreWolf\Profiles\*|*.corrupt|RECURSE FileKey20=%AppData%\LibreWolf\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey21=%AppData%\LibreWolf\Profiles\*\notificationstore|* FileKey22=%AppData%\LibreWolf\Profiles\*\security_state|* FileKey23=%AppData%\LibreWolf\Profiles\*\shader-cache|* FileKey24=%AppData%\LibreWolf\Profiles\*\storage\temporary|*|RECURSE FileKey25=%AppData%\Moonchild Productions\*\Profiles\*|*.corrupt|RECURSE FileKey26=%AppData%\Moonchild Productions\*\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey27=%AppData%\Moonchild Productions\*\Profiles\*\notificationstore|* FileKey28=%AppData%\Moonchild Productions\*\Profiles\*\security_state|* FileKey29=%AppData%\Moonchild Productions\*\Profiles\*\shader-cache|* FileKey30=%AppData%\Moonchild Productions\*\Profiles\*\storage\temporary|*|RECURSE FileKey31=%AppData%\Mozilla\*\Profiles\*|*.corrupt|RECURSE FileKey32=%AppData%\Mozilla\*\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey33=%AppData%\Mozilla\*\Profiles\*\notificationstore|* FileKey34=%AppData%\Mozilla\*\Profiles\*\security_state|* FileKey35=%AppData%\Mozilla\*\Profiles\*\shader-cache|* FileKey36=%AppData%\Mozilla\*\Profiles\*\storage\temporary|*|RECURSE FileKey37=%AppData%\Waterfox\Profiles\*|*.corrupt|RECURSE FileKey38=%AppData%\Waterfox\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey39=%AppData%\Waterfox\Profiles\*\notificationstore|* FileKey40=%AppData%\Waterfox\Profiles\*\security_state|* FileKey41=%AppData%\Waterfox\Profiles\*\shader-cache|* FileKey42=%AppData%\Waterfox\Profiles\*\storage\temporary|*|RECURSE FileKey43=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*\*cache*|*|REMOVESELF FileKey44=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey45=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*\thumbnails|*|REMOVESELF FileKey46=%LocalAppData%\Flashpeak\SlimBrowser\Profiles\*\*cache*|*|REMOVESELF FileKey47=%LocalAppData%\Flashpeak\SlimBrowser\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey48=%LocalAppData%\Flashpeak\SlimBrowser\Profiles\*\thumbnails|*|REMOVESELF FileKey49=%LocalAppData%\LibreWolf\Profiles\*\*cache*|*|REMOVESELF FileKey50=%LocalAppData%\LibreWolf\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey51=%LocalAppData%\LibreWolf\Profiles\*\thumbnails|*|REMOVESELF FileKey52=%LocalAppData%\Moonchild Productions\*\Profiles\*\*cache*|*|REMOVESELF FileKey53=%LocalAppData%\Moonchild Productions\*\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey54=%LocalAppData%\Moonchild Productions\*\Profiles\*\thumbnails|*|REMOVESELF FileKey55=%LocalAppData%\Mozilla\*\Profiles\*\*cache*|*|REMOVESELF FileKey56=%LocalAppData%\Mozilla\*\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey57=%LocalAppData%\Mozilla\*\Profiles\*\thumbnails|*|REMOVESELF FileKey58=%LocalAppData%\Packages\Mozilla.Firefox_*\AC|*|RECURSE FileKey59=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|*.corrupt|RECURSE FileKey60=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;xulstore.json;ClientAuthRememberList.txt FileKey61=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\*cache*|*|RECURSE FileKey62=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\notificationstore|* FileKey63=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\security_state|* FileKey64=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\storage\temporary|*|RECURSE FileKey65=%LocalAppData%\Packages\Mozilla.Firefox_*\Settings|*.log* FileKey66=%LocalAppData%\Packages\Mozilla.Firefox_*\TempState|*|RECURSE FileKey67=%LocalAppData%\Waterfox\Profiles\*\*cache*|*|REMOVESELF FileKey68=%LocalAppData%\Waterfox\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey69=%LocalAppData%\Waterfox\Profiles\*\thumbnails|*|REMOVESELF FileKey70=%LocalAppData%\Waterfox\Profiles\Profiles\*\Safebrowsing-failedupdate|*|REMOVESELF FileKey71=%LocalAppData%\Waterfox\Profiles\Profiles\*\thumbnails|*|REMOVESELF FileKey72=%ProgramData%\Mozilla*|cache2.* FileKey73=%ProgramFiles%\Basilisk|*.tmp|RECURSE FileKey74=%ProgramFiles%\Firefox*|*.tmp|RECURSE FileKey75=%ProgramFiles%\LibreWolf|*.tmp|RECURSE FileKey76=%ProgramFiles%\Mozilla*|*.tmp;*_tmp.exe|RECURSE FileKey77=%ProgramFiles%\Pale Moon|*.tmp|RECURSE FileKey78=%ProgramFiles%\SeaMonkey|*.tmp|RECURSE FileKey79=%ProgramFiles%\SlimBrowser|*.tmp|RECURSE FileKey80=%ProgramFiles%\Waterfox|*.tmp|RECURSE FileKey81=%ProgramFiles%\WindowsApps\Mozilla.Firefox_*\VFS\ProgramFiles\Firefox Package Root|*.tmp;*_tmp.exe|RECURSE FileKey82=%UserProfile%\AppData\LocalLow\Mozilla\Temp-*|*|REMOVESELF [Firefox Content Preferences *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|content-prefs.sqlite FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|content-prefs.sqlite FileKey3=%AppData%\LibreWolf\Profiles\*|content-prefs.sqlite FileKey4=%AppData%\Moonchild Productions\*\Profiles\*|content-prefs.sqlite FileKey5=%AppData%\Mozilla\*\Profiles\*|content-prefs.sqlite FileKey6=%AppData%\Waterfox\Profiles\*|content-prefs.sqlite FileKey7=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|content-prefs.sqlite [Firefox Cookies *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|cookies* FileKey2=%AppData%\FlashPeak\SlimBrowser\Profiles\*|cookies* FileKey3=%AppData%\LibreWolf\Profiles\*|cookies* FileKey4=%AppData%\Moonchild Productions\*\Profiles\*|cookies* FileKey5=%AppData%\Mozilla\*\Profiles\*|cookies* FileKey6=%AppData%\Waterfox\Profiles\*|cookies* FileKey7=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|cookies* [Firefox Federated Credential Management *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\ComodoGroup\IceDragon Detect3=HKLM\Software\FlashPeak\SlimBrowser Detect4=HKLM\Software\Mozilla\Basilisk Detect5=HKLM\Software\Mozilla\Pale Moon Detect6=HKLM\Software\Mozilla\SeaMonkey Detect7=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|credentialstate.sqlite FileKey2=%AppData%\Comodo\IceDragon\Profiles\*|credentialstate.sqlite FileKey3=%AppData%\FlashPeak\SlimBrowser\Profiles\*|credentialstate.sqlite FileKey4=%AppData%\LibreWolf\Profiles\*|credentialstate.sqlite FileKey5=%AppData%\Moonchild Productions\*\Profiles\*|credentialstate.sqlite FileKey6=%AppData%\Mozilla\*\Profiles\*|credentialstate.sqlite FileKey7=%AppData%\Waterfox\Profiles\*|credentialstate.sqlite FileKey8=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|credentialstate.sqlite [Firefox Logs *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\ComodoGroup\IceDragon Detect3=HKLM\Software\FlashPeak\SlimBrowser Detect4=HKLM\Software\Mozilla\Basilisk Detect5=HKLM\Software\Mozilla\Pale Moon Detect6=HKLM\Software\Mozilla\SeaMonkey Detect7=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|*.log|RECURSE FileKey2=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|TestPilotErrorLog.* FileKey3=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\weave\logs|* FileKey4=%AppData%\FlashPeak\SlimBrowser|*.log|RECURSE FileKey5=%AppData%\FlashPeak\SlimBrowser\Profiles\*|TestPilotErrorLog.* FileKey6=%AppData%\FlashPeak\SlimBrowser\Profiles\*\weave\logs|* FileKey7=%AppData%\LibreWolf|*.log|RECURSE FileKey8=%AppData%\LibreWolf\Profiles\*|TestPilotErrorLog.* FileKey9=%AppData%\LibreWolf\Profiles\*\weave\logs|* FileKey10=%AppData%\Moonchild Productions\*|*.log|RECURSE FileKey11=%AppData%\Moonchild Productions\*\Profiles\*|TestPilotErrorLog.* FileKey12=%AppData%\Moonchild Productions\*\Profiles\*\weave\logs|* FileKey13=%AppData%\Mozilla\*|*.log|RECURSE FileKey14=%AppData%\Mozilla\*\Profiles\*|TestPilotErrorLog.* FileKey15=%AppData%\Mozilla\*\Profiles\*\weave\logs|* FileKey16=%AppData%\Waterfox|*.log|RECURSE FileKey17=%AppData%\Waterfox\Profiles\*|TestPilotErrorLog.* FileKey18=%AppData%\Waterfox\Profiles\*\weave\logs|* FileKey19=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox|*.log|RECURSE FileKey20=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|TestPilotErrorLog.* FileKey21=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\weave\logs|* FileKey22=%ProgramData%\Mozilla*|*.log;*.moz_log|RECURSE FileKey23=%ProgramFiles%\Basilisk|*.log FileKey24=%ProgramFiles%\Firefox*|*.log FileKey25=%ProgramFiles%\LibreWolf|*.log FileKey26=%ProgramFiles%\Mozilla Firefox|*.log FileKey27=%ProgramFiles%\Mozilla Maintenance Service\*logs|* FileKey28=%ProgramFiles%\Pale Moon|*.log FileKey29=%ProgramFiles%\SeaMonkey|*.log FileKey30=%ProgramFiles%\SlimBrowser|*.log FileKey31=%ProgramFiles%\Waterfox|*.log FileKey32=%ProgramFiles%\WindowsApps\Mozilla.Firefox_*\VFS\ProgramFiles\Firefox Package Root|*.log [Firefox Saved Logins *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\ComodoGroup\IceDragon Detect3=HKLM\Software\FlashPeak\SlimBrowser Detect4=HKLM\Software\Mozilla\Basilisk Detect5=HKLM\Software\Mozilla\Pale Moon Detect6=HKLM\Software\Mozilla\SeaMonkey Detect7=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|key4.db;logins.json FileKey2=%AppData%\Comodo\IceDragon\Profiles\*|key4.db;logins.json FileKey3=%AppData%\FlashPeak\SlimBrowser\Profiles\*|key4.db;logins.json FileKey4=%AppData%\LibreWolf\Profiles\*|key4.db;logins.json FileKey5=%AppData%\Moonchild Productions\*\Profiles\*|key4.db;logins.json FileKey6=%AppData%\Mozilla\*\Profiles\*|key4.db;logins.json FileKey7=%AppData%\Waterfox\Profiles\*|key4.db;logins.json FileKey8=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|key4.db;logins.json [Firefox Sessions *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|session*.json* FileKey2=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\sessionstore-backups|* FileKey3=%AppData%\FlashPeak\SlimBrowser\Profiles\*|session*.json* FileKey4=%AppData%\FlashPeak\SlimBrowser\Profiles\*\sessionstore-backups|* FileKey5=%AppData%\LibreWolf\Profiles\*|session*.json* FileKey6=%AppData%\LibreWolf\Profiles\*\sessionstore-backups|* FileKey7=%AppData%\Moonchild Productions\*\Profiles\*|session*.json* FileKey8=%AppData%\Moonchild Productions\*\Profiles\*\sessionstore-backups|* FileKey9=%AppData%\Mozilla\*\Profiles\*|session*.json* FileKey10=%AppData%\Mozilla\*\Profiles\*\sessionstore-backups|* FileKey11=%AppData%\Waterfox\Profiles\*|session*.json* FileKey12=%AppData%\Waterfox\Profiles\*\sessionstore-backups|* FileKey13=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|session*.json* FileKey14=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\sessionstore-backups|* [Firefox Telemetry *] LangSecRef=3026 Detect1=HKCU\Software\LibreWolf Detect2=HKLM\Software\ComodoGroup\IceDragon Detect3=HKLM\Software\FlashPeak\SlimBrowser Detect4=HKLM\Software\Mozilla\Basilisk Detect5=HKLM\Software\Mozilla\Pale Moon Detect6=HKLM\Software\Mozilla\SeaMonkey Detect7=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Basilisk-Dev\Basilisk\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey2=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\crashes|* FileKey3=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\datareporting|*|REMOVESELF FileKey4=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\minidumps|* FileKey5=%AppData%\Basilisk-Dev\Basilisk\Profiles\*\saved-telemetry-pings|* FileKey6=%AppData%\FlashPeak\SlimBrowser\Crash Reports|*|RECURSE FileKey7=%AppData%\FlashPeak\SlimBrowser\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey8=%AppData%\FlashPeak\SlimBrowser\Profiles\*\crashes|* FileKey9=%AppData%\FlashPeak\SlimBrowser\Profiles\*\datareporting|*|REMOVESELF FileKey10=%AppData%\FlashPeak\SlimBrowser\Profiles\*\minidumps|* FileKey11=%AppData%\FlashPeak\SlimBrowser\Profiles\*\saved-telemetry-pings|* FileKey12=%AppData%\LibreWolf\Crash Reports|*|RECURSE FileKey13=%AppData%\LibreWolf\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey14=%AppData%\LibreWolf\Profiles\*\crashes|* FileKey15=%AppData%\LibreWolf\Profiles\*\datareporting|*|REMOVESELF FileKey16=%AppData%\LibreWolf\Profiles\*\minidumps|* FileKey17=%AppData%\LibreWolf\Profiles\*\saved-telemetry-pings|* FileKey18=%AppData%\Moonchild Productions\*\Crash Reports|*|RECURSE FileKey19=%AppData%\Moonchild Productions\*\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey20=%AppData%\Moonchild Productions\*\Profiles\*\crashes|* FileKey21=%AppData%\Moonchild Productions\*\Profiles\*\datareporting|*|REMOVESELF FileKey22=%AppData%\Moonchild Productions\*\Profiles\*\minidumps|* FileKey23=%AppData%\Moonchild Productions\*\Profiles\*\saved-telemetry-pings|* FileKey24=%AppData%\Mozilla\*\Crash Reports|*|RECURSE FileKey25=%AppData%\Mozilla\*\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey26=%AppData%\Mozilla\*\Profiles\*\crashes|* FileKey27=%AppData%\Mozilla\*\Profiles\*\datareporting|*|REMOVESELF FileKey28=%AppData%\Mozilla\*\Profiles\*\minidumps|* FileKey29=%AppData%\Mozilla\*\Profiles\*\saved-telemetry-pings|* FileKey30=%AppData%\Talkback\MozillaOrg\Firefox*|*|RECURSE FileKey31=%AppData%\Talkback\MozillaOrg\Thunderbird*|*|RECURSE FileKey32=%AppData%\Waterfox\Crash Reports|*|RECURSE FileKey33=%AppData%\Waterfox\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey34=%AppData%\Waterfox\Profiles\*\crashes|* FileKey35=%AppData%\Waterfox\Profiles\*\datareporting|*|REMOVESELF FileKey36=%AppData%\Waterfox\Profiles\*\minidumps|* FileKey37=%AppData%\Waterfox\Profiles\*\saved-telemetry-pings|* FileKey38=%LocalAppData%\Basilisk-Dev\Basilisk\Profiles\*|ShutdownDuration.* FileKey39=%LocalAppData%\FlashPeak\SlimBrowser\Profiles\*|ShutdownDuration.* FileKey40=%LocalAppData%\LibreWolf\Profiles\*|ShutdownDuration.* FileKey41=%LocalAppData%\Moonchild Productions\*\Profiles\*|ShutdownDuration.* FileKey42=%LocalAppData%\Mozilla\*\Profiles\*|ShutdownDuration.* FileKey43=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Local\Mozilla\Firefox\Profiles\*|ShutdownDuration.* FileKey44=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Crash Reports|*|RECURSE FileKey45=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*|protections.sqlite;storage.sqlite;Telemetry*;times.json;targeting.snapshot.json FileKey46=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\datareporting|*|REMOVESELF FileKey47=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\minidumps|* FileKey48=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\saved-telemetry-pings|* FileKey49=%LocalAppData%\Waterfox\Profiles\*|ShutdownDuration.* FileKey50=%ProgramData%\Mozilla*|profile_count_*.json RegKey1=HKLM\Software\FullCircle\TalkBack [Firefox Updates *] LangSecRef=3026 Detect1=HKLM\Software\ComodoGroup\IceDragon Detect2=HKLM\Software\FlashPeak\SlimBrowser Detect3=HKLM\Software\Mozilla\Basilisk Detect4=HKLM\Software\Mozilla\Pale Moon Detect5=HKLM\Software\Mozilla\SeaMonkey Detect6=HKLM\Software\Mozilla\Waterfox DetectFile1=%AppData%\Mozilla\Firefox DetectFile2=%LocalAppData%\Packages\Mozilla.Firefox_* FileKey1=%AppData%\Waterfox*\Waterfox*\install|*|RECURSE FileKey2=%LocalAppData%\Basilisk-Dev\Basilisk\Basilisk|*|RECURSE FileKey3=%LocalAppData%\Moonchild Productions\Basilisk\Basilisk|*|RECURSE FileKey4=%LocalAppData%\Moonchild Productions\Pale Moon\Pale Moon|*|RECURSE FileKey5=%LocalAppData%\Mozilla\updates|*|RECURSE FileKey6=%LocalAppData%\Packages\Mozilla.Firefox_*\LocalCache\Local\Mozilla\updates|*|RECURSE FileKey7=%LocalAppData%\Waterfox\updates|*.log|RECURSE FileKey8=%ProgramData%\Mozilla*\updates|*|RECURSE FileKey9=%ProgramData%\Mozilla*\updates|to-be-removed*;*ping*.json;updatelock* FileKey10=%ProgramFiles%\Mozilla Firefox\tobedeleted|* FileKey11=%ProgramFiles%\Mozilla Maintenance Service|*.moz-delete FileKey12=%ProgramFiles%\WindowsApps\Mozilla.Firefox_*\VFS\ProgramFiles\Firefox Package Root\tobedeleted|* ExcludeKey1=FILE|%ProgramData%\Mozilla*\updates\*\|update-config.json ; End of Firefox/Mozilla based browsers ; ; Thunderbird [Thunderbird Caches *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|*.corrupt|RECURSE FileKey2=%AppData%\Binary Outcast\Interlink\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;global-messages-db.sqlite FileKey3=%AppData%\Binary Outcast\Interlink\Profiles\*\storage\temporary|*|RECURSE FileKey4=%AppData%\Thunderbird\Profiles\*|*.corrupt|RECURSE FileKey5=%AppData%\Thunderbird\Profiles\*|AlternateServices.txt;notificationstore.json;parent.lock;serviceworker.txt;webappsstore.sqlite;cert9.db;global-messages-db.sqlite;folderCache.json;favicons* FileKey6=%AppData%\Thunderbird\Profiles\*\shader-cache|* FileKey7=%AppData%\Thunderbird\Profiles\*\storage\temporary|*|RECURSE FileKey8=%LocalAppData%\interlink\*|* FileKey9=%LocalAppData%\Interlink\*|*cache*|REMOVESELF FileKey10=%LocalAppData%\Thunderbird\Profiles|*|RECURSE [Thunderbird Cookies *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|cookies* FileKey2=%AppData%\Thunderbird\Profiles\*|cookies* [Thunderbird History *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|history* FileKey2=%AppData%\Thunderbird\Profiles\*|history* [Thunderbird Log Files *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|extensions.log;filterlog.html;TestPilotErrorLog.*|RECURSE FileKey2=%AppData%\Thunderbird\Profiles\*|extensions.log;filterlog.html;TestPilotErrorLog.*|RECURSE FileKey3=%ProgramData%\Mozilla*\logs|*|RECURSE FileKey4=%ProgramFiles%\Interlink|*.log FileKey5=%ProgramFiles%\Mozilla Maintenance Service\*logs|* FileKey6=%ProgramFiles%\Mozilla Thunderbird|*.log [Thunderbird Session *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%AppData%\Binary Outcast\Interlink\Profiles\*|session*.json* FileKey2=%AppData%\Thunderbird\Profiles\*|session*.json* [Thunderbird Telemetry *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%AppData%\Binary Outcast\Interlink\Crash Reports|*|RECURSE FileKey2=%AppData%\Binary Outcast\Interlink\Profiles\*|memory-report.json.gz FileKey3=%AppData%\Binary Outcast\Interlink\Profiles\*\minidumps|* FileKey4=%AppData%\Binary Outcast\Interlink\Profiles\*\saved-telemetry-pings|*|RECURSE FileKey5=%AppData%\Thunderbird\Crash Reports|*|RECURSE FileKey6=%AppData%\Thunderbird\Profiles\*|memory-report.json.gz FileKey7=%AppData%\Thunderbird\Profiles\*\datareporting|*|RECURSE FileKey8=%AppData%\Thunderbird\Profiles\*\minidumps|* FileKey9=%AppData%\Thunderbird\Profiles\*\saved-telemetry-pings|*|RECURSE FileKey10=%ProgramData%\Mozilla*|profile_count_*.json [Thunderbird Updates *] LangSecRef=3030 Detect1=HKLM\Software\Binary Outcast\Interlink Detect2=HKLM\Software\Mozilla\Mozilla Thunderbird FileKey1=%LocalAppData%\Binary Outcast\updates|*|RECURSE FileKey2=%LocalAppData%\Thunderbird\updates|*|RECURSE FileKey3=%ProgramData%\Mozilla*\updates|*|RECURSE FileKey4=%ProgramData%\Mozilla*\updates|to-be-removed*;*ping*.json;updatelock* ExcludeKey1=FILE|%ProgramData%\Mozilla*\updates\*\|update-config.json ; End of Thunderbird ; ; Internet Explorer [Internet Explorer *] LangSecRef=3001 DetectFile1=%AppData%\Microsoft\Internet Explorer\UserData DetectFile2=%LocalAppData%\Packages\windows_ie_ac_001\AC\*Cache FileKey1=%AppData%\Microsoft\Internet Explorer\UserData|*|RECURSE FileKey2=%LocalAppData%\Packages\windows_ie_*\AC\*Cache|*|REMOVESELF FileKey3=%LocalAppData%\Packages\windows_ie_*\AC\IEDownloadHistory|*|REMOVESELF FileKey4=%LocalAppData%\Packages\windows_ie_*\AC\INet*|*|REMOVESELF FileKey5=%LocalAppData%\Packages\windows_ie_*\AC\Microsoft\CryptnetUrlCache\*|* FileKey6=%LocalAppData%\Packages\windows_ie_*\AC\Microsoft\Internet Explorer\DOMStore|*|REMOVESELF FileKey7=%LocalAppData%\Packages\windows_ie_*\AC\Microsoft\Internet Explorer\Emie*List|*|REMOVESELF FileKey8=%LocalAppData%\Packages\windows_ie_*\AC\Temp|*|REMOVESELF FileKey9=%LocalAppData%\Packages\windows_ie_*\LocalState\Cache|*|REMOVESELF FileKey10=%LocalAppData%\Packages\windows_ie_*\LocalState\navigationHistory|*|REMOVESELF FileKey11=%LocalAppData%\Packages\windows_ie_*\Settings|*.log* FileKey12=%LocalAppData%\Packages\windows_ie_*\TempState|*|REMOVESELF FileKey13=%SystemDrive%\Documents and Settings\LocalService*\Cookies|*|RECURSE FileKey14=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\History|*|RECURSE FileKey15=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temporary Internet Files|*|RECURSE FileKey16=%SystemDrive%\Documents and Settings\NetworkService*\Cookies|*|RECURSE FileKey17=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\History|*|RECURSE FileKey18=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temporary Internet Files|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage RegKey2=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU RegKey3=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU RegKey4=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs ; End of Internet Explorer [.NET Framework *] LangSecRef=3025 Detect1=HKLM\Software\CBSTEST Detect2=HKLM\Software\Microsoft\.NETFramework FileKey1=%LocalAppData%\ApplicationHistory|*|RECURSE FileKey2=%LocalAppData%\IsolatedStorage|*|RECURSE FileKey3=%LocalAppData%\Microsoft\CLR_v*|*|RECURSE FileKey4=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0*|*|RECURSE FileKey5=%SystemDrive%\BVTBin\Tests\installpackage|csilogfile.log FileKey6=%SystemDrive%\BVTBin\Tests\installpackage\cbstest\*|CBSTest-*.wtl;CBSTestWDS.log FileKey7=%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data|*FontCache*.dat FileKey8=%WinDir%\assembly\NativeImages_*\Temp|*|RECURSE FileKey9=%WinDir%\assembly\t*mp|*|REMOVESELF FileKey10=%WinDir%\Microsoft.NET\Framework*\*|*.log FileKey11=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*|RECURSE FileKey12=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*|RECURSE FileKey13=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*|RECURSE FileKey14=%WinDir%\ServiceProfiles\LocalService\AppData\Local|*FontCache*.dat FileKey15=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v*|*|RECURSE FileKey16=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Microsoft\CLR_v*|*.*|RECURSE FileKey17=%WinDir%\System32\URTTemp|*|RECURSE FileKey18=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v*|*|RECURSE FileKey19=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\Microsoft\CLR_v*|*|RECURSE RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps RegKey2=HKLM\Software\CBSTEST|CBSTestWDSLogFile RegKey3=HKLM\Software\CBSTEST|CBSTestWTTLogFile [.NET Reflector *] LangSecRef=3021 DetectFile=%LocalAppData%\Red Gate\.NET Reflector 6 FileKey1=%LocalAppData%\Red Gate\.NET Reflector 6|Reflector.cfg FileKey2=%LocalAppData%\Red Gate\.NET Reflector 6\Cache|*.*|RECURSE [.Thumbnails *] LangSecRef=3021 DetectFile=%UserProfile%\.Thumbnails FileKey1=%UserProfile%\.Thumbnails|*.*|RECURSE [//N.P.P.D. RUSH// - The Milk of Ultra Violet *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\270090 FileKey1=%LocalAppData%\NPPDRUSH|Web Data*|RECURSE FileKey2=%LocalAppData%\NPPDRUSH\*Cache|*.*|RECURSE [1Click DVD Copy Pro *] LangSecRef=3023 DetectFile=%ProgramData%\1click dvd copy pro FileKey1=%ProgramData%\1click dvd copy pro|*.log [2K Launcher *] Section=Games DetectFile=%LocalAppData%\2K\LaunchPad FileKey1=%LocalAppData%\2K\LaunchPad\Cache\QtWebEngine\Default\Cache|*.* FileKey2=%LocalAppData%\2K\LaunchPad\QtWebEngine\Default|Visited Links FileKey3=%LocalAppData%\2K\LaunchPad\QtWebEngine\Default\*Cache|*.* [3 Stars of Destiny *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\278530 FileKey1=%AppData%\3Stars|*.tmp [3delite Filesystem Dialogs Library *] LangSecRef=3024 Detect=HKCU\Software\3delite\Filesystem Dialogs RegKey1=HKCU\Software\3delite\Filesystem Dialogs\Last config folder|Folder [3DMark *] Section=Games DetectFile=%UserProfile%\Documents\3DMark FileKey1=%ProgramFiles%\Steam\SteamApps\common\3DMark|*.log|RECURSE FileKey2=%UserProfile%\Documents\3DMark|*.log FileKey3=%UserProfile%\Documents\3DMark\Log|*.*|REMOVESELF [3SwitcheD *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\206610 FileKey1=%LocalAppData%\3SwitcheD\cache|*.*|RECURSE [4K Video Downloader *] LangSecRef=3023 Detect=HKCU\Software\4kdownload.com\4K Video Downloader FileKey1=%LocalAppData%\4kdownload.com\4K Video Downloader\4K Video Downloader|*.bak;*.log;*.sqlite;*.xml FileKey2=%LocalAppData%\4kdownload.com\4K Video Downloader\crashdb|*.*|RECURSE FileKey3=%LocalAppData%\4kdownload.com\4K Video Downloader\QtWebEngine\Default|*.*|RECURSE FileKey4=%ProgramFiles%\4KDownload\4KVideoDownloader|*.rtf;*.txt RegKey1=HKCU\Software\4kdownload.com\4K Video Downloader\Download|downloadedItems RegKey2=HKCU\Software\4kdownload.com\4K Video Downloader\Download|downloadedItemsDb RegKey3=HKCU\Software\4kdownload.com\4K Video Downloader\FileWatcher RegKey4=HKCU\Software\4kdownload.com\4K Video Downloader\Gamification RegKey5=HKCU\Software\4kdownload.com\4K Video Downloader\Settings|outputPath [4K YouTube to MP3 *] LangSecRef=3023 Detect=HKCU\Software\4kdownload.com\4K YouTube to MP3 FileKey1=%LocalAppData%\4kdownload.com\4K YouTube to MP3\4K YouTube to MP3|*.xml RegKey1=HKCU\Software\4kdownload.com\4K YouTube to MP3\Download|downloadedItems RegKey2=HKCU\Software\4kdownload.com\4K YouTube to MP3\Settings|outputPath [4shared Desktop *] LangSecRef=3022 DetectFile=%AppData%\4shared desktop FileKey1=%AppData%\4shared desktop|*.log FileKey2=%AppData%\4shared desktop\*|dhistory.xml [4t Tray Minimizer *] LangSecRef=3024 DetectFile=%AppData%\4t Niagara Software\4t Tray Minimizer FileKey1=%AppData%\4t Niagara Software\4t Tray Minimizer|*.log [4Team Sync2 *] LangSecRef=3022 DetectFile=%AppData%\4Team\Sync2 FileKey1=%AppData%\4Team\Sync2|*.log|RECURSE [4Team Updater *] LangSecRef=3022 DetectFile=%AppData%\4Team\4Team-Updater FileKey1=%AppData%\4Team\4Team-Updater\Logs|*.* [7-Zip *] LangSecRef=3024 Detect=HKU\.DEFAULT\Software\7-Zip RegKey1=HKU\.DEFAULT\Software\7-Zip\Compression|ArcHistory RegKey2=HKU\.DEFAULT\Software\7-Zip\Compression\ArcHistory RegKey3=HKU\.DEFAULT\Software\7-Zip\Extraction|PathHistory RegKey4=HKU\.DEFAULT\Software\7-Zip\Extraction\PathHistory RegKey5=HKU\.DEFAULT\Software\7-Zip\FM|CopyHistory RegKey6=HKU\.DEFAULT\Software\7-Zip\FM|FolderHistory RegKey7=HKU\.DEFAULT\Software\7-Zip\FM|PanelPath0 [7-Zip ZS *] LangSecRef=3024 Detect=HKCU\Software\7-Zip-Zstandard RegKey1=HKCU\Software\7-Zip-Zstandard\Compression|ArcHistory RegKey2=HKCU\Software\7-Zip-Zstandard\Extraction|PathHistory RegKey3=HKCU\Software\7-Zip-Zstandard\FM|CopyHistory RegKey4=HKCU\Software\7-Zip-Zstandard\FM|FolderHistory RegKey5=HKCU\Software\7-Zip-Zstandard\FM|PanelPath0 RegKey6=HKCU\Software\7-Zip-Zstandard\FM|PanelPath1 [7+ Taskbar Tweaker *] LangSecRef=3024 Detect=HKCU\Software\7 Taskbar Tweaker RegKey1=HKCU\Software\7 Taskbar Tweaker|MementoSectionUsed [7z SFX Builder *] LangSecRef=3024 Detect=HKCU\Software\7z SFX Builder RegKey1=HKCU\Software\7z SFX Builder\MRU [10 Years After *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\339240 FileKey1=%ProgramFiles%\Steam\SteamApps\common\10 Years After\10 Years After_Data|output_log.txt [18 Wheels of Steel *] Section=Games Detect=HKCU\Software\ValuSoft FileKey1=%UserProfile%\Documents\18 WoS*|*.log;*.crash [32bit Web Browser *] LangSecRef=3022 DetectFile=%ProgramFiles%\32BITWEB FileKey1=%ProgramFiles%\32BITWEB\Data|LastURL.da* FileKey2=%SystemDrive%\32bw\data|LastURL.da* [140 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\242820 FileKey1=%ProgramFiles%\Steam\SteamApps\common\140\140_Data|output_log.txt [360 Internet Security *] LangSecRef=3024 Detect=HKCU\Software\360Safe FileKey1=%AppData%\360DesktopLite\DTFence|*.bk FileKey2=%AppData%\360Safe\360ScanLog|*.* FileKey3=%AppData%\360Safe\Clean\OKClean|*.log FileKey4=%ProgramFiles%\360\360 Internet Security|*.log*|RECURSE FileKey5=%SystemDrive%\360SANDBOX|*.log*|RECURSE [1000 Amps *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\205690 FileKey1=%ProgramFiles%\Steam\SteamApps\common\1000 Amps|stdout.txt [1954 Alcatraz *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\255280 FileKey1=%ProgramFiles%\Steam\SteamApps\common\1954 Alcatraz\Alcatraz_Data|output_log.txt FileKey2=%UserProfile%\AppData\LocalLow\Daedalic Entertainment\1954 Alcatraz|*.log [A-PDF PDF Content Splitter *] LangSecRef=3021 Detect=HKCU\Software\A-PDF\PDFContentSplitter RegKey1=HKCU\Software\A-PDF\PDFContentSplitter\Setting|hloadpdfpath RegKey2=HKCU\Software\A-PDF\PDFContentSplitter\Setting|hSaveallpdfpath RegKey3=HKCU\Software\A-PDF\PDFContentSplitter\Setting|LastRulename [A-PDF Watermark *] LangSecRef=3021 Detect=HKCU\Software\A-PDF\Watermark RegKey1=HKCU\Software\A-PDF\Watermark\Setting|hdIndir RegKey2=HKCU\Software\A-PDF\Watermark\Setting|hdoutDir RegKey3=HKCU\Software\A-PDF\Watermark\Setting|hloadpdfpath RegKey4=HKCU\Software\A-PDF\Watermark\Setting|hSaveallpdfpath RegKey5=HKCU\Software\A-PDF\Watermark\Setting|ptlastprinter [A Hat in Time *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\253230 FileKey1=%ProgramFiles%\Steam\steamapps\common\HatinTime\HatinTimeGame\Logs|*.* [A Space Adventure - Remastered Edition *] Section=Games DetectFile=%LocalAppData%\Simon Says Play\ASA Remastered FileKey1=%LocalAppData%\Simon Says Play\ASA Remastered|*.log [ABBYY FineReader *] LangSecRef=3021 Detect1=HKCU\Software\ABBYY\FineReader Detect2=HKCU\Software\ABBYY\FineReaderSprint Detect3=HKCU\Software\ABBYY\Sprint\5.00 FileKey1=%LocalAppData%\ABBYY\FineReader\*|datafile.bin;SendToWorkFiles.txt FileKey2=%LocalAppData%\ABBYY\FineReader\*\*\Dumps|* FileKey3=%LocalAppData%\ABBYY\FineReader\*\Dumps|* FileKey4=%LocalAppData%\ABBYY\FineReader\*\FineReaderShell|SendToWorkFiles.txt FileKey5=%LocalAppData%\ABBYY\ScanManager\*|scantwain.txt;scanwia.txt;*.bmp FileKey6=%ProgramData%\ABBYY\FineReader*\*\Licenses|*.log FileKey7=%ProgramData%\ABBYY\FineReader\*\*\Dumps|* FileKey8=%ProgramData%\ABBYY\FineReader\*\Dumps|* FileKey9=%ProgramData%\ABBYY\FineReader\*\PdfToolsCache|FontsCache*.dat FileKey10=%ProgramFiles%\ABBYY FineReader*|*.cnt;*.log FileKey11=%ProgramFiles%\ABBYY FineReader*\Resource\Cmap|*.lst FileKey12=%ProgramFiles%\ABBYY FineReader*\Resource\Font|*.lst FileKey13=%SystemDrive%\Temp\FR*|*|REMOVESELF RegKey1=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|LoadImagePath RegKey2=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|OpenBatchPath RegKey3=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|SaveImagePath RegKey4=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|SaveToPath RegKey5=HKCU\Software\ABBYY\FineReader\7.00\Shell\Dialogs|StandardBatchOptionsPath RegKey6=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastBatchPath RegKey7=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastFormatsPage RegKey8=HKCU\Software\ABBYY\FineReader\7.00\Shell\Options|LastOptionsPage RegKey9=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|ExportTAPath RegKey10=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|ImportTAPath RegKey11=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|LoadImagePath RegKey12=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|SaveImagePath RegKey13=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|SaveToPath RegKey14=HKCU\Software\ABBYY\FineReader\8.00\Shell\Dialogs|StandardBatchOptionsPath RegKey15=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastBatchPath RegKey16=HKCU\Software\ABBYY\FineReader\8.00\Shell\Options|LastTAScenario RegKey17=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|ExportTAPath RegKey18=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|ImportTAPath RegKey19=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|LoadImagePath RegKey20=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|SaveImagePath RegKey21=HKCU\Software\ABBYY\FineReader\9.00\Shell\Dialogs|SaveToPath RegKey22=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastBatchPath RegKey23=HKCU\Software\ABBYY\FineReader\9.00\Shell\Options|LastTAScenario RegKey24=HKCU\Software\ABBYY\FineReader\11.00\Shell\Dialogs|SaveToPath RegKey25=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastTAScenario RegKey26=HKCU\Software\ABBYY\FineReader\11.00\Shell\Options|LastWebFoldersNames RegKey27=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|BatchDialogsMRU RegKey28=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|LoadImagePath RegKey29=HKCU\Software\ABBYY\FineReader\12.00\Shell\Dialogs|SaveImagePath RegKey30=HKCU\Software\ABBYY\FineReader\12.00\Shell\MainFrame\RecentFileList RegKey31=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader|LaunchCount RegKey32=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LanguagesMRU RegKey33=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LastSaveImagePath RegKey34=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|LastUseTime RegKey35=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|SaveTablePath RegKey36=HKCU\Software\ABBYY\FineReader\14.00\Bonus.ScreenshotReader\Options|SaveTextPath RegKey37=HKCU\Software\ABBYY\FineReader\14.00\Comparator\RateUs|RunCount RegKey38=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell|LaunchCount RegKey39=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|ExportTAPath RegKey40=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|ImportTAPath RegKey41=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath RegKey42=HKCU\Software\ABBYY\FineReader\14.00\FineReaderShell\Shell\Options|LastWebFoldersNames RegKey43=HKCU\Software\ABBYY\FineReader\14.00\FineUI\Dialogs\FROpenFileDialog|LastFolder RegKey44=HKCU\Software\ABBYY\FineReader\14.00\FineUpdate|LaunchCount RegKey45=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer|LaunchCount RegKey46=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\PDFEngine\EraseExtraData|LastDeleteNeedlessExtraData RegKey47=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Frame|ImportDataFolder RegKey48=HKCU\Software\ABBYY\FineReader\14.00\PDFTransformer\Shell\Statistics|LastUsedBuyMessages RegKey49=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentBatchList RegKey50=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentCompareList RegKey51=HKCU\Software\ABBYY\FineReader\14.00\Shell\RecentPdfList RegKey52=HKCU\Software\ABBYY\FineReader\14.00\StatisticSender|LastSendStatisticsEvent RegKey53=HKCU\Software\ABBYY\FineReader\14.00\StatisticSender|LaunchCount RegKey54=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader|LaunchCount RegKey55=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LanguagesMRU RegKey56=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastRecognitionLanguage RegKey57=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|LastSaveImagePath RegKey58=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|SaveTablePath RegKey59=HKCU\Software\ABBYY\FineReader\15\Bonus.ScreenshotReader\Options|SaveTextPath RegKey60=HKCU\Software\ABBYY\FineReader\15\Comparator\RateUs|RunCount RegKey61=HKCU\Software\ABBYY\FineReader\15\Comparator\Shell\Options|MRURecognitionLanguages RegKey62=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|ExportTAPath RegKey63=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|ImportTAPath RegKey64=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|SaveToWebFolderPath RegKey65=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Dialogs|WebFolderPath RegKey66=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Options|LastTAScenario RegKey67=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Shell\Options|LastWebFoldersNames RegKey68=HKCU\Software\ABBYY\FineReader\15\FineReaderShell\Tips|LastGetSocialTips RegKey69=HKCU\Software\ABBYY\FineReader\15\FineUI\Dialogs\FROpenFileDialog|LastFolder RegKey70=HKCU\Software\ABBYY\FineReader\15\PDFTransformer|LaunchCount RegKey71=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\PDFEngine\EraseExtraData|LastDeleteNeedlessExtraData RegKey72=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Frame|ImportDataFolder RegKey73=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Frame|Last signature RegKey74=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Signature|SignatureCertificateLocation RegKey75=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Signature|SignatureImagePath RegKey76=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Shell\Statistics|LastUsedBuyMessages RegKey77=HKCU\Software\ABBYY\FineReader\15\PDFTransformer\Tips|LastGetSocialTips RegKey78=HKCU\Software\ABBYY\FineReader\15\Shell\RecentBatchList RegKey79=HKCU\Software\ABBYY\FineReader\15\Shell\RecentCompareList RegKey80=HKCU\Software\ABBYY\FineReader\15\Shell\RecentPdfList RegKey81=HKCU\Software\ABBYY\Sprint\5.00\Options|ExportToFilePath RegKey82=HKCU\Software\ABBYY\Sprint\5.00\Options|OpenImagePath RegKey83=HKCU\Software\ABBYY\Sprint\5.00\Options|SaveImagePath [ABBYY Lingvo *] LangSecRef=3021 Detect=HKCU\Software\ABBYY\Lingvo\15.0 DetectFile=%ProgramFiles%\ABBYY Lingvo x5 FileKey1=%ProgramData%\ABBYY\Lingvo\*\Licenses|*.log FileKey2=%ProgramFiles%\ABBYY Lingvo x5|*.log;*.rtf RegKey1=HKCU\Software\ABBYY\Lingvo\15.0\Dictionaries\FavoriteDirections RegKey2=HKCU\Software\ABBYY\Lingvo\15.0\View|LastText RegKey3=HKCU\Software\ABBYY\Lingvo\15.0\X3M|LastActivity [ABBYY PDFTransformer *] LangSecRef=3021 Detect=HKCU\Software\ABBYY\PDFTransformer FileKey1=%LocalAppData%\ABBYY\PDFTransformer\*|*.log FileKey2=%LocalAppData%\ABBYY\PDFTransformer\*\FontCache|* FileKey3=%ProgramData%\ABBYY\PDFTransformer\*\Licenses|*.log FileKey4=%ProgramFiles%\ABBYY PDF Transformer *.0|*.log FileKey5=%SystemDrive%\Temp\PDFT*|*|REMOVESELF RegKey1=HKCU\Software\ABBYY\PDFTransformer\3.00\Transform|MRURecognitionLanguages RegKey2=HKCU\Software\ABBYY\PDFTransformer\3.00\Transform|TransformOpenPath RegKey3=HKCU\Software\ABBYY\PDFTransformer\12.00\Shell\Statistics [ABBYY ScreenshotReader *] LangSecRef=3021 Detect1=HKCU\Software\ABBYY\Bonus.ScreenshotReader Detect2=HKCU\Software\ABBYY\Retail.ScreenshotReader Detect3=HKCU\Software\ABBYY\ScreenshotReader DetectFile=%ProgramFiles%\ABBYY Screenshot Reader FileKey1=%ProgramData%\ABBYY\*.ScreenshotReader\*|*.xml FileKey2=%ProgramData%\ABBYY\*.ScreenshotReader\*\Licenses|*.log FileKey3=%ProgramFiles%\ABBYY Screenshot Reader|*.log;*.rtf RegKey1=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|LastSaveImagePath RegKey2=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|SaveTablePath RegKey3=HKCU\Software\ABBYY\Bonus.ScreenshotReader\9.00\Options|SaveTextPath RegKey4=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Advertising RegKey5=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|LastSaveImagePath RegKey6=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|SaveTablePath RegKey7=HKCU\Software\ABBYY\Retail.ScreenshotReader\9.00\Options|SaveTextPath RegKey8=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|LastSaveImagePath RegKey9=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|SaveTablePath RegKey10=HKCU\Software\ABBYY\ScreenshotReader\9.00\Options|SaveTextPath [Abelssoft AntiBrowserSpy *] LangSecRef=3024 DetectFile=%LocalAppData%\Abelssoft\AntiBrowserSpy FileKey1=%LocalAppData%\Abelssoft\AntiBrowserSpy|*.log [Abelssoft GClean *] LangSecRef=3024 DetectFile=%LocalAppData%\Abelssoft\G*Clean FileKey1=%LocalAppData%\Abelssoft\GClean|*.log FileKey2=%LocalAppData%\Abelssoft\GoogleClean\log|*|REMOVESELF [Abelssoft JetDrive *] LangSecRef=3024 DetectFile=%ProgramFiles%\JetDrive FileKey1=%LocalAppData%\Abelssoft\JetDrive|JetDrive.reports.xml FileKey2=%ProgramFiles%\JetDrive|JetDrive.log [Abelssoft PCFresh Backups *] LangSecRef=3024 DetectFile=%LocalAppData%\Abelssoft\PCFresh FileKey1=%LocalAppData%\Abelssoft\PCFresh\Backup|*.* [Abelssoft SSD Fresh Backups *] LangSecRef=3024 DetectFile=%LocalAppData%\Abelssoft\SSD Fresh FileKey1=%LocalAppData%\Abelssoft\SSD Fresh|backup.* [Abelssoft StartupStar *] LangSecRef=3024 DetectFile=%LocalAppData%\Abelssoft\StartupStar FileKey1=%AppData%\AbelsSoft\StartupStar|*.log FileKey2=%LocalAppData%\Abelssoft\StartupStar|backup.xml [Abelssoft WashAndGo *] LangSecRef=3024 DetectFile=%LocalAppData%\Abelssoft\WashAndGo FileKey1=%AppData%\Abelssoft\WashAndGo\Log|*.log FileKey2=%LocalAppData%\Abelssoft\WashAndGo\Backups|*.* FileKey3=%UserProfile%\Documents\Abelssoft\WashAndGo\Backups|*.* [abgx360 *] LangSecRef=3024 Detect=HKCU\Software\abgx360gui RegKey1=HKCU\Software\abgx360gui\RecentFiles [Ability Office *] LangSecRef=3021 Detect=HKCU\Software\Ability 6.0 FileKey1=%UserProfile%\Documents\My Ability Files|*.*|RECURSE RegKey1=HKCU\Software\Ability 6.0\Ability Database\Recent File List RegKey2=HKCU\Software\Ability 6.0\Ability PhotoPaint Studio\Recent File List RegKey3=HKCU\Software\Ability 6.0\Ability PhotoPaint\Recent File List RegKey4=HKCU\Software\Ability 6.0\Ability Spreadsheet\Recent File List RegKey5=HKCU\Software\Ability 6.0\Ability Write\Files [Ableton Live *] LangSecRef=3023 Detect=HKLM\Software\Propellerhead Software\ReWire\Ableton Live Engine FileKey1=%AppData%\Ableton\*\Preferences|*.log;*Log.txt;Indexer.txt|RECURSE FileKey2=%AppData%\Ableton\Cache|*|RECURSE FileKey3=%AppData%\Ableton\Live Reports|Ableton Crash Report*.zip FileKey4=%AppData%\Ableton\Live Reports\Ableton Crash Report*|*|REMOVESELF FileKey5=%AppData%\Ableton\Live Reports\Temp|*|REMOVESELF FileKey6=%AppData%\Ableton\Live Reports\Usage|*|REMOVESELF FileKey7=%AppData%\Ableton\Live*\Preferences\Crash|*|RECURSE FileKey8=%LocalAppData%\Ableton\Cache\cache\decoding|*.* FileKey9=%ProgramData%\Ableton\*\Redist|vc*redist*.exe FileKey10=%ProgramFiles%\Ableton\*\Redist|vc*redist*.exe [AbsoluteFTP *] LangSecRef=3022 Detect=HKCU\Software\Van Dyke Technologies\AbsoluteFTP RegKey1=HKCU\Software\Van Dyke Technologies\AbsoluteFTP\Recent File List [Abvent Artlantis *] LangSecRef=3021 DetectFile1=%AppData%\Abvent\Artlantis* DetectFile2=%AppData%\Abvent_Artlantis* FileKey1=%AppData%\Abvent\Artlantis*|*Log.txt FileKey2=%AppData%\Abvent\Artlantis*\*_DiagnosticReports_*|*.*|REMOVESELF FileKey3=%AppData%\Abvent_Artlantis*|*Log.txt FileKey4=%AppData%\Abvent_Artlantis*\*_DiagnosticReports_*|*.*|REMOVESELF [Abylon Protection Manager *] LangSecRef=3024 DetectFile=%ProgramFiles%\AbylonSoft\SALogon FileKey1=%ProgramFiles%\AbylonSoft\SALogon\LOGS|*.* [Abyssmedia Quick Batch File Compiler *] LangSecRef=3024 Detect1=HKCU\Software\Abyssmedia\Quick Batch File Compiler Detect2=HKCU\Software\qbfc RegKey1=HKCU\Software\Abyssmedia\Quick Batch File Compiler\Settings|savedir RegKey2=HKCU\Software\qbfc\RecentFiles [Abyssmedia ScriptCryptor Compiler *] LangSecRef=3024 Detect=HKCU\Software\Abyssmedia\ScriptCryptor RegKey1=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mrucount RegKey2=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem0 RegKey3=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem1 RegKey4=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem2 RegKey5=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem3 RegKey6=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|mruitem4 RegKey7=HKCU\Software\Abyssmedia\ScriptCryptor\Settings|savedir [AC74 *] LangSecRef=3021 Detect=HKCU\Software\AC74\View64 RegKey1=HKCU\Software\AC74\View64|MRU1 RegKey2=HKCU\Software\AC74\View64|MRU2 RegKey3=HKCU\Software\AC74\View64|MRU3 RegKey4=HKCU\Software\AC74\View64|MRU4 RegKey5=HKCU\Software\AC74\View64|MRU5 RegKey6=HKCU\Software\AC74\View64|MRU6 RegKey7=HKCU\Software\AC74\View64|MRU7 RegKey8=HKCU\Software\AC74\View64|MRU8 [AccessData Registry Viewer *] LangSecRef=3024 Detect=HKCU\Software\AccessData\Registry Viewer RegKey1=HKCU\Software\AccessData\Registry Viewer\Recent File List [AccurateRip *] LangSecRef=3023 DetectFile=%AppData%\AccurateRip FileKey1=%AppData%\AccurateRip\AccurateRipCache|dBAR*.bin [ACDSee Photo Studio *] LangSecRef=3023 Detect1=HKCU\Software\ACD Systems\ACDSee Pro\90 Detect2=HKCU\Software\ACD Systems\ACDSee Professional Detect3=HKCU\Software\ACD Systems\ACDSee Standard Detect4=HKCU\Software\ACD Systems\ACDSee Ultimate Detect5=HKCU\Software\ACD Systems\ACDSee\60 FileKey1=%LocalAppData%\ACD Systems\GeoTag\Cache|*.*|RECURSE FileKey2=%LocalAppData%\ACD Systems\ICMCache|*.*|RECURSE FileKey3=%LocalAppData%\ACD Systems\Logs|*.*|RECURSE FileKey4=%LocalAppData%\ACD Systems\SavedSearches|*.*|RECURSE RegKey1=HKCU\Software\ACD Systems\ACDSee Pro\90|HistMCFDestFolder RegKey2=HKCU\Software\ACD Systems\ACDSee Pro\90|HistPaths RegKey3=HKCU\Software\ACD Systems\ACDSee Pro\90|LastOptionPageName RegKey4=HKCU\Software\ACD Systems\ACDSee Pro\90|OpenFolder RegKey5=HKCU\Software\ACD Systems\ACDSee Pro\90\PrintOptions\OutputContactSheet|ContactSheetFN RegKey6=HKCU\Software\ACD Systems\ACDSee Pro\90\PrintOptions\OutputContactSheet|ImageMapFN RegKey7=HKCU\Software\ACD Systems\ACDSee Professional\110|HistMCFDestFolder RegKey8=HKCU\Software\ACD Systems\ACDSee Professional\110|HistPaths RegKey9=HKCU\Software\ACD Systems\ACDSee Professional\110|LastOptionPageName RegKey10=HKCU\Software\ACD Systems\ACDSee Professional\110|OnlineHistPaths RegKey11=HKCU\Software\ACD Systems\ACDSee Professional\110|OpenFolder RegKey12=HKCU\Software\ACD Systems\ACDSee Professional\120|HistMCFDestFolder RegKey13=HKCU\Software\ACD Systems\ACDSee Professional\120|HistPaths RegKey14=HKCU\Software\ACD Systems\ACDSee Professional\120|LastOptionPageName RegKey15=HKCU\Software\ACD Systems\ACDSee Professional\120|OnlineHistPaths RegKey16=HKCU\Software\ACD Systems\ACDSee Professional\120|OpenFolder RegKey17=HKCU\Software\ACD Systems\ACDSee Standard\210|HistMCFDestFolder RegKey18=HKCU\Software\ACD Systems\ACDSee Standard\210|HistPaths RegKey19=HKCU\Software\ACD Systems\ACDSee Standard\210|LastOptionPageName RegKey20=HKCU\Software\ACD Systems\ACDSee Standard\210|OnlineHistPaths RegKey21=HKCU\Software\ACD Systems\ACDSee Standard\210|OpenFolder RegKey22=HKCU\Software\ACD Systems\ACDSee Standard\220|HistMCFDestFolder RegKey23=HKCU\Software\ACD Systems\ACDSee Standard\220|HistPaths RegKey24=HKCU\Software\ACD Systems\ACDSee Standard\220|LastOptionPageName RegKey25=HKCU\Software\ACD Systems\ACDSee Standard\220|OnlineHistPaths RegKey26=HKCU\Software\ACD Systems\ACDSee Standard\220|OpenFolder RegKey27=HKCU\Software\ACD Systems\ACDSee Ultimate\110|HistMCFDestFolder RegKey28=HKCU\Software\ACD Systems\ACDSee Ultimate\110|HistPaths RegKey29=HKCU\Software\ACD Systems\ACDSee Ultimate\110|LastOptionPageName RegKey30=HKCU\Software\ACD Systems\ACDSee Ultimate\110|OnlineHistPaths RegKey31=HKCU\Software\ACD Systems\ACDSee Ultimate\110|OpenFolder RegKey32=HKCU\Software\ACD Systems\ACDSee Ultimate\120|HistMCFDestFolder RegKey33=HKCU\Software\ACD Systems\ACDSee Ultimate\120|HistPaths RegKey34=HKCU\Software\ACD Systems\ACDSee Ultimate\120|LastOptionPageName RegKey35=HKCU\Software\ACD Systems\ACDSee Ultimate\120|OnlineHistPaths RegKey36=HKCU\Software\ACD Systems\ACDSee Ultimate\120|OpenFolder RegKey37=HKCU\Software\ACD Systems\ACDSee\60|HistMCFDestFolder RegKey38=HKCU\Software\ACD Systems\ACDSee\60|HistPaths RegKey39=HKCU\Software\ACD Systems\ACDSee\60|LastOptionPageName RegKey40=HKCU\Software\ACD Systems\ACDSee\60|OpenFolder RegKey41=HKCU\Software\ACD Systems\ACDSee\60\PrintOptions\OutputContactSheet|ContactSheetFN RegKey42=HKCU\Software\ACD Systems\ACDSee\60\PrintOptions\OutputContactSheet|ImageMapFN RegKey43=HKCU\Software\ACD Systems\EditLib\Presets\Photo Repair 2|Last Used [Ace of Spades *] Section=Games DetectFile=%ProgramFiles%\Steam\steamapps\common\aceofspades FileKey1=%ProgramFiles%\Steam\steamapps\common\aceofspades\logs|*.* [Ace Stream *] LangSecRef=3023 DetectFile=%AppData%\ACEStream FileKey1=%AppData%\.ACEStream|*.ini FileKey2=%AppData%\.ACEStream\collected_torrent_files|*.* FileKey3=%AppData%\ACEStream\engine|*.log FileKey4=%AppData%\ACEStream\player\plugins|plugins.dat FileKey5=%AppData%\ACEStream\updater|*.log FileKey6=%SystemDrive%\_acestream_cache_|*.*|REMOVESELF FileKey7=%UserProfile%\AppData\LocalLow\.ACEStream|*.log [Ace Utilities *] LangSecRef=3024 Detect=HKCU\Software\Acelogix\Ace Utilities FileKey1=%LocalAppData%\Acelogix\Ace Utilities\Backups|*.reg RegKey1=HKCU\Software\Acelogix\Ace Utilities\Settings|UsageHistory [Acebyte Utilities *] LangSecRef=3024 Detect=HKCU\Software\AceBIT FileKey1=%ProgramData%\Acebyte\Acebyte Utilities*\Log|*|RECURSE [Acer Arcade Deluxe *] Section=Games DetectFile=%LocalAppData%\Acer Arcade Deluxe FileKey1=%LocalAppData%\Acer Arcade Deluxe|*.log FileKey2=%ProgramData%|ArcadeDexluxe2.log [Acer Care Center *] LangSecRef=3024 Detect1=HKLM\Software\OEM\AcerCareCenter Detect2=HKLM\Software\OEM\CareCenter FileKey1=%ProgramData%\Acer\CareCenter\DebugLog\SurfaceCheck|log*.txt FileKey2=%ProgramFiles%\Acer\Care Center\DebugLog|*.log [Acer Clear.fi *] LangSecRef=3021 DetectFile=%LocalAppData%\Acer\Clear.fi FileKey1=%LocalAppData%\Acer\Clear.fi\log|*.log FileKey2=%LocalAppData%\AOP SDK\acer infra\acer\log|*.log FileKey3=%LocalAppData%\AOP SDK\acer infra\acer\SyncAgent\logs|*.*|RECURSE FileKey4=%LocalAppData%\Clear.fi\AcerCloud\SyncAgent\logs|*.*|RECURSE FileKey5=%LocalAppData%\Clear.fi\log|*.*|RECURSE [Acer eSupport *] LangSecRef=3024 DetectFile=%SystemDrive%\eSupport\eDriver FileKey1=%SystemDrive%\eSupport\eDriver\Software|*.log;URLLog.dat|RECURSE [Acer GameZone *] Section=Games DetectFile=%ProgramFiles%\Acer GameZone FileKey1=%ProgramFiles%\Acer GameZone|*.log|RECURSE [Acoustica CD Label Maker *] LangSecRef=3024 Detect=HKCU\Software\Acoustica\CD Label Maker FileKey1=%AppData%\Acoustica\CD Label Maker\*\cache|*.*|RECURSE FileKey2=%AppData%\Acoustica\CD Label Maker\cache|*.*|RECURSE FileKey3=%AppData%\Acoustica\CD Label Maker\shapes|*.* FileKey4=%ProgramFiles%\Acoustica CD Label Maker\thumbs|*.*|RECURSE [Acoustica Premium Edition 6 *] LangSecRef=3023 Detect=HKCU\Software\Acon Digital\Acoustica Premium Edition 6 RegKey1=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\General|BrowserFolder RegKey2=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\General|LastAudioDir RegKey3=HKCU\Software\Acon Digital\Acoustica Premium Edition 6\Recent File List [Acrok Video Converter Ultimate *] LangSecRef=3023 Detect=HKCU\Software\Acrok Software\Acrok Video Converter Ultimate FileKey1=%AppData%\Acrok Software\Blu-ray Plugin\Log|*.log FileKey2=%AppData%\Acrok\Acrok Video Converter Ultimate|*.dmp FileKey3=%AppData%\Acrok\Acrok Video Converter Ultimate\log|*.* FileKey4=%AppData%\Auxre\Blu-ray Plugin|*.log FileKey5=%UserProfile%\.BDAccess|*.*|RECURSE [Active@ Disk Image *] LangSecRef=3024 Detect=HKLM\Software\LSoft Technologies\Active Disk Image FileKey1=%ProgramFiles%\LSoft Technologies\Active@ Disk Image|*.txt FileKey2=%ProgramFiles%\LSoft Technologies\Active@ Disk Image\Logs|*.*|RECURSE [Active@ File Recovery *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C34F36E0-4D8B-42E8-90AD-50C76E1AE282}_is1 FileKey1=%ProgramFiles%\LSoft Technologies\Active@ File Recovery*|*Log.txt;*.scn;*.xml [Active@ KillDisk *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0F62EFB8-3C1C-4EE6-B6EF-9593007F9B03}_is1 FileKey1=%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|*.log;*.xml [Actual Window Guard *] LangSecRef=3024 Detect=HKCU\Software\Actual Tools\Actual Window Guard FileKey1=%AppData%\Actual Tools\Actual Window Guard|*.log RegKey1=HKCU\Software\Actual Tools\Actual Window Guard|LastNagScreenDate [Acustica Aquarius *] LangSecRef=3023 DetectFile=%AppData%\Acustica\Aquarius FileKey1=%AppData%\Acustica\Aquarius\Resources\Temp|*.* FileKey2=%AppData%\Acustica\Stagearea\AquariusTemp|*.* [Ad-Aware Antivirus *] LangSecRef=3021 DetectFile=%ProgramFiles%\Ad-Aware Antivirus FileKey1=%AppData%\Ad-Aware Antivirus\Logs|*|RECURSE FileKey2=%ProgramData%\Ad-Aware Antivirus\Logs|*|RECURSE FileKey3=%ProgramData%\Lavasoft\AntiMalware\Events|*|RECURSE FileKey4=%ProgramData%\Lavasoft\AntiMalware\History|*|RECURSE FileKey5=%ProgramData%\Lavasoft\AntiMalware\Logs|*|RECURSE [Adaptec's Audio CD *] LangSecRef=3024 Detect=HKCU\Software\Adaptec RegKey1=HKCU\Software\Adaptec\AUDIO_CD_INFO [Adaware *] LangSecRef=3024 DetectFile=%LocalAppData%\Adaware* FileKey1=%LocalAppData%\Adaware*\QtWebEngine\Default|Visited Links [Adaware Web Companion *] LangSecRef=3021 DetectFile=%AppData%\Lavasoft\Web Companion FileKey1=%AppData%\Lavasoft\Web Companion|*log.txt FileKey2=%ProgramData%\Lavasoft\Web Companion\Logs|*|RECURSE FileKey3=%ProgramData%\Lavasoft\Web Companion\Options|Statistics.txt [Add-in Express *] LangSecRef=3021 DetectFile1=%AppData%\Add-in Express DetectFile2=%UserProfile%\Documents\Add-in Express FileKey1=%AppData%\Add-in Express|*.log|RECURSE FileKey2=%UserProfile%\Documents\Add-in Express|*.log|RECURSE [AdFender *] LangSecRef=3022 DetectFile=%LocalAppData%\AdFender FileKey1=%LocalAppData%\AdFender\Log|*.log [Adobe *] LangSecRef=3023 Detect=HKCU\Software\Adobe FileKey1=%AppData%\Adobe|*.log|RECURSE FileKey2=%AppData%\Adobe\Acrobat\Distiller*|*.log FileKey3=%AppData%\Adobe\Common\* Cache*|*|RECURSE FileKey4=%AppData%\Adobe\Common\Peak Files|*|RECURSE FileKey5=%AppData%\Adobe\CRLogs|*|RECURSE FileKey6=%AppData%\Adobe\LogTransport2\Logs|*|RECURSE FileKey7=%CommonProgramFiles%\Adobe\Creative Cloud Libraries|*.log|RECURSE FileKey8=%CommonProgramFiles%\Adobe\Installers|*.log*|RECURSE FileKey9=%LocalAppData%\Adobe|*.Log|RECURSE FileKey10=%LocalAppData%\Adobe\ARM|*.*|RECURSE FileKey11=%ProgramData%\Adobe\ARM|*|RECURSE FileKey12=%ProgramFiles%\Adobe\Adobe Creative Cloud Experience\js\node_modules\table-parser\test\output|*.log FileKey13=%UserProfile%\Documents\Adobe|*.log|RECURSE RegKey1=HKCU\Software\Adobe\Adobe ARM\1.0\ARM|tLastT_Reader RegKey2=HKCU\Software\Adobe\Adobe Customization Wizard 8\Recent File List RegKey3=HKCU\Software\Adobe\Adobe Customization Wizard 9\Recent File List RegKey4=HKCU\Software\Adobe\Adobe Customization Wizard X\Recent File List RegKey5=HKCU\Software\Adobe\Adobe Customization Wizard XI\Recent File List [Adobe Acrobat Distiller *] LangSecRef=3021 Detect1=HKCU\Software\Adobe\Acrobat Distiller Detect2=HKCU\Software\Adobe\Adobe Acrobat FileKey1=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*|RECURSE FileKey2=%AppData%\Adobe\Acrobat\Distiller*\Cache|* FileKey3=%AppData%\Adobe\OOBE|dlcanalytics.db FileKey4=%LocalAppData%|oobelibMkey.log FileKey5=%LocalAppData%\Adobe\Acrobat|*.idx|RECURSE FileKey6=%LocalAppData%\Adobe\Acrobat\*DC\Cache|*.lst FileKey7=%LocalAppData%\Adobe\Acrobat\11.0|UserCache.bin FileKey8=%LocalAppData%\Adobe\Acrobat\DC|*.lst;Exchange-ProMessages;IconCacheAcro*.dat;SharedDataEvents;UserCache*.bin FileKey9=%LocalAppData%\Adobe\Acrobat\DC\ProtectedView|*.lst;UserCache*.bin FileKey10=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*|RECURSE FileKey11=%LocalAppData%\Adobe\Acrobat\Distiller*\Cache|* FileKey12=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE FileKey13=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cookie|* FileKey14=%LocalAppData%\Adobe\Color|*.lst FileKey15=%LocalAppData%\Adobe\TypeSupport|*.lst FileKey16=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC|*-journal;Exchange-ProMessages FileKey17=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB|notificationsDB FileKey18=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync|*.db-shm;*.db-wal FileKey19=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\CreativeCloud\CoreSync|*.log FileKey20=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Synchronizer|*-log.txt FileKey21=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons|*|RECURSE FileKey22=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Search|*|RECURSE FileKey23=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE FileKey24=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie|*-journal RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl RegKey2=HKCU\Software\Adobe\Adobe Acrobat\11.0\AVGeneral\cRecentFolders RegKey3=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFiles RegKey4=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFolders RegKey5=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFiles RegKey6=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFolders RegKey7=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFiles RegKey8=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFolders RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConnector\cIconCache RegKey10=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings RegKey11=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings RegKey12=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|iNumAcrobatLaunches RegKey13=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|iNumOfAVDocsOpened RegKey14=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|uLastAppLaunchTimeStamp RegKey15=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables RegKey16=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles RegKey17=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders RegKey18=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList RegKey19=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars RegKey20=HKCU\Software\Adobe\Adobe Acrobat\DC\CompoundDocs\cStoredBinder RegKey21=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles RegKey22=HKCU\Software\Adobe\Adobe Acrobat\DC\SessionManagement|uLastAppExitTimeStamp RegKey23=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity RegKey24=HKCU\Software\Adobe\Adobe Synchronizer\DC [Adobe Acrobat Reader *] LangSecRef=3021 Detect1=HKCU\Software\Adobe\Acrobat Reader Detect2=HKCU\Software\Adobe\Backup\Preferences\brr1\Software\Adobe\Acrobat Reader Detect3=HKCU\Software\Adobe\Backup\Preferences\brr2\Software\Adobe\Acrobat Reader Detect4=HKLM\Software\Adobe\Acrobat Reader DetectFile=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_* FileKey1=%AppData%\Adobe\Acrobat\*.0|*.lst;UserCache.bin FileKey2=%AppData%\Adobe\Acrobat\6.0\AcroForm|MRUFormsList FileKey3=%AppData%\Adobe\Acrobat\6.0\Collab|OfflineDocs;Reviews FileKey4=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*|RECURSE FileKey5=%CommonProgramFiles%\Adobe\Color|*.lst FileKey6=%CommonProgramFiles%\Adobe\TypeSpt|*.lst FileKey7=%LocalAppData%\Adobe\Acrobat\*.0\Cache|*.lst FileKey8=%LocalAppData%\Adobe\Acrobat\DC|DCAPIDiscoveryCacheReader;IconCacheRdr*.dat;UserCache*.bin;SharedDataEvents FileKey9=%LocalAppData%\Adobe\Acrobat\DC\eurekareviewdocumentsrdr|*|RECURSE FileKey10=%LocalAppData%\Adobe\Acrobat\DC\thumbcache\reader\files|* FileKey11=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheRdr|*|RECURSE FileKey12=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE FileKey13=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cookie|* FileKey14=%LocalAppData%\Adobe\Color|*.lst FileKey15=%LocalAppData%\Adobe\TypeSpt|*.lst FileKey16=%LocalAppData%\Adobe\TypeSupport|*.lst FileKey17=%LocalAppData%\Packages\AdobeSystemsIncorporated.AdobeReader_*\AC|*|RECURSE FileKey18=%ProgramFiles%\Adobe\Reader 9.0\Reader\plug_ins3d\prc|*.lst FileKey19=%ProgramFiles%\Adobe\Reader 9.0\Resource\Font|*.lst FileKey20=%SystemDrive%\Documents and Settings\Default User\Local Settings\Application Data\Adobe|*.log|RECURSE FileKey21=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC|ReaderMessages FileKey22=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons|*|RECURSE FileKey23=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB|notificationsDB FileKey24=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync|*.db-shm;*.db-wal FileKey25=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync|*.log FileKey26=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer|*log.txt FileKey27=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\syncuploaddir|*.pdf FileKey28=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE FileKey29=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie|*-journal RegKey1=HKCU\Software\Adobe\Acrobat Reader\7.0\Collab\cWorkflowFolders RegKey2=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionFromPDF RegKey3=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionToPDF RegKey4=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cDockables RegKey5=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFolders RegKey6=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cToolbars RegKey7=HKCU\Software\Adobe\Acrobat Reader\11.0\RememberedViews\cNoCategoryFiles RegKey8=HKCU\Software\Adobe\Acrobat Reader\2015\AVGeneral\cRecentFiles RegKey9=HKCU\Software\Adobe\Acrobat Reader\2015\AVGeneral\cRecentFolders RegKey10=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFiles RegKey11=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFolders RegKey12=HKCU\Software\Adobe\Acrobat Reader\2020\AVGeneral\cRecentFiles RegKey13=HKCU\Software\Adobe\Acrobat Reader\2020\AVGeneral\cRecentFolders RegKey14=HKCU\Software\Adobe\Acrobat Reader\DC\AVConnector\cIconCache RegKey15=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionFromPDF RegKey16=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionToPDF RegKey17=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral|iNumOfAVDocsOpened RegKey18=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral|iNumReaderLaunches RegKey19=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cDockables RegKey20=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentToolsList RegKey21=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cToolbars RegKey22=HKCU\Software\Adobe\Acrobat Reader\DC\RememberedViews\cNoCategoryFiles RegKey23=HKCU\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent RegKey24=HKCU\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsPrev RegKey25=HKCU\Software\Adobe\Acrobat Reader\DC\ShareIdentity RegKey26=HKCU\Software\Adobe\Adobe Synchronizer\11.0 RegKey27=HKCU\Software\Adobe\Adobe Synchronizer\DC RegKey28=HKCU\Software\Adobe\Backup\Preferences\brr1\Software\Adobe\Acrobat Reader\8.0\AVGeneral\cRecentFiles RegKey29=HKCU\Software\Adobe\Backup\Preferences\brr2\Software\Adobe\Acrobat Reader\8.0\AVGeneral\cRecentFiles RegKey30=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AdobeSystemsIncorporated.AdobeReader_ynb6jyjzte8ga\PersistedStorageItemTable\MostRecentlyUsed [Adobe Air *] LangSecRef=3024 DetectFile=%LocalAppData%\Adobe\Air FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\Adobe\AIR\logs|*.* FileKey2=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Adobe\AIR\logs|*.* [Adobe Bridge *] LangSecRef=3023 DetectFile=%AppData%\Adobe\Bridge* FileKey1=%AppData%\Adobe\Bridge*|*Log.txt FileKey2=%AppData%\Adobe\Bridge*\Cache\*|*.jpg|RECURSE [Adobe CC *] LangSecRef=3023 Detect1=HKCU\Software\Adobe\CreativeCloud Detect2=HKCU\Software\Adobe\Photoshop FileKey1=%AppData%\Adobe\Adobe Media Encoder\*\logs|*|RECURSE FileKey2=%AppData%\Adobe\Adobe Photoshop*\Adobe Photoshop*Settings|PSErrorLog.txt;sniffer-*.txt FileKey3=%AppData%\Adobe\Adobe Photoshop*\Adobe Photoshop*Settings\CrashLogs|*|RECURSE FileKey4=%AppData%\Adobe\Adobe Photoshop*\Adobe Photoshop*Settings\web-cache-temp|*|RECURSE FileKey5=%AppData%\Adobe\Adobe Photoshop*\CT Font Cache|*.lst FileKey6=%AppData%\Adobe\Adobe Photoshop*\FontFeatureCache|*|RECURSE FileKey7=%AppData%\Adobe\Adobe Photoshop*\Logs|*|RECURSE FileKey8=%AppData%\Adobe\CameraRaw\Logs|* FileKey9=%AppData%\Adobe\Color|*.lst FileKey10=%AppData%\Adobe\dynamiclinkmanager\*\logs|*|RECURSE FileKey11=%AppData%\Adobe\Extension Manager CC\Log|*|RECURSE FileKey12=%AppData%\Adobe\Extension Manager CC\Temp|*|RECURSE FileKey13=%AppData%\Adobe\LogTransport2CC\Logs|*|RECURSE FileKey14=%AppData%\Adobe\Lumetri\*\logs|*|RECURSE FileKey15=%AppData%\Adobe\Premiere Pro\*\logs|*|RECURSE FileKey16=%LocalAppData%\Adobe\CameraRaw\Cache*|* FileKey17=%UserProfile%\Documents\Adobe\Adobe Media Encoder\*|*Log.txt;Recent Directories FileKey18=%UserProfile%\Documents\Adobe\Adobe Media Encoder\*\logs|*|RECURSE FileKey19=%UserProfile%\Documents\Adobe\Premiere Pro\*|Plugin Loading.log RegKey1=HKCU\Software\Adobe\MediaBrowser\MRU [Adobe Elements Organizer *] LangSecRef=3023 Detect=HKCU\Software\Adobe\Elements Organizer FileKey1=%AppData%\Adobe\Elements Organizer\*\Organizer|*.txt;status.dat FileKey2=%ProgramData%|StreamingMediaTechnologyLog.txt FileKey3=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog|*.thumb.*.cache FileKey4=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog\FaceAnalysis|FaceAnalysis.cache FileKey5=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog\WaldoData|waldo.cache FileKey6=%ProgramData%\Adobe\Elements Organizer\Catalogs\My Catalog\Watch Folder|*.txt;*.xml RegKey1=HKCU\Software\Adobe\Elements Organizer\11.0\CurrentMediaFilePath RegKey2=HKCU\Software\Adobe\Elements Organizer\13.0\CurrentMediaFilePath RegKey3=HKCU\Software\Adobe\Elements Organizer\14.0\CurrentMediaFilePath RegKey4=HKCU\Software\Adobe\Elements Organizer\15.0\CurrentMediaFilePath RegKey5=HKCU\Software\Adobe\Elements Organizer\16.0\CurrentMediaFilePath RegKey6=HKCU\Software\Adobe\Elements Organizer\17.0\CurrentMediaFilePath [Adobe Flash Player *] LangSecRef=3023 Detect=HKCU\Software\Macromedia\FlashPlayer DetectFile=%AppData%\Adobe\Flash Player FileKey1=%AppData%\Adobe\Flash Player\*Cache|*|RECURSE FileKey2=%WinDir%\System32\Macromed\Flash|*Install*.log FileKey3=%WinDir%\System32\Macromed\Temp|* FileKey4=%WinDir%\SysWOW64\Macromed\Flash|*Install*.log FileKey5=%WinDir%\SysWOW64\Macromed\Temp|* [Adobe Photoshop Elements *] LangSecRef=3023 Detect=HKCU\Software\Adobe\Photoshop Elements FileKey1=%AppData%\Adobe\Photoshop Elements\*\Editor|*.txt FileKey2=%ProgramData%\Adobe\Photoshop Elements\File Agent|WatchFolder.3.cache RegKey1=HKCU\Software\Adobe\Photoshop Elements\11.0\common\settings\Elements MRU RegKey2=HKCU\Software\Adobe\Photoshop Elements\11.0\CurrentMediaFilePath RegKey3=HKCU\Software\Adobe\Photoshop Elements\11.0\VisitedDirs|STARTUPIMAGEDIRECTORY RegKey4=HKCU\Software\Adobe\Photoshop Elements\13.0\common\settings\Elements MRU RegKey5=HKCU\Software\Adobe\Photoshop Elements\13.0\CurrentMediaFilePath RegKey6=HKCU\Software\Adobe\Photoshop Elements\13.0\VisitedDirs|STARTUPIMAGEDIRECTORY RegKey7=HKCU\Software\Adobe\Photoshop Elements\14.0\common\settings\Elements MRU RegKey8=HKCU\Software\Adobe\Photoshop Elements\14.0\CurrentMediaFilePath RegKey9=HKCU\Software\Adobe\Photoshop Elements\14.0\VisitedDirs|STARTUPIMAGEDIRECTORY RegKey10=HKCU\Software\Adobe\Photoshop Elements\15.0\common\settings\Elements MRU RegKey11=HKCU\Software\Adobe\Photoshop Elements\15.0\CurrentMediaFilePath RegKey12=HKCU\Software\Adobe\Photoshop Elements\15.0\VisitedDirs|STARTUPIMAGEDIRECTORY RegKey13=HKCU\Software\Adobe\Photoshop Elements\16.0\common\settings\Elements MRU RegKey14=HKCU\Software\Adobe\Photoshop Elements\16.0\CurrentMediaFilePath RegKey15=HKCU\Software\Adobe\Photoshop Elements\16.0\VisitedDirs|STARTUPIMAGEDIRECTORY RegKey16=HKCU\Software\Adobe\Photoshop Elements\17.0\common\settings\Elements MRU RegKey17=HKCU\Software\Adobe\Photoshop Elements\17.0\CurrentMediaFilePath RegKey18=HKCU\Software\Adobe\Photoshop Elements\17.0\VisitedDirs|STARTUPIMAGEDIRECTORY [Adobe Premiere Elements *] LangSecRef=3023 Detect=HKCU\Software\Adobe\Premiere Elements FileKey1=%AppData%\Adobe\Common\Thumbnail Cache|thumbnailDB FileKey2=%AppData%\Adobe\Premiere Elements\*\logs|*.*|RECURSE FileKey3=%UserProfile%\Documents\NewBlueFX\Logs|*.txt RegKey1=HKCU\Software\Adobe\Premiere Elements\11.0\MRUDocuments RegKey2=HKCU\Software\Adobe\Premiere Elements\13.0\MRUDocuments RegKey3=HKCU\Software\Adobe\Premiere Elements\14.0\MRUDocuments RegKey4=HKCU\Software\Adobe\Premiere Elements\15.0\MRUDocuments RegKey5=HKCU\Software\Adobe\Premiere Elements\16.0\MRUDocuments RegKey6=HKCU\Software\Adobe\Premiere Elements\17.0\MRUDocuments [Advanced CSV Converter *] LangSecRef=3024 Detect=HKCU\Software\csvconverter RegKey1=HKCU\Software\csvconverter|EXPORTPATH RegKey2=HKCU\Software\csvconverter|LASTEXPORT RegKey3=HKCU\Software\csvconverter|LASTSRC RegKey4=HKCU\Software\csvconverter|SRCPATH [Advanced Grapher *] LangSecRef=3023 Detect=HKCU\Software\Advanced Grapher RegKey1=HKCU\Software\Advanced Grapher\RecentFiles RegKey2=HKU\.DEFAULT\Software\Advanced Grapher\RecentFiles [Advanced IP Scanner *] LangSecRef=3024 Detect1=HKCU\Software\famatech\Advanced IP Scanner Detect2=HKCU\Software\famatech\advanced_ip_scanner DetectFile=%ProgramFiles%\Advanced IP Scanner* FileKey1=%ProgramFiles%\Advanced IP Scanner*|*.cnt;*.GID;*.msi FileKey2=%UserProfile%|advanced_ip_scanner_*.bin RegKey1=HKCU\Software\famatech\Advanced IP Scanner\LastLoadedListName RegKey2=HKCU\Software\famatech\advanced_ip_scanner\State|IpRangesMruList RegKey3=HKCU\Software\famatech\advanced_ip_scanner\State|LastRangeUsed RegKey4=HKCU\Software\famatech\advanced_ip_scanner\State|SearchMruList RegKey5=HKLM\Software\famatech\advanced_ip_scanner|locale_timestamp [Advanced Port Scanner *] LangSecRef=3024 Detect1=HKCU\Software\famatech\Advanced Port Scanner Detect2=HKCU\Software\famatech\advanced_port_scanner FileKey1=%ProgramFiles%\Advanced Port Scanner|*.cnt;*.GID;*.msi FileKey2=%UserProfile%|advanced_port_scanner_*.bin RegKey1=HKCU\Software\famatech\Advanced Port Scanner\LastUsedIPsListPath RegKey2=HKCU\Software\famatech\Advanced Port Scanner\LastUsedPortsListPath RegKey3=HKCU\Software\famatech\advanced_port_scanner\State|details_save_path RegKey4=HKCU\Software\famatech\advanced_port_scanner\State|IpRangesMruList RegKey5=HKCU\Software\famatech\advanced_port_scanner\State|LastPortsUsed RegKey6=HKCU\Software\famatech\advanced_port_scanner\State|LastRangeUsed RegKey7=HKCU\Software\famatech\advanced_port_scanner\State|PortsMruList RegKey8=HKCU\Software\famatech\advanced_port_scanner\State|SearchMruList RegKey9=HKLM\Software\famatech\advanced_port_scanner|locale_timestamp [Advanced Registry Doctor *] LangSecRef=3024 Detect=HKLM\Software\Elcor Software\Advanced Registry Doctor DetectFile=%ProgramFiles%\Advanced Registry Doctor FileKey1=%ProgramFiles%\Advanced Registry Doctor|*.log;*.tmp FileKey2=%ProgramFiles%\Advanced Registry Doctor\Undo|history_*.dat [Advanced Renamer 3 *] LangSecRef=3024 DetectFile=%AppData%\Hulubulu\Advanced Renamer 3 FileKey1=%AppData%\Hulubulu\Advanced Renamer 3\Data\UndoLists|*.* [Advanced Uninstaller *] LangSecRef=3024 Detect1=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\9 Detect2=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\10 RegKey1=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\9\compress|listHistoryText RegKey2=HKCU\Software\Innovative Solutions\Advanced Uninstaller PRO\10\compress|listHistoryText [Advanced XLS Converter *] LangSecRef=3024 Detect=HKCU\Software\xlsconverter RegKey1=HKCU\Software\xlsconverter|EXPORTPATH RegKey2=HKCU\Software\xlsconverter|LASTEXPORT RegKey3=HKCU\Software\xlsconverter|LASTSRC RegKey4=HKCU\Software\xlsconverter|OPT RegKey5=HKCU\Software\xlsconverter|RECENTS RegKey6=HKCU\Software\xlsconverter|SRCPATH [Adware-Removal-Tool *] LangSecRef=3024 DetectFile=%ProgramFiles%\Adware-Removal-Tool FileKey1=%ProgramFiles%\Adware-Removal-Tool\Quarantine|*.*|RECURSE FileKey2=%ProgramFiles%\Adware-Removal-Tool\Reports|*.txt FileKey3=%ProgramFiles%\Adware-Removal-Tool\scanlogs|*.txt [AdwCleaner *] LangSecRef=3024 Detect=HKLM\Software\AdwCleaner DetectFile=%SystemDrive%\AdwCleaner FileKey1=%SystemDrive%|AdwCleaner*.txt FileKey2=%SystemDrive%\AdwCleaner|*.txt|RECURSE FileKey3=%SystemDrive%\AdwCleaner\Logs|*.* RegKey1=HKLM\Software\AdwCleaner|DeleteCount RegKey2=HKLM\Software\AdwCleaner|SearchCount RegKey3=HKLM\Software\Wow6432Node\AdwCleaner|DeleteCount RegKey4=HKLM\Software\Wow6432Node\AdwCleaner|SearchCount [Aegisub *] LangSecRef=3023 Detect=HKLM\Software\Aegisub FileKey1=%AppData%\Aegisub|mru.json FileKey2=%AppData%\Aegisub\crashdumps|*.*|REMOVESELF FileKey3=%AppData%\Aegisub\log|*.*|REMOVESELF FileKey4=%AppData%\Aegisub\recovered|*.*|REMOVESELF FileKey5=%LocalAppData%\Aegisub\ffms2cache|*.*|REMOVESELF FileKey6=%ProgramFiles%\Aegisub|*.txt [Aegisub Backups *] LangSecRef=3023 Detect=HKLM\Software\Aegisub FileKey1=%AppData%\Aegisub\autoback|*.*|REMOVESELF FileKey2=%AppData%\Aegisub\autosave|*.*|REMOVESELF [Aero Glass *] LangSecRef=3021 DetectFile=%SystemDrive%\AeroGlass FileKey1=%SystemDrive%\AeroGlass|*.dmp;debug.log [Affinity Designer *] LangSecRef=3023 DetectFile=%AppData%\Affinity\Designer FileKey1=%AppData%\Affinity\Designer\*|Log.txt FileKey2=%AppData%\Affinity\Designer\*\CrashReports|*.*|RECURSE [Age of Conan *] Section=Games Detect=HKLM\Software\Funcom\Age of Conan FileKey1=%ProgramFiles%\Funcom\Age of Conan|*.log;MiniDump.dmp;CrashLog.txt;*.tmp FileKey2=%ProgramFiles%\Funcom\Age of Conan\OldLogs|* [Age of Empires *] Section=Games Detect1=HKCU\Software\Valve\Steam\Apps\105430 Detect2=HKLM\Software\Microsoft\Games\Age of Empires Detect3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Detect4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires 3 FileKey1=%ProgramFiles%\Microsoft Games\Age of Mythology|*log.txt FileKey2=%ProgramFiles%\Steam\steamapps\common\Age Of Empires Online|PatchLog*.txt FileKey3=%UserProfile%\Documents\My Games\Age of Empires 3|*.txt FileKey4=%UserProfile%\Documents\My Games\Age of Empires 3\RM|*.dmp.txt FileKey5=%UserProfile%\Documents\My Games\Age of Mythology|*.txt RegKey1=HKLM\Software\Microsoft\Games\Age of Empires\1.00|Zone RegKey2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires|Zone RegKey3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Expansion\1.0|Zone RegKey4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires II: The Conquerors Expansion\1.0|Zone RegKey5=HKLM\Software\Microsoft\Microsoft Games\Age of Empires\2.0|Zone [Age of Oracles: Tara's Journey *] Section=Games DetectFile=%ProgramData%\JollyBear\Age of Oracles Taras Journey FileKey1=%ProgramData%\JollyBear\Age of Oracles Taras Journey|error.* [Age of Wonders II *] Section=Games DetectFile=%ProgramFiles%\Age of Wonders II FileKey1=%ProgramFiles%\Age of Wonders II\Resource\FX\Spell|*.lnk FileKey2=%ProgramFiles%\Age of Wonders Shadow Magic\Resource\Maps|*.bak FileKey3=%ProgramFiles%\Age of Wonders*|*Log.txt [Agomo *] LangSecRef=3024 DetectFile=%ProgramData%\Piriform\Agomo FileKey1=%ProgramData%\Piriform\Agomo\Logs|* FileKey2=%ProgramFiles%\Agomo\Logs|* FileKey3=%ProgramFiles%\Agomo\tmp_update|* [AHA Dialer *] LangSecRef=3022 Detect=HKLM\System\CurrentControlSet\Services\HWDeviceService.exe DetectFile=%ProgramData%\DatacardService FileKey1=%ProgramData%\DatacardService\log|* [AhnLab V3 Lite *] LangSecRef=3024 DetectFile=%UserProfile%\AppData\LocalLow\AhnLab\V3Lite FileKey1=%UserProfile%\AppData\LocalLow\AhnLab\V3Lite|*.log [AI Roboform *] LangSecRef=3022 Detect=HKCU\Software\Siber Systems FileKey1=%AppData%\RoboForm\_*mirrors_|*.*|RECURSE FileKey2=%UserProfile%\Documents\My RoboForm Data|mru.rfo;cache.rfo|RECURSE FileKey3=%UserProfile%\Documents\My RoboForm Data\_gsdata_|*.log;*.gss;*.gsl|RECURSE RegKey1=HKCU\Software\Siber Systems|_InstallerDir RegKey2=HKCU\Software\Siber Systems\RoboForm\Query-MRU [AIDA64 *] LangSecRef=3021 Detect=HKCU\Software\FinalWire\AIDA64 FileKey1=%UserProfile%\Documents\AIDA64 Reports|*.*|REMOVESELF [Aignes Website-Watcher *] LangSecRef=3023 Detect=HKCU\Software\aignes\wswatch FileKey1=%AppData%\aignes\WebSite-Watcher\config\favicons|*.* FileKey2=%AppData%\aignes\website-watcher\config\log|*.* FileKey3=%AppData%\aignes\WebSite-Watcher\config\settings|*.cfg_bak* FileKey4=%AppData%\aignes\website-watcher\config\temp|*.* [Aignes Website-Watcher AutoBackups *] LangSecRef=3023 Detect=HKCU\Software\aignes\wswatch FileKey1=%AppData%\aignes\website-watcher\config\autobackup|*.* [Aignes Website-Watcher Bookmarks *] LangSecRef=3023 Detect=HKCU\Software\aignes\wswatch FileKey1=%AppData%\aignes\website-watcher\bookmarks|*.* [Aimersoft *] LangSecRef=3023 Detect=HKLM\Software\Aimersoft FileKey1=%ProgramData%\Aimersoft\*\*Logs|*|RECURSE FileKey2=%Public%\Documents\Aimersoft|*|REMOVESELF [Aimersoft DRM Media Converter *] LangSecRef=3023 Detect=HKLM\Software\Aimersoft\351 FileKey1=%ProgramFiles%\Aimersoft\DRM Media Converter\Log|*.*|REMOVESELF [Aimersoft Video Converter *] LangSecRef=3023 Detect1=HKLM\Software\Aimersoft\Aimersoft Video Converter Detect2=HKLM\Software\Aimersoft\Aimersoft Video Converter Ultimate FileKey1=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact|ProductUpdateLists.xml;ASHelper*.exe_temp FileKey2=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\DATADICT|*.*|RECURSE FileKey3=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\Log|*.*|RECURSE FileKey4=%CommonProgramFiles%\Aimersoft\Aimersoft Helper Compact\Temp|*.*|RECURSE FileKey5=%ProgramFiles%\Aimersoft\Video Converter*\TempThumbDir|*.*|RECURSE FileKey6=%UserProfile%\Documents\Aimersoft MediaServer\log|*.*|RECURSE [Aimersoft Video Editor *] LangSecRef=3023 Detect=HKLM\Software\Aimersoft\Aimersoft Video Editor FileKey1=%ProgramFiles%\Aimersoft\Video Editor\log|*.*|RECURSE [AIMP *] LangSecRef=3023 DetectFile=%AppData%\AIMP* FileKey1=%AppData%\AIMP*|*.bak FileKey2=%ProgramFiles%\AIMP*\!Backup|*.*|REMOVESELF FileKey3=%ProgramFiles%\AIMP*\Data|*.bak|RECURSE [AirBuccaneers *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\223630 FileKey1=%ProgramFiles%\Steam\Steamapps\common\AirBuccaneers\abu_data|output_log.txt FileKey2=%ProgramFiles%\Steam\Steamapps\common\AirBuccaneers\logs|*.* [AirDC++ *] LangSecRef=3022 DetectFile=%ProgramFiles%\AirDC++ FileKey1=%AppData%\AirDC++|Recents.xml FileKey2=%AppData%\AirDC++\FileLists|*.* FileKey3=%AppData%\AirDC++\Logs|*.* FileKey4=%LocalAppData%\AirDC++|Recents.xml FileKey5=%LocalAppData%\AirDC++\FileLists|*.* FileKey6=%LocalAppData%\AirDC++\Logs|*.* FileKey7=%ProgramFiles%\AirDC++\Logs|*.* FileKey8=%ProgramFiles%\AirDC++\Settings|Recents.xml FileKey9=%ProgramFiles%\AirDC++\Settings\FileLists|*.* FileKey10=%ProgramFiles%\AirDC++\Settings\Logs|*.* [AirPcap *] LangSecRef=3021 DetectFile=%ProgramFiles%\Riverbed\AirPcap\driver FileKey1=%ProgramFiles%\Riverbed\AirPcap\driver|*.log [AirStrike 3D *] Section=Games DetectFile=%ProgramFiles%\Blimb Entertainment\AIRSTRIKE3D FileKey1=%ProgramFiles%\Blimb Entertainment\AIRSTRIKE3D|*.log [Aiseesoft Burnova *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\Log Files\dvdcore*.log FileKey1=%UserProfile%\Documents\Log Files|dvdcore*.log [Aiseesoft Media Converter Ultimate *] LangSecRef=3023 Detect=HKCU\Software\Aiseesoft Studio\Aiseesoft Media Converter Ultimate FileKey1=%LocalAppData%\Aiseesoft Studio\Aiseesoft Media Converter Ultimate|*.txt RegKey1=HKCU\Software\Aiseesoft Studio\Aiseesoft Media Converter Ultimate\Edit|LastVideoFilePath [Aiseesoft Screen Recorder *] LangSecRef=3023 DetectFile=%ProgramFiles%\Aiseesoft Studio\Aiseesoft Screen Recorder FileKey1=%ProgramFiles%\Aiseesoft Studio\Aiseesoft Screen Recorder|*.mdmp FileKey2=%SystemDrive%\Log Files|Screencast*.log [Aiseesoft Video Converter Ultimate *] LangSecRef=3023 DetectFile=%LocalAppData%\Aiseesoft Studio\Aiseesoft Video Converter Ultimate FileKey1=%LocalAppData%\Aiseesoft Studio\Aiseesoft Video Converter Ultimate|*.log;*log.txt [Akamai *] LangSecRef=3022 DetectFile=%LocalAppData%\Akamai FileKey1=%LocalAppData%\Akamai\Logs|*.log [Al Quran *] LangSecRef=3021 DetectFile=%LocalAppData%\Packages\*Goheer.TheQuran_* FileKey1=%LocalAppData%\Packages\*Goheer.TheQuran_*\LocalState|*|RECURSE FileKey2=%LocalAppData%\Packages\*Goheer.TheQuran_*\Settings|*.log*;*.lock [AlbumPlayer *] LangSecRef=3023 DetectFile=%AppData%\AlbumPlayer FileKey1=%SystemDrive%\AlbumPlayerData\Cache|*.*|RECURSE FileKey2=%SystemDrive%\AlbumPlayerData\Logging|*.*|RECURSE [Alchemy Mindworks GIF Construction Set *] LangSecRef=3023 DetectFile=%AppData%\Alchemy Mindworks\GIF Construction Set Professional* FileKey1=%AppData%\Alchemy Mindworks\GIF Construction Set Professional*|FileMenuHistory.txt FileKey2=%AppData%\Alchemy Mindworks\GIF Construction Set Professional*\temp|*.* FileKey3=%AppData%\Alchemy Mindworks\Up To Date\images|*.log FileKey4=%AppData%\Alchemy Mindworks\Up To Date\temp|*.* [Alcohol 52% *] LangSecRef=3023 Detect=HKCU\Software\Alcohol Soft RegKey1=HKCU\Software\Alcohol Soft\Alcohol 52%\Basic|Image File Path RegKey2=HKCU\Software\Alcohol Soft\Alcohol 52%\Images RegKey3=HKCU\Software\Alcohol Soft\Alcohol 52%\Options\Image Making Wizard|ImageName [Algorius Net Viewer *] LangSecRef=3022 Detect=HKLM\Software\Algorius Software\Algorius Net Viewer FileKey1=%AppData%\Algorius Software\Algorius Net Viewer*\install|*.*|REMOVESELF FileKey2=%LocalAppData%\Algorius\Algorius Net Viewer|*.log;Log.db* [Alibaba *] LangSecRef=3021 DetectFile=%LocalAppData%\Alibaba\AliSetup FileKey1=%LocalAppData%\Alibaba\AliSetup\*|*.log [Alien Swarm *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\630 FileKey1=%ProgramFiles%\Steam\steamapps\common\alien swarm\swarm|tilegen_log.txt [Aliens: Colonial Marines *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Aliens: Colonial Marines_is1 FileKey1=%UserProfile%\Documents\My Games\Aliens Colonial Marines\PecanGame\Logs|*.* [All in One Runtimes *] LangSecRef=3024 DetectFile1=%SystemDrive%\AiO-Files DetectFile2=%SystemDrive%\AiOLog.txt FileKey1=%SystemDrive%|AiOLog.txt FileKey2=%SystemDrive%\AiO-Files|*.*|RECURSE [All Office Converter *] LangSecRef=3021 DetectFile=%ProgramFiles%\All Office Converter Platinum FileKey1=%ProgramFiles%\All Office Converter Platinum|Eventlog.txt [All Zombies Must Die! *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\All Zombies Must Die!_is1 FileKey1=%ProgramFiles%\Doublesix Games\All Zombies Must Die!\Prerequisites|*.*|REMOVESELF FileKey2=%UserProfile%\Documents\My Games\UnrealEngine3\Bzb2Game\Logs|*.* [AllDup *] LangSecRef=3024 DetectFile=%AppData%\AllDup FileKey1=%AppData%\AllDup|*.log [AloneWolf Brutal Force *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\BForce RegKey1=HKCU\Software\AloneWolf\BForce|ArcName [AloneWolf Dos Win Converter *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\DosWinConverter RegKey1=HKCU\Software\AloneWolf\DosWinConverter|Dir [AloneWolf FFRestorer *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\FFRestorer RegKey1=HKCU\Software\AloneWolf\FFRestorer|SaveDir [AloneWolf File Renamer *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\FileRen RegKey1=HKCU\Software\AloneWolf\FileRen|Dir RegKey2=HKCU\Software\AloneWolf\FileRen|LastExt [AloneWolf Hide Trace *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\HideTrace RegKey1=HKCU\Software\AloneWolf\HideTrace|LogDir RegKey2=HKCU\Software\AloneWolf\HideTrace|PathHt [AloneWolf HTML Optimizer *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\HTMLOpt RegKey1=HKCU\Software\AloneWolf\HTMLOpt|Dir1 RegKey2=HKCU\Software\AloneWolf\HTMLOpt|Dir2 [AloneWolf Icon Scanner *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\IconScanner RegKey1=HKCU\Software\AloneWolf\IconScanner|SourceFolder [AloneWolf Later Remover *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\LRemover RegKey1=HKCU\Software\AloneWolf\LRemover|Path [AloneWolf Registry Search and Delete *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\RSD RegKey1=HKCU\Software\AloneWolf\RSD|LastSearch [AloneWolf Sign Photo *] LangSecRef=3023 Detect=HKCU\Software\AloneWolf\SignPhoto RegKey1=HKCU\Software\AloneWolf\SignPhoto|Dir RegKey2=HKCU\Software\AloneWolf\SignPhoto|Text [AloneWolf TestYourSelf *] LangSecRef=3021 Detect=HKCU\Software\AloneWolf\TestYourSelf RegKey1=HKCU\Software\AloneWolf\TestYourSelf|QuestionFile [AloneWolf Text Replacer *] LangSecRef=3024 Detect=HKCU\Software\AloneWolf\TextReplacer RegKey1=HKCU\Software\AloneWolf\TextReplacer|Dir RegKey2=HKCU\Software\AloneWolf\TextReplacer|String1 RegKey3=HKCU\Software\AloneWolf\TextReplacer|String2 [ALSee *] LangSecRef=3023 DetectFile=%AppData%\ALSee FileKey1=%AppData%\ESTsoft\ALCM|cmulog.dat FileKey2=%AppData%\ESTsoft\ALUpdate\Log|*.* FileKey3=%LocalAppData%\ECRSC\UnsentCrashReports|*.*|RECURSE [Alternate File Shredder *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Alternate File Shredder_is1 FileKey1=%AppData%\Alternate\FileShredder|FileShredderLog*.txt [Always Right *] LangSecRef=3024 Detect=HKCU\Software\AlwaysRight FileKey1=%ProgramFiles%\Superhunter\Always Right\*Backup|*.* [Alwin 6 *] LangSecRef=3023 DetectFile=%SystemDrive%\alwin6 FileKey1=%SystemDrive%\alwin6\postgresql\9.0\data\pg_log|*.* [ALZip *] LangSecRef=3024 DetectFile=%AppData%\ESTsoft\ALZip FileKey1=%AppData%\ESTsoft\ALZip|extraction_history.db [AM-DeadLink *] LangSecRef=3022 Detect=HKCU\Software\aignes\deadlink FileKey1=%AppData%\aignes\AM-DeadLink|deadlink.log [Amaya *] LangSecRef=3022 DetectFile=%UserProfile%\amaya FileKey1=%UserProfile%\amaya|list_url_utf8.dat FileKey2=%UserProfile%\amaya\*|*.*|REMOVESELF [Amazing World *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\293500 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Amazing World\AmazingWorld_Data|output_log.txt FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Amazing World\Cache|*.*|REMOVESELF [Amazon Cloud Player *] LangSecRef=3024 Detect1=HKCR\Amazon.AmazonMP3DownloaderPlugin Detect2=HKCR\Software\Amazon\MP3 Downloader DetectFile=%LocalAppData%\Amazon Cloud Player FileKey1=%LocalAppData%\Amazon Cloud Player\Logs|*.* FileKey2=%LocalAppData%\Program Files\Amazon\MP3 Downloader|InstallerLog.txt FileKey3=%UserProfile%\Documents\Amazon MP3*\Logs|*.*|RECURSE [Amazon Downloader *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\Amazon Downloader Logs FileKey1=%UserProfile%\Documents\Amazon Downloader Logs|*.*|RECURSE [Amazon Games *] Section=Games Detect=HKCU\SOFTWARE\Amazon\Amazon Games FileKey1=%AppData%\electron-platform\Amazon Games UI\logs|*|REMOVESELF FileKey2=%LocalAppData%\Amazon Games\App|*.log FileKey3=%LocalAppData%\Amazon Games\Data|*.tmp FileKey4=%LocalAppData%\Amazon Games\Data\Dumps|*|RECURSE FileKey5=%LocalAppData%\Amazon Games\Data\Electron|*|REMOVESELF FileKey6=%LocalAppData%\Amazon Games\Data\Logs|*|RECURSE [Amazon Kindle for PC *] LangSecRef=3023 Detect=HKCU\Software\Amazon\Kindle FileKey1=%LocalAppData%\Amazon\Kindle\Cache|*|RECURSE FileKey2=%LocalAppData%\Amazon\Kindle\crashdump|* RegKey1=HKCU\Software\Amazon\Kindle\User Settings|last_getitems_date RegKey2=HKCU\Software\Amazon\Kindle\User Settings|last_syncmetadata_date RegKey3=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate0 RegKey4=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate1 RegKey5=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate2 RegKey6=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate3 RegKey7=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate4 RegKey8=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate5 RegKey9=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate6 RegKey10=HKCU\Software\Amazon\Kindle\User Settings|LastSyncDate7 RegKey11=HKCU\Software\Amazon\Kindle\User Settings|OpenBook ExcludeKey1=PATH|%LocalAppData%\Amazon\Kindle\Cache\plugins\*\|*.db [Amazon Music *] LangSecRef=3023 Detect=HKCU\Software\Amazon\Amazon Music FileKey1=%LocalAppData%\Amazon Music\Crash Dumps|*.* FileKey2=%LocalAppData%\Amazon Music\data\App Cache|*-journal;ChromeDWriteFontCache;data_*;f_*;index FileKey3=%LocalAppData%\Amazon Music\data\App Cache\*Cache|*|RECURSE FileKey4=%LocalAppData%\Amazon Music\data\Artwork Cache|*.jpg;*.png|RECURSE FileKey5=%LocalAppData%\Amazon Music\data\Hammer Cache|* FileKey6=%LocalAppData%\Amazon Music\data\Streaming Cache|cache.ini;*.stream FileKey7=%LocalAppData%\Amazon Music\Logs|* FileKey8=%LocalAppData%\Amazon Music\User Data\Crashpad\Reports|* FileKey9=%UserProfile%\.amu\updates|*.exe FileKey10=%UserProfile%\Documents\Amazon Music Importer\Logs|*.*|RECURSE [Amazon Prime Video *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_* FileKey1=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_*\LocalState|*.log;*.tmp|RECURSE FileKey3=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\AmazonVideo.PrimeVideo_*\TempState|*|RECURSE [AMD/ATI *] LangSecRef=3024 Detect1=HKLM\Software\AMD Detect2=HKLM\Software\ATI Detect3=HKLM\Software\ATI Technologies DetectFile1=%ProgramFiles%\AMD DetectFile2=%ProgramFiles%\ATI Technologies DetectFile3=%ProgramFiles%\RAIDXpert2 FileKey1=%LocalAppData%\AMD Ryzen Master\cache\qmlcache|*.* FileKey2=%LocalAppData%\AMD\*Cache|*.*|RECURSE FileKey3=%LocalAppData%\AMD\cn|*.log FileKey4=%LocalAppData%\AMD\Fuel|ClientProxyLog*.* FileKey5=%LocalAppData%\AMD\RadeonSoftware\Cache|*.* FileKey6=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default|*-journal;*.old;LOG;QuotaManager;Visited Links|RECURSE FileKey7=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\blob_storage|*|RECURSE FileKey8=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\GPUCache|* FileKey9=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\Service Worker\*Cache*|*|RECURSE FileKey10=%LocalAppData%\AMD\RadeonSoftware\QtWebEngine\Default\VideoDecodeStats|* FileKey11=%LocalAppData%\AMD\RadeonSoftware\vkcache|* FileKey12=%LocalAppData%\AMD\Ryzen Master\cache\qmlcache|* FileKey13=%LocalAppData%\AMD\StoreMI\cache\qmlcache|* FileKey14=%LocalAppData%\ATI\ACE|*.txt FileKey15=%LocalAppData%\Packages\*\AC\*\AMD\DxCache|* FileKey16=%LocalAppData%\Packages\*\AC\AMD\DxCache|* FileKey17=%LocalAppData%\Radeon*\Cache\qmlcache|* FileKey18=%LocalAppData%\RadeonSettings\Cache\QtWebEngine\Default\Cache|*.* FileKey19=%LocalAppData%\RadeonSettings\QtWebEngine\Default|*-journal;*.old;LOG;Visited Links|RECURSE FileKey20=%LocalAppData%\RadeonSettings\QtWebEngine\Default\blob_storage|*.*|RECURSE FileKey21=%LocalAppData%\Setup\cache\qmlcache|* FileKey22=%ProgramData%\AMD AutoUpdate|*.log FileKey23=%ProgramData%\AMD\Fuel|*.txt FileKey24=%ProgramData%\AMD\KDB|*.log FileKey25=%ProgramFiles%\AMD|*.log FileKey26=%ProgramFiles%\AMD\amdkmpfd|*|REMOVESELF FileKey27=%ProgramFiles%\AMD\CIM\Log|*.log;*.txt FileKey28=%ProgramFiles%\AMD\CIM\Reports|*.xml;*.xsl FileKey29=%ProgramFiles%\AMD\OverDrive|*.log FileKey30=%ProgramFiles%\AMD\RyzenMaster|*.rtf FileKey31=%ProgramFiles%\AMD\RyzenMaster\bin|*.bak FileKey32=%ProgramFiles%\AMD\RyzenMaster\logs|* FileKey33=%ProgramFiles%\ATI Technologies|*.log|RECURSE FileKey34=%ProgramFiles%\ATI Technologies|cccutil64.txt FileKey35=%ProgramFiles%\ATI\CIM\Reports|* FileKey36=%ProgramFiles%\RAIDXpert2|*.log FileKey37=%SystemDrive%\AMD|*|REMOVESELF FileKey38=%SystemDrive%\ATI|*|REMOVESELF FileKey39=%UserProfile%|AMD_*.log;AMDRM_Install.log;ChipsetExtraction.log;Device_ID.log FileKey40=%UserProfile%\AppData\LocalLow\AMD\DxCache|* FileKey41=%WinDir%\System32|CCCInstall*.log FileKey42=%WinDir%\System32\config\systemprofile\AppData\Local\AMD\DxCache|* FileKey43=%WinDir%\SysWOW64|CCCInstall*.log [America's Army 2 *] Section=Games DetectFile=%ProgramFiles%\USArmy\America's Army 2 FileKey1=%LocalAppData%\AA2DeployClient|debug*.* FileKey2=%ProgramFiles%\USArmy\America's Army 2|*.log|RECURSE [AMID EVIL *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\673130 FileKey1=%LocalAppData%\AmidEvil\Saved\Logs|*.* [Amigabit Privacy Cleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Amigabit\Privacy Cleaner FileKey1=%ProgramFiles%\Amigabit\Privacy Cleaner\Update|*.log [Amigabit Registry Cleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Amigabit\Registry Cleaner FileKey1=%ProgramFiles%\Amigabit\Registry Cleaner\Purchase|*.*|REMOVESELF FileKey2=%ProgramFiles%\Amigabit\Registry Cleaner\Update|update.log [Amnesia: The Dark Descent *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\57300 FileKey1=%UserProfile%\Documents\Amnesia|*.log|RECURSE [AMP Font Viewer *] LangSecRef=3024 Detect=HKCU\Software\AMP Soft\Font Viewer RegKey1=HKCU\Software\AMP Soft\Font Viewer|Default copy folder RegKey2=HKCU\Software\AMP Soft\Font Viewer|Last file operarion folder RegKey3=HKCU\Software\AMP Soft\Font Viewer|Not installed tab path [aMSN *] LangSecRef=3022 Detect=HKCU\Software\aMSN FileKey1=%ProgramFiles%\amsn\scripts\amsn_received|*.incomplete FileKey2=%UserProfile%\amsn\*\FT\cache|*.* FileKey3=%UserProfile%\amsn\*\logs\*|*.log FileKey4=%UserProfile%\amsn\*\winks\cache\tmp|*.* FileKey5=%UserProfile%\amsn\displaypic\cache|*.* [AMYUNI PDF Converter *] LangSecRef=3021 DetectFile=%ProgramData%\Package Cache\3DBECED19CFC2819A7E0BE14463CF18FC8720D91\amyuni_pdfconverter_5_00 FileKey1=%ProgramData%\Package Cache\3DBECED19CFC2819A7E0BE14463CF18FC8720D91\amyuni_pdfconverter_5_00|*.log|RECURSE [AnalogX PortMapper *] LangSecRef=3024 Detect=HKCU\Software\AnalogX\PortMapper FileKey1=%ProgramFiles%\AnalogX\PortMapper|debug.log [And Yet It Moves *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\18700 FileKey1=%AppData%\Broken Rules\And Yet It Moves Steam|console.log [Android Notifier Desktop *] LangSecRef=3022 DetectFile=%UserProfile%\.android\android-notifier-desktop FileKey1=%UserProfile%\.android\android-notifier-desktop|android-notifier-desktop.* [Android SDK Tools *] LangSecRef=3023 Detect=HKLM\Software\Android SDK Tools FileKey1=%AppData%\Android\android-sdk\temp|*.*|REMOVESELF FileKey2=%UserProfile%\.android\cache|*.*|REMOVESELF [Android Studio *] LangSecRef=3021 Detect=HKCU\Software\Android Open Source Project\Emulator FileKey1=%UserProfile%\.AndroidStudio2.3\system\log|*.*|REMOVESELF FileKey2=%UserProfile%\.AndroidStudio2.3\system\tmp|*.* FileKey3=%UserProfile%\.gradle|*.log|RECURSE [Anfibia Deskman *] LangSecRef=3024 DetectFile=%ProgramData%\DNET* FileKey1=%ProgramData%\DNET*|.log [Anfibia Switch *] LangSecRef=3021 Detect=HKCU\Software\Anfibia Switch FileKey1=%ProgramData%\Anfibia Switch|*.log|RECURSE [Anim8or *] LangSecRef=3021 Detect=HKCU\Software\Silicon Valley Software\Anim8or RegKey1=HKCU\Software\Silicon Valley Software\Anim8or|File1 RegKey2=HKCU\Software\Silicon Valley Software\Anim8or|File2 RegKey3=HKCU\Software\Silicon Valley Software\Anim8or|File3 RegKey4=HKCU\Software\Silicon Valley Software\Anim8or|File4 [Ankama Dofus *] Section=Games DetectFile=%LocalAppData%\Ankama\Dofus* FileKey1=%LocalAppData%\Ankama\Dofus*\Logs|*.* [Ankama Wakfu *] Section=Games DetectFile=%LocalAppData%\Ankama\Wakfu FileKey1=%LocalAppData%\Ankama\Wakfu\Game\logs|*.* FileKey2=%LocalAppData%\Ankama\Wakfu\Logs|*.* FileKey3=%LocalAppData%\Ankama\Wakfu\user_data\Game\Logs|*.* FileKey4=%LocalAppData%\Ankama\Wakfu\user_data\Logs|*.* [Anki Backups *] LangSecRef=3021 DetectFile=%ProgramFiles%\Anki FileKey1=%AppData%\.anki\backups|*.* [Annie's Millions *] Section=Games DetectFile=%AppData%\PoBros\Annies Millions FileKey1=%AppData%\PoBros\Annies Millions|logfile.txt [Anno 1404 *] Section=Games DetectFile=%ProgramFiles%\Anno1404 FileKey1=%ProgramFiles%\Anno1404|AnnoCrash.log FileKey2=%ProgramFiles%\Anno1404\CrashDumps|*.* [ANNO 2070 *] Section=Games DetectFile=%AppData%\Ubisoft\ANNO 2070 FileKey1=%AppData%\Ubisoft\ANNO 2070\Cache|*.*|REMOVESELF FileKey2=%AppData%\Ubisoft\ANNO 2070\Logs|*.log;*.dmp|RECURSE [AnnyStudio JPEG Lossless Rotator *] LangSecRef=3023 Detect=HKCU\Software\AnnyStudio\JPEGRotator RegKey1=HKCU\Software\AnnyStudio\JPEGRotator\Main|LastFolder [Anomos *] LangSecRef=3022 DetectFile=%ProgramFiles%\Anomos FileKey1=%AppData%\.anomos|logfile.txt [Ant Video Downloader *] LangSecRef=3022 Detect=HKCU\Software\Ant.com\AVD\Ant Video downloader RegKey1=HKCU\Software\Ant.com\AVD\Ant Video downloader\Settings|TemporaryFilesLocation [Antichamber *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219890 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Antichamber\UDKGame\Logs|*.* [Anvisoft Cloud System Booster *] LangSecRef=3024 Detect=HKLM\Software\Anvisoft\Cloud System Booster FileKey1=%LocalAppData%\Anvisoft\Anvi Slim Toolbar\FFToobar\tmp|*.*|REMOVESELF FileKey2=%ProgramFiles%\Anvisoft\Cloud System Booster|*.log;*.txt FileKey3=%ProgramFiles%\Anvisoft\Cloud System Booster\logs|*.* FileKey4=%ProgramFiles%\Anvisoft\Cloud System Booster\reports|*.* FileKey5=%ProgramFiles%\Anvisoft\Cloud System Booster\VLog|*.* [AnvSoft Any Audio Converter *] LangSecRef=3023 Detect=HKCU\Software\AnvSoft\Any Audio Converter FileKey1=%AppData%\AnvSoft|*.tmp FileKey2=%AppData%\AnvSoft\Any Audio Converter|*.log;histroy_v3.db [AnvSoft Any DVD Converter *] LangSecRef=3023 Detect=HKCU\Software\AnvSoft\Any DVD Converter Professional FileKey1=%AppData%\AnvSoft\Any DVD Converter Professional|*.db FileKey2=%AppData%\AnvSoft\Any DVD Converter Professional|*.log [AnvSoft Any Video Converter *] LangSecRef=3023 Detect=HKCU\Software\AnvSoft\Any Video Converter FileKey1=%AppData%\AnvSoft\Any Video Converter|*.log;history*.db|RECURSE FileKey2=%AppData%\AnvSoft\Any Video Converter\thumbs|*.*|RECURSE FileKey3=%AppData%\Any Video Converter Professional|*.log;history*.db [Any.do *] LangSecRef=3021 DetectFile=%AppData%\@anydo FileKey1=%AppData%\@anydo\electron-app|*.old;LOG|RECURSE FileKey2=%AppData%\@anydo\electron-app\*Cache|*.*|RECURSE [AnyBurn *] LangSecRef=3021 DetectFile=%AppData%\AnyBurn FileKey1=%AppData%\AnyBurn\Upgrade|anyburn_setup.exe [AnyDesk *] LangSecRef=3024 DetectFile=%AppData%\AnyDesk FileKey1=%AppData%\AnyDesk|ad.trace;connection_trace.txt [AnyDVD *] LangSecRef=3023 Detect=HKCU\Software\SlySoft\AnyDVD FileKey1=%UserProfile%\Documents\AnyDVD_logs|*.*|REMOVESELF [AnyMP4 DVD Ripper *] LangSecRef=3023 DetectFile=%LocalAppData%\AnyMP4 Studio\AnyMP4 DVD Ripper FileKey1=%LocalAppData%\AnyMP4 Studio\AnyMP4 DVD Ripper|*.log;*log.txt [AnyMusic *] LangSecRef=3022 DetectFile=%LocalAppData%\AnyMusic FileKey1=%LocalAppData%\AnyMusic\Cache\QtWebEngine\Default\Cache|*.* FileKey2=%LocalAppData%\AnyMusic\QtWebEngine\Default|*-journal;*.old;LOG;Network Persistent State;Visited Links|RECURSE FileKey3=%LocalAppData%\AnyMusic\QtWebEngine\Default\blob_storage|*.*|RECURSE FileKey4=%LocalAppData%\AnyMusic\QtWebEngine\Default\GPUCache|*.* [AOMEI Backupper *] LangSecRef=3024 DetectFile=%ProgramFiles%\AOMEI Backupper FileKey1=%ProgramData%\AomeiBR|brlog.xml FileKey2=%ProgramFiles%\AOMEI Backupper\AOMEI Image Deploy\log|* FileKey3=%ProgramFiles%\AOMEI Backupper\log|*.* [AOMEI Dynamic Disk Manager *] LangSecRef=3024 DetectFile=%ProgramFiles%\AOMEI DDM Pro Edition FileKey1=%ProgramFiles%\AOMEI DDM Pro Edition\log|*.* [AOMEI Partition Assistant *] LangSecRef=3024 Detect=HKCU\Software\Partition Assistant FileKey1=%ProgramFiles%\AOMEI Partition Assistant\log|*.log [APC PowerChute Personal Edition *] LangSecRef=3024 Detect=HKCU\Software\APC\PowerChute Personal Edition FileKey1=%ProgramFiles%\APC\PowerChute Personal Edition|PCPELog.txt FileKey2=%WinDir%\System32|PCPELog.txt FileKey3=%WinDir%\SysWOW64|PCPELog.txt [ApexDC++ *] LangSecRef=3022 DetectFile=%ProgramFiles%\ApexDC++ FileKey1=%AppData%\ApexDC++|files.xml.bz2;FinishedTransfers.xml;Queue.bkp.xml;Queue.xml.bak;Recents.xml FileKey2=%AppData%\ApexDC++\FileLists|*.* FileKey3=%AppData%\ApexDC++\Logs|*.* FileKey4=%LocalAppData%\ApexDC++|files.xml.bz2;FinishedTransfers.xml;Queue.bkp.xml;Queue.xml.bak;Recents.xml FileKey5=%LocalAppData%\ApexDC++\FileLists|*.* FileKey6=%LocalAppData%\ApexDC++\Logs|*.* FileKey7=%ProgramFiles%\ApexDC++\Logs|*.* FileKey8=%ProgramFiles%\ApexDC++\Settings|files.xml.bz2;FinishedTransfers.xml;Queue.bkp.xml;Queue.xml.bak;Recents.xml FileKey9=%ProgramFiles%\ApexDC++\Settings\FileLists|*.* FileKey10=%ProgramFiles%\ApexDC++\Settings\Logs|*.* [ApHeMo *] LangSecRef=3022 Detect=HKCU\Software\KC Softwares\ApHeMo FileKey1=%AppData%\KC Softwares\ApHeMo|*.log;error.* [Apowersoft iPhone Recorder *] LangSecRef=3023 DetectFile=%AppData%\Apowersoft\Apowersoft iPhone Recorder FileKey1=%AppData%\Apowersoft\Apowersoft iPhone Recorder\Log|*.* [Apowersoft Online Launcher *] LangSecRef=3023 DetectFile=%AppData%\Apowersoft\Apowersoft Online Launcher FileKey1=%AppData%\Apowersoft\Apowersoft Online Launcher\Log|*.* FileKey2=%LocalAppData%\Apowersoft\Apowersoft Online Launcher\Logs|*.* [Apowersoft Photo Viewer *] LangSecRef=3023 DetectFile=%AppData%\Apowersoft\Apowersoft Photo Viewer FileKey1=%AppData%\Apowersoft\Apowersoft Photo Viewer|CommUtilities.Report.Data FileKey2=%AppData%\Apowersoft\Apowersoft Photo Viewer\Log|*.* FileKey3=%UserProfile%\Pictures\Apowersoft\Apowersoft Photo Viewer\Screenshots|*.* [ApowerSoft Screen Recorder *] LangSecRef=3023 DetectFile=%LocalAppData%\Apowersoft\Apowersoft Screen Recorder* FileKey1=%AppData%\Apowersoft\Apowersoft*Screen Recorder*\Log|*.* FileKey2=%LocalAppData%\Apowersoft\Apowersoft Screen Recorder*|*.log FileKey3=%LocalAppData%\Apowersoft\Apowersoft Screen Recorder*\Log|*.* [ApowerSoft Streaming Audio Recorder *] LangSecRef=3023 DetectFile=%AppData%\ApowerSoft\Streaming Audio Recorder FileKey1=%AppData%\ApowerSoft\Streaming Audio Recorder|*.log|RECURSE FileKey2=%ProgramFiles%\Apowersoft\Streaming Audio Recorder\*\config|*.config.cch* [Apowersoft Video Converter Studio *] LangSecRef=3023 DetectFile=%AppData%\Apowersoft\Video Converter Studio FileKey1=%AppData%\Apowersoft\Apowersoft Online Video Converter\Log|*.* FileKey2=%AppData%\Apowersoft\Video Converter Studio|download.lst FileKey3=%AppData%\Apowersoft\Video Converter Studio\Log*|*.* FileKey4=%LocalAppData%\Apowersoft\Online Video Converter\Temp|*.* [Apowersoft Video Download Capture *] LangSecRef=3023 DetectFile=%AppData%\Apowersoft\Video Download Capture* FileKey1=%AppData%\Apowersoft\Video Download Capture*\Log|*.* [Apowersoft Video Editor *] LangSecRef=3023 DetectFile=%AppData%\Apowersoft\Apowersoft Video Editor FileKey1=%AppData%\Apowersoft\Apowersoft Video Editor\Log|*.* [Apple Software Update *] LangSecRef=3021 DetectFile=%LocalAppData%\Apple Software Update FileKey1=%LocalAppData%\Apple Software Update|*.msi FileKey2=%LocalAppData%\Apple Software Update\DistCache|*.*|RECURSE [Applet Password Wizard *] LangSecRef=3024 Detect=HKLM\Software\Silicon Joy Software\Applet Password Wizard RegKey1=HKLM\Software\Silicon Joy Software\Applet Password Wizard\1\mainWindow|MRUList [Appupdater *] LangSecRef=3024 DetectFile=%AppData%\Appupdater FileKey1=%AppData%\Appupdater|appupdaterw.log FileKey2=%ProgramData%\Appupdater|*.log [AQQ *] LangSecRef=3022 Detect1=HKCU\Software\MyPortal\AQQ Detect2=HKCU\Software\Wapster\AQQ FileKey1=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\*Avatars|*.* FileKey2=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\*Cache|*.* FileKey3=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\*Avatars|*.* FileKey4=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\*Cache|*.* [AQQ Chat History *] LangSecRef=3022 Detect1=HKCU\Software\MyPortal\AQQ Detect2=HKCU\Software\Wapster\AQQ FileKey1=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\Archive|*.DC2 FileKey2=%LocalAppData%\MyPortal\AQQ Folder\Profiles\*\Data\Temp|*.* FileKey3=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\Archive|*.DC2 FileKey4=%UserProfile%\WapSter\AQQ Folder\Profiles\*\Data\Temp|*.* [Arasan Chess *] Section=Games Detect=HKCU\Software\Arasan\Arasan RegKey1=HKCU\Software\Arasan\Arasan\Recent File List [Arcane Worlds *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\269610 FileKey1=%AppData%\ArcaneWorlds|log.txt [ArcGIS ArcMap *] LangSecRef=3021 Detect1=HKCU\Software\ESRI\ArcMap Detect2=HKCU\Software\ESRI\Desktop10.0\ArcMap Detect3=HKCU\Software\ESRI\Desktop10.1\ArcMap RegKey1=HKCU\Software\ESRI\ArcMap\Recent File List RegKey2=HKCU\Software\ESRI\Desktop10.0\ArcMap\Recent File List RegKey3=HKCU\Software\ESRI\Desktop10.1\ArcMap\Recent File List [ArcSoft MediaConverter *] LangSecRef=3023 Detect=HKLM\Software\arcsoft\mediaconverter FileKey1=%AppData%\ArcSoft\ArcSoft MediaConverter\*|saved.proj FileKey2=%AppData%\ArcSoft\log|*.log [Ares *] LangSecRef=3022 Detect=HKCU\Software\Ares FileKey1=%LocalAppData%\Ares\Temp|*temp.txt RegKey1=HKCU\Software\Ares|GUI.LastChatRoomBrowse RegKey2=HKCU\Software\Ares|GUI.LastSearch [Argus Monitor *] LangSecRef=3024 Detect=HKCU\Software\Argotronic\Argus Monitor FileKey1=%ProgramFiles%|ArgusMonitor_*Log.* FileKey2=%UserProfile%\Documents|ArgusMonitor_*Log.* [ARO *] LangSecRef=3024 DetectFile=%AppData%\Sammsoft\ARO FileKey1=%AppData%\Sammsoft\ARO\Version *\Logs|*.txt [Artifex GSview 6.0 *] LangSecRef=3021 Detect=HKCU\Software\Artifex Software\gsview 6.0 RegKey1=HKCU\Software\Artifex Software\gsview 6.0|File RegKey2=HKCU\Software\Artifex Software\gsview 6.0|Page RegKey3=HKCU\Software\Artifex Software\gsview 6.0\Files [ASAP Utilities *] LangSecRef=3024 Detect=HKCU\Software\VB and VBA Program Settings\ASAP Utilities RegKey1=HKCU\Software\VB and VBA Program Settings\ASAP Utilities\TimeSavers [ASCOMP Cleaning Suite *] LangSecRef=3024 Detect=HKCU\Software\ASCOMP\Cleaning Suite DetectFile=%ProgramFiles%\ASCOMP Software\Cleaning Suite FileKey1=%AppData%\ASCOMP Software\Cleaning Suite|*.log FileKey2=%AppData%\ASCOMP Software\Cleaning Suite\Restore|*.*|RECURSE RegKey1=HKCU\Software\ASCOMP\Cleaning Suite|ClientID [Ashampoo *] LangSecRef=3024 Detect=HKCU\Software\Ashampoo FileKey1=%AppData%\Ashampoo|*.log;*.txt;*.xml|RECURSE FileKey2=%LocalAppData%\Ashampoo\BaNT|*|RECURSE FileKey3=%LocalAppData%\Ashampoo\boxshots|*.png FileKey4=%ProgramData%\Ashampoo|ico_ashampoo_deals.ico [Ashampoo Burning Studio *] LangSecRef=3024 Detect1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5 Detect2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6 Detect3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7 Detect4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8 Detect5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12 Detect6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14 Detect7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15 Detect8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16 Detect9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18 Detect10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19 Detect11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20 Detect12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 21 Detect13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22 Detect14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23 Detect15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007 Detect16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2009 Detect17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012 Detect18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016 Detect19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017 Detect20=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018 Detect21=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019 FileKey1=%ProgramData%\Ashampoo\drivers|driverdatabase.xml|REMOVESELF RegKey1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Burn Image Project\SelectImage RegKey2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\AddDialog RegKey3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\DumpImage RegKey4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Unknown Project\AddDialog RegKey5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Burn Image Project\SelectImage RegKey6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Data Disc Project\AddDialog RegKey7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Unknown Project\AddDialog RegKey8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Burn Image Project\SelectImage RegKey9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Data Disc Project\AddDialog RegKey10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Unknown Project\AddDialog RegKey11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Data Disc Project\AddDialog RegKey12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\tempFiles RegKey14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\tempFiles RegKey16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Backup Project\BackupOptions|CustomLocation RegKey18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\BrowseImageFile|ImagePath RegKey20=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey21=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey22=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SelectImage|ImagePath RegKey23=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\DumpImage|ImagePath RegKey24=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey25=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\MoviesPage|Path RegKey26=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey27=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Logs RegKey28=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\tempFiles RegKey29=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Unknown Project RegKey30=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey31=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey32=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey33=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey34=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Backup Project\BackupOptions|CustomLocation RegKey35=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey36=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\BrowseImageFile|ImagePath RegKey37=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey38=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey39=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SelectImage|ImagePath RegKey40=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\DumpImage|ImagePath RegKey41=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey42=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\MoviesPage|Path RegKey43=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey44=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Logs RegKey45=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\tempFiles RegKey46=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Unknown Project RegKey47=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey48=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey49=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey50=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey51=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Backup Project\BackupOptions|CustomLocation RegKey52=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey53=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\BrowseImageFile|ImagePath RegKey54=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey55=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey56=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SelectImage|ImagePath RegKey57=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\DumpImage|ImagePath RegKey58=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey59=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\MoviesPage|Path RegKey60=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey61=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Logs RegKey62=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\tempFiles RegKey63=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Unknown Project RegKey64=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey65=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey66=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey67=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey68=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Backup Project\BackupOptions|CustomLocation RegKey69=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey70=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Browse Image Project\BrowseImageFile|ImagePath RegKey71=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey72=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey73=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Burn Image Project\SelectImage|ImagePath RegKey74=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Data Disc Project\DumpImage|ImagePath RegKey75=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey76=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\DVD-Video Disc Project\MoviesPage|Path RegKey77=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey78=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Logs RegKey79=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\tempFiles RegKey80=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\Unknown Project RegKey81=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey82=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey83=HKCU\Software\Ashampoo\Ashampoo Burning Studio 20\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey84=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey85=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Backup Project\BackupOptions|CustomLocation RegKey86=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey87=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Browse Image Project\BrowseImageFile|ImagePath RegKey88=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey89=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey90=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Burn Image Project\SelectImage|ImagePath RegKey91=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Data Disc Project\DumpImage|ImagePath RegKey92=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey93=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\DVD-Video Disc Project\MoviesPage|Path RegKey94=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey95=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Logs RegKey96=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\tempFiles RegKey97=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\Unknown Project RegKey98=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey99=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey100=HKCU\Software\Ashampoo\Ashampoo Burning Studio 22\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey101=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey102=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Backup Project\BackupOptions|CustomLocation RegKey103=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey104=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Browse Image Project\BrowseImageFile|ImagePath RegKey105=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey106=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey107=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Burn Image Project\SelectImage|ImagePath RegKey108=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Data Disc Project\DumpImage|ImagePath RegKey109=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey110=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\DVD-Video Disc Project\MoviesPage|Path RegKey111=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey112=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Logs RegKey113=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\tempFiles RegKey114=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\Unknown Project RegKey115=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey116=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey117=HKCU\Software\Ashampoo\Ashampoo Burning Studio 23\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey118=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey119=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Backup Project\BackupOptions|CustomLocation RegKey120=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\BDMV Disc Project\SelectBDMVFolder|BdmvPath RegKey121=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Browse Image Project\BrowseImageFile|ImagePath RegKey122=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey123=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey124=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Burn Image Project\SelectImage|ImagePath RegKey125=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Data Disc Project\DumpImage|ImagePath RegKey126=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey127=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\DVD-Video Disc Project\MoviesPage|Path RegKey128=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory RegKey129=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Logs RegKey130=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\tempFiles RegKey131=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\Unknown Project RegKey132=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey133=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey134=HKCU\Software\Ashampoo\Ashampoo Burning Studio 24\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey135=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Burn Image Project\AddDialog RegKey136=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Data Disc Project\AddDialog RegKey137=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Dump Image Project\DumpImage RegKey138=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Unknown Project\AddDialog RegKey139=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey140=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Backup Project\BackupOptions|CustomLocation RegKey141=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Browse Image Project\BrowseImageFile|ImagePath RegKey142=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey143=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey144=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Burn Image Project\SelectImage|ImagePath RegKey145=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Data Disc Project\DumpImage|ImagePath RegKey146=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey147=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Logs RegKey148=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\tempFiles RegKey149=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\Unknown Project RegKey150=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey151=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey152=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2012\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey153=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey154=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Backup Project\BackupOptions|CustomLocation RegKey155=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\BrowseImageFile|ImagePath RegKey156=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey157=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey158=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SelectImage|ImagePath RegKey159=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\DumpImage|ImagePath RegKey160=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey161=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Logs RegKey162=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\tempFiles RegKey163=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Unknown Project RegKey164=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey165=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey166=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey167=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey168=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Backup Project\BackupOptions|CustomLocation RegKey169=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\BrowseImageFile|ImagePath RegKey170=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey171=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey172=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SelectImage|ImagePath RegKey173=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\DumpImage|ImagePath RegKey174=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey175=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Logs RegKey176=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\tempFiles RegKey177=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Unknown Project RegKey178=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey179=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey180=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey181=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey182=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Backup Project\BackupOptions|CustomLocation RegKey183=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Browse Image Project\BrowseImageFile|ImagePath RegKey184=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey185=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey186=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Burn Image Project\SelectImage|ImagePath RegKey187=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Data Disc Project\DumpImage|ImagePath RegKey188=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey189=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Logs RegKey190=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\tempFiles RegKey191=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\Unknown Project RegKey192=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey193=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey194=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2018\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath RegKey195=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory RegKey196=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Backup Project\BackupOptions|CustomLocation RegKey197=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Browse Image Project\BrowseImageFile|ImagePath RegKey198=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey199=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory RegKey200=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Burn Image Project\SelectImage|ImagePath RegKey201=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Data Disc Project\DumpImage|ImagePath RegKey202=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory RegKey203=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Logs RegKey204=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\tempFiles RegKey205=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\Unknown Project RegKey206=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VCD Project\SaveDialog_OnAddMovies|InitialDirectory RegKey207=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VIDEO_TS Disc Project\DumpImage|ImagePath RegKey208=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2019\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath [Ashampoo PDF *] LangSecRef=3021 Detect1=HKCU\Software\Ashampoo\Ashampoo PDF Detect2=HKCU\Software\Ashampoo\Ashampoo PDF Pro 2 FileKey1=%LocalAppData%\Ashampoo PDF\*|lastFileOpenned.txt RegKey1=HKCU\Software\Ashampoo\Ashampoo PDF\Find Replace RegKey2=HKCU\Software\Ashampoo\Ashampoo PDF\Recent File List [Ashampoo Registry Cleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Ashampoo\Ashampoo Registry Cleaner* FileKey1=%ProgramFiles%\Ashampoo\Ashampoo Registry Cleaner*\Backups|*.* [Ashampoo Snap *] LangSecRef=3024 DetectFile=%ProgramFiles%\Ashampoo Snap* FileKey1=%ProgramFiles%\Ashampoo\Ashampoo Snap*|_NLogMsg.txt [Ashampoo Snap AutoSaves *] LangSecRef=3024 DetectFile=%ProgramFiles%\Ashampoo Snap* FileKey1=%UserProfile%\Pictures\Ashampoo Snap*\_SNAPDOC|*.*|RECURSE [Ashampoo WinOptimizer *] LangSecRef=3024 DetectFile=%ProgramFiles%\Ashampoo\Ashampoo WinOptimizer* FileKey1=%ProgramFiles%\Ashampoo\Ashampoo WinOptimizer*\Backups|*.ini;*.reg [Ashes of the Singularity *] Section=Games DetectFile=%LocalAppData%\Ashes of the Singularity FileKey1=%LocalAppData%\Ashes of the Singularity\Stardock\Tachyon|*.txt [Ashley Jones and the Heart of Egypt *] Section=Games DetectFile=%ProgramData%\Fenomen Games\Ashley Jones - The Heart Of Egypt FileKey1=%ProgramData%\Fenomen Games\Ashley Jones - The Heart Of Egypt|*.log [Asmwsoft PC Optimizer *] LangSecRef=3024 DetectFile=%ProgramFiles%\Asmwsoft PC Optimizer FileKey1=%ProgramFiles%\Asmwsoft PC Optimizer|eraselog.txt [Astase PowerBatch *] LangSecRef=3024 DetectFile=%ProgramFiles%\Astase\PowerBatch FileKey1=%ProgramFiles%\Astase\PowerBatch|recents.ini [AstroGrep *] LangSecRef=3024 Detect=HKCU\Software\AstroGrep FileKey1=%AppData%\AstroGrep|AstroGrep.general.config FileKey2=%AppData%\AstroGrep\Log|*.log [ASUS *] LangSecRef=3024 Detect=HKLM\Software\ASUS\SmartCore DetectFile1=%AppData%\ASUS WebStorage DetectFile2=%LocalAppData%\AcSdkInsLog DetectFile3=%ProgramData%\ASUS DetectFile4=%ProgramFiles%\ASUS\AI Suite FileKey1=%AppData%\*WebStorage\Logs|* FileKey2=%LocalAppData%\AcLoader|*.log FileKey3=%LocalAppData%\AcSdkInsLog|* FileKey4=%ProgramData%\ASUS|*Log.txt;*.bak;*.log*;Thumbs.db|RECURSE FileKey5=%ProgramData%\ASUS\ARMOURY CRATE Diagnosis\ASUS Update\ACS|*.txt FileKey6=%ProgramData%\ASUS\ARMOURY CRATE Diagnosis\LightingService|* FileKey7=%ProgramData%\ASUS\ARMOURY CRATE Diagnosis\ROG Live Service\InstallLog|*.*|RECURSE FileKey8=%ProgramData%\ASUS\ASUS System Control Interface\AsusSoftwareManager\AsusLiveUpdate\Log|*_logtrack.txt FileKey9=%ProgramData%\ASUS\ASUS System Control Interface\AsusSoftwareManager\AsusLiveUpdate\Temp|* FileKey10=%ProgramData%\ASUS\ASUS System Control Interface\AsusSystemDiagnosis|*.txt FileKey11=%ProgramData%\ASUS\ASUS System Control Interface\log|* FileKey12=%ProgramFiles%\ASUS\*|*.log;*log*.txt;*.tmp|RECURSE FileKey13=%Public%\ASUSFlipLog|* FileKey14=%SystemDrive%|wifi.log ExcludeKey1=FILE|%ProgramData%\ASUS\*\|install.log [ASUS USB Charger Plus *] LangSecRef=3021 DetectFile=%ProgramData%\USBChargerPlus FileKey1=%ProgramData%|AsACPLog.* [Athentech Perfectly Clear *] LangSecRef=3021 Detect=HKLM\Software\Athentech FileKey1=%LocalAppData%\cache\Athentech|*.*|REMOVESELF [Atheros Driver *] LangSecRef=3024 Detect=HKLM\Software\Atheros FileKey1=%CommonProgramFiles%\Atheros|InstallLog.txt FileKey2=%CommonProgramFiles%\Qualcomm|InstallLog.txt FileKey3=%CommonProgramFiles%\Qualcomm Atheros|*.log FileKey4=%LocalAppData%\Atheros\DirectConnect|*.log FileKey5=%ProgramData%\Atheros|*.log|RECURSE FileKey6=%ProgramData%\Qualcomm Atheros WiFi Driver Installation|*.Log|RECURSE [Atlantis Quest *] Section=Games DetectFile=%ProgramFiles%\GameTop.com\Atlantis Quest FileKey1=%ProgramFiles%\GameTop.com\Atlantis Quest|Error.log [Atlantis Word Processor *] LangSecRef=3021 Detect=HKCU\Software\Atlantis Word Processor FileKey1=%AppData%\Atlantis|*.tmp|RECURSE FileKey2=%ProgramData%\Atlantis|Update.log RegKey1=HKCU\Software\Atlantis Word Processor\ClipLib|AddGraphicClip_RecentFolder RegKey2=HKCU\Software\Atlantis Word Processor\ClipLib|AddTextClip_RecentFolder RegKey3=HKCU\Software\Atlantis Word Processor\ClipLib|RecentClip RegKey4=HKCU\Software\Atlantis Word Processor\InsertDoc_Files RegKey5=HKCU\Software\Atlantis Word Processor\InsertPicture_Files RegKey6=HKCU\Software\Atlantis Word Processor\InsertPicture_Folders RegKey7=HKCU\Software\Atlantis Word Processor\Internal|ImportStyles_LastUsedFile RegKey8=HKCU\Software\Atlantis Word Processor\Internal|InitDir RegKey9=HKCU\Software\Atlantis Word Processor\Internal|LastBulPic RegKey10=HKCU\Software\Atlantis Word Processor\Internal|LastFavSubfolder RegKey11=HKCU\Software\Atlantis Word Processor\Internal|LastUsedDocTemplate RegKey12=HKCU\Software\Atlantis Word Processor\Internal\Envelopes|LastAddr RegKey13=HKCU\Software\Atlantis Word Processor\Internal\Envelopes|LastAddrBook RegKey14=HKCU\Software\Atlantis Word Processor\Internal\Envelopes|RetAddr RegKey15=HKCU\Software\Atlantis Word Processor\Internal\FindReplace RegKey16=HKCU\Software\Atlantis Word Processor\LangHistory RegKey17=HKCU\Software\Atlantis Word Processor\LoadSave|DocFolder RegKey18=HKCU\Software\Atlantis Word Processor\LoadSave|DocsToReload RegKey19=HKCU\Software\Atlantis Word Processor\LoadSave|Ebook_LastSavedDoc RegKey20=HKCU\Software\Atlantis Word Processor\OpenDoc_Files RegKey21=HKCU\Software\Atlantis Word Processor\RecentDocs RegKey22=HKCU\Software\Atlantis Word Processor\SaveDocAs_Files [Atomic Cleaner *] LangSecRef=3024 Detect=HKCU\Software\AtomicWare\Atomic Cleaner FileKey1=%LocalAppData%\Atomicware\AtomicCleaner*|*.log;*.tmp;info_messages.txt FileKey2=%LocalAppData%\Atomicware\AtomicCleaner*\Logs|*.* RegKey1=HKCU\Software\AtomicWare\Atomic Cleaner|Last Scan RegKey2=HKCU\Software\AtomicWare\Atomic Cleaner|Last Used [AtomTime Pro *] LangSecRef=3024 Detect=HKLM\Software\NaissanInnovations\AtomTime FileKey1=%ProgramFiles%\AtomTime Pro|*.log [Attila *] Section=Games DetectFile=%AppData%\The Creative Assembly\Attila FileKey1=%AppData%\The Creative Assembly\Attila\*_cache|*.*|RECURSE FileKey2=%AppData%\The Creative Assembly\Attila\Logs|*.* [Attribute Changer *] LangSecRef=3024 Detect1=HKCU\Software\Attribute Changer Detect2=HKCU\Software\Romain's Software\Attribute Changer RegKey1=HKCU\Software\Attribute Changer\File Settings|!DTDateMax RegKey2=HKCU\Software\Attribute Changer\File Settings|!DTDateMin RegKey3=HKCU\Software\Attribute Changer\File Settings|!DTTimeMax RegKey4=HKCU\Software\Attribute Changer\File Settings|!DTTimeMin RegKey5=HKCU\Software\Attribute Changer\File Settings|AccessedValue RegKey6=HKCU\Software\Attribute Changer\File Settings|CreatedValue RegKey7=HKCU\Software\Attribute Changer\File Settings|LimitDateMax RegKey8=HKCU\Software\Attribute Changer\File Settings|LimitDateMin RegKey9=HKCU\Software\Attribute Changer\File Settings|LimitTimeMax RegKey10=HKCU\Software\Attribute Changer\File Settings|LimitTimeMin RegKey11=HKCU\Software\Attribute Changer\File Settings|ModifiedValue RegKey12=HKCU\Software\Attribute Changer\File Settings|PhotoValue RegKey13=HKCU\Software\Attribute Changer\File Settings|RandomDateMax RegKey14=HKCU\Software\Attribute Changer\File Settings|RandomDateMin RegKey15=HKCU\Software\Attribute Changer\File Settings|RandomTimeMax RegKey16=HKCU\Software\Attribute Changer\File Settings|RandomTimeMin RegKey17=HKCU\Software\Attribute Changer\Folder Settings|!DTDateMax RegKey18=HKCU\Software\Attribute Changer\Folder Settings|!DTDateMin RegKey19=HKCU\Software\Attribute Changer\Folder Settings|!DTTimeMax RegKey20=HKCU\Software\Attribute Changer\Folder Settings|!DTTimeMin RegKey21=HKCU\Software\Attribute Changer\Folder Settings|AccessedValue RegKey22=HKCU\Software\Attribute Changer\Folder Settings|CreatedValue RegKey23=HKCU\Software\Attribute Changer\Folder Settings|LimitDateMax RegKey24=HKCU\Software\Attribute Changer\Folder Settings|LimitDateMin RegKey25=HKCU\Software\Attribute Changer\Folder Settings|LimitTimeMax RegKey26=HKCU\Software\Attribute Changer\Folder Settings|LimitTimeMin RegKey27=HKCU\Software\Attribute Changer\Folder Settings|ModifiedValue RegKey28=HKCU\Software\Attribute Changer\Folder Settings|RandomDateMax RegKey29=HKCU\Software\Attribute Changer\Folder Settings|RandomDateMin RegKey30=HKCU\Software\Attribute Changer\Folder Settings|RandomTimeMax RegKey31=HKCU\Software\Attribute Changer\Folder Settings|RandomTimeMin RegKey32=HKCU\Software\Attribute Changer\Global Settings|OtherExport RegKey33=HKCU\Software\Romain's Software\Attribute Changer\File Settings|AccessedDT RegKey34=HKCU\Software\Romain's Software\Attribute Changer\File Settings|CreatedDT RegKey35=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMaxDate RegKey36=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMaxTime RegKey37=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMinDate RegKey38=HKCU\Software\Romain's Software\Attribute Changer\File Settings|FltMinTime RegKey39=HKCU\Software\Romain's Software\Attribute Changer\File Settings|ModifiedDT RegKey40=HKCU\Software\Romain's Software\Attribute Changer\File Settings|PictureDT RegKey41=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMaxDate RegKey42=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMaxTime RegKey43=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMinDate RegKey44=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RandomMinTime RegKey45=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RLowerDT RegKey46=HKCU\Software\Romain's Software\Attribute Changer\File Settings|RUpperDT RegKey47=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|AccessedDT RegKey48=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|CreatedDT RegKey49=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMaxDate RegKey50=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMaxTime RegKey51=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMinDate RegKey52=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|FltMinTime RegKey53=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|ModifiedDT RegKey54=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMaxDate RegKey55=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMaxTime RegKey56=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMinDate RegKey57=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RandomMinTime RegKey58=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RLowerDT RegKey59=HKCU\Software\Romain's Software\Attribute Changer\Folder Settings|RUpperDT RegKey60=HKCU\Software\Romain's Software\Attribute Changer\Global Settings|PFolderFilter [aTube Catcher *] LangSecRef=3023 DetectFile=%ProgramFiles%\dsnet Corp\aTube Catcher* FileKey1=%ProgramFiles%\dsnet Corp\aTube Catcher*|ScrRecX.log [Audacity *] LangSecRef=3023 Detect=HKCU\Software\Audacity FileKey1=%AppData%\Audacity|lastlog.txt FileKey2=%LocalAppData%\Audacity\CrashReports|*.* RegKey1=HKCU\Software\Audacity\Audacity|DefaultOpenPath [Audials *] LangSecRef=3023 DetectFile=%LocalAppData%\RapidSolution\Audials_* FileKey1=%LocalAppData%\RapidSolution\Audials_*\Log|*.log;*.txt|RECURSE FileKey2=%LocalAppData%\RapidSolution\Audials_Software\RapidSolution\Audials_*\Log|*.log;*.txt|RECURSE FileKey3=%ProgramData%\RapidSolution\Audials_*\ChildMSILogs|*.txt [Audio Control *] LangSecRef=3023 DetectFile=%LocalAppData%\MBBSoftware\Audio Control FileKey1=%LocalAppData%\MBBSoftware\Audio Control\*\TemporaryFolder|*.* [Audio Sliders *] LangSecRef=3024 DetectFile=%ProgramFiles%\Audio Sliders FileKey1=%ProgramFiles%\Audio Sliders|*.log [AudioGrail *] LangSecRef=3023 Detect=HKCU\Software\KC Softwares\AudioGrail FileKey1=%AppData%\KC Softwares\AudioGrail|ag.sel;AudioGrail.log [Aurigma Image Uploader *] LangSecRef=3023 Detect=HKCU\Software\Aurigma\ImageUploader FileKey1=%LocalAppData%|recently-used.xbel RegKey1=HKCU\Software\Aurigma\ImageUploader\Image Uploader 5.0|LastVisitedAsString2 RegKey2=HKCU\Software\Aurigma\ImageUploader\Image Uploader 5.0|LastVisitedAsStringHash [Auslogics *] LangSecRef=3024 Detect=HKLM\Software\Auslogics FileKey1=%AppData%\Auslogics|*.htm*;*.log;*.rsc;*.sta;*.xml|RECURSE FileKey2=%ProgramFiles%\Auslogics\*|GASender.exe;GoogleAnalyticsHelper.dll RegKey1=HKLM\Software\Auslogics\Google Analytics Package [Auslogics BoostSpeed *] LangSecRef=3024 Detect=HKCU\Software\Auslogics\BoostSpeed FileKey1=%ProgramData%\Auslogics\BoostSpeed\*.x|*.err;*.htm*;*.log;*.rsc;*.sta;*.xml|RECURSE FileKey2=%ProgramFiles%\Auslogics\Auslogics BoostSpeed|rdboot.log RegKey1=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsFailed RegKey2=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsFound RegKey3=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.ErrorsRemoved RegKey4=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|DiskCleaner.AppLogic.LastScan RegKey5=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey6=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey7=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey8=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|RegCleaner.AppLogic.LastScan RegKey9=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.DateTimeHi RegKey10=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.DateTimeLo RegKey11=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.FailedToRemove RegKey12=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.Found RegKey13=HKCU\Software\Auslogics\BoostSpeed\5.x\Settings|TrackEraser.LastScan.Removed RegKey14=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.DisksList.SelectedDrives RegKey15=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DateTime RegKey16=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DisksList RegKey17=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.FilesCount RegKey18=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey19=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey20=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey21=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey22=HKLM\Software\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.LastScan RegKey23=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.DisksList.SelectedDrives RegKey24=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DateTime RegKey25=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.DisksList RegKey26=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|DiskDefrag.LastDefragment.FilesCount RegKey27=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey28=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey29=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey30=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey31=HKLM\Software\Wow6432Node\Auslogics\BoostSpeed\7.x\Settings|RegCleaner.AppLogic.LastScan [Auslogics Disk Defrag *] LangSecRef=3024 Detect1=HKLM\Software\Auslogics\Disk Defrag Detect2=HKLM\Software\Auslogics\Disk Defrag Portable Detect3=HKLM\Software\Auslogics\Disk Defrag Professional FileKey1=%AppData%\Auslogics\*Disk*Defrag*\Reports|*|RECURSE FileKey2=%ProgramData%\Auslogics\*Disk*Defrag*\*\*Reports|*|RECURSE FileKey3=%ProgramFiles%\Auslogics\*Disk*Defrag*|ndefrg.log [Auslogics Duplicate File Finder *] LangSecRef=3024 Detect=HKLM\Software\Auslogics\Duplicate File Finder\7.x DetectFile=%ProgramFiles%\Auslogics\Duplicate File Finder RegKey1=HKLM\Software\Wow6432Node\Auslogics\Duplicate File Finder\7.x\Settings|DuplicateFileFinder.CheckDrives [Auslogics Registry Cleaner *] LangSecRef=3024 Detect1=HKCU\Software\Auslogics\Registry Cleaner Detect2=HKLM\Software\Auslogics\Registry Cleaner\3.x Detect3=HKLM\Software\Auslogics\Registry Cleaner\4.x Detect4=HKLM\Software\Auslogics\Registry Cleaner\5.X FileKey1=%ProgramData%\Auslogics\Registry Cleaner\*.x|*.htm*;*.log|RECURSE FileKey2=%ProgramData%\Auslogics\Registry Cleaner\*.x\DeliveredAction|*.tmp FileKey3=%ProgramData%\Auslogics\Registry Cleaner\*.x\Reports|*.*|RECURSE FileKey4=%ProgramData%\Auslogics\Registry Cleaner\*.x\Rescue\Auslogics Registry Cleaner|*.rsc RegKey1=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey2=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey3=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey4=HKCU\Software\Auslogics\Registry Cleaner\2.x\Settings|RegCleaner.AppLogic.LastScan RegKey5=HKLM\Software\Auslogics\DeliveredActions RegKey6=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey7=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey8=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey9=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey10=HKLM\Software\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.LastScan RegKey11=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey12=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey13=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey14=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey15=HKLM\Software\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.LastScan RegKey16=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey17=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFound RegKey18=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey19=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey20=HKLM\Software\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.LastScan RegKey21=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey22=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey23=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey24=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey25=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\3.x\Settings|RegCleaner.AppLogic.LastScan RegKey26=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey27=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsFound RegKey28=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey29=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey30=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\4.x\Settings|RegCleaner.AppLogic.LastScan RegKey31=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFailed RegKey32=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsFound RegKey33=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemoved RegKey34=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.ErrorsRemovedTotal RegKey35=HKLM\Software\Wow6432Node\Auslogics\Registry Cleaner\5.X\Settings|RegCleaner.AppLogic.LastScan [Auslogics Registry Defrag *] LangSecRef=3024 Detect1=HKCU\Software\Auslogics\Registry Defrag Detect2=HKLM\Software\Auslogics\Registry Defrag FileKey1=%AppData%\Auslogics\Registry Defrag\Logs|* FileKey2=%AppData%\Auslogics\Registry Defrag\Reports|* FileKey3=%ProgramData%\Auslogics\Registry Defrag\*.x\DeliveredAction|*.tmp FileKey4=%ProgramData%\Auslogics\Registry Defrag\*.x\Reports|* [Auslogics System Information *] LangSecRef=3024 Detect=HKCU\Software\Auslogics\System Information FileKey1=%AppData%\Auslogics\System Information|*.* [Auslogics Windows Slimmer *] LangSecRef=3024 DetectFile=%ProgramData%\Auslogics\Windows Slimmer FileKey1=%ProgramData%\Auslogics\Windows Slimmer\*.x|*.err FileKey2=%ProgramData%\Auslogics\Windows Slimmer\*.x\Logs|* FileKey3=%ProgramData%\Auslogics\Windows Slimmer\*.x\Reports|*|RECURSE [Auto Text Expander *] LangSecRef=3021 DetectFile=%AppData%\Winsome Technologies\Auto Text Expander 1.0 FileKey1=%AppData%\Winsome Technologies\Auto Text Expander 1.0|*.log [Autobahn *] LangSecRef=3021 DetectFile=%UserProfile%\.autobahn FileKey1=%UserProfile%\.autobahn|autobahn-log*.* [Autodesk AutoCAD *] LangSecRef=3021 Detect1=HKCU\Software\Autodesk\AutoCAD\R17.0 Detect2=HKCU\Software\Autodesk\AutoCAD\R18.0 Detect3=HKCU\Software\Autodesk\AutoCAD\R18.1 Detect4=HKCU\Software\Autodesk\AutoCAD\R19.0 Detect5=HKCU\Software\Autodesk\AutoCAD\R20.0 Detect6=HKCU\Software\Autodesk\AutoCAD\R23.0 Detect7=HKCU\Software\Autodesk\R19.0 Detect8=HKCU\Software\Autodesk\R22.0 FileKey1=%AppData%\Autodesk\ACA*\*\Recent|*.lnk|RECURSE FileKey2=%AppData%\Autodesk\ADPSDK\JSON\Upload|logstats.json FileKey3=%AppData%\Autodesk\AutoCAD*\r*\*\Recent|*.lnk|RECURSE FileKey4=%LocalAppData%\Autodesk\AutoCAD*|*.log|RECURSE FileKey5=%LocalAppData%\Autodesk\AutoCAD*\r*\*\BrowserCache|data_*;index FileKey6=%LocalAppData%\Autodesk\Autodesk Desktop App\BrowserCache|data_*;f_*;index FileKey7=%LocalAppData%\Autodesk\Web Services|*.log FileKey8=%UserProfile%\Documents|plot.log RegKey1=HKCU\Software\Autodesk\AutoCAD\R17.0\ACAD-5001:409\Recent File List RegKey2=HKCU\Software\Autodesk\AutoCAD\R18.0\ACAD-8001:409\Recent File List RegKey3=HKCU\Software\Autodesk\AutoCAD\R18.0\ACAD-8001:411\Recent File List RegKey4=HKCU\Software\Autodesk\AutoCAD\R18.1\ACAD-9000:409\Recent File List RegKey5=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B000:409\Recent File List RegKey6=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B001:409\Recent File List RegKey7=HKCU\Software\Autodesk\AutoCAD\R19.0\ACAD-B004:409\Recent File List RegKey8=HKCU\Software\Autodesk\AutoCAD\R20.0\ACAD-8001:409\Recent File List RegKey9=HKCU\Software\Autodesk\AutoCAD\R23.0\ACAD-A001:409\Recent File List RegKey10=HKCU\Software\Autodesk\R19.0\ACAD-B005:409\Recent File List RegKey11=HKCU\Software\Autodesk\R22.0\ACAD-1001:409\Recent File List [Autodesk Design Review *] LangSecRef=3023 Detect=HKCU\Software\AutoDesk\DWF Common RegKey1=HKCU\Software\AutoDesk\DWF Common\Preferences\MRUList [Autodesk Installer *] LangSecRef=3021 DetectFile=%AppData%\Autodesk Installer FileKey1=%AppData%\Autodesk Installer|Network Persistent State FileKey2=%AppData%\Autodesk Installer\blob_storage|*.*|RECURSE FileKey3=%AppData%\Autodesk Installer\GPUCache|*.* FileKey4=%AppData%\Autodesk Installer\Logs|*.* [Autodesk Inventor *] LangSecRef=3021 Detect1=HKCU\Software\Autodesk\Inventor\RegistryVersion19.0 Detect2=HKCU\Software\Autodesk\Inventor\RegistryVersion20.0 Detect3=HKCU\Software\Autodesk\Inventor\RegistryVersion21.0 Detect4=HKCU\Software\Autodesk\Inventor\RegistryVersion22.0 Detect5=HKCU\Software\Autodesk\Inventor\RegistryVersion23.0 Detect6=HKCU\Software\Autodesk\Inventor\RegistryVersion24.0 RegKey1=HKCU\Software\Autodesk\Inventor\RegistryVersion19.0\Recent File List RegKey2=HKCU\Software\Autodesk\Inventor\RegistryVersion20.0\Recent File List RegKey3=HKCU\Software\Autodesk\Inventor\RegistryVersion21.0\Recent File List RegKey4=HKCU\Software\Autodesk\Inventor\RegistryVersion22.0\Recent File List RegKey5=HKCU\Software\Autodesk\Inventor\RegistryVersion23.0\Recent File List RegKey6=HKCU\Software\Autodesk\Inventor\RegistryVersion24.0\Recent File List [Autodesk Revit *] LangSecRef=3021 DetectFile=%AppData%\Autodesk\Revit\Autodesk Revit* FileKey1=%AppData%\Autodesk\Revit\Autodesk Revit*\*\components|*.log FileKey2=%AppData%\Autodesk\Revit\Autodesk Revit*\RecentFileCache|*.jpg FileKey3=%LocalAppData%\Microsoft\Microsoft SQL Server Local DB\Instances\SteelConnections*|*.log;*.mdmp;*log.ldf;log*.trc;SQLDump*.txt;system_health_*.xel [AutoIt3 *] LangSecRef=3021 Detect=HKCU\Software\AutoIt v3 FileKey1=%UserProfile%|SciTE.* RegKey1=HKCU\Software\AutoIt v3\Aut2Exe|LastExeDir RegKey2=HKCU\Software\AutoIt v3\Aut2Exe|LastIcon RegKey3=HKCU\Software\AutoIt v3\Aut2Exe|LastIconDir RegKey4=HKCU\Software\AutoIt v3\Aut2Exe|LastScriptDir [AV Stumpfl Wings Platinum *] LangSecRef=3023 DetectFile=%ProgramFiles%\AV Stumpfl\Wings Platinum FileKey1=%ProgramFiles%\AV Stumpfl\Wings Platinum|*Log.txt [AvaFind *] LangSecRef=3023 Detect=HKLM\Software\Think Less Do More Services\AVA Find FileKey1=%AppData%\AvaFind Data|*00.db [Avast *] LangSecRef=3024 Detect=HKCU\Software\AVAST Software\Avast DetectFile=%ProgramFiles%\Alwil Software\Avast* FileKey1=%AppData%\AVAST Software\Avast\Cache|*-journal;LOG;LOG.old;Network Persistent State;Visited Links|RECURSE FileKey2=%AppData%\AVAST Software\Avast\Cache\*Cache|*|RECURSE FileKey3=%AppData%\AVAST Software\Avast\Cache\blob_storage|*|RECURSE FileKey4=%AppData%\AVAST Software\Avast\log|* FileKey5=%LocalAppData%\Background_Fault|debug.log FileKey6=%ProgramData%\Alwil Software\Avast*\log|* FileKey7=%ProgramData%\Alwil Software\Avast*\report|*.txt FileKey8=%ProgramData%\AVAST Software\Avast|*.obsolete;*.old;backend.txt;Log.db FileKey9=%ProgramData%\AVAST Software\Avast\backup|*|RECURSE FileKey10=%ProgramData%\AVAST Software\Avast\log|* FileKey11=%ProgramData%\AVAST Software\Avast\report|*.txt FileKey12=%ProgramData%\AVAST Software\Browser|*.*|RECURSE FileKey13=%ProgramData%\AVAST Software\Persistent Data\Avast\Logs|*.log FileKey14=%ProgramFiles%\Alwil Software\Avast*\Setup|*.log FileKey15=%ProgramFiles%\AVAST Software\Avast|*.tmp RegKey1=HKCU\Software\AVAST Software\Avast Browser Cleanup [Avast TuneUp *] LangSecRef=3024 Detect=HKCU\Software\AVAST Software\Tuneup RegKey1=HKCU\Software\AVAST Software\Tuneup\FixProblems RegKey2=HKLM\Software\AVAST Software\Tuneup\FixProblems [AVG *] LangSecRef=3024 Detect1=HKCU\Software\AVG Detect2=HKLM\Software\AVG FileKey1=%LocalAppData%\Avg\Log|*.*|RECURSE FileKey2=%LocalAppData%\AvgSetupLog|*.*|REMOVESELF FileKey3=%WinDir%\System32\config\systemprofile\AppData\Local\Avg\log|*.*|RECURSE FileKey4=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg\Log|*.*|RECURSE [AVG AntiVirus *] LangSecRef=3024 Detect=HKLM\Software\AVG FileKey1=%AppData%\AVG\Antivirus\cache|ChromeDWriteFontCache FileKey2=%AppData%\AVG\Antivirus\log|*|RECURSE FileKey3=%LocalAppData%\MFAData\logs|*.log* FileKey4=%ProgramData%\AVG\Antivirus|*.old FileKey5=%ProgramData%\AVG\Antivirus\GrimeFighter2|*.txt FileKey6=%ProgramData%\AVG\Antivirus\log|*.log FileKey7=%ProgramData%\AVG\Antivirus\opm|*|RECURSE FileKey8=%ProgramData%\AVG\Antivirus\report|*|RECURSE FileKey9=%ProgramData%\Avg\Antivirus\SWCUData\Cache|*|RECURSE FileKey10=%ProgramData%\Avg\Antivirus\SWCUData\icons|*|RECURSE FileKey11=%ProgramData%\AVG\Persistent Data\Antivirus\Logs|*|RECURSE FileKey12=%ProgramFiles%\AVG\Antivirus|*.tmp|RECURSE FileKey13=%WinDir%\System32\config\systemprofile\AppData\Local\AvgSetupLog|*|REMOVESELF FileKey14=%WinDir%\System32\config\systemprofile\AppData\Local\MFAData\logs|* FileKey15=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\AvgSetupLog|*|REMOVESELF FileKey16=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\MFAData\logs|* RegKey1=HKLM\Software\AVG\Antivirus\PUB-Detected RegKey2=HKLM\Software\AVG\Antivirus\PUB-Removed RegKey3=HKLM\Software\Wow6432Node\AVG\Antivirus\PUB-Detected RegKey4=HKLM\Software\Wow6432Node\AVG\Antivirus\PUB-Removed [AVG PC TuneUp *] LangSecRef=3024 Detect1=HKCU\Software\AVG\AWL\RegistryCleaner Detect2=HKCU\Software\TuneUp DetectFile=%AppData%\AVG TuneUp FileKey1=%AppData%\AVG TuneUp\Cache|*|RECURSE FileKey2=%AppData%\AVG TuneUp\log|* FileKey3=%AppData%\AVG\AVG TuneUp\Cache|ChromeDWriteFontCache;data_*;f_*;index FileKey4=%AppData%\AVG\AVG TuneUp\log|* FileKey5=%AppData%\AVG\AWL*\CrashDumps|* FileKey6=%AppData%\AVG\TuneUp\log|* FileKey7=%AppData%\TuneUp Software\TuneUp Utilities\CrashDumps|* FileKey8=%LocalAppData%\Avg\AWL*\Log|*.log FileKey9=%LocalAppData%\Avg\dumps\fmw1|* FileKey10=%LocalAppData%\Microsoft\Windows|USRCLASS.DAT_tureg_new.LOG*;*.DAT_tureg_old FileKey11=%LocalAppData%\TuneUp Software|*.log|RECURSE FileKey12=%ProgramData%|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old FileKey13=%ProgramData%\AVG\AVG TuneUp\Backups|*.rcb FileKey14=%ProgramData%\AVG\AVG TuneUp\Cache|*.log FileKey15=%ProgramData%\AVG\AVG TuneUp\log|* FileKey16=%ProgramData%\AVG\AWL*|TUReportData.*.tudb FileKey17=%ProgramData%\AVG\Icarus\Logs|* FileKey18=%ProgramData%\AVG\TuneUp|*.bak;*.old FileKey19=%ProgramData%\AVG\TuneUp\log|*|RECURSE FileKey20=%ProgramData%\TuneUp Software\tu*|TUReportData.*.tudb FileKey21=%ProgramData%\TuneUp Software\TuneUp Utilities*|*.log|RECURSE FileKey22=%ProgramData%\TuneUp Software\TuneUp Utilities\Program Statistics|*.tudb FileKey23=%ProgramFiles%\AVG\AVG TuneUp\DATA\log|* FileKey24=%ProgramFiles%\AVG\AVG TuneUp\x*\DATA\log|* FileKey25=%ProgramFiles%\AVG\TuneUp\DATA\log|* FileKey26=%ProgramFiles%\AVG\TuneUp\DATA\report|* FileKey27=%Public%|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old FileKey28=%SystemDrive%\Boot|BCD_tureg_new.LOG*;BCD_tureg_old FileKey29=%SystemDrive%\Documents and Settings\LocalService*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old FileKey30=%SystemDrive%\Documents and Settings\NetworkService*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old FileKey31=%SystemDrive%\Users\Default\AppData\Local\Avg\Log\tu*|*.log FileKey32=%UserProfile%|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old FileKey33=%WinDir%\ServiceProfiles\*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old FileKey34=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows|USRCLASS.DAT_tureg_old;USRCLASS.DAT_tureg_new.LOG* FileKey35=%WinDir%\System32\config|*_tureg_new.LOG*;*_tureg_old;Software_tureg_new;SYSTEM_tureg_new [Avi-Mux GUI *] LangSecRef=3023 DetectFile=%ProgramFiles%\AVIMuxGUI FileKey1=%ProgramFiles%\AVIMuxGUI|AVI-Mux GUI - Logfile*.*;*.dmp [AVI Toolbox *] LangSecRef=3023 Detect=HKCU\Software\KC Softwares\AVIToolbox FileKey1=%AppData%\KC Softwares\AVI Toolbox|*.log [AVIcodec *] LangSecRef=3023 Detect=HKLM\Software\AVIcodec RegKey1=HKLM\Software\AVIcodec|szInitDir [Avid *] LangSecRef=3023 DetectFile1=%AppData%\Digidesign DetectFile2=%LocalAppData%\Avid FileKey1=%AppData%\Digidesign\Recent Files|*.*|RECURSE FileKey2=%AppData%\Digidesign\Recent Folders|*.*|RECURSE FileKey3=%LocalAppData%\Avid\Crashlog|*.* FileKey4=%LocalAppData%\Avid\Logs|*_log.txt;*.dlog FileKey5=%LocalAppData%\Avid\Pro Tools\Cache|*.*|RECURSE [Avidemux *] LangSecRef=3023 DetectFile=%AppData%\avidemux FileKey1=%AppData%\avidemux|admlog.txt [Avira AntiVir Desktop *] LangSecRef=3024 Detect1=HKCU\Software\Avira\Antivirus Detect2=HKLM\Software\Avira\AntiVir Desktop FileKey1=%ProgramData%\Avira\Antivir*\EVENTDB\Logs|* FileKey2=%ProgramData%\Avira\AntiVir*\IPM|*|RECURSE FileKey3=%ProgramData%\Avira\AntiVir*\REPORTS|* FileKey4=%ProgramData%\Avira\OptimizerHost\Logs|* FileKey5=%ProgramFiles%\Avira GmbH|*.log|RECURSE [Avira Launcher *] LangSecRef=3021 DetectFile=%ProgramFiles%\Avira\Launcher FileKey1=%ProgramData%\Avira\Launcher|*.backup FileKey2=%ProgramData%\Avira\Launcher\Logfiles*|* FileKey3=%ProgramData%\Avira\Launcher\Temp|*|RECURSE FileKey4=%ProgramFiles%\Avira\Launcher|*.backup [Avira Phantom VPN *] LangSecRef=3022 DetectFile=%ProgramData%\Avira\VPN FileKey1=%ProgramData%\Avira\VPN|*.log [Avira Privacy Pal *] LangSecRef=3024 DetectFile=%ProgramData%\Avira\PrivacyPal FileKey1=%ProgramData%\Avira\PrivacyPal\Logs|* [Avira System Speedup *] LangSecRef=3024 DetectFile=%ProgramData%\Avira\SystemSpeedup FileKey1=%ProgramData%\Avira\SystemSpeedup\Update|*.exe [AVS Audio Converter *] LangSecRef=3023 DetectFile=%AppData%\AVS4YOU\AVSAudioConverter* FileKey1=%AppData%\AVS4YOU\AVSAudioConverter*|*.log;RecentFiles.* [AVS Audio Editor *] LangSecRef=3023 DetectFile=%AppData%\AVS4YOU\AVSAudioEditor FileKey1=%AppData%\AVS4YOU\AVSAudioEditor|*.log;Recent*.txt [AVS Registry Cleaner *] LangSecRef=3024 Detect=HKCU\Software\AVS4YOU\RegistryCleaner DetectFile=%ProgramFiles%\AVS4YOU\AVSRegistryCleaner FileKey1=%AppData%\AVS4YOU\AVSRegistryCleaner*\Logs|*.log FileKey2=%AppData%\AVS4YOU\AVSRegistryCleaner\RollBack|*.*|RECURSE FileKey3=%ProgramFiles%\AVS4YOU|*.rtf [AxCrypt *] LangSecRef=3024 DetectFile=%LocalAppData%\AxCrypt FileKey1=%LocalAppData%\AxCrypt|ReportSnapshot.txt [Axialis IconWorkshop *] LangSecRef=3023 Detect=HKCU\Software\Axialis\IconWorkshop FileKey1=%UserProfile%\Documents\Axialis Librarian\Deleted Items|*.del;*.ii RegKey1=HKCU\Software\Axialis\IconWorkshop\folders|CurrentExportDirectory RegKey2=HKCU\Software\Axialis\IconWorkshop\folders|CurrentImportDirectory RegKey3=HKCU\Software\Axialis\IconWorkshop\folders|CurrentOpenDirectory RegKey4=HKCU\Software\Axialis\IconWorkshop\rss|MostRecentNewsId RegKey5=HKCU\Software\Axialis\IconWorkshop\rss|News1 RegKey6=HKCU\Software\Axialis\IconWorkshop\rss|News2 RegKey7=HKCU\Software\Axialis\IconWorkshop\rss|News3 RegKey8=HKCU\Software\Axialis\IconWorkshop\rss|News4 RegKey9=HKCU\Software\Axialis\IconWorkshop\rss|News5 RegKey10=HKCU\Software\Axialis\IconWorkshop\rss|News6 RegKey11=HKCU\Software\Axialis\IconWorkshop\rss|News7 RegKey12=HKCU\Software\Axialis\IconWorkshop\rss|News8 RegKey13=HKCU\Software\Axialis\IconWorkshop\rss|News9 RegKey14=HKCU\Software\Axialis\IconWorkshop\rss|News10 RegKey15=HKCU\Software\Axialis\IconWorkshop\rss|News11 RegKey16=HKCU\Software\Axialis\IconWorkshop\rss|News12 RegKey17=HKCU\Software\Axialis\IconWorkshop\rss|News13 RegKey18=HKCU\Software\Axialis\IconWorkshop\rss|News14 RegKey19=HKCU\Software\Axialis\IconWorkshop\rss|News15 RegKey20=HKCU\Software\Axialis\IconWorkshop\rss|News16 RegKey21=HKCU\Software\Axialis\IconWorkshop\rss|News17 RegKey22=HKCU\Software\Axialis\IconWorkshop\rss|News18 RegKey23=HKCU\Software\Axialis\IconWorkshop\rss|News19 RegKey24=HKCU\Software\Axialis\IconWorkshop\rss|News20 RegKey25=HKCU\Software\Axialis\IconWorkshop\rss|UnreadNews [Axigen Mail Server *] LangSecRef=3022 DetectFile=%ProgramFiles%\Axigen Mail Server FileKey1=%ProgramFiles%\Axigen Mail Server\log|LOG_FILE.txt [AzureWave *] LangSecRef=3022 DetectFile=%ProgramData%\AzureWave FileKey1=%ProgramData%\AzureWave|*.log [Babylon *] LangSecRef=3024 Detect=HKCU\Software\Babylon\Babylon Translator FileKey1=%AppData%\Babylon|log_file.txt RegKey1=HKCU\Software\Babylon\Babylon Translator\UserInfo\History [Backyard Basketball 2004 *] Section=Games DetectFile=%ProgramFiles%\Atari\Backyard Basketball 2004 FileKey1=%ProgramFiles%\Atari\Backyard Basketball 2004|*.log [Bad Piggies *] Section=Games DetectFile=%ProgramFiles%\Rovio\Bad Piggies FileKey1=%ProgramFiles%\Rovio\Bad Piggies\BadPiggies_Data|output_log.txt [Badlion Client *] Section=Games DetectFile=%AppData%\Badlion Client FileKey1=%AppData%\Badlion Client|*.log FileKey2=%AppData%\Badlion Client\GPUCache|*.* FileKey3=%AppData%\Badlion Client\logs\launcher|*.* [Baidu PC Faster *] LangSecRef=3024 Detect=HKCU\Software\Baidu Security FileKey1=%ProgramData%\Baidu Security\RpData|*.tmp FileKey2=%UserProfile%\Documents\Baidu Security\Bav\Dump|*|REMOVESELF FileKey3=%UserProfile%\Documents\Baidu Security\PC Faster\*\Dump|*|REMOVESELF FileKey4=%UserProfile%\Documents\Baidu Security\PC Faster\*\log|*|REMOVESELF [Baldur's Gate II: Enhanced Edition *] Section=Games DetectFile=%UserProfile%\Documents\Baldur's Gate II - Enhanced Edition FileKey1=%UserProfile%\Documents\Baldur's Gate II - Enhanced Edition\Scrnshot|*.png [Banished *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\242920 FileKey1=%UserProfile%\Documents\Banished\Save|Crash*.dmp [BarcodeOK *] LangSecRef=3024 Detect=HKCU\Software\BarcodeOK ist OK\BarcodeOK RegKey1=HKCU\Software\BarcodeOK ist OK\BarcodeOK\Recent File List [Batch Purifier *] LangSecRef=3024 DetectFile=%AppData%\Digital Confidence\BatchPurifier FileKey1=%AppData%\Digital Confidence\BatchPurifier|OutputFolderMRU [BATExpert *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\BATExpert FileKey1=%AppData%\KC Softwares\BATExpert|*.log [Batman: Arkham Asylum *] Section=Games Detect1=HKLM\Software\Eidos Interactive Limited\Batman: Arkham Asylum Detect2=HKLM\Software\RocksteadyLtd\Batman Arkham Asylum FileKey1=%UserProfile%\Documents\*\Batman Arkham Asylum*\BmGame|*.log|RECURSE [Batman: Arkham City *] Section=Games DetectFile=%UserProfile%\Documents\WB Games\Batman Arkham City* FileKey1=%UserProfile%\Documents\WB Games\Batman Arkham City*\BmGame\Logs|* [Batman: Arkham Origins *] Section=Games DetectFile=%ProgramFiles%\Steam\steamapps\common\Batman Arkham Origins FileKey1=%ProgramFiles%\Steam\steamapps\common\Batman Arkham Origins\SinglePlayer\BMGame\Logs|* [BatteryCare *] LangSecRef=3024 DetectFile=%AppData%\BatteryCare FileKey1=%AppData%\BatteryCare|log.txt [Battle Islands *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\305260 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Battle Islands\BattleIslands_Data|output_log.txt [Battle.net *] Section=Games Detect=HKCU\Software\Blizzard Entertainment\Battle.net FileKey1=%AppData%\Battle.net\Telemetry|* FileKey2=%LocalAppData%\Battle.net\*Cache|*|RECURSE FileKey3=%LocalAppData%\Battle.net\Errors|* FileKey4=%LocalAppData%\Battle.net\Logs|*|RECURSE FileKey5=%LocalAppData%\Blizzard Entertainment\Battle.net\Cache|*|RECURSE FileKey6=%LocalAppData%\Blizzard Entertainment\System Survey|*.log;log.txt|RECURSE FileKey7=%LocalAppData%\Blizzard Entertainment\Telemetry|* FileKey8=%ProgramData%\Battle.net|*.log|RECURSE FileKey9=%ProgramData%\Battle.net\*\Logs|*|RECURSE FileKey10=%ProgramData%\Battle.net\Agent\Agent.*\Logs|*|RECURSE FileKey11=%ProgramData%\Battle.net\Client\Blizzard Launcher.*\Logs|*|RECURSE FileKey12=%ProgramData%\Battle.net\Setup\*\Logs|* FileKey13=%ProgramData%\Battle.net\Telemetry|* FileKey14=%ProgramData%\Blizzard Entertainment\Battle.net\Cache|*|RECURSE FileKey15=%ProgramFiles%\Blizzard App\Logs|*.log [BB FlashBack/TestAssistant *] LangSecRef=3023 Detect1=HKLM\Software\Blueberry Software\BB FlashBack Express Detect2=HKLM\Software\Blueberry Software\BB FlashBack Pro 4 Detect3=HKLM\Software\Blueberry Software\BB FlashBack Standard 4 Detect4=HKLM\Software\Blueberry Software\BB TestAssistant Expert 4 Detect5=HKLM\Software\Blueberry Software\BB TestAssistant Pro 4 FileKey1=%AppData%\Blueberry|ExportTo*Stat.txt;*Tracking.xml;Recorder*Stat.txt FileKey2=%AppData%\LogSys|*|REMOVESELF FileKey3=%CommonProgramFiles%\Blueberry Software|*.log FileKey4=%ProgramFiles%\Blueberry Software\*|drvinstlog.txt;*.log FileKey5=%WinDir%\System32\MTSLog|*|REMOVESELF [BDtoAVCHD *] LangSecRef=3023 DetectFile=%ProgramFiles%\BDtoAVCHD FileKey1=%ProgramFiles%\BDtoAVCHD\*ac3to|log.txt [BeamNG.drive *] Section=Games DetectFile=%UserProfile%\Documents\BeamNG.drive FileKey1=%UserProfile%\Documents\BeamNG.drive|*.log [Beckhoff TwinCat *] LangSecRef=3021 Detect=HKCU\Software\Beckhoff FileKey1=%SystemDrive%\TwinCAT\3.1\Components\TcEventLogger\EventConfigurator|~evtCfgTmp*.html FileKey2=%UserProfile%|*TwinCat*.log;TC*.log;TF*.log [Behringer Neutron *] LangSecRef=3023 DetectFile=%AppData%\Neutron FileKey1=%AppData%\Neutron\*Cache|*.*|RECURSE FileKey2=%AppData%\Neutron\Logs|*.* FileKey3=%LocalAppData%\Behringer\Synthtribe\Cache\qmlcache|*.* [Belarc Advisor *] LangSecRef=3024 Detect=HKCU\Software\Belarc FileKey1=%ProgramFiles%\Belarc\*Advisor|*.bci;install.log FileKey2=%ProgramFiles%\Belarc\*Advisor\System|Progress.Log FileKey3=%ProgramFiles%\Belarc\*Advisor\System\Security\BelNotify|*.log FileKey4=%ProgramFiles%\Belarc\*Advisor\System\Tmp|*.* [Benthic PLEdit *] LangSecRef=3024 Detect=HKCU\Software\Benthic\PLEdit32 FileKey1=%ProgramFiles%\Benthic|*.txt RegKey1=HKCU\Software\Benthic\PLEdit32\RecentFiles [BestBuy Software Installer *] LangSecRef=3024 DetectFile=%ProgramData%\Best Buy Software Installer FileKey1=%ProgramData%\Best Buy Software Installer\Resources\Cache|* [Betrayer *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\243120 FileKey1=%UserProfile%\Documents\Betrayer\UDKGame\Logs|*.* [Better Explorer *] LangSecRef=3024 DetectFile=%ProgramFiles%\Better Explorer FileKey1=%ProgramFiles%\Better Explorer|log.txt [Beyond Compare *] LangSecRef=3021 DetectFile=%AppData%\Scooter Software\Beyond Compare* FileKey1=%AppData%\Scooter Software\Beyond Compare*|*.bak RegKey1=HKCU\Software\Scooter Software\Beyond Compare\Recent [Beyondo *] LangSecRef=3024 Detect=HKCU\Software\Bluefive\Beyondo RegKey1=HKCU\Software\Bluefive\Beyondo\RecentFiles [Big City Adventure *] Section=Games DetectFile=%ProgramData%\JollyBear\Big City Adventure * FileKey1=%ProgramData%\JollyBear\Big City Adventure *|error.* [Big Fish Games *] Section=Games Detect=HKCU\Software\Big Fish Games FileKey1=%ProgramData%\Big Fish Games\Game Manager\resources-old|*|RECURSE FileKey2=%ProgramData%\Big Fish\Game Manager\Addons\BFGameLauncher|*.log|RECURSE FileKey3=%ProgramData%\BigFishCache|*.exe|RECURSE FileKey4=%ProgramData%\BigFishCache\GameManager\log|*.txt|RECURSE FileKey5=%ProgramData%\BigFishGamesCache\GameManager\log|* [BiglyBT *] LangSecRef=3022 Detect=HKCU\Software\BiglyBT FileKey1=%AppData%\BiglyBT|ipfilter.cache FileKey2=%AppData%\BiglyBT\active|*.bak FileKey3=%AppData%\BiglyBT\logs|* FileKey4=%AppData%\BiglyBT\tmp|* FileKey5=%ProgramFiles%\BiglyBT|*.log|RECURSE [BIMx Desktop Viewer *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\BIMx FileKey1=%UserProfile%\Documents\BIMx|*_Log.txt [Bing Dynamic *] LangSecRef=3023 DetectFile=%LocalAppData%\Microsoft\Windows\Themes\BingDynamic1.theme FileKey1=%LocalAppData%\Microsoft\Feeds|http~c~f~fthemeserver~dmicrosoft~dcom~fdefault~daspx~mp*Bing* [BioShock Infinite *] Section=Games DetectFile=%UserProfile%\Documents\My Games\BioShock Infinite FileKey1=%UserProfile%\Documents\My Games\BioShock Infinite\Benchmarks|* [BIT.TRIP *] Section=Games DetectFile=%LocalAppData%\BIT.TRIP * FileKey1=%LocalAppData%\BIT.TRIP *|*.txt [Bitcoin *] LangSecRef=3022 DetectFile=%AppData%\Bitcoin FileKey1=%AppData%\Bitcoin|*.log;*.old [Bitdefender *] LangSecRef=3024 Detect1=HKLM\Software\Bitdefender\Bitdefender Internet Security Detect2=HKLM\Software\Bitdefender\Bitdefender Total Security Detect3=HKLM\Software\Bitdefender\Bitdefender Total Security 2015 Detect4=HKLM\Software\Softwin\Bitdefender Antivirus FileKey1=%AppData%\Bitdefender\Desktop\profiles\Logs\*|*.xml FileKey2=%ProgramData%\Bitdefender\DTrace|*.log FileKey3=%ProgramFiles%\Softwin\Bitdefender*\Logs|* FileKey4=%SystemDrive%|bdlog.txt [BitTorrent *] LangSecRef=3022 DetectFile1=%AppData%\BitTorrent DetectFile2=%ProgramFiles%\BitTorrent FileKey1=%AppData%\BitTorrent\ie|*.tmp FileKey2=%AppData%\BitTorrent\Updates|*.exe|REMOVESELF FileKey3=%UserProfile%\AppData\LocalLow\BitTorrent|BitTorrent_* [BitTorrent Incomplete Downloads *] LangSecRef=3022 Detect=HKCU\Software\BitTorrent FileKey1=%AppData%\BitTorrent\incomplete|*.* [Bitwarden *] LangSecRef=3024 DetectFile=%AppData%\Bitwarden FileKey1=%AppData%\Bitwarden|*-journal;*.old;LOG;Network Persistent State;Visited Links|RECURSE FileKey2=%AppData%\Bitwarden\*Cache|*.*|RECURSE FileKey3=%AppData%\Bitwarden\Bitwarden\Logs|*.* FileKey4=%AppData%\Bitwarden\blob_storage|*.*|RECURSE FileKey5=%AppData%\Bitwarden\Logs|*.* FileKey6=%LocalAppData%\Bitwarden-Updater|package.7z [BlackBeltPrivacy DarkNet *] LangSecRef=3023 DetectFile=%LocalAppData%\BlackBeltPrivacy FileKey1=%AppData%\i2pd|i2pd.log FileKey2=%LocalAppData%\BlackBeltPrivacy\3rdParty|*.*|REMOVESELF FileKey3=%LocalAppData%\BlackBeltPrivacy\DarkNet\logs|*.*|RECURSE FileKey4=%LocalAppData%\BlackBeltPrivacy\Docs|*.* FileKey5=%LocalAppData%\BlackBeltPrivacy\Logs|*.*|RECURSE FileKey6=%LocalAppData%\BlackBeltPrivacy\MicroSip|MicroSIP.log ExcludeKey1=FILE|%LocalAppData%\BlackBeltPrivacy\Docs\|readme.pdf [BlackBerry Desktop *] LangSecRef=3023 Detect=HKCU\Software\Research In Motion\BlackBerry FileKey1=%AppData%|Rim*.log FileKey2=%AppData%\Research In Motion\BlackBerry Desktop|*.dmp FileKey3=%AppData%\Research In Motion\BlackBerry\AddinSync|sync.log FileKey4=%AppData%\Research In Motion\BlackBerry\Intellisync|*.log|RECURSE FileKey5=%LocalAppData%\Research In Motion\BlackBerry*Desktop\*\*|*.backup FileKey6=%LocalAppData%\Research In Motion\BlackBerry*Desktop\*\*\Log|*.html FileKey7=%LocalAppData%\Research In Motion\BlackBerry*Desktop\Logs|*.*|REMOVESELF [Blackmagic Design DaVinci Resolve *] LangSecRef=3023 Detect=HKCU\SOFTWARE\Blackmagic Design\DaVinci Resolve FileKey1=%AppData%\Blackmagic Design\DaVinci Resolve\Support\logs|*|REMOVESELF FileKey2=%ProgramData%\Blackmagic Design\DaVinci Resolve\Support\logs|*|REMOVESELF [Blade Symphony *] Section=Games DetectFile=%ProgramFiles%\Steam\Steamapps\common\Blade Symphony FileKey1=%ProgramFiles%\Steam\Steamapps\common\Blade Symphony\workshop_temp|*|RECURSE [Blades of Time *] Section=Games DetectFile=%LocalAppData%\BladesOfTime FileKey1=%LocalAppData%\BladesOfTime\_debuginfo|*.* [BleachBit *] LangSecRef=3024 Detect=HKCU\Software\BleachBit FileKey1=%ProgramFiles%\BleachBit|bleachbit.exe.log [Blender *] LangSecRef=3023 Detect=HKLM\Software\BlenderFoundation FileKey1=%AppData%\Blender Foundation\Blender\*\config|recent-files.txt [Blood Bowl: Legendary Edition *] Section=Games DetectFile=%UserProfile%\Documents\BloodBowlLegendary FileKey1=%UserProfile%\Documents\BloodBowlLegendary|*.log FileKey2=%UserProfile%\Documents\BloodBowlLegendary\Cache\3d|*|REMOVESELF FileKey3=%UserProfile%\Documents\BloodBowlLegendary\Cache\DB|*|REMOVESELF [Bloodstained: Ritual of the Night *] Section=Games DetectFile=%LocalAppData%\BloodstainedRotN FileKey1=%LocalAppData%\BloodstainedRotN\Saved\Logs|*|RECURSE [Blue-Cloner *] LangSecRef=3023 Detect=HKCU\Software\Blue-cloner FileKey1=%AppData%\Blue-Cloner|*.log FileKey2=%AppData%\Blue-Cloner\ReadCache|*.*|REMOVESELF FileKey3=%ProgramFiles%\Blue-Cloner|*.log;*.txt [BlueGriffon *] LangSecRef=3021 DetectFile=%LocalAppData%\Disruptive Innovations SARL\BlueGriffon FileKey1=%LocalAppData%\Disruptive Innovations SARL\BlueGriffon\Profiles\*\Cache|*.*|RECURSE [BlueSky Interactive *] LangSecRef=3022 DetectFile=%ProgramFiles%\BlueSky Interactive FileKey1=%ProgramFiles%\BlueSky Interactive\PTP\Settings|*.tmp [BlueSprig JetClean *] LangSecRef=3024 DetectFile=%ProgramFiles%\BlueSprig\JetClean FileKey1=%AppData%\BlueSprig\JetClean\Backup|*.reg FileKey2=%AppData%\BlueSprig\JetClean\Log|*.* FileKey3=%ProgramFiles%\BlueSprig\JetClean|*_Log.txt FileKey4=%ProgramFiles%\BlueSprig\JetClean\Update|*.*|REMOVESELF [BlueStacks *] LangSecRef=3021 Detect1=HKCU\Software\BlueStacks Detect2=HKLM\Software\BlueStacks FileKey1=%LocalAppData%\BlueStacks|*.log FileKey2=%LocalAppData%\BlueStacksSetup|BlueStacksInstaller*.exe FileKey3=%ProgramData%\BlueStacks\CefData\Cache|*|RECURSE FileKey4=%ProgramData%\BlueStacks\Engine\Android\Logs|*.log* FileKey5=%ProgramData%\BlueStacks\Logs|*.log|RECURSE FileKey6=%ProgramData%\BlueStacksSetup|*.apk FileKey7=%UserProfile%\Pictures\BlueStacks|*_Screenshot_*.jpg [Bluetack Blocklist Manager *] LangSecRef=3024 Detect=HKCU\Software\Bluetack\Blocklist Manager FileKey1=%ProgramFiles%\Bluetack\Blocklist Manager\Cache|*.* [Blumentals Easy GIF Animator *] LangSecRef=3023 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Easy GIF Animator_is1 FileKey1=%ProgramFiles%\Easy GIF Animator|*.txt|RECURSE [Blurity *] LangSecRef=3023 DetectFile=%AppData%\Blurity FileKey1=%AppData%\Blurity|event.log [Boilsoft Video Utilities *] LangSecRef=3023 DetectFile=%AppData%\Boilsoft\Boilsoft Video* FileKey1=%AppData%\Boilsoft\Boilsoft Video*|*.log [Boinc *] LangSecRef=3024 Detect=HKCU\Software\Space Sciences Laboratory, U.C. Berkeley\BOINC Manager FileKey1=%ProgramFiles%\BOINC|stdout*.*;stderr*.* [Borderlands *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Borderlands* FileKey1=%UserProfile%\Documents\My Games\Borderlands*\WillowGame\Logs|*.* [Borland C++ Builder 5.0 *] LangSecRef=3024 Detect=HKCU\Software\Borland\C++Builder\5.0 RegKey1=HKCU\Software\Borland\C++Builder\5.0\Closed Files RegKey2=HKCU\Software\Borland\C++Builder\5.0\Closed Projects RegKey3=HKCU\Software\Borland\C++Builder\5.0\Session [Borland Delphi 7 *] LangSecRef=3024 Detect=HKCU\Software\Borland\Delphi\7.0 RegKey1=HKCU\Software\Borland\Delphi\7.0\Closed Files RegKey2=HKCU\Software\Borland\Delphi\7.0\Closed Projects RegKey3=HKCU\Software\Borland\Delphi\7.0\Session [Borland Developer Studio 2006 *] LangSecRef=3024 Detect=HKCU\Software\Borland\BDS\4.0 RegKey1=HKCU\Software\Borland\BDS\4.0\Closed Files RegKey2=HKCU\Software\Borland\BDS\4.0\Closed Projects RegKey3=HKCU\Software\Borland\BDS\4.0\Session [BOSS *] Section=Games DetectFile=%SystemDrive%\BOSS FileKey1=%SystemDrive%\BOSS\*|BOSSlog.* [Box For Office *] LangSecRef=3021 DetectFile=%LocalAppData%\Box\BoxforOffice* FileKey1=%LocalAppData%\Box\BoxforOfficeLogs|*.* [Breevy *] LangSecRef=3021 DetectFile=%AppData%\Breevy FileKey1=%AppData%\Breevy\Backups|*.* [Bricks of Egypt *] Section=Games DetectFile=%ProgramData%\Arcade Lab FileKey1=%ProgramData%\Arcade Lab|log.txt [Broadcom Wireless LAN Driver *] LangSecRef=3021 DetectFile=%SystemDrive%\Drivers\Broadcom Wireless LAN Driver FileKey1=%SystemDrive%\Drivers\Broadcom Wireless LAN Driver|*.log|RECURSE [BroadWave Streaming Audio *] LangSecRef=3022 DetectFile=%ProgramData%\NCH Software\BroadWave FileKey1=%ProgramData%\NCH Software\BroadWave\Logs|* [Broforce *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\274190 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Broforce\*\Broforce Logs|*.csv [Broken Shortcut Fixer *] LangSecRef=3024 DetectFile=%ProgramFiles%\ConsumerSoft\Broken Shortcut Fixer FileKey1=%ProgramFiles%\ConsumerSoft\Broken Shortcut Fixer|ht.htm [Brother *] LangSecRef=3024 DetectFile=%ProgramData%\Brother FileKey1=%ProgramData%\Brother\BrLog|*.log FileKey2=%ProgramFiles%\Brother|*.tmp|RECURSE [Brother P-touch *] LangSecRef=3021 DetectFile=%LocalAppData%\Brother\P-touch Update Software FileKey1=%LocalAppData%\Brother\P-touch Update Software|*.log [Brothers - A Tale of Two Sons *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\225080 FileKey1=%UserProfile%\Documents\my games\UnrealEngine3\P13\Logs|*.* [BSD *] LangSecRef=3023 DetectFile=%AppData%\BSD FileKey1=%AppData%\BSD\*\logs|*.*|RECURSE FileKey2=%AppData%\BSD\MediaWidget\PodCache|*.*|RECURSE [BSPlayer *] LangSecRef=3021 Detect1=HKCU\Software\BST\bsplayer Detect2=HKCU\Software\BST\bsplayerv1 DetectFile1=%ProgramFiles%\BSPlayer DetectFile2=%ProgramFiles%\Webteh\BSPlayer FileKey1=%AppData%\BSplayer\*|unreg.log FileKey2=%AppData%\BSplayer\AC3 Filter|Changes.txt FileKey3=%AppData%\BSplayer\cache|* FileKey4=%ProgramFiles%\BSPlayer|bugreport.txt FileKey5=%ProgramFiles%\BSPlayer\lang|lang_changes.txt FileKey6=%ProgramFiles%\Webteh\BSplayerPro|*.jpg FileKey7=%ProgramFiles%\Webteh\BSplayerPro\cache|*.mpos [Buchstabenzoo BHV *] LangSecRef=3021 DetectFile=%AppData%\bhv-gswvs\users FileKey1=%AppData%\bhv-gswvs\users\*\Buchstabenzoo|*.log [Bugs Tachy *] LangSecRef=3022 DetectFile=%UserProfile%\Documents\Bugs\Tachy FileKey1=%UserProfile%\Documents\Bugs\Tachy|*.xfer.log FileKey2=%UserProfile%\Documents\Bugs\Tachy\Cache|*.* FileKey3=%UserProfile%\Documents\Bugs\Tachy\Log|*.* FileKey4=%UserProfile%\Documents\Bugs\Tachy\Temp|*.* [Bugsplat *] LangSecRef=3024 Detect=HKCU\Software\Bugsplat RegKey1=HKCU\Software\Bugsplat\gaspowered\SupremeCommander RegKey2=HKCU\Software\Bugsplat\lol_beta_riotgames_com\LOL_Public RegKey3=HKCU\Software\Bugsplat\Pando_win\Pando RegKey4=HKCU\Software\Bugsplat\Relic\CoH RegKey5=HKCU\Software\Bugsplat\Relic\RelicDownloader [Bulk Image Downloader *] LangSecRef=3022 DetectFile=%LocalAppData%\Bulk Image Downloader FileKey1=%AppData%\BID\cef\cache|*.* FileKey2=%AppData%\BID\Log|*.log FileKey3=%LocalAppData%\Bulk Image Downloader\BID_CEF|*.7z FileKey4=%LocalAppData%\Bulk Image Downloader\BID_Chilkat|*.7z RegKey1=HKCU\Software\Antibody Software\Bulk Image Downloader\frmBIM|edDir.Text RegKey2=HKCU\Software\Antibody Software\Bulk Image Downloader\frmBIM|OpenDialog1.InitialDir RegKey3=HKCU\Software\Antibody Software\Bulk Image Downloader\frmBIM|SaveDialog1.InitialDir [Bulk Rename Utility *] LangSecRef=3024 Detect=HKCU\Software\TGRMN Software\Bulk Rename Utility RegKey1=HKCU\Software\TGRMN Software\Bulk Rename Utility\Recent File List RegKey2=HKCU\Software\TGRMN Software\Bulk Rename Utility\Settings|last_path_selected [Bullzip PDF Printer *] LangSecRef=3022 DetectFile=%AppData%\PDF Writer\Bullzip PDF Printer FileKey1=%AppData%\PDF Writer\Bullzip PDF Printer|user.ini [Burger Shop *] Section=Games Detect1=HKCU\Software\GoBit\BurgerShop Detect2=HKCU\Software\GoBit\BurgerShop2 FileKey1=%ProgramData%\GoBit Games\BurgerShop2\*\cached|*|REMOVESELF FileKey2=%ProgramFiles%\Burger Shop|*.db;*.txt|RECURSE FileKey3=%ProgramFiles%\Burger Shop\cached|*|REMOVESELF FileKey4=%ProgramFiles%\GoBit Games\Burger Shop 2|*.db;*.txt|RECURSE [Burn Zombie Burn! *] Section=Games Detect=HKLM\Software\Burn Zombie Burn FileKey1=%ProgramFiles%\P2 Games\Burn Zombie Burn|*.log FileKey2=%ProgramFiles%\P2 Games\Burn Zombie Burn\REQS\NET|*.*|REMOVESELF [Bus-Simulator 2009 *] Section=Games DetectFile=%ProgramFiles%\Bus-Simulator 2009 FileKey1=%ProgramFiles%\Bus-Simulator 2009|*.dmp;*.log|RECURSE [Business Objects Enterprise 11 *] LangSecRef=3021 DetectFile=%ProgramFiles%\Business Objects\Business Objects Enterprise 11 FileKey1=%ProgramFiles%\Business Objects\Business Objects Enterprise 11\Logging|*.* [ByteFence Anti-Malware *] LangSecRef=3024 Detect=HKCU\Software\ByteFence\RTOP FileKey1=%ProgramData%\ByteFence\RTOP|uclogfile.bin FileKey2=%ProgramFiles%\ByteFence\Logs|* [CA Security Center *] LangSecRef=3021 Detect=HKLM\Software\CA\CAPF FileKey1=%ProgramData%\CA|*.log;*.txt|RECURSE FileKey2=%UserProfile%\AppData\LocalLow\CA\Consumer\APH|*.log [Calendar Magic *] LangSecRef=3021 DetectFile1=%ProgramFiles%\EuroSoft\Calendar Magic DetectFile2=%SystemDrive%\EuroSoft\Calendar Magic FileKey1=%ProgramFiles%\EuroSoft\Calendar Magic|debug.txt;*.bak FileKey2=%SystemDrive%\EuroSoft\Calendar Magic|debug.txt;*.bak [Calibre *] LangSecRef=3021 DetectFile=%LocalAppData%\calibre-cache FileKey1=%LocalAppData%\calibre-cache|*.*|RECURSE FileKey2=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\OffTheRecord\GPUCache|*.*|RECURSE FileKey3=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup|Network Persistent State;Visited Links FileKey4=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\blob_storage|*.*|RECURSE FileKey5=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\GPUCache|*.*|RECURSE FileKey6=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\Platform Notifications|*.*|RECURSE FileKey7=%LocalAppData%\calibre-ebook.com\calibre\QtWebEngine\viewer-lookup\Session Storage|*.*|RECURSE [Calico *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Peachy Keen Games\Calico FileKey1=%UserProfile%\AppData\LocalLow\Peachy Keen Games\Calico|*log [Call of Atlantis *] Section=Games Detect=HKLM\Software\Playrix\Call of Atlantis FileKey1=%ProgramData%\Playrix Entertainment\Call of Atlantis*\Log|* [Call of Juarez *] Section=Games DetectFile=%UserProfile%\Documents\Call Of Juarez* FileKey1=%UserProfile%\Documents\Call Of Juarez*\Out\logs|*.log|RECURSE [Cameyo *] LangSecRef=3021 Detect=HKCU\Software\VOS FileKey1=%AppData%\VOS|*.*|REMOVESELF RegKey1=HKCU\Software\VOS [CamStudio *] LangSecRef=3023 Detect=HKCU\Software\CamStudioOpenSource for Nick FileKey1=%UserProfile%\Documents\My CamStudio Temp Files|*.* [Camtasia *] LangSecRef=3023 Detect=HKCU\Software\TechSmith\Camtasia Studio FileKey1=%AppData%\TechSmith\CamtasiaStudio\Logs|*|RECURSE FileKey2=%LocalAppData%\TechSmith\Camtasia Studio\*\Trackerbird_Files|tblog.log FileKey3=%LocalAppData%\TechSmith\Logs|*|RECURSE FileKey4=%ProgramData%\TechSmith\Camtasia Studio *\Library *\Temp|*|RECURSE RegKey1=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Recorder\9.0\General|lstLastSaveDir RegKey2=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|ExportAsZipMru RegKey3=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|FileSaveAsMru RegKey4=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|MRUImportFolder RegKey5=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|MRUOpenProjectFolder RegKey6=HKCU\Software\TechSmith\Camtasia Studio\9.0\Camtasia Studio\9.0|RecentRecordingsMru RegKey7=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Recorder\18.0\General|lstLastSaveDir RegKey8=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|ExportAsZipMru RegKey9=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|FileSaveAsMru RegKey10=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|MRUImportFolder RegKey11=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|MRUOpenProjectFolder RegKey12=HKCU\Software\TechSmith\Camtasia Studio\18.0\Camtasia Studio\18.0|RecentRecordingsMru [Canon *] LangSecRef=3021 DetectFile=%ProgramData%\CanonBJ\IJPrinter\CNMWindows\*log* FileKey1=%ProgramData%\CanonBJ\IJPrinter\CNMWindows|*log*.*|RECURSE [Canon Digital Photo Professional 4 *] LangSecRef=3021 Detect=HKLM\Software\Canon_Inc_IC\DPP4 DetectFile=%ProgramFiles%\Canon\Digital Photo Professional 4 FileKey1=%AppData%\Canon_Inc_IC\DPP4\Application\Temp|*|RECURSE FileKey2=%AppData%\Canon_Inc_IC\DPP4\DppMWare\Cache|*|RECURSE FileKey3=%AppData%\Canon_Inc_IC\ServiceLog\AutoUpdateService|*.txt FileKey4=%AppData%\Canon_Inc_IC\ServiceLog\imagebrowserexservice|*.txt FileKey5=%ProgramData%\Canon_Inc_IC\UniversalInstaller\ServiceLog|*.TXT [Canon Inkjet Print Utility *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_* FileKey1=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\Settings|*.log* FileKey3=%LocalAppData%\Packages\34791E63.CanonInkjetPrintUtility_*\TempState|*|RECURSE [Canon Zoom Browser *] LangSecRef=3021 Detect=HKCU\Software\Canon\ZoomBrowser Ex DetectFile1=%AppData%\ZoomBrowser EX DetectFile2=%UserProfile%\Pictures\My Pictures\ZbThumbnail.info DetectFile3=%UserProfile%\Pictures\ZbThumbnail.info FileKey1=%UserProfile%\Pictures|ZbThumbnail.info|RECURSE [Caphyon *] LangSecRef=3024 DetectFile=%ProgramData%\Caphyon FileKey1=%ProgramData%\Caphyon|*|REMOVESELF [Caprine *] LangSecRef=3022 DetectFile=%AppData%\Caprine FileKey1=%AppData%\Caprine|*-journal;LOG;LOG.old;Network Persistent State|RECURSE FileKey2=%AppData%\Caprine\*Cache|*.*|RECURSE FileKey3=%AppData%\Caprine\blob_storage|*.*|RECURSE FileKey4=%AppData%\Caprine\Caprine\logs|*.* FileKey5=%AppData%\Caprine\logs|*.* FileKey6=%AppData%\Caprine\Session Storage|*.*|RECURSE FileKey7=%LocalAppData%\caprine-updater|*.*|RECURSE [Captcha Brotherhood *] LangSecRef=3024 DetectFile=%LocalAppData%\Captcha_Brotherhood FileKey1=%LocalAppData%\Captcha_Brotherhood|*log*.txt [CareUEyes *] LangSecRef=3021 DetectFile=%AppData%\careueyes FileKey1=%AppData%\careueyes\log|*.* [Casper *] LangSecRef=3024 DetectFile=%ProgramData%\Future Systems Solutions\Casper FileKey1=%ProgramData%\Future Systems Solutions\Casper\Minidump|* [Castle of Illusion *] Section=Games DetectFile=%ProgramFiles%\Castle of Illusion FileKey1=%ProgramFiles%\Castle of Illusion\_CommonRedist\vcredist\*|vc*redist_x*.exe [Casual Arts *] Section=Games DetectFile=%AppData%\CasualArts FileKey1=%AppData%\casualArts\*|logfile.*;*.txt|RECURSE FileKey2=%ProgramData%\casualArts|*|REMOVESELF [Cave Story+ *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\200900 FileKey1=%ProgramFiles%\Steam\steamapps\common\cave story+|log.txt FileKey2=%ProgramFiles%\Steam\steamapps\common\cave story+\data|*.DS_STORE|RECURSE [CC Magic *] Section=Games DetectFile=%UserProfile%\Documents\Electronic Arts\CC Magic\Logs FileKey1=%UserProfile%\Documents\Electronic Arts\CC Magic\Logs|*.log|RECURSE [CCDump *] LangSecRef=3024 DetectFile=%ProgramFiles%\CCleaner\CCDump.exe FileKey1=%ProgramFiles%\CCleaner|winapp.ini;winreg.ini;winsys.ini;regkeys.output.txt [CCleaner *] LangSecRef=3024 Detect=HKCU\Software\Piriform\CCleaner DetectFile=%ProgramFiles%\CCleaner Network\Management Server FileKey1=%ProgramData%\Gibraltar\Local Logs\CCleaner Network|*.glf FileKey2=%ProgramFiles%\CCleaner|*.dmp;*.log;CCleaner_log*.txt;gcapi_*.dll|RECURSE FileKey3=%ProgramFiles%\CCleaner Network\Management Server\Logs|* FileKey4=%ProgramFiles%\CCleaner\Data\log|* FileKey5=%ProgramFiles%\CCleaner\LOG|* FileKey6=%ProgramFiles%\CCleaner\Setup|*|REMOVESELF FileKey7=%ProgramFiles%\CCleaner\temp_ccupdate|*|REMOVESELF FileKey8=%UserProfile%|CCleaner_log*.txt RegKey1=HKLM\Software\Piriform\CCleaner|(Cfg)ABTestingNames RegKey2=HKLM\Software\Piriform\CCleaner|(Cfg)DTNP RegKey3=HKLM\Software\Piriform\CCleaner|(Cfg)DUNP RegKey4=HKLM\Software\Piriform\CCleaner|(Cfg)LastUpdate RegKey5=HKLM\Software\Piriform\CCleaner|BCD RegKey6=HKLM\Software\Piriform\CCleaner|FTU RegKey7=HKLM\Software\Piriform\CCleaner|GD RegKey8=HKLM\Software\Piriform\CCleaner|LatestICS RegKey9=HKLM\Software\Piriform\CCleaner|LLSR RegKey10=HKLM\Software\Piriform\CCleaner|PPC RegKey11=HKLM\Software\Piriform\CCleaner|RunICS RegKey12=HKLM\Software\Piriform\CCleaner|StateSig RegKey13=HKLM\Software\Piriform\CCleaner|STS RegKey14=HKLM\Software\Piriform\CCleaner|UpdateKey [CCTV Security *] LangSecRef=3021 DetectFile=%ProgramFiles%\CCTV Security FileKey1=%ProgramFiles%\CCTV Security\Log|*.* [CD-R Diagnostic *] LangSecRef=3024 Detect=HKCU\Software\CDROM_Productions\CDRDIAG FileKey1=%ProgramFiles%\CDRDiagnostic|*.cnt FileKey2=%UserProfile%\Documents|ERRORLOG.TXT RegKey1=HKCU\Software\CDROM_Productions\CDRDIAG|LastCopyDir RegKey2=HKCU\Software\CDROM_Productions\CDRDIAG|LastDevice [CDBurnerXP *] LangSecRef=3024 Detect=HKCU\Software\Canneverbe Limited\CDBurnerXP FileKey1=%AppData%\Canneverbe Limited\CDBurnerXP|*.log [CDex *] LangSecRef=3024 Detect=HKLM\Software\CDex FileKey1=%UserProfile%\Music\CDDB|*.txt [Centarsia *] LangSecRef=3021 Detect=HKCU\Software\Centarsia RegKey1=HKCU\Software\Centarsia|RecentImage0 RegKey2=HKCU\Software\Centarsia|RecentImage1 RegKey3=HKCU\Software\Centarsia|RecentImage2 RegKey4=HKCU\Software\Centarsia|RecentImage3 RegKey5=HKCU\Software\Centarsia|RecentImage4 RegKey6=HKCU\Software\Centarsia|RecentImage5 RegKey7=HKCU\Software\Centarsia|RecentImage6 [Ceville *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\23460 FileKey1=%AppData%|ceville_console_history.txt FileKey2=%UserProfile%\Documents\Ceville\logs|*.* [CFE Exam Prep Course *] LangSecRef=3021 DetectFile=%ProgramFiles%\CFE Exam Prep Course FileKey1=%AppData%\ACFEExamPrep|*.log FileKey2=%ProgramFiles%\CFE Exam Prep Course\Log|*.*|RECURSE [cFosSpeed *] LangSecRef=3022 DetectFile=%ProgramData%\cFos\cFosSpeed FileKey1=%ProgramData%\cFos\cFosSpeed\Logs|*.ini [Chameleon *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\Chameleon Files FileKey1=%UserProfile%\Documents\Chameleon Files\Cache|*.*|RECURSE FileKey2=%UserProfile%\Documents\Chameleon Files\Log|*.*|RECURSE [Chameleon Clock *] LangSecRef=3021 DetectFile=%ProgramFiles%\Chameleon Clock FileKey1=%ProgramFiles%\Chameleon Clock|clock.lo0.txt [Chameleon Startup Manager *] LangSecRef=3024 Detect=HKCU\Software\NeoSoftTools\System Manager RegKey1=HKCU\Software\NeoSoftTools\System Manager\Common\FileInfo [Champions Online *] Section=Games Detect1=HKCU\Software\Cryptic\Champions Online Detect2=HKCU\Software\Valve\Steam\Apps\9880 FileKey1=%ProgramFiles%\Steam\Steamapps\Common\Champions Online\*\Logs\GameClient|*.* FileKey2=%ProgramFiles%\Steam\Steamapps\Common\Champions Online\Champions Online\*\Cache|*.* FileKey3=%Public%\Games\cryptic studios\Champions Online\*\Cache|*.* FileKey4=%Public%\Games\cryptic studios\Champions Online\*\Logs\GameClient|*.* [Cheat Engine *] LangSecRef=3021 Detect=HKCU\Software\Cheat Engine FileKey1=%ProgramFiles%\Cheat Engine*|*.tmp RegKey1=HKCU\SOFTWARE\Cheat Engine|Recent Files [CheatBook *] LangSecRef=3021 Detect=HKLM\Software\CheatBook FileKey1=%ProgramFiles%\Cheatbook Database *|*log.txt [Chicken Hunter *] Section=Games Detect=HKLM\Software\Chicken Hunter FileKey1=%ProgramFiles%\Chicken Hunter|debug.txt [Chicken Invaders *] Section=Games DetectFile1=%AppData%\InterAction studios\CI3demo DetectFile2=%ProgramData%\InterAction studios\CI2rmdemo DetectFile3=%ProgramFiles%\Chicken*Invaders* FileKey1=%AppData%\InterAction studios|*.log|RECURSE FileKey2=%ProgramData%\InterAction studios|*.log|RECURSE FileKey3=%ProgramFiles%\*\Chicken Invaders*|*.log;*.html;*.png|RECURSE FileKey4=%ProgramFiles%\Chicken*Invaders*|*.log|RECURSE [Children of the Nile *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17100 FileKey1=%UserProfile%\Documents\Tilted Mill\Children of the Nile|*.log [Chivalry: Medieval Warfare *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219640 FileKey1=%UserProfile%\Documents\My Games\Chivalry Medieval Warfare*\UDKGame\Logs|*.* [Chocolatey *] LangSecRef=3024 DetectFile=%ProgramData%\chocolatey FileKey1=%AppData%\ChocolateyGUI\Logs|* FileKey2=%ProgramData%\chocolatey\lib\*|*.txt FileKey3=%ProgramData%\chocolatey\logs|*.log [ChomikBox *] LangSecRef=3022 DetectFile=%LocalAppData%\ChomikBox FileKey1=%LocalAppData%\ChomikBox|*.log;queue-download-*.ini FileKey2=%LocalAppData%\ChomikBox\Backup|*.log FileKey3=%LocalAppData%\ChomikBox\Cache\Thumbs|*.* [Christmas Adventure: Candy Storm *] Section=Games Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Adventure - Candy Storm1.1 Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Adventure - Candy Stormv1.3 DetectFile=%ProgramFiles%\Christmas Adventure - Candy Storm FileKey1=%AppData%\Argali|*.log|RECURSE FileKey2=%ProgramFiles%\Christmas Adventure - Candy Storm|*.nfo;*.txt FileKey3=%ProgramFiles%\Foxy Games\Christmas Adventure - Candy Storm|*.html;*.msi;*.nfo;*.txt;*.url [Christmas Griddlers 2014 *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Griddlers 20141.1 FileKey1=%ProgramFiles%\*\Christmas Griddlers*|*.ico;*.html;*msi;*.nfo;*.txt;*.url|RECURSE FileKey2=%ProgramFiles%\Christmas Griddlers*|*.ico;*.html;*msi;*.nfo;*.txt;*.url|RECURSE [Christmas Wonderland *] Section=Games Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 2 Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 3 1.0 Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 4 1.0.4 Detect4=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 21.0 Detect5=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 31.0 Detect6=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Christmas Wonderland 41.1 FileKey1=%ProgramFiles%\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE FileKey2=%ProgramFiles%\Foxy Games\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE FileKey3=%SystemDrive%\Games\Christmas Wonderland *|*.html;*.nfo;*.txt;*.url|RECURSE [Chroma Squad *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad FileKey1=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad|*txt FileKey2=%UserProfile%\AppData\LocalLow\Behold Studios\Chroma Squad\Crashes|* [Chromium Embedded Framework *] LangSecRef=3022 DetectFile=%LocalAppData%\CEF\User Data FileKey1=%LocalAppData%\CEF\User Data|*.pma [Chronos Atomic Clock Synchronizer *] LangSecRef=3024 Detect=HKLM\Software\Chronos RegKey1=HKLM\Software\Chronos|LastCorrectionTime RegKey2=HKLM\Software\Chronos|LastCorrectionValue [Chuzzle Deluxe *] Section=Games DetectFile=%ProgramFiles%\HP Games\Chuzzle Deluxe FileKey1=%ProgramFiles%\HP Games\Chuzzle Deluxe|DEBUG.TXT [Cinema Tycoon *] Section=Games DetectFile=%ProgramFiles%\Cinema Tycoon* FileKey1=%ProgramFiles%\Cinema Tycoon*|flashplayer7_winax.exe;*.txt [Cisco Connect *] LangSecRef=3022 DetectFile=%ProgramData%\Cisco Systems\Cisco Connect FileKey1=%ProgramData%\Cisco Systems\Cisco Connect\Log|* [Cisco HostScan *] LangSecRef=3021 DetectFile=%LocalAppData%\Cisco\Cisco HostScan FileKey1=%LocalAppData%\Cisco\Cisco HostScan\log|*.log [Cisco VPN *] LangSecRef=3022 DetectFile=%UserProfile%\.cisco\VPN FileKey1=%UserProfile%\.cisco\VPN\Log|*.txt [Cisco WebEx *] LangSecRef=3022 DetectFile=%LocalAppData%\WebEx FileKey1=%LocalAppData%\WebEx|webex_*.ini.bk FileKey2=%LocalAppData%\WebEx\wbxcache|*.*|RECURSE [Cities in Motion *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\73010 FileKey1=%UserProfile%\Documents\Cities in Motion|log_metro.txt [Citrix Online Plug-in Web Setup Files *] LangSecRef=3021 Detect=HKLM\Software\Citrix\ICA Client FileKey1=%ProgramData%\Citrix\Citrix Online Plug-in - Web|*.msi;*.cab;eula*.rtf [Citrix Receiver *] LangSecRef=3021 Detect=HKLM\Software\Citrix\ICA Client DetectFile=%LocalAppData%\Citrix\Receiver FileKey1=%AppData%\Citrix\ICA Client\Cache|*.*|RECURSE FileKey2=%AppData%\ICAClient|wfcwin*.log FileKey3=%AppData%\ICAClient\Cache|*.*|RECURSE FileKey4=%LocalAppData%\Citrix\AuthManager\Logs|*.* FileKey5=%LocalAppData%\Citrix\Citrix Files\Logs|*.* FileKey6=%LocalAppData%\Citrix\Receiver|*.log*;ErrorLog.xml FileKey7=%LocalAppData%\Citrix\SelfService\Temp|*.* FileKey8=%ProgramFiles%\Citrix\ICA Client|wfclient.log RegKey1=HKLM\Software\Citrix\ICA Client\Default [Civilization *] Section=Games Detect1=HKCU\Software\Firaxis\Civilization5 Detect2=HKLM\Software\Firaxis Games DetectFile=%AppData%\My Games\Civilizaton 4 FileKey1=%AppData%\My Games\Beyond the Sword\cache|*.dat FileKey2=%AppData%\My Games\Civilizaton 4\Cache|*|RECURSE FileKey3=%AppData%\My Games\Sid Meier's Civilization*\cache|*.dat FileKey4=%AppData%\My Games\Warlords\cache|*.dat FileKey5=%LocalAppData%\My Games\Beyond the Sword\cache|*.dat FileKey6=%LocalAppData%\My Games\Sid Meier's Civilization*\cache|*.dat FileKey7=%LocalAppData%\My Games\Warlords\cache|*.dat FileKey8=%ProgramFiles%\2K Games\Firaxis Games\Sid Meier's Civilization IV Colonization|*.txt FileKey9=%ProgramFiles%\Firaxis Games\Sid Meier's Civilization 4|*.txt FileKey10=%ProgramFiles%\Firaxis Games\Sid Meier's Civilization 4\*|*.txt FileKey11=%UserProfile%\Documents\My Games\Beyond the Sword\Logs|* FileKey12=%UserProfile%\Documents\My Games\Sid Meier's Civilization*\cache|*|RECURSE FileKey13=%UserProfile%\Documents\My Games\Sid Meier's Civilization*\Logs|* FileKey14=%UserProfile%\Documents\My Games\Warlords\Logs|* [Civilization 5 Installers *] Section=Games Detect=HKCU\Software\Firaxis\Civilization5 FileKey1=%ProgramFiles%\Civilization V*\DirectX|*.*|REMOVESELF FileKey2=%ProgramFiles%\Civilization V*\VCRedist|*.*|REMOVESELF [Civilization 5 Old AutoSaves *] Section=Games Detect=HKCU\Software\Firaxis\Civilization5 FileKey1=%UserProfile%\Documents\My Games\Sid Meier's Civilization 5\Saves\*\auto\prev|*.Civ5Save [Clam Sentinel *] LangSecRef=3021 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{060FE577-1BDF-4330-ACCA-B6760AB07191}_is1 FileKey1=%AppData%\ClamSentinel|*.txt FileKey2=%ProgramFiles%\ClamSentinel|*.txt [ClamWin *] LangSecRef=3021 Detect1=HKCU\Software\ClamWin Detect2=HKLM\Software\ClamWin DetectFile=%SystemDrive%\PortableApps\ClamWinPortable FileKey1=%AppData%\.clamwin\log|*|RECURSE FileKey2=%ProgramData%\.clamwin\log|*|RECURSE FileKey3=%ProgramFiles%\ClamWin\bin|*.txt FileKey4=%SystemDrive%\PortableApps\ClamWinPortable\Data\db\clamav*|*|REMOVESELF FileKey5=%SystemDrive%\PortableApps\ClamWinPortable\Data\db\tmp.*|*|REMOVESELF [ClassicShell *] LangSecRef=3024 Detect=HKCU\Software\IvoSoft\ClassicStartMenu RegKey1=HKCU\Software\IvoSoft\ClassicStartMenu\MRU [Clean Genius 3 *] LangSecRef=3024 DetectFile=%ProgramFiles%\CleanGenius 3\Update FileKey1=%ProgramFiles%\CleanGenius 3\Update|update.log [Clean Master *] LangSecRef=3024 Detect=HKCU\Software\cmcm\cleanMaster DetectFile=%ProgramFiles%\cmcm\Clean Master FileKey1=%ProgramFiles%\Clean Master|*.log* FileKey2=%ProgramFiles%\Clean Master\log|*.* FileKey3=%ProgramFiles%\cmcm\Clean Master\log|ktrashscan.benchmark [CleanMyPC Registry Cleaner *] LangSecRef=3024 Detect=HKCU\Software\CleanMyPC\CleanMyPC - Registry Cleaner FileKey1=%AppData%\CleanMyPC Software\CleanMyPC Registry Cleaner|fixlog.ini RegKey1=HKCU\Software\CleanMyPC\CleanMyPC - Registry Cleaner\Recent File List [CleanUp! *] LangSecRef=3024 Detect=HKCU\Software\stevengould.org\CleanUp! FileKey1=%AppData%|CleanUp!.log RegKey1=HKCU\Software\stevengould.org\CleanUp!\Statistics [ClearProg *] LangSecRef=3024 DetectFile=%AppData%\ClearProg FileKey1=%AppData%\ClearProg|ClearProg.log RegKey1=HKCU\Software\ClearProg|PlugIns [Clementine *] LangSecRef=3023 Detect=HKCU\Software\Clementine FileKey1=%UserProfile%\.config\Clementine\networkcache\http|*.cache|RECURSE [Click.to *] LangSecRef=3021 DetectFile=%LocalAppData%\click.to FileKey1=%LocalAppData%\click.to|*.txt|RECURSE [ClickFree Full Imaging Backup *] LangSecRef=3024 DetectFile=%ProgramData%\ClickFree\FullImagingBackup FileKey1=%ProgramData%\ClickFree\FullImagingBackup|*.log [ClipGrab *] LangSecRef=3023 DetectFile=%LocalAppData%\ClipGrab\ClipGrab FileKey1=%LocalAppData%\ClipGrab\ClipGrab\QtWebEngine\Default|Visited Links FileKey2=%LocalAppData%\ClipGrab\ClipGrab\QtWebEngine\Default\blob_storage|*.*|RECURSE FileKey3=%LocalAppData%\ClipGrab\ClipGrab\QtWebEngine\Default\GPUCache|*.* [ClipX *] LangSecRef=3024 DetectFile=%LocalAppData%\ClipX FileKey1=%LocalAppData%\ClipX\Storage|*.* [Clockify *] LangSecRef=3024 DetectFile=%AppData%\Clockify FileKey1=%AppData%\Clockify\*Cache|*.* FileKey2=%AppData%\Clockify\*logs|*.* [CloneDVD *] LangSecRef=3021 Detect=HKCU\Software\Elaborate Bytes\CloneDVD2 RegKey1=HKCU\Software\Elaborate Bytes\CloneDVD2|AnimationProcessingPath RegKey2=HKCU\Software\Elaborate Bytes\CloneDVD2|AnimationWritingPath RegKey3=HKCU\Software\Elaborate Bytes\CloneDVD2|LogFilePath RegKey4=HKCU\Software\Elaborate Bytes\CloneDVD2|VideoFilesPath [CloneSpy *] LangSecRef=3024 DetectFile=%ProgramFiles%\CloneSpy FileKey1=%ProgramFiles%\CloneSpy|CloneSpy.log FileKey2=%UserProfile%\Documents\CloneSpy|CloneSpy.log [Cloudflare Warp VPN *] LangSecRef=3022 DetectFile=%ProgramFiles%\Cloudflare\Cloudflare WARP FileKey1=%LocalAppData%\Cloudflare|WARP-GUI.log [Clover *] LangSecRef=3024 Detect=HKCU\Software\Clover FileKey1=%LocalAppData%\Clover\User Data\Default|Bookmarks.bak;Current *;Last * FileKey2=%LocalAppData%\Clover\User Data\Default\JumpListIcons*|*tmp FileKey3=%LocalAppData%\Clover\User Data\temp|*.*|RECURSE [Cobian Backup *] LangSecRef=3024 DetectFile=%ProgramFiles%\Cobian Backup* FileKey1=%ProgramFiles%\Cobian Backup*\Logs|*.* FileKey2=%ProgramFiles%\Cobian Backup*\Settings|Cobian Backup*last updated.ini [CobraTek PC Info *] LangSecRef=3024 Detect=HKCU\Software\CobraTek\PC Info FileKey1=%LocalAppData%\CobraTek\PC Info\ChangeLog|*.txt FileKey2=%LocalAppData%\CobraTek\PC Info\Log|*.* [Cocosenor System Tuner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Cocosenor System Tuner FileKey1=%ProgramFiles%\Cocosenor System Tuner|*.log [CodeGear RAD Studio 2009 *] LangSecRef=3024 Detect=HKCU\Software\CodeGear\BDS\6.0 RegKey1=HKCU\Software\CodeGear\BDS\6.0\Closed Files RegKey2=HKCU\Software\CodeGear\BDS\6.0\Closed Projects RegKey3=HKCU\Software\CodeGear\BDS\6.0\Session [CodeMeter *] LangSecRef=3023 DetectFile=%ProgramData%\CodeMeter FileKey1=%ProgramData%\CodeMeter\Logs|* [CoffeeCup GIF Animator *] LangSecRef=3024 Detect=HKCU\Software\CoffeeCup Software\GIF Animator RegKey1=HKCU\Software\CoffeeCup Software\GIF Animator\Settings\MRU [Cogs *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\26500 FileKey1=%LocalAppData%\Lazy 8 Studio\Cogs|log.txt [CoinManage *] LangSecRef=3021 Detect1=HKCU\Software\Liberty Street Software\CoinManage Detect2=HKCU\Software\Liberty Street Software\CoinManage Canada FileKey1=%ProgramFiles%\CoinManage*|*.txt FileKey2=%UserProfile%\Documents|CoinManage.zip;CRASH.DMP;ERRORLOG.TXT;XCrashReport.ini;XCRASHREPORT_Mon1.bmp [ColorSchemer *] LangSecRef=3023 Detect=HKCU\Software\ColorSchemer FileKey1=%AppData%\ColorSchemer\Studio\*|recentfiles.xml [ComboFix *] LangSecRef=3024 DetectFile=%SystemDrive%\Qoobox FileKey1=%SystemDrive%|ComboFix.txt FileKey2=%SystemDrive%\*.tmp|*.*|REMOVESELF FileKey3=%SystemDrive%\Qoobox|*.txt FileKey4=%SystemDrive%\Qoobox\LastRun|*.*|REMOVESELF FileKey5=%SystemDrive%\Qoobox\Quarantine|*.log FileKey6=%SystemDrive%\Qoobox\Test*|*.*|REMOVESELF [Comfort Keys Pro *] LangSecRef=3021 DetectFile=%AppData%\ComfortSoftware FileKey1=%AppData%\ComfortSoftware\CKeys|*.* [ComicRack *] LangSecRef=3021 DetectFile=%LocalAppData%\cYo\ComicRack FileKey1=%LocalAppData%\cYo\ComicRack\Cache\Images|*.*|RECURSE FileKey2=%LocalAppData%\cYo\ComicRack\Cache\Thumbnails|*.*|RECURSE [Command Line Shell *] LangSecRef=3024 Detect=HKCU\Software\Juan M. Aguirregabiria\CmdShEd RegKey1=HKCU\Software\Juan M. Aguirregabiria\CmdShEd\Previous [Comodo *] LangSecRef=3024 Detect=HKCU\Software\ComodoGroup FileKey1=%AppData%\Comodo\CCE\Logs|*.* FileKey2=%AppData%\ComodoGroup\CSC\Cache|* FileKey3=%LocalAppData%\COMODO|*.tmp FileKey4=%ProgramData%\Comodo Downloader|* FileKey5=%ProgramData%\Comodo\Cis\Quarantine\Temp\TempFiles|* FileKey6=%ProgramData%\Comodo\CisDumps|* FileKey7=%ProgramData%\Comodo\Firewall Pro|cislogs.sdb FileKey8=%ProgramData%\Comodo\Installer|* FileKey9=%ProgramFiles%\COMODO\COMODO Internet Security|*.tmp;CRASH.DMP;cmdagent.zip [Comodo AV Sandbox *] LangSecRef=3024 DetectFile=%SystemDrive%\VritualRoot FileKey1=%SystemDrive%\VritualRoot|*.*|RECURSE [Comodo CertSentry *] LangSecRef=3022 Detect=HKLM\Software\COMODO\CertSentry FileKey1=%LocalAppData%\COMODO\CertSentry|*.log [Comodo GeekBuddy *] LangSecRef=3021 Detect=HKLM\Software\GeekBuddyRSP DetectFile=%ProgramFiles%\Comodo\GeekBuddy FileKey1=%ProgramFiles%\Comodo\GeekBuddy\logs|*.*|RECURSE [Comodo System Utilities *] LangSecRef=3024 DetectFile=%ProgramFiles%\COMODO\COMODO System Utilities FileKey1=%ProgramFiles%\COMODO\COMODO System Utilities\backup|*.*|RECURSE FileKey2=%ProgramFiles%\COMODO\COMODO System Utilities\dumps|*.*|RECURSE FileKey3=%ProgramFiles%\COMODO\COMODO System Utilities\logs|*.*|RECURSE FileKey4=%ProgramFiles%\COMODO\COMODO System Utilities\temp|*.*|RECURSE FileKey5=%ProgramFiles%\COMODO\COMODO System Utilities\update|*.*|RECURSE [Company of Heroes *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Company of Heroes* FileKey1=%UserProfile%\Documents\My Games\Company of Heroes*|*.log FileKey2=%UserProfile%\Documents\My Games\Company of Heroes*\Cache|*.* FileKey3=%UserProfile%\Documents\My Games\Company of Heroes*\LogFiles|*.* FileKey4=%UserProfile%\Documents\My Games\RelicDownloader|*.log [Complete Internet Repair *] LangSecRef=3024 DetectFile=%AppData%\Rizonesoft\ComIntRep FileKey1=%AppData%\Rizonesoft\ComIntRep\Logging|*.*|RECURSE [Conceiva Mezzmo *] LangSecRef=3023 Detect=HKLM\Software\Conceiva\Mezzmo FileKey1=%LocalAppData%\Conceiva\Logs|*|REMOVESELF FileKey2=%LocalAppData%\Conceiva\Mezzmo|DebugCERwrite.txt FileKey3=%LocalAppData%\Conceiva\Mezzmo\Temporary_*_Files|*|REMOVESELF FileKey4=%ProgramData%\Conceiva\*|*.bat;*.exe;*.txt FileKey5=%ProgramData%\Conceiva\Mezzmo\CER|*.zip FileKey6=%ProgramFiles%\Conceiva\Mezzmo|*.txt FileKey7=%ProgramFiles%\Conceiva\Mezzmo\Third\MKVToolNix|*.txt FileKey8=%ProgramFiles%\Conceiva\Mezzmo\Third\OGMDemuxer\doc|*|REMOVESELF RegKey1=HKCU\Software\Conceiva\Mezzmo\General|LastWatchFolder [Conduit *] LangSecRef=3021 Detect=HKCU\Software\Conduit FileKey1=%LocalAppData%\*Elf_*\CacheIcons|* FileKey2=%LocalAppData%\*Elf_*\Logs|* FileKey3=%LocalAppData%\Conduit\Community Alerts\Log|*|REMOVESELF FileKey4=%LocalAppData%\ConduitEngine\CacheIcons|* FileKey5=%LocalAppData%\ConduitEngine\Logs|* FileKey6=%UserProfile%\AppData\LocalLow\*Elf_*\CacheIcons|* FileKey7=%UserProfile%\AppData\LocalLow\*Elf_*\Logs|* FileKey8=%UserProfile%\AppData\LocalLow\Conduit\Community Alerts\Log|*|REMOVESELF FileKey9=%UserProfile%\AppData\LocalLow\ConduitEngine\CacheIcons|* FileKey10=%UserProfile%\AppData\LocalLow\ConduitEngine\Logs|* FileKey11=%UserProfile%\AppData\LocalLow\key_bar\CacheIcons|* FileKey12=%UserProfile%\AppData\LocalLow\key_bar\Logs|* FileKey13=%UserProfile%\AppData\LocalLow\key_bar\Repository\Conduit_*|*.bck.txt|RECURSE FileKey14=%WinDir%\System32|ConduitEngine.tmp [Conexant *] LangSecRef=3024 Detect=HKCU\Software\Conexant FileKey1=%ProgramData%\Conexant\UCILogs\COINST|*.log FileKey2=%Public%|CAFADEBUG.log [Connectify Hotspot *] LangSecRef=3022 Detect=HKLM\Software\Connectify FileKey1=%ProgramData%\Connectify\cache|*.time;*.cache;*.runtime FileKey2=%ProgramFiles%\Connectify\Installer|*|REMOVESELF FileKey3=%ProgramFiles%\Connectify\Portal|*|REMOVESELF [Conquer Online *] Section=Games DetectFile=%ProgramFiles%\NetDragon\Conquer Online 2.0\AutoPatch FileKey1=%ProgramFiles%\NetDragon\Conquer Online 2.0\AutoPatch|Update.log [ConTEXT *] LangSecRef=3021 Detect=HKCU\Software\Eden\ConTEXT RegKey1=HKCU\Software\Eden\ConTEXT\FileHistory RegKey2=HKCU\Software\Eden\ConTEXT\FindHistory [Cook'n *] LangSecRef=3021 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n FileKey1=%AppData%\Mozilla\eclipse\Cache|*.* FileKey2=%LocalAppData%\DVO\Cook'n*App|*.log|RECURSE FileKey3=%LocalAppData%\DVO\Cook'n10App\plugins|Getting Started Guide.rtf|RECURSE FileKey4=%UserProfile%\Documents\Cook'n*|*.log|RECURSE [Cook'n Backups *] LangSecRef=3021 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cook'n FileKey1=%UserProfile%\Documents\Cook'n Backups|*.ckn FileKey2=%UserProfile%\Documents\Cook'n10\Workspace\data|download;dvodb.backup FileKey3=%UserProfile%\Documents\Cook'n10\Workspace\update|update.zip FileKey4=%UserProfile%\Documents\Cook'n11\Download|*.* [Coolmuster PDF Image Extractor *] LangSecRef=3023 DetectFile=%ProgramFiles%\Coolmuster\Coolmuster PDF Image Extractor FileKey1=%UserProfile%\Documents\Coolmuster files\Coolmuster PDF Image Extractor|PDF_IMAGE_EXTRACTOR_COOL.cfg [Copernic Desktop Search *] LangSecRef=3024 DetectFile1=%AppData%\Copernic\DesktopSearch* DetectFile2=%LocalAppData%\Copernic\DesktopSearch* FileKey1=%AppData%\Copernic\DesktopSearch*\Logs|*.*|REMOVESELF FileKey2=%LocalAppData%\Copernic\DesktopSearch*\Logs|*.*|REMOVESELF [Copy as Path ContextMenu *] LangSecRef=3024 DetectFile=%ProgramFiles%\Copy Path Context Menu FileKey1=%ProgramFiles%\Copy Path Context Menu|*.log [CopyQ *] LangSecRef=3021 DetectFile=%AppData%\copyq FileKey1=%AppData%\copyq|*.bak FileKey2=%AppData%\copyq\copyq|copyq.log [CopyTo Synchronizer *] LangSecRef=3024 Detect=HKCU\Software\kishDesign\CopyTo RegKey1=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder00 RegKey2=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder01 RegKey3=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder02 RegKey4=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder03 RegKey5=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder04 RegKey6=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder05 RegKey7=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder06 RegKey8=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder07 RegKey9=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder08 RegKey10=HKCU\Software\kishDesign\CopyTo\settings3|scutFolder09 RegKey11=HKCU\Software\kishDesign\CopyTo\settings3|scutname00 RegKey12=HKCU\Software\kishDesign\CopyTo\settings3|scutname01 RegKey13=HKCU\Software\kishDesign\CopyTo\settings3|scutname02 RegKey14=HKCU\Software\kishDesign\CopyTo\settings3|scutname03 RegKey15=HKCU\Software\kishDesign\CopyTo\settings3|scutname04 RegKey16=HKCU\Software\kishDesign\CopyTo\settings3|scutname05 RegKey17=HKCU\Software\kishDesign\CopyTo\settings3|scutname06 RegKey18=HKCU\Software\kishDesign\CopyTo\settings3|scutname07 RegKey19=HKCU\Software\kishDesign\CopyTo\settings3|scutname08 RegKey20=HKCU\Software\kishDesign\CopyTo\settings3|scutname09 RegKey21=HKCU\Software\kishDesign\CopyTo\settings3|Source00 RegKey22=HKCU\Software\kishDesign\CopyTo\settings3|Source01 RegKey23=HKCU\Software\kishDesign\CopyTo\settings3|Source02 RegKey24=HKCU\Software\kishDesign\CopyTo\settings3|Source03 RegKey25=HKCU\Software\kishDesign\CopyTo\settings3|Source04 RegKey26=HKCU\Software\kishDesign\CopyTo\settings3|Source05 RegKey27=HKCU\Software\kishDesign\CopyTo\settings3|Source06 RegKey28=HKCU\Software\kishDesign\CopyTo\settings3|Source07 RegKey29=HKCU\Software\kishDesign\CopyTo\settings3|Source08 RegKey30=HKCU\Software\kishDesign\CopyTo\settings3|Source09 RegKey31=HKCU\Software\kishDesign\CopyTo\settings3|target00 RegKey32=HKCU\Software\kishDesign\CopyTo\settings3|target01 RegKey33=HKCU\Software\kishDesign\CopyTo\settings3|target02 RegKey34=HKCU\Software\kishDesign\CopyTo\settings3|target03 RegKey35=HKCU\Software\kishDesign\CopyTo\settings3|target04 RegKey36=HKCU\Software\kishDesign\CopyTo\settings3|target05 RegKey37=HKCU\Software\kishDesign\CopyTo\settings3|target06 RegKey38=HKCU\Software\kishDesign\CopyTo\settings3|target07 RegKey39=HKCU\Software\kishDesign\CopyTo\settings3|target08 RegKey40=HKCU\Software\kishDesign\CopyTo\settings3|target09 [CopyTrans *] LangSecRef=3023 DetectFile1=%AppData%\WindSolutions\CopyTrans* DetectFile2=%ProgramData%\WindSolutions\CopyTrans* FileKey1=%ProgramData%\WindSolutions|*.txt|RECURSE FileKey2=%ProgramData%\WindSolutions\CopyTrans*\Logs|*|RECURSE [Core Temp *] LangSecRef=3024 DetectFile=%ProgramFiles%\Core Temp FileKey1=%ProgramFiles%\Core Temp|*.csv [Corel AfterShot Pro *] LangSecRef=3023 Detect=HKCU\Software\Corel\AfterShot Pro V3 FileKey1=%LocalAppData%\Corel\AfterShot Pro *|*.log FileKey2=%LocalAppData%\Corel\AfterShot Pro *\Cache|*.*|RECURSE [Corel Downloads *] LangSecRef=3021 DetectFile=%ProgramData%\Corel\Downloads FileKey1=%ProgramData%\Corel\Downloads|*|RECURSE [Corel PaintShop Pro *] LangSecRef=3023 Detect1=HKCU\Software\Corel\PaintShop Pro Detect2=HKCU\Software\Corel\PhotoDownloader FileKey1=%AppData%\Corel\PaintShop Photo Pro\13\Cache|*|RECURSE FileKey2=%LocalAppData%\Corel|*.db;*.PspCache FileKey3=%LocalAppData%\Corel PaintShop Pro\*\Cache|* FileKey4=%LocalAppData%\Corel PaintShop Pro\*\Database|*.db FileKey5=%LocalAppData%\Corel PaintShop Pro\*\Thumbs|*|RECURSE FileKey6=%LocalAppData%\Corel\Thumbs|*|RECURSE RegKey1=HKCU\Software\Corel\PaintShop Pro\X7\CoreMemoryManager\0 RegKey2=HKCU\Software\Corel\PaintShop Pro\X10\CoreMemoryManager\0 RegKey3=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DefaultDownloadFolder RegKey4=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DownloadFolder [Corel PaintShop Pro AutoPreserve *] LangSecRef=3023 Detect=HKCU\Software\Corel\PaintShop Pro FileKey1=%UserProfile%\Pictures\Corel Auto-Preserve|* [Corel PhotoImpact X3 *] LangSecRef=3023 DetectFile=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0 FileKey1=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0\Ulead.DAT\BwsCache|*.* FileKey2=%AppData%\Ulead Systems\Ulead PhotoImpact\13.0\Ulead.DAT\Recently|*.lnk [Corel VideoStudio Pro *] LangSecRef=3023 Detect=HKCU\Software\Ulead Systems\Corel VideoStudio Pro FileKey1=%UserProfile%\Documents\Corel VideoStudio Pro\*.0\AudioTmp|* FileKey2=%UserProfile%\Documents\Corel VideoStudio Pro\*.0\SmartProxy|* RegKey1=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\14.0\Preference|Working Folder RegKey2=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\16.0\HerRFL RegKey3=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\17.0\HerRFL [Corel Wordperfect *] LangSecRef=3021 Detect=HKCU\Software\Corel\User Assistant RegKey1=HKCU\Software\Corel\User Assistant\11\Recent Work\Presentations RegKey2=HKCU\Software\Corel\User Assistant\12\Recent Work\Presentations RegKey3=HKCU\Software\Corel\User Assistant\13\Recent Work\Presentations RegKey4=HKCU\Software\Corel\User Assistant\14\Recent Work\Presentations RegKey5=HKCU\Software\Corel\User Assistant\X3\Recent Work\Presentations RegKey6=HKCU\Software\Corel\User Assistant\X4\Recent Work\Presentations [CorelDRAW Graphics Suite X7 *] LangSecRef=3021 Detect=HKCU\Software\Corel\CorelDRAW\17.0 FileKey1=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Config|corelpdf.ini;capture.ini FileKey2=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Connect|Connect.config FileKey3=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw|FindAndReplaceMRU.xml FileKey4=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\Export|dialog.export.web.xml FileKey5=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\Presets\HTML Export|default.pst FileKey6=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\Draw\PreviewCache|*|RECURSE FileKey7=%LocalAppData%\Corel\CorelDRAW Graphics Suite X7\PHOTO-PAINT\PreviewCache|*|RECURSE FileKey8=%ProgramData%\Bitstream\Font Navigator\6.0\Cache|*|RECURSE FileKey9=%ProgramFiles%\Corel\CorelDRAW Graphics Suite X7\Setup|*|REMOVESELF RegKey1=HKCU\Software\Bitstream\Font Navigator\6.0\Copy|Folders RegKey2=HKCU\Software\Bitstream\Font Navigator\6.0\Move|Folders RegKey3=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\Directories|DrawDocsDir RegKey4=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\Framework|RecentFiles RegKey5=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\HTML Export|DestPath RegKey6=HKCU\Software\Corel\CorelDRAW\17.0\Draw\Application Preferences\NewFromTemplate|BrowseTemplateDir RegKey7=HKCU\Software\Corel\CorelDRAW\17.0\PHOTO-PAINT\Application Preferences\Framework|RecentFiles [Corsair iCue *] LangSecRef=3024 DetectFile=%ProgramData%\Corsair\CUE\Service logs FileKey1=%LocalAppData%\Corsair\CUE\logs|*.log FileKey2=%ProgramData%\Corsair\CorsairLLAccessService|*.log FileKey3=%ProgramData%\Corsair\CUE\Service logs|Service_Trace*.log [Cortana *] LangSecRef=3025 DetectFile1=%LocalAppData%\Packages\Microsoft.*Cortana* DetectFile2=%LocalAppData%\Packages\Microsoft.549981C3F5F10* FileKey1=%LocalAppData%\Packages\Microsoft.*Cortana*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.*Cortana*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.*Cortana*\LocalCache\Local\*|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.*Cortana*\LocalState|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.*Cortana*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.*Cortana*\TempState|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.549981C3F5F10*\AC|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.549981C3F5F10*\LocalCache|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.549981C3F5F10*\Settings|*.log* FileKey10=%LocalAppData%\Packages\Microsoft.549981C3F5F10*\TempState|*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\DeviceSearchCache\|SettingsCache.txt [Counter-Strike *] Section=Games DetectFile=%ProgramFiles%\Counter-Strike* FileKey1=%ProgramFiles%\Counter-Strike*|*.log FileKey2=%ProgramFiles%\Counter-Strike*\cstrike\addons\amxmodx\logs|*.log FileKey3=%ProgramFiles%\Counter-Strike*\cstrike\lhdoc\Demo Player\SK Player|history.txt FileKey4=%ProgramFiles%\Counter-Strike*\valve\bin|*.log [CounterSpy *] LangSecRef=3024 Detect=HKLM\Software\Sunbelt Software\CounterSpy FileKey1=%ProgramData%\Sunbelt Software\CounterSpy\Logs|* [CrashRpt *] LangSecRef=3024 DetectFile=%LocalAppData%\CrashRpt FileKey1=%LocalAppData%\CrashRpt|*.*|RECURSE [Crayon Physics Deluxe *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\26900 FileKey1=%AppData%\Crayon Physics Deluxe|log.txt FileKey2=%AppData%\Crayon Physics Deluxe\data\recordings\temp|current_recording.tmp FileKey3=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe|log.txt FileKey4=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\cache|*.* FileKey5=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\data\editor|*.tmp FileKey6=%ProgramFiles%\Steam\steamapps\common\crayon physics deluxe\data\recordings\temp|*.tmp [Creative Installation Information *] LangSecRef=3024 DetectFile=%ProgramFiles%\Creative Installation Information FileKey1=%ProgramFiles%\Creative Installation Information|*.log|RECURSE [Creative Live! Central 3 *] LangSecRef=3023 DetectFile=%AppData%\Creative\Live! Central 3 FileKey1=%AppData%\Creative\Live! Central 3|*.txt|RECURSE [Creative Pro Proteus VX *] LangSecRef=3023 Detect=HKCU\Software\Creative Professional\Proteus VX RegKey1=HKCU\Software\Creative Professional\Proteus VX VSTi\Recent File List [Creative Sound Blaster *] LangSecRef=3024 DetectFile=%ProgramData%\Creative\Software Update FileKey1=%ProgramData%\Creative\Software Update\Cache|*|RECURSE FileKey2=%ProgramData%\Creative\Software Update\Log|* [Cricut Design Space *] LangSecRef=3021 DetectFile=%AppData%\Cricut Design Space FileKey1=%AppData%\Cricut Design Space|*-journal;*.old;LOG;Network Persistent State|RECURSE FileKey2=%AppData%\Cricut Design Space\*Cache|*.*|RECURSE FileKey3=%AppData%\Cricut Design Space\blob_storage|*.*|RECURSE FileKey4=%AppData%\Cricut Design Space\Native\Logs|*.* [Crusader Kings *] Section=Games DetectFile=%UserProfile%\Documents\Paradox Interactive\Crusader Kings * FileKey1=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Cache|* FileKey2=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Crashes|*|REMOVESELF FileKey3=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Dumps|* FileKey4=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\Logs|* FileKey5=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\oos|*.log|RECURSE FileKey6=%UserProfile%\Documents\Paradox Interactive\Crusader Kings*\TerrainCache|*.cache [Crypt of the NecroDancer *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\247080 FileKey1=%LocalAppData%\NecroDancer\replays|*|REMOVESELF FileKey2=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\logs|*.* FileKey3=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\Necrodancer*|*.log FileKey4=%ProgramFiles%\Steam\steamapps\common\Crypt of the NecroDancer\replays|* [CrypTool 2 *] LangSecRef=3024 Detect=HKCU\Software\CrypTool2.0 FileKey1=%LocalAppData%\CrypTool2\Temp|*.*|REMOVESELF RegKey1=HKCU\Software\CrypTool2.0|recentFileList [Crysis *] Section=Games DetectFile1=%ProgramFiles%\EA Games\Crysis* DetectFile2=%ProgramFiles%\Steam\Steamapps\common\Crysis* FileKey1=%ProgramFiles%\EA Games\Crysis *|*.log FileKey2=%ProgramFiles%\EA Games\Crysis *\LogBackups|*.* FileKey3=%ProgramFiles%\Steam\Steamapps\common\Crysis *|*.log FileKey4=%ProgramFiles%\Steam\Steamapps\common\Crysis *\LogBackups|*.* FileKey5=%UserProfile%\Documents\My Games\Crysis*\Shaders\Cache|*.*|RECURSE FileKey6=%UserProfile%\Saved Games\Crysis*\Shaders\Cache|*.*|RECURSE [CrystalDiskInfo *] LangSecRef=3024 DetectFile=%ProgramFiles%\CrystalDiskInfo\Smart FileKey1=%ProgramFiles%\CrystalDiskInfo\Smart|*.*|RECURSE [Cultist Simulator *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Weather Factory\Cultist Simulator FileKey1=%UserProfile%\AppData\LocalLow\Weather Factory\Cultist Simulator|*log [CurrencyManage *] LangSecRef=3021 Detect=HKCU\Software\Liberty Street Software\CurrencyManage FileKey1=%ProgramFiles%\CurrencyManage|*.txt [Curse Client *] Section=Games Detect=HKCU\Software\Classes\Curse FileKey1=%AppData%\Curse Client|*.log FileKey2=%AppData%\Curse Client\Logs|*.* FileKey3=%LocalAppData%\Apps\2.0|*.Log|RECURSE [CursorArts *] LangSecRef=3023 Detect=HKCU\Software\CursorArts RegKey1=HKCU\Software\CursorArts\MRU Items RegKey2=HKCU\Software\CursorArts\MRU Library Items [CursorFX *] LangSecRef=3024 Detect=HKCU\Software\CursorFX Theme Editor RegKey1=HKCU\Software\CursorFX Theme Editor\Recent File List [CustomFolder *] LangSecRef=3024 Detect=HKCU\Software\CustomFolder FileKey1=%ProgramFiles%\CustomFolder|*.log [CuteFTP *] LangSecRef=3022 DetectFile=%AppData%\Globalscape\CuteFTP FileKey1=%AppData%\Globalscape\CuteFTP\*|*.log FileKey2=%AppData%\Globalscape\CuteFTP\*\Logs|*.* FileKey3=%LocalAppData%\Globalscape\CuteFTP\*\Cache*|*.*|RECURSE [CuteHTML 2.3 *] LangSecRef=3024 Detect=HKCU\Software\GlobalSCAPE\CuteHTML\2.3 RegKey1=HKCU\Software\GlobalSCAPE\CuteHTML\2.3\Recent File List [CutePDF Writer *] LangSecRef=3023 Detect=HKCU\Software\Acro Software Inc\CPW FileKey1=%LocalAppData%\CutePDF Writer|*.tmp RegKey1=HKCU\Software\Acro Software Inc\CPW|Filename RegKey2=HKCU\Software\Acro Software Inc\CPW|Title [Cyber Privacy Suite *] LangSecRef=3024 DetectFile=%AppData%\Cyber Privacy Suite FileKey1=%AppData%\Cyber Privacy Suite\Cyber Privacy Suite*\install|*log.txt FileKey2=%LocalAppData%\CyberPrivacySuite|*.log;log.rtf [Cyberduck *] LangSecRef=3024 Detect=HKCR\.cyberducklicense FileKey1=%AppData%\Cyberduck|*.log [Cyberlab *] LangSecRef=3024 Detect=HKCU\Software\ZookaWare DetectFile=%LocalAppData%\Cyberlab FileKey1=%LocalAppData%\Cyberlab\ScanLogs|*.log FileKey2=%LocalAppData%\ZookaWare\ScanLogs|*.log [CyberLink *] LangSecRef=3023 Detect=HKCU\Software\CyberLink FileKey1=%AppData%\CyberLink\MediaCache|*|RECURSE FileKey2=%ProgramData%\CyberLink\Boomerang\*|*.xml;*.dmp FileKey3=%ProgramData%\CyberLink\CBE\*|*|RECURSE FileKey4=%ProgramData%\CyberLink\Downloader|*|RECURSE FileKey5=%ProgramData%\install_backup|*|REMOVESELF FileKey6=%ProgramData%\install_clap|*|REMOVESELF RegKey1=HKCU\Software\CyberLink\DSSharedMediaInfo\SharedInfoCache RegKey2=HKCU\Software\CyberLink\MediaCache\Data4 RegKey3=HKCU\Software\CyberLink\MediaCache\Thumbnail4 RegKey4=HKCU\Software\CyberLink\MediaCache5\Data5 RegKey5=HKCU\Software\CyberLink\MediaCache5\Thumbnail5 [CyberLink AudioDirector *] LangSecRef=3023 Detect1=HKCU\Software\CyberLink\AudioDirector4 Detect2=HKCU\Software\CyberLink\AudioDirector5 Detect3=HKCU\Software\CyberLink\AudioDirector6 Detect4=HKCU\Software\CyberLink\AudioDirector7 Detect5=HKCU\Software\CyberLink\AudioDirector8 Detect6=HKCU\Software\CyberLink\AudioDirector9 FileKey1=%LocalAppData%\Cyberlink\AudioDirector\*|*.*|RECURSE FileKey2=%UserProfile%\Documents\Cyberlink\AudioDirector\*\SplitterIndex|*.*|RECURSE RegKey1=HKCU\Software\CyberLink\AudioDirector4\MediaObj\MediaCache5\Data5 RegKey2=HKCU\Software\CyberLink\AudioDirector4\MediaObj\MediaCache5\Thumbnail5 RegKey3=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Data5 RegKey4=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Thumbnail5 RegKey5=HKCU\Software\CyberLink\AudioDirector6\MediaObj\MediaCache5\Data5 RegKey6=HKCU\Software\CyberLink\AudioDirector6\MediaObj\MediaCache5\Thumbnail5 RegKey7=HKCU\Software\CyberLink\AudioDirector7\MediaObj\MediaCache5\Data5 RegKey8=HKCU\Software\CyberLink\AudioDirector7\MediaObj\MediaCache5\Thumbnail5 RegKey9=HKCU\Software\CyberLink\AudioDirector8\MediaObj\MediaCache5\Data5 RegKey10=HKCU\Software\CyberLink\AudioDirector8\MediaObj\MediaCache5\Thumbnail5 RegKey11=HKCU\Software\CyberLink\AudioDirector9\MediaObj\MediaCache5\Data5 RegKey12=HKCU\Software\CyberLink\AudioDirector9\MediaObj\MediaCache5\Thumbnail5 [CyberLink ColorDirector *] LangSecRef=3023 Detect1=HKCU\Software\CyberLink\ColorDirector3 Detect2=HKCU\Software\CyberLink\ColorDirector4 Detect3=HKCU\Software\CyberLink\ColorDirector5 Detect4=HKCU\Software\CyberLink\ColorDirector6 Detect5=HKCU\Software\CyberLink\ColorDirector7 FileKey1=%LocalAppData%\Cyberlink\ColorDirector\*|*.*|RECURSE RegKey1=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Data5 RegKey2=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Thumbnail5 RegKey3=HKCU\Software\CyberLink\ColorDirector4\MediaObj\MediaCache5\Data5 RegKey4=HKCU\Software\CyberLink\ColorDirector4\MediaObj\MediaCache5\Thumbnail5 RegKey5=HKCU\Software\CyberLink\ColorDirector5\MediaObj\MediaCache5\Data5 RegKey6=HKCU\Software\CyberLink\ColorDirector5\MediaObj\MediaCache5\Thumbnail5 RegKey7=HKCU\Software\CyberLink\ColorDirector6\MediaObj\MediaCache5\Data5 RegKey8=HKCU\Software\CyberLink\ColorDirector6\MediaObj\MediaCache5\Thumbnail5 RegKey9=HKCU\Software\CyberLink\ColorDirector7\MediaObj\MediaCache5\Data5 RegKey10=HKCU\Software\CyberLink\ColorDirector7\MediaObj\MediaCache5\Thumbnail5 [CyberLink PhotoDirector *] LangSecRef=3023 DetectFile=%UserProfile%\Pictures\PhotoDirector FileKey1=%UserProfile%\Pictures\PhotoDirector\*\*|*|RECURSE ExcludeKey1=PATH|%UserProfile%\Pictures\PhotoDirector\*\*\|*.phd [CyberLink Power2Go *] LangSecRef=3023 Detect1=HKCU\Software\CyberLink\Power2Go9 Detect2=HKCU\Software\CyberLink\Power2Go10 Detect3=HKCU\Software\CyberLink\Power2Go11 Detect4=HKCU\Software\CyberLink\Power2Go12 FileKey1=%LocalAppData%\Cyberlink\Power2Go*|DLDB.db FileKey2=%ProgramFiles%\Cyberlink\Power2Go*|Thumbs.db;*.tmp|RECURSE FileKey3=%Public%\Documents\Cyberlink\Power2Go*|MP3Cache.log FileKey4=%UserProfile%\Documents\PDRMUSIC.TMP|*|REMOVESELF FileKey5=%UserProfile%\Music|*.tmp FileKey6=%UserProfile%\Pictures|*.tmp RegKey1=HKCU\Software\CyberLink\LabelPrint\Recent File List RegKey2=HKCU\Software\CyberLink\Power2Go9\9.0|CDRippingPath RegKey3=HKCU\Software\CyberLink\Power2Go9\9.0|CUEName RegKey4=HKCU\Software\CyberLink\Power2Go9\9.0|CUEPath RegKey5=HKCU\Software\CyberLink\Power2Go9\9.0|DestFolder RegKey6=HKCU\Software\CyberLink\Power2Go9\9.0|DVDFolderPath RegKey7=HKCU\Software\CyberLink\Power2Go9\9.0|ImagePath RegKey8=HKCU\Software\CyberLink\Power2Go9\9.0|LastBrowsePath RegKey9=HKCU\Software\CyberLink\Power2Go9\9.0|LastSaveProjPath RegKey10=HKCU\Software\CyberLink\Power2Go9\9.0|MonitorPaths RegKey11=HKCU\Software\CyberLink\Power2Go9\9.0|OpenPrjFilePath RegKey12=HKCU\Software\CyberLink\Power2Go9\9.0|SelectedFolderPath RegKey13=HKCU\Software\CyberLink\Power2Go9\9.0\MediaObj\MediaCache5\Data5 RegKey14=HKCU\Software\CyberLink\Power2Go9\9.0\MediaObj\MediaCache5\Thumbnail5 RegKey15=HKCU\Software\CyberLink\Power2Go10\10.0|CDRippingPath RegKey16=HKCU\Software\CyberLink\Power2Go10\10.0|CUEName RegKey17=HKCU\Software\CyberLink\Power2Go10\10.0|CUEPath RegKey18=HKCU\Software\CyberLink\Power2Go10\10.0|DestFolder RegKey19=HKCU\Software\CyberLink\Power2Go10\10.0|DVDFolderPath RegKey20=HKCU\Software\CyberLink\Power2Go10\10.0|ImagePath RegKey21=HKCU\Software\CyberLink\Power2Go10\10.0|LastBrowsePath RegKey22=HKCU\Software\CyberLink\Power2Go10\10.0|LastSaveProjPath RegKey23=HKCU\Software\CyberLink\Power2Go10\10.0|MonitorPaths RegKey24=HKCU\Software\CyberLink\Power2Go10\10.0|OpenPrjFilePath RegKey25=HKCU\Software\CyberLink\Power2Go10\10.0|SelectedFolderPath RegKey26=HKCU\Software\CyberLink\Power2Go10\10.0\MediaObj\MediaCache5\Data5 RegKey27=HKCU\Software\CyberLink\Power2Go10\10.0\MediaObj\MediaCache5\Thumbnail5 RegKey28=HKCU\Software\CyberLink\Power2Go11\11.0|CDRippingPath RegKey29=HKCU\Software\CyberLink\Power2Go11\11.0|CUEName RegKey30=HKCU\Software\CyberLink\Power2Go11\11.0|CUEPath RegKey31=HKCU\Software\CyberLink\Power2Go11\11.0|DestFolder RegKey32=HKCU\Software\CyberLink\Power2Go11\11.0|DVDFolderPath RegKey33=HKCU\Software\CyberLink\Power2Go11\11.0|ImagePath RegKey34=HKCU\Software\CyberLink\Power2Go11\11.0|LastBrowsePath RegKey35=HKCU\Software\CyberLink\Power2Go11\11.0|LastSaveProjPath RegKey36=HKCU\Software\CyberLink\Power2Go11\11.0|MonitorPaths RegKey37=HKCU\Software\CyberLink\Power2Go11\11.0|OpenPrjFilePath RegKey38=HKCU\Software\CyberLink\Power2Go11\11.0|SelectedFolderPath RegKey39=HKCU\Software\CyberLink\Power2Go11\11.0\MediaObj\MediaCache5\Data5 RegKey40=HKCU\Software\CyberLink\Power2Go11\11.0\MediaObj\MediaCache5\Thumbnail5 RegKey41=HKCU\Software\CyberLink\Power2Go12\12.0|CDRippingPath RegKey42=HKCU\Software\CyberLink\Power2Go12\12.0|CUEName RegKey43=HKCU\Software\CyberLink\Power2Go12\12.0|CUEPath RegKey44=HKCU\Software\CyberLink\Power2Go12\12.0|DestFolder RegKey45=HKCU\Software\CyberLink\Power2Go12\12.0|DVDFolderPath RegKey46=HKCU\Software\CyberLink\Power2Go12\12.0|ImagePath RegKey47=HKCU\Software\CyberLink\Power2Go12\12.0|LastBrowsePath RegKey48=HKCU\Software\CyberLink\Power2Go12\12.0|LastSaveProjPath RegKey49=HKCU\Software\CyberLink\Power2Go12\12.0|MonitorPaths RegKey50=HKCU\Software\CyberLink\Power2Go12\12.0|OpenPrjFilePath RegKey51=HKCU\Software\CyberLink\Power2Go12\12.0|SelectedFolderPath RegKey52=HKCU\Software\CyberLink\Power2Go12\12.0\MediaObj\MediaCache5\Data5 RegKey53=HKCU\Software\CyberLink\Power2Go12\12.0\MediaObj\MediaCache5\Thumbnail5 RegKey54=HKCU\Software\CyberLink\WaveEditor\2.0|ImportDir RegKey55=HKCU\Software\CyberLink\WaveEditor\2.0|TempFileDir RegKey56=HKCU\Software\CyberLink\WaveEditor\2.0|WorkDir [Cyberlink PowerCinema *] LangSecRef=3023 Detect=HKCU\Software\Cyberlink\PowerCinema DetectFile=%LocalAppData%\PowerCinema FileKey1=%LocalAppData%\PowerCinema|trace.* FileKey2=%ProgramData%|{*-*-*-*-*}.log [CyberLink PowerDirector *] LangSecRef=3023 Detect1=HKCU\Software\CyberLink\PowerDirector10 Detect2=HKCU\Software\CyberLink\PowerDirector11 Detect3=HKCU\Software\CyberLink\PowerDirector12 Detect4=HKCU\Software\CyberLink\PowerDirector13 Detect5=HKCU\Software\CyberLink\PowerDirector14 Detect6=HKCU\Software\CyberLink\PowerDirector15 Detect7=HKCU\Software\CyberLink\PowerDirector16 Detect8=HKCU\Software\CyberLink\PowerDirector17 FileKey1=%AppData%\Cyberlink\PowerDirector\*|Recentfiles.ini FileKey2=%AppData%\CyberLink\PowerDirector\*\AutoSave|*.*|RECURSE FileKey3=%AppData%\CyberLink\PowerDirector\*\photoTmp|*.*|RECURSE FileKey4=%AppData%\Cyberlink\PowerDirector\*\WaveForms|*.*|RECURSE FileKey5=%UserProfile%\Documents\CyberLink\PowerDirector\*|Snapshot(*).jpg FileKey6=%UserProfile%\Documents\CyberLink\PowerDirector\*\MyTitles|*.*|RECURSE FileKey7=%UserProfile%\Documents\Cyberlink\PowerDirector\*\PDRMUSIC.TMP|*.*|REMOVESELF FileKey8=%UserProfile%\Documents\Cyberlink\PowerDirector\*\PP.TWOPASS|*.*|REMOVESELF FileKey9=%UserProfile%\Documents\CyberLink\PowerDirector\*\Preview Cache Files|*.* FileKey10=%UserProfile%\Documents\CyberLink\PowerDirector\*\ShadowEditFiles|*.MPG FileKey11=%UserProfile%\Documents\CyberLink\PowerDirector\*\SplitterIndex|*.maidx RegKey1=HKCU\Software\CyberLink\Hanuman RegKey2=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Data5 RegKey3=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Thumbnail5 RegKey4=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Data5 RegKey5=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Thumbnail5 RegKey6=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Data5 RegKey7=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Thumbnail5 RegKey8=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Data5 RegKey9=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Thumbnail5 RegKey10=HKCU\Software\CyberLink\PowerDirector14\MediaObj\MediaCache5\Data5 RegKey11=HKCU\Software\CyberLink\PowerDirector14\MediaObj\MediaCache5\Thumbnail5 RegKey12=HKCU\Software\CyberLink\PowerDirector15\MediaObj\MediaCache5\Data5 RegKey13=HKCU\Software\CyberLink\PowerDirector15\MediaObj\MediaCache5\Thumbnail5 RegKey14=HKCU\Software\CyberLink\PowerDirector16\MediaObj\MediaCache5\Data5 RegKey15=HKCU\Software\CyberLink\PowerDirector16\MediaObj\MediaCache5\Thumbnail5 RegKey16=HKCU\Software\CyberLink\PowerDirector17\MediaObj\MediaCache5\Data5 RegKey17=HKCU\Software\CyberLink\PowerDirector17\MediaObj\MediaCache5\Thumbnail5 RegKey18=HKCU\Software\CyberLink\PowerDirector17\OldCacheFolder [CyberLink PowerDVD *] LangSecRef=3023 Detect1=HKCU\Software\CyberLink\PowerDVD14 Detect2=HKCU\Software\CyberLink\PowerDVD15 Detect3=HKCU\Software\CyberLink\PowerDVD16 Detect4=HKCU\Software\CyberLink\PowerDVD17 Detect5=HKCU\Software\CyberLink\PowerDVD18 Detect6=HKCU\Software\CyberLink\PowerDVD19 Detect7=HKCU\Software\CyberLink\PowerDVD20 Detect8=HKCU\Software\CyberLink\PowerDVD21 Detect9=HKCU\Software\CyberLink\PowerDVD22 FileKey1=%AppData%\CyberLink\Webview|*.old|RECURSE FileKey2=%LocalAppData%\Cyberlink\DigitalHome|*.log|RECURSE FileKey3=%LocalAppData%\Cyberlink\PowerDVD*|*.log|RECURSE FileKey4=%LocalAppData%\Cyberlink\PowerDVD*\*\PowerDVDMainAP|*|RECURSE FileKey5=%LocalAppData%\Cyberlink\PowerDVD*\cache*|*|RECURSE FileKey6=%LocalAppData%\Cyberlink\PowerDVD*\CL_DMP_Browser|*|RECURSE FileKey7=%LocalAppData%\Cyberlink\PowerDVD*\DB*\computer|*.db|RECURSE FileKey8=%LocalAppData%\Cyberlink\PowerDVD*\DefaultMember|*|RECURSE FileKey9=%ProgramData%\Cyberlink\Evoparser|*.xml FileKey10=%ProgramData%\CyberLink\PowerDVD*\Boomerang\*|*.xml;*.dmp FileKey11=%ProgramData%\SUPPORTDIR\*|*.log RegKey1=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey2=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey3=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey4=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey5=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey6=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey7=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey8=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey9=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey10=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey11=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey12=HKCU\Software\CyberLink\PowerDVD18\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey13=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey14=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey15=HKCU\Software\CyberLink\PowerDVD19\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey16=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey17=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey18=HKCU\Software\CyberLink\PowerDVD20\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey19=HKCU\Software\CyberLink\PowerDVD20\CoarseSnapshot\MediaObj\MediaCache5\Data5 RegKey20=HKCU\Software\CyberLink\PowerDVD20\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo RegKey21=HKCU\Software\CyberLink\PowerDVD21\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey22=HKCU\Software\CyberLink\PowerDVD21\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey23=HKCU\Software\CyberLink\PowerDVD21\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey24=HKCU\Software\CyberLink\PowerDVD21\CoarseSnapshot\MediaObj\MediaCache5\Data5 RegKey25=HKCU\Software\CyberLink\PowerDVD21\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo RegKey26=HKCU\Software\CyberLink\PowerDVD22\CLMPSvc\MediaObj\MediaCache5\Data5 RegKey27=HKCU\Software\CyberLink\PowerDVD22\CLMPSvc\MediaObj\MediaCache5\ProgramInfo RegKey28=HKCU\Software\CyberLink\PowerDVD22\CLMPSvc\MediaObj\MediaCache5\Thumbnail5 RegKey29=HKCU\Software\CyberLink\PowerDVD22\CoarseSnapshot\MediaObj\MediaCache5\Data5 RegKey30=HKCU\Software\CyberLink\PowerDVD22\CoarseSnapshot\MediaObj\MediaCache5\ProgramInfo [CyberLink PowerProducer *] LangSecRef=3023 DetectFile=%ProgramFiles%\HomeCinema FileKey1=%ProgramFiles%\HomeCinema\PowerProducer\Template\Cyberlink\frame|*tmp [CyberLink YouCam *] LangSecRef=3023 Detect=HKCU\Software\CyberLink\YouCam FileKey1=%UserProfile%\Documents\YouCam|*.tmp [CyberScrub Privacy Suite *] LangSecRef=3024 Detect=HKCU\Software\CyberScrub\Privacy Suite FileKey1=%AppData%\CyberScrub\Privacy Suite|cybscrub.log [Cybertron Privacy Eraser *] LangSecRef=3024 DetectFile=%AppData%\Cybertron\Privacy Eraser FileKey1=%AppData%\Cybertron\Privacy Eraser\Registry Backups|*.* [Cycling '74 *] LangSecRef=3023 DetectFile=%AppData%\Cycling '74 FileKey1=%AppData%\Cycling '74\Logs|*.* FileKey2=%AppData%\Cycling '74\Max*\Crash Recovery\MaxEditorLogFiles|*.* FileKey3=%AppData%\Cycling '74\Max*\Database|*-journal;*.bak;*.old FileKey4=%AppData%\Cycling '74\Max*\Settings\cef*|debug.log;Visited Links FileKey5=%AppData%\Cycling '74\Max*\Settings\cef*\blob_storage|*.*|RECURSE [CzDC *] LangSecRef=3022 DetectFile=%AppData%\CzDC FileKey1=%AppData%\CzDC|*.bak|RECURSE [Daemon Tools *] LangSecRef=3024 Detect1=HKCU\Software\Disc Soft Detect2=HKCU\Software\DT Soft FileKey1=%AppData%\DAEMON Tools*|ImgList.dat FileKey2=%AppData%\DAEMON Tools*\*Cache|*|RECURSE FileKey3=%ProgramData%\DAEMON Tools*\Temp|*|RECURSE RegKey1=HKCU\Software\Disc Soft\DAEMON Tools Pro\GuiNamespace|MountFolder RegKey2=HKCU\Software\DT Soft\DAEMON Tools Pro\GuiNamespace|MountFolder [Dakota AG *] LangSecRef=3021 DetectFile=%SystemDrive%\dakotaag FileKey1=%SystemDrive%\dakotaag|*.log|RECURSE FileKey2=%UserProfile%\Documents|dakotaDeinstallieren.log [DAMN Hash Calculator *] LangSecRef=3024 Detect=HKCU\Software\DAMN\Hash Calculator RegKey1=HKCU\Software\DAMN\Hash Calculator\Settings|LastDir [DAMN NFO Viewer *] LangSecRef=3024 Detect=HKCU\Software\DAMN\DAMN NFO Viewer RegKey1=HKCU\Software\DAMN\DAMN NFO Viewer|WorkingDirectory RegKey2=HKCU\Software\DAMN\DAMN NFO Viewer\Recently Viewed Files [Damned *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\251170 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Damned|*.log|RECURSE [Danger Scavenger *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\1169740 FileKey1=%UserProfile%\AppData\LocalLow\Star Drifters\Danger Scavenger|*.log [Dangerous Waters *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\1600 DetectFile=%ProgramFiles%\Sonalysts Combat Simulations\Dangerous Waters FileKey1=%ProgramFiles%\Sonalysts Combat Simulations\Dangerous Waters|*.log FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Dangerous Waters|*.log [DARK *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\225360 FileKey1=%AppData%\Kalypso Media\Dark|log.txt [Dark Manor *] Section=Games DetectFile=%AppData%\DarkManor FileKey1=%AppData%\DarkManor|*.dmp [DarkComet RAT *] LangSecRef=3024 DetectFile=%AppData%\DCLogs FileKey1=%AppData%\DCLogs|*.dc|REMOVESELF [Darksiders II Deathinitive Edition Backups *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\388410 FileKey1=%ProgramFiles%\Steam\steamapps\common\Darksiders II Deathinitive Edition\Debug Saves|*.* [Darksiders Warmastered Edition *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\462780 FileKey1=%ProgramFiles%\Steam\steamapps\common\Darksiders Warmastered Edition|*.log [Dashlane *] LangSecRef=3022 DetectFile=%AppData%\Dashlane FileKey1=%AppData%\Dashlane\*\background_cache|*.*|RECURSE [DataNumen Disk Image *] LangSecRef=3024 Detect=HKCU\Software\DDKI RegKey1=HKCU\Software\DDKI\Misc|OpenDirectory [DataNumen Outlook Password Recovery *] LangSecRef=3024 Detect=HKCU\Software\DOPR RegKey1=HKCU\Software\DOPR\Misc|OpenDirectory [DataNumen Outlook Repair *] LangSecRef=3024 Detect1=HKCU\Software\DOLKR Detect2=HKCU\Software\DOLKR64 RegKey1=HKCU\Software\DOLKR\Misc|OpenDirectory RegKey2=HKCU\Software\DOLKR64\Misc|OpenDirectory [DataTron 7 *] LangSecRef=3021 DetectFile=%ProgramFiles%\DataTron7 FileKey1=%ProgramFiles%\DataTron7|*.GID;*.BAK [DATEV *] LangSecRef=3021 DetectFile=%SystemDrive%\DATEV FileKey1=%SystemDrive%\DATEV\LOG|*.log|RECURSE [Daum Streaming Agent Manager *] LangSecRef=3023 DetectFile=%LocalAppData%\KakaoLiveAgent FileKey1=%LocalAppData%\KakaoLiveAgent\Log|*.* FileKey2=%LocalAppData%\KakaoLiveAgent\tmp|*.* [Dawn of War *] Section=Games DetectFile=%ProgramFiles%\Dawn of War* FileKey1=%ProgramFiles%\Dawn of War*|warnings.log FileKey2=%ProgramFiles%\Dawn of War*\Playback|temp.rec [DayZ *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\221100 FileKey1=%LocalAppData%\DayZ|DayZ.mdmp;DayZ.bidmp [DAZ 3D Studio *] LangSecRef=3021 DetectFile=%AppData%\DAZ 3D\Studio* FileKey1=%AppData%\DAZ 3D\Studio*|log.txt FileKey2=%AppData%\DAZ 3D\Studio*\Temp|*.*|RECURSE [DB Browser for SQLite *] LangSecRef=3024 Detect=HKCU\Software\sqlitebrowser\sqlitebrowser RegKey1=HKCU\Software\sqlitebrowser\sqlitebrowser\db|lastlocation RegKey2=HKCU\Software\sqlitebrowser\sqlitebrowser\General|recentFileList RegKey3=HKCU\Software\sqlitebrowser\sqlitebrowser\MainWindow [DBFView *] LangSecRef=3021 Detect=HKCU\Software\DBFView RegKey1=HKCU\Software\DBFView\DBFView\Recent File List [dBpoweramp *] LangSecRef=3023 Detect=HKCU\Software\Illustrate\dBpoweramp FileKey1=%AppData%\dBpoweramp|*.bin [DC Universe Online *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\24200 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\DC Universe Online|.downloadInfo.txt;.downloadStats.txt FileKey2=%UserProfile%\Documents\My Games\DC Universe Online\Logs|*.* [DC++ *] LangSecRef=3022 DetectFile=%ProgramFiles%\DC++ FileKey1=%AppData%\DC++|CrashLog.txt;FinishedTransfers.xml;Queue.xml.bak;Recents.xml FileKey2=%AppData%\DC++\FileLists|*.* FileKey3=%AppData%\DC++\Logs|*.* FileKey4=%LocalAppData%\DC++|CrashLog.txt;FinishedTransfers.xml;Queue.xml.bak;Recents.xml FileKey5=%ProgramFiles%\DC++|CrashLog.txt;FinishedTransfers.xml;Queue.xml.bak;Recents.xml [Dead Island *] Section=Games DetectFile=%UserProfile%\Documents\DeadIsland* FileKey1=%UserProfile%\Documents\DeadIsland*\out\logs|* [DeadHash *] LangSecRef=3024 DetectFile=%AppData%\deadhash FileKey1=%AppData%\deadhash\*Cache|*.*|RECURSE FileKey2=%AppData%\deadhash\blob_storage|*.*|RECURSE FileKey3=%AppData%\deadhash\Local Storage|*.*|RECURSE FileKey4=%AppData%\deadhash\Session Storage|*.* FileKey5=%LocalAppData%\deadhash-updater|*.exe [Dear Esther *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\203810 FileKey1=%ProgramFiles%\Steam\Steamapps\common\dear esther\dearesther|*.tmp FileKey2=%ProgramFiles%\Steam\Steamapps\common\dear esther\dearesther\resource|*.icns [Death to Spies: Moment of Truth *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\34410 FileKey1=%UserProfile%\Documents\My Games\Smersh_MT\Cache|*.* [Death Track: Resurrection *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\7840 FileKey1=%UserProfile%\Documents\Skyfallen Entertaiment\DeathTrack\Logs|*.* [Debenu *] LangSecRef=3021 Detect=HKCU\Software\Debenu FileKey1=%ProgramData%\Debenu\PDF Tools\Reports\App Log|* RegKey1=HKCU\Software\Debenu\Debenu PDF Maximus 2\MaximusViewerRecentDocs RegKey2=HKCU\Software\Debenu\Debenu PDF Maximus 2\MaximusViewerRecentFolders [DECAdry Business Card *] LangSecRef=3021 DetectFile=%AppData%\DECAdry\BusinessCard FileKey1=%AppData%\DECAdry\BusinessCard|LWTHUMB.DAT [DeepBurner *] LangSecRef=3024 Detect=HKCU\Software\Astonsoft\DeepBurner FileKey1=%AppData%\DeepBurner|DeepBurner.log [Deezer Desktop *] LangSecRef=3022 DetectFile=%LocalAppData%\Programs\deezer.desktop FileKey1=%AppData%\Deezer*|*-journal;LOG;LOG.old|RECURSE FileKey2=%AppData%\Deezer*|Network Persistent State;Origin Bound Certs;QuotaManager;log.log FileKey3=%AppData%\Deezer*\*Cache|*.*|RECURSE FileKey4=%AppData%\Deezer*\*logs|*.*|RECURSE FileKey5=%AppData%\Deezer*\blob_storage|*.*|RECURSE FileKey6=%AppData%\Deezer*\Service Worker\*Cache*|*.*|RECURSE FileKey7=%LocalAppData%\deezer*desktop-updater|*.*|RECURSE [Default Programs Editor *] LangSecRef=3024 DetectFile=%LocalAppData%\factormystic.net\Default Programs Editor FileKey1=%LocalAppData%\factormystic.net\Default Programs Editor\*|crash-report.*|RECURSE [Defense Grid: The Awakening *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\18500 FileKey1=%ProgramFiles%\Steam\steamapps\common\defensegridtheawakening\Shaders\Generated|*.cache [Defraggler *] LangSecRef=3024 Detect=HKCU\Software\Piriform\Defraggler FileKey1=%ProgramFiles%\Defraggler|*.dmp;*statistics*;*.log;Defraggler*.txt FileKey2=%UserProfile%|Defraggler*.txt [Delfix *] LangSecRef=3024 DetectFile=%SystemDrive%\DelFix.txt FileKey1=%SystemDrive%|DelFix.txt [Dell *] LangSecRef=3024 Detect1=HKLM\Software\Dell Detect2=HKLM\Software\PC-Doctor DetectFile1=%AppData%\Creative\DELL Webcam Center DetectFile2=%LocalAppData%\Dell DetectFile3=%LocalAppData%\SupportSoft\DellSupportCenter DetectFile4=%ProgramData%\Dell DetectFile5=%ProgramFiles%\Dell* FileKey1=%AppData%\Creative\DELL Webcam Center|MO_Log.txt FileKey2=%AppData%\PCDr\*\Logs|* FileKey3=%LocalAppData%\Dell\*\Log|* FileKey4=%LocalAppData%\Dell\DellMobileConnect|*.log FileKey5=%LocalAppData%\SupportSoft\DellSupportCenter\*\state\logs|* FileKey6=%ProgramData%\Dell\*|*.log FileKey7=%ProgramData%\Dell\*\Log*|*|RECURSE FileKey8=%ProgramData%\Dell\BiosVerification|*.log FileKey9=%ProgramData%\Dell\D3\pla\*\*|*.log;*.txt|REMOVESELF FileKey10=%ProgramData%\Dell\D3\Resources\Logs\serilog|* FileKey11=%ProgramData%\Dell\Drivers\*|*.log;*.tmp|RECURSE FileKey12=%ProgramData%\Dell\orca\deviceq|* FileKey13=%ProgramData%\Dell\SupportAssist|*|RECURSE FileKey14=%ProgramData%\Dell\TrustedDevice|*.log FileKey15=%ProgramData%\Dell\Update|*.txt FileKey16=%ProgramData%\Dell\UpdateService|*.log;*.txt|RECURSE FileKey17=%ProgramData%\PCDr\*\Logs|* FileKey18=%ProgramFiles%\Dell*|*.log|RECURSE [Dell Customer Connect *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.DellCustomerConnect_* FileKey1=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\LocalState\serilog|*.txt FileKey3=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\DellInc.DellCustomerConnect_*\TempState|*|RECURSE [Dell Digital Delivery *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_* FileKey1=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\LocalState\serilog|*.txt FileKey3=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\DellInc.DellDigitalDelivery_*\TempState|*|RECURSE [Dell Help & Support *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.DellHelpSupport_* FileKey1=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\LocalCache\Local\Dell\DHSC\Logs|*.log FileKey3=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\DellInc.DellHelpSupport_*\TempState|*|RECURSE [Dell Installation Files *] LangSecRef=3024 DetectFile=%SystemDrive%\Dell FileKey1=%SystemDrive%\Dell|*.*|REMOVESELF [Dell Mobile Connect *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_* FileKey1=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\LocalCache\Local\Dell\DellMobileConnect|*.log FileKey3=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE FileKey4=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\ScreenovateTechnologies.DellMobileConnect_*\TempState|*|RECURSE [Dell My Dell *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.MyDell_* FileKey1=%LocalAppData%\Packages\DellInc.MyDell_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.MyDell_*\LocalState\Logs|* FileKey3=%LocalAppData%\Packages\DellInc.MyDell_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\DellInc.MyDell_*\TempState|*|RECURSE [Dell PC Doctor *] LangSecRef=3024 DetectFile=%ProgramData%\PCDr FileKey1=%ProgramData%\PCDr|*.dmp|RECURSE FileKey2=%ProgramData%\PCDr\*\Cache|*.xml FileKey3=%ProgramData%\PCDr\*\Cache\archives|*|RECURSE FileKey4=%ProgramData%\PCDr\*\Cache\BUMA|* FileKey5=%ProgramData%\PCDr\*\Cache\DriverScan|* FileKey6=%ProgramData%\PCDr\*\Snapshots\*|* [Dell Power Manager *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.DellPowerManager_* FileKey1=%LocalAppData%\Packages\DellInc.DellPowerManager_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellPowerManager_*\Settings|*.log* FileKey3=%LocalAppData%\Packages\DellInc.DellPowerManager_*\TempState|*|RECURSE [Dell PremierColor *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_* FileKey1=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\LocalCache\Local\Microsoft\Windows\Caches|*.db FileKey3=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\PortraitDisplays.DellPremierColor_*\TempState|*|RECURSE [Dell Product Registration *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.DellProductRegistration_* FileKey1=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\LocalCache\Local\Dell\Product Registration\UILog|*.htm FileKey3=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE FileKey4=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\DellInc.DellProductRegistration_*\TempState|*|RECURSE [Dell Stage Suite *] LangSecRef=3023 DetectFile1=%AppData%\Dell\*Stage DetectFile2=%LocalAppData%\Dell\*Stage FileKey1=%AppData%\Dell\Dell Stage|*.backup|RECURSE FileKey2=%AppData%\Dell\MusicStage\*\Album_Images|*.* FileKey3=%AppData%\Dell\MusicStage\*\Artist_Images|*.* FileKey4=%AppData%\Dell\MusicStage\*\Cache|*.* FileKey5=%AppData%\Fingertapps\AccuWeather\Cache|*.* FileKey6=%LocalAppData%\Dell\VideoStage\CinemaNow\*|kthumb*.db;log.* FileKey7=%LocalAppData%\Dell\VideoStage\Library\*|kthumb*.db;log.* [Dell SupportAssist *] LangSecRef=3024 DetectFile1=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs* DetectFile2=%ProgramData%\SupportAssist FileKey1=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs*\LocalCache\Local\Microsoft\Windows\Caches|*|RECURSE FileKey3=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs*\LocalState|*.txt FileKey4=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs*\Settings|*.log* FileKey5=%LocalAppData%\Packages\DellInc.DellSupportAssistforPCs*\TempState|*|RECURSE FileKey6=%ProgramData%\SupportAssist\Client\Agent\Downloads|*|RECURSE FileKey7=%ProgramData%\SupportAssist\Client\Agent\Logs\*|*|REMOVESELF FileKey8=%ProgramData%\SupportAssist\Client\SRE|*.log FileKey9=%ProgramData%\SupportAssist\Client\SRE\ExtendedLogs|* FileKey10=%ProgramData%\SupportAssist\Client\TechnicianToolkit\Library\Logs|*|RECURSE FileKey11=%ProgramData%\SupportAssist\Client\TechnicianToolkit\Library\RegBackup|* FileKey12=%ProgramData%\SupportAssist\Client\TechnicianToolkit\Library\Temp|*|RECURSE [Dell Update *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\DellInc.DellUpdate* FileKey1=%LocalAppData%\Packages\DellInc.DellUpdate*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\DellInc.DellUpdate*\LocalCache\Local\Microsoft\Windows\Caches|* FileKey3=%LocalAppData%\Packages\DellInc.DellUpdate*\Settings|*.log* FileKey4=%LocalAppData%\Packages\DellInc.DellUpdate*\TempState|*|RECURSE FileKey5=%ProgramData%\Dell\UpdateService\Downloads\*|*|REMOVESELF [Dependency Walker *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\Dependency Walker RegKey1=HKCU\Software\Microsoft\Dependency Walker\Recent File List [Deponia *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\214340 DetectFile=%LocalAppData%\Daedalic Entertainment\Deponia FileKey1=%LocalAppData%\Daedalic Entertainment\Deponia|*.log [Desk 365 *] LangSecRef=3021 Detect1=HKCU\Software\V9\Desk 365 Detect2=HKLM\Software\V9\Desk 365 Plus DetectFile=%ProgramFiles%\Desk 365* FileKey1=%AppData%\Desk 365*\icons|*.*|RECURSE FileKey2=%AppData%\Desk 365*\sysicons|*.ico FileKey3=%ProgramFiles%\Desk 365|recent.xml FileKey4=%SystemDrive%\User Data\Default|*.* [Desktop Central Free Windows Admin Tools *] LangSecRef=3024 DetectFile=%ProgramFiles%\ManageEngine\ManageEngine Free Tools\DesktopCentral Free Windows Admin Tools FileKey1=%ProgramFiles%\ManageEngine\ManageEngine Free Tools\DesktopCentral Free Windows Admin Tools\logs|*.* FileKey2=%SystemDrive%|free-tools.log [Desktop Dialing *] LangSecRef=3022 DetectFile=%AppData%\Desktop Dialing FileKey1=%AppData%\Desktop Dialing|log-*.sil [Desktop SMS *] LangSecRef=3021 DetectFile=%ProgramFiles%\IDM\Desktop SMS FileKey1=%ProgramFiles%\IDM\Desktop SMS|*.log [Deus Ex *] Section=Games DetectFile=%SystemDrive%\DeusEx\System FileKey1=%SystemDrive%\DeusEx\System|*.log [DeviceDoctor *] LangSecRef=3024 DetectFile=%AppData%\DeviceDoctorSoftware\DeviceDoctor FileKey1=%AppData%\DeviceDoctorSoftware\DeviceDoctor\Logs|*.* [Devolo Cockpit *] LangSecRef=3024 Detect=HKLM\Software\devolo\dLAN FileKey1=%ProgramFiles%\devolo\dlan|dlanhistory.*txt;dlanstats.*xml;support.html;support.zip FileKey2=%ProgramFiles%\devolo\dlan\updates|*.*|RECURSE [Devolutions Remote Desktop Manager *] LangSecRef=3021 DetectFile=%AppData%\Devolutions\RemoteDesktopManager FileKey1=%AppData%\Devolutions\RemoteDesktopManager|*.log* FileKey2=%LocalAppData%\Devolutions\RemoteDesktopManager|*.log* [Dexpot *] LangSecRef=3024 DetectFile=%AppData%\Dexpot FileKey1=%AppData%\Dexpot|*.log [DFX *] LangSecRef=3021 Detect=HKCU\Software\DFX FileKey1=%LocalAppData%\DFX\*|dfx_skin.txt FileKey2=%LocalAppData%\DFX\*\Tmp|*.*|REMOVESELF [Diablo II/III *] Section=Games Detect1=HKCU\Software\Blizzard Entertainment\D3 Detect2=HKCU\Software\Blizzard Entertainment\Diablo II FileKey1=%ProgramData%\Battle.net\Setup\diablo3_engb\Log|* FileKey2=%ProgramFiles%\Diablo II|*.log;BnetLog.txt;D*.txt FileKey3=%ProgramFiles%\Diablo III*\Logs|* FileKey4=%SystemDrive%\Diablo II|*.log;BnetLog.txt;D*.txt FileKey5=%UserProfile%\Documents\Diablo II\GameLogs|*.txt [Diagnose Windows *] LangSecRef=3024 DetectFile=%ProgramFiles%\Diagnose Windows FileKey1=%ProgramFiles%\Diagnose Windows|*.log [Digi Net Mobile *] LangSecRef=3021 DetectFile=%ProgramData%\Digi Net Mobile FileKey1=%ProgramData%\Digi Net Mobile\log|*.log;*.txt [Digital Janitor *] LangSecRef=3024 Detect=HKCU\Software\Davide Vitelaru\Digital Janitor FileKey1=%AppData%\Digital Janitor|ToSortHistory [Digsby *] LangSecRef=3022 DetectFile=%ProgramFiles%\Digsby FileKey1=%LocalAppData%\Digsby\Cache|*.*|RECURSE FileKey2=%LocalAppData%\Digsby\Logs|*.*|RECURSE FileKey3=%LocalAppData%\Digsby\Temp|*.*|RECURSE [Digsby Chat Logs *] LangSecRef=3022 DetectFile=%ProgramFiles%\Digsby FileKey1=%UserProfile%\Documents\Digsby Logs|*.*|RECURSE [Dimension 4 *] LangSecRef=3024 DetectFile=%ProgramFiles%\D4 FileKey1=%ProgramFiles%\D4|SyncHistory*.dat [Directory Lister *] LangSecRef=3024 DetectFile=%ProgramFiles%\Directory Lister* FileKey1=%ProgramFiles%\Directory Lister*|*Setup.exe [Directory Opus *] LangSecRef=3024 Detect=HKLM\Software\GPSoftware\Directory Opus FileKey1=%AppData%\GPSoftware\Directory Opus\Icon Cache Roaming|*.*|RECURSE FileKey2=%LocalAppData%\GPSoftware\Directory Opus\Thumbnail Cache|*.*|RECURSE [Disco Elysium *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\ZAUM Studio\Disco Elysium FileKey1=%UserProfile%\AppData\LocalLow\ZAUM Studio\Disco Elysium|*log [Discord *] LangSecRef=3022 Detect1=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Discord Detect2=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiscordCanary Detect3=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiscordPTB FileKey1=%AppData%\BetterDiscord|*.log FileKey2=%AppData%\BetterDiscord\temp|*|REMOVESELF FileKey3=%AppData%\Discord*|*-journal;*.old;*.tmp;LOG;modules.log;Network Persistent State;QuotaManager|RECURSE FileKey4=%AppData%\Discord*\*Cache|*|REMOVESELF FileKey5=%AppData%\Discord*\blob_storage|*|RECURSE FileKey6=%AppData%\Discord*\Crashpad\reports|* FileKey7=%AppData%\Discord*\Logs|* FileKey8=%AppData%\Discord*\module_data\discord_hook|*.log FileKey9=%AppData%\Discord*\VideoDecodeStats|* FileKey10=%LocalAppData%\Discord*|*.log FileKey11=%LocalAppData%\Discord*\packages\SquirrelTemp|*|REMOVESELF [Dishonored *] Section=Games Detect=HKCU\Software\Arkane\Dishonored DetectFile=%UserProfile%\Documents\My Games\Dishonored FileKey1=%UserProfile%\Documents\My Games\Dishonored\DishonoredGame\Logs|*.* [Disk Space Fan *] LangSecRef=3024 Detect=HKCU\Software\Cookapp\DSF4 FileKey1=%AppData%\DiskSpaceFan|log.txt;history_C.sqlite [DiskBoss *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskBoss Ultimate FileKey1=%LocalAppData%\DiskBoss Ultimate\data\reports|*.*|REMOVESELF [DiskMax *] LangSecRef=3024 DetectFile=%AppData%\KoshyJohn.com\DiskMax FileKey1=%AppData%\KoshyJohn.com\DiskMax|*Log.txt FileKey2=%AppData%\KoshyJohn.com\DiskMax\bin|*.log [DisplayFusion *] LangSecRef=3024 Detect=HKCU\Software\Binary Fortress Software\DisplayFusion FileKey1=%AppData%\DisplayFusion|DisplayFusionSetup.exe;DisplayFusion*.log;DebugInfo.* FileKey2=%LocalAppData%\DisplayFusion|*.log FileKey3=%ProgramData%\Binary Fortress Software\DisplayFusion|DisplayFusionSetup.exe;*.log [DivFix++ *] LangSecRef=3023 Detect=HKCU\Software\Death Knight\DivFix++ RegKey1=HKCU\Software\Death Knight\DivFix++|PathLog RegKey2=HKCU\Software\Death Knight\DivFix++|PathOut [DivX *] LangSecRef=3023 Detect1=HKCU\Software\DivX Detect2=HKLM\Software\DivXNetworks FileKey1=%AppData%\DivX|Font Cache.*|RECURSE FileKey2=%AppData%\DivX\DivX Codec|statistics.xml FileKey3=%AppData%\DivX\DMS\logs|* FileKey4=%ProgramData%\DivX|*.log|RECURSE FileKey5=%UserProfile%\Videos\DivX Movies|*|RECURSE RegKey1=HKCU\Software\DivX\Settings\Converter|lastBrowseDir RegKey2=HKCU\Software\DivX\Settings\Converter|outputDir RegKey3=HKCU\Software\DivX\Settings\Player\PlayerState|LastOpenFileLocation RegKey4=HKCU\Software\DivX\Settings\TransferWizard|LastBrwosedDir RegKey5=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry1 RegKey6=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry2 RegKey7=HKCU\Software\DivX\Settings\WebPlayer|cacheEntry3 RegKey8=HKCU\Software\DivXNetworks\DivX Player|CustomOpenFileFolder RegKey9=HKCU\Software\DivXNetworks\DivX Player|file RegKey10=HKCU\Software\DivXNetworks\DivX Player|LastOpenFileFolder RegKey11=HKCU\Software\DivXNetworks\DivX4Windows|MP4 File Name RegKey12=HKCU\Software\DivXNetworks\DivX4Windows|MV File Name RegKey13=HKCU\Software\DivXNetworks\DivX4Windows|YUV Dir Name RegKey14=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry1 RegKey15=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry2 RegKey16=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry3 RegKey17=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry4 RegKey18=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry5 RegKey19=HKCU\Software\DivXNetworks\DivXBrowserPlugin|cacheEntry6 [Dj MixStation *] LangSecRef=3023 DetectFile=%ProgramFiles%\ejay\Dj MixStation* FileKey1=%ProgramFiles%\ejay\Dj MixStation*\history|*.txt [DJUCED *] LangSecRef=3023 DetectFile=%UserProfile%\Documents\DJUCED FileKey1=%UserProfile%\Documents\DJUCED\Cache|*.*|RECURSE FileKey2=%UserProfile%\Documents\DJUCED\Logs|*.* [DjVuReader *] LangSecRef=3021 Detect=HKCU\Software\DjVuReader RegKey1=HKCU\Software\DjVuReader\MRUList [DLExpert *] LangSecRef=3021 Detect=HKCU\Software\Ying3\DLExpert RegKey1=HKCU\Software\Ying3\DLExpert|ftp RegKey2=HKCU\Software\Ying3\DLExpert|http RegKey3=HKCU\Software\Ying3\DLExpert\MAIN|ALLFILE RegKey4=HKCU\Software\Ying3\DLExpert\MAIN|GOOD RegKey5=HKCU\Software\Ying3\DLExpert\MAIN|GOODURL RegKey6=HKCU\Software\Ying3\DLExpert\Recent File List [DNIe *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\DNIeRemote.log FileKey1=%UserProfile%\Documents|DNIeRemote.log [DoctorWeb *] LangSecRef=3024 DetectFile=%UserProfile%\DoctorWeb\Quarantine FileKey1=%UserProfile%\DoctorWeb\Quarantine|*.*|RECURSE [DocuCom PDF *] LangSecRef=3021 DetectFile1=%AppData%\Zeon\DocuCom\PDF* DetectFile2=%AppData%\Zeon\DocuCom\ZNSL FileKey1=%AppData%\Zeon\DocuCom\PDF*\Log|*.* FileKey2=%AppData%\Zeon\DocuCom\ZNSL|*.log;VeriHist.zli [Document Trace Remover *] LangSecRef=3024 Detect=HKCU\Software\Smart PC Solutions\Document Trace Remover FileKey1=%AppData%\Smart PC Solutions\Smart Fast PC\Log|*.* RegKey1=HKCU\Software\Smart PC Solutions\Document Trace Remover|LastFile RegKey2=HKCU\Software\Smart PC Solutions\Document Trace Remover|LastFolder [DocX Viewer *] LangSecRef=3021 DetectFile=%SystemDrive%\epingsoft\DocXV FileKey1=%SystemDrive%\epingsoft\DocXV|rec.lst [Dollar Dash *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\214320 FileKey1=%UserProfile%\Documents\My Games\DollarDash\PKGame\Logs|*.* [Dolphin Emulator *] Section=Games DetectFile=%UserProfile%\Documents\Dolphin Emulator FileKey1=%UserProfile%\Documents\Dolphin Emulator\Logs|*.*|RECURSE [Donkey Kong Country *] Section=Games DetectFile=%ProgramFiles%\Donkey Kong Country FileKey1=%ProgramFiles%\Donkey Kong Country|stderr.txt;stdout.txt [Don't Starve *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219740 FileKey1=%ProgramFiles%\Steam\steamapps\common\dont_starve\bin|log.txt FileKey2=%UserProfile%\Documents\Klei\DoNotStarve|log.txt [Dooble *] LangSecRef=3022 DetectFile=%SystemDrive%\Dooble FileKey1=%SystemDrive%\Dooble\*\.dooble|cookies.db;favicons.fb;history.db FileKey2=%SystemDrive%\Dooble\*\.dooble|downloads.db FileKey3=%SystemDrive%\Dooble\*\.dooble\Cache|*.*|REMOVESELF [DOOM 2016 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\379720 FileKey1=%LocalAppData%\id Software\DOOM\base\generated\temp|*.* FileKey2=%UserProfile%\Saved Games\id Software\DOOM\base\generated\temp|*.* [Doremi *] LangSecRef=3023 DetectFile=%LocalAppData%\Doremi FileKey1=%LocalAppData%\Doremi\Cache\QtWebEngine\Default\Cache|*.* FileKey2=%LocalAppData%\Doremi\QtWebEngine\Default|*-journal;*.old;LOG;NetWork Persistent State;Visited Links|RECURSE FileKey3=%LocalAppData%\Doremi\QtWebEngine\Default\blob_storage|*.*|RECURSE FileKey4=%LocalAppData%\Doremi\QtWebEngine\Default\GPUCache|*.* [Double Vision Browser 3.0 *] LangSecRef=3022 Detect=HKCU\Software\Sincell\Double Vision 3.0.0 FileKey1=%ProgramFiles%\Sincell\Double Vision 3.0.0\Logs|*.* [Download Accelerator Plus *] LangSecRef=3022 Detect=HKCU\Software\SpeedBit\Download Accelerator DetectFile=%ProgramFiles%\DAP FileKey1=%ProgramData%\SpeedBit\DAP\Plugins\Log|* [Download Free Music *] LangSecRef=3022 DetectFile=%ProgramFiles%\Download Free Music FileKey1=%ProgramFiles%\Download Free Music|lastDev.dat;lastUser.dat FileKey2=%UserProfile%|lastDev.dat;lastUser.dat [Download Manager *] LangSecRef=3022 DetectFile=%AppData%\Download Manager FileKey1=%AppData%\Download Manager|DownloadManagerList.dmc [DownTango *] LangSecRef=3022 DetectFile=%LocalAppData%\DownTango FileKey1=%LocalAppData%\DownTango|application.log FileKey2=%LocalAppData%\DownTango\Logs|log.txt [Dr. Despicable's Dastardly Deeds *] Section=Games DetectFile=%AppData%\HitPoint Studios\DrD FileKey1=%AppData%\HitPoint Studios\DrD|logfile.txt [Dr. Hardware 2014 Report *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Dr. Hardware 2014_is1 FileKey1=%UserProfile%|Report_drhard.txt [Dr. Web CureIt! *] LangSecRef=3024 DetectFile=%UserProfile%\Doctor Web FileKey1=%UserProfile%\Doctor Web|*.log [DraftSight *] LangSecRef=3021 Detect1=HKCU\Software\Dassault Systemes\DraftSight Detect2=HKLM\Software\Dassualt Systemes\DraftSight FileKey1=%AppData%\DraftSight\*|history.txt;plot.log FileKey2=%LocalAppData%\Dassault Systemes\DraftSight\cache|*.*|RECURSE [Dragon Age: Origins *] Section=Games Detect1=HKCU\Software\BioWare\Dragon Age Detect2=HKLM\Software\BioWare\Dragon Age FileKey1=%ProgramData%\BioWare\Dragon Age\DA Updater\Logs|* FileKey2=%UserProfile%\Documents|DAO Ultimate Addins Updater.log FileKey3=%UserProfile%\Documents\BioWare\Dragon Age\Logs|* [Dragon UnPACKer 5 *] LangSecRef=3024 Detect=HKCU\Software\Dragon Software\Dragon UnPACKer 5 FileKey1=%ProgramFiles%\Dragon UnPACKer 5|*.log;*.diz RegKey1=HKCU\Software\Dragon Software\Dragon UnPACKer 5\HyperRipper|Source RegKey2=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|LastFilterIndex RegKey3=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|LastFilterIndex_Hash RegKey4=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_0 RegKey5=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_1 RegKey6=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_2 RegKey7=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_3 RegKey8=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_4 RegKey9=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_5 RegKey10=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_6 RegKey11=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_7 RegKey12=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_8 RegKey13=HKCU\Software\Dragon Software\Dragon UnPACKer 5\Options|Recent_9 [Dreadnought *] Section=Games Detect=HKCU\Software\Grey Box\Dreadnought FileKey1=%LocalAppData%\DreadGame\Saved\Logs|*.log [Dream Aquarium *] LangSecRef=3021 DetectFile=%ProgramFiles%\Dream Aquarium FileKey1=%ProgramFiles%\Dream Aquarium|stdout [Drive SnapShot *] LangSecRef=3024 Detect=HKCU\Software\SnapShot RegKey1=HKCU\Software\SnapShot|RecentFile0 RegKey2=HKCU\Software\SnapShot|RecentFile1 RegKey3=HKCU\Software\SnapShot|RecentFile2 RegKey4=HKCU\Software\SnapShot|RecentFile3 RegKey5=HKCU\Software\SnapShot|RecentFile4 RegKey6=HKCU\Software\SnapShot|RecentFile5 RegKey7=HKCU\Software\SnapShot|RecentFile6 RegKey8=HKCU\Software\SnapShot|RecentFile7 RegKey9=HKCU\Software\SnapShot|RecentFile8 RegKey10=HKCU\Software\SnapShot|RecentFile9 RegKey11=HKCU\Software\SnapShot|RecentHashFile0 RegKey12=HKCU\Software\SnapShot|RecentHashFile1 RegKey13=HKCU\Software\SnapShot|RecentHashFile2 RegKey14=HKCU\Software\SnapShot|RecentHashFile3 RegKey15=HKCU\Software\SnapShot|RecentHashFile4 RegKey16=HKCU\Software\SnapShot|RecentHashFile5 RegKey17=HKCU\Software\SnapShot|RecentHashFile6 RegKey18=HKCU\Software\SnapShot|RecentHashFile7 RegKey19=HKCU\Software\SnapShot|RecentHashFile8 RegKey20=HKCU\Software\SnapShot|RecentHashFile9 RegKey21=HKCU\Software\SnapShot|RecentVirtualDrive [DriveImage XML *] LangSecRef=3021 Detect=HKLM\Software\Runtime Software\DIXML FileKey1=%ProgramFiles%\Runtime Software\DriveImage XML|log.txt [Driver Cleaner.NET *] LangSecRef=3024 DetectFile=%ProgramFiles%\DriverCleanerDotNET FileKey1=%ProgramFiles%\DriverCleanerDotNET\Backup|*.*|RECURSE FileKey2=%ProgramFiles%\DriverCleanerDotNET\Log|*.* [Driver Fusion *] LangSecRef=3024 DetectFile=%ProgramFiles%\Driver Fusion\Logs FileKey1=%ProgramFiles%\Driver Fusion\Backup|*.*|RECURSE FileKey2=%ProgramFiles%\Driver Fusion\Logs|*.*|RECURSE [Driver Magician *] LangSecRef=3021 Detect=HKCU\Software\Driver Magician FileKey1=%AppData%\Driver Magician|HiddenUpdate.txt [DriverCure *] LangSecRef=3024 Detect=HKCU\Software\ParetoLogic DriverCure FileKey1=%AppData%\DriverCure|LogFile.* [DriverEasy *] LangSecRef=3024 DetectFile=%ProgramFiles%\Easeware\DriverEasy FileKey1=%AppData%\Easeware\DriverEasy\drivers|*.*|RECURSE FileKey2=%UserProfile%\Documents\DriverEasy|*.*|RECURSE [DriverGenius *] LangSecRef=3024 Detect=HKLM\Software\Driver-Soft\DriverGenius DetectFile=%ProgramFiles%\Driver-Soft\DriverGenius FileKey1=%LocalAppData%\DriverGenius|ScanLog.log FileKey2=%ProgramData%\DriverGenius|*.log FileKey3=%ProgramData%\DriverGenius\Downloads|* FileKey4=%ProgramData%\DriverGenius\InstalledUpdates|* FileKey5=%ProgramData%\DriverGenius\Temp|* [DriverMax *] LangSecRef=3024 Detect=HKCU\Software\Innovative Solutions\DriverMax FileKey1=%LocalAppData%\Innovative Solutions\DriverMax\Agent|*.tmp;dmxlog.txt;lastscan*.xml;logScan.txt FileKey2=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Downloded Drivers|*.* FileKey3=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Dump|*.* FileKey4=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Uploads|*.*|RECURSE FileKey5=%LocalAppData%\Innovative Solutions\DriverMax\Backup|*.* FileKey6=%LocalAppData%\Innovative Solutions\DriverMax\LastScan|*.* FileKey7=%LocalAppData%\Innovative Solutions\DriverMax\Temp*|*.* FileKey8=%ProgramFiles%\Innovative Solutions\DriverMax|*.log [DriverPack Solution *] LangSecRef=3024 Detect=HKCU\Software\drpsu FileKey1=%AppData%\DriverPack Notifier\temp|*.* FileKey2=%AppData%\DRPSu\Logs|*.* FileKey3=%AppData%\DRPSu\snapshots|*.* FileKey4=%AppData%\DRPSu\temp|*.* FileKey5=%UserProfile%\Documents\DRP-Log|*.* FileKey6=%WinDir%\Logs\DIALog|*.txt FileKey7=%WinDir%\Logs\DRPLog|*.png;*.txt FileKey8=%WinDir%\Logs\SysInfo|*.* [DriverRadarPro *] LangSecRef=3024 Detect=HKCU\Software\NoVirusThanks\DriverRadarPro RegKey1=HKCU\Software\NoVirusThanks\DriverRadarPro|edCopyDrvTo RegKey2=HKCU\Software\NoVirusThanks\DriverRadarPro|edSaveLogsTo [DriverRobot *] LangSecRef=3024 Detect=HKCU\Software\Driver Robot FileKey1=%AppData%\Blitware\DriverRobot\Logs|*.* [Dropbox *] LangSecRef=3024 Detect=HKCU\Software\Dropbox FileKey1=%AppData%\DropBox|Filecache.db;SigStore.db FileKey2=%AppData%\DropBox\Bin|*.log FileKey3=%AppData%\Dropbox\Cache|*|RECURSE FileKey4=%AppData%\Dropbox\installer|*|RECURSE FileKey5=%AppData%\Dropbox\logs|*|RECURSE FileKey6=%AppData%\DropBoxOem\Log|*|RECURSE FileKey7=%LocalAppData%\Dropbox\Crashpad\reports|*.dmp FileKey8=%LocalAppData%\Dropbox\CrashReports|*|RECURSE FileKey9=%LocalAppData%\Dropbox\instance*\sync|*.sqlite3-* FileKey10=%LocalAppData%\Dropbox\instance*\sync\temp|* FileKey11=%LocalAppData%\Dropbox\Logs|*|RECURSE FileKey12=%LocalAppData%\Dropbox\QuitReports|* FileKey13=%ProgramData%\Dropbox\Update\Log|* FileKey14=%ProgramFiles%\Dropbox\Update\Download|*|REMOVESELF FileKey15=%UserProfile%\Documents\Dropbox\.dropbox.cache|*|RECURSE FileKey16=%UserProfile%\Dropbox\.dropbox.cache|*|RECURSE [DSDCS InputMapper *] LangSecRef=3024 DetectFile=%ProgramFiles%\DSDCS FileKey1=%ProgramFiles%\DSDCS|*.log|RECURSE [DU Meter *] LangSecRef=3022 Detect=HKCU\Software\Hagel\DU Meter FileKey1=%ProgramData%\Hagel Technologies\DU Meter|*.csv;error.elf [DuckieTV *] LangSecRef=3023 DetectFile=%AppData%\DuckieTV FileKey1=%AppData%\DuckieTV|*.log;*.txt [Duke Nukem 3D *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\225140 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Duke Nukem 3D\bin|stderr.txt;stdout.txt [DUMo *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\DUMo FileKey1=%AppData%\KC Softwares\DUMo|*.log;DUMo.cache [Dungeon of the Endless *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\249050 FileKey1=%UserProfile%\Documents\Dungeon of the Endless\Temporary Files|*.* [Dungeon Siege *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\39190 FileKey1=%UserProfile%\Documents\Dungeon Siege\Logs|*.* [Dungeons - The Dark Lord *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\200550 FileKey1=%AppData%\Kalypso Media\Dungeons - The Dark Lord|log.txt [Dup Detector *] LangSecRef=3023 Detect=HKCU\Software\Prismatic Software\PhotoBatch RegKey1=HKCU\Software\Prismatic Software\PhotoBatch\Dialogs|LastBatchFile RegKey2=HKCU\Software\Prismatic Software\PhotoBatch\Dialogs|LastBatchFolder RegKey3=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastBatFile RegKey4=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastFold RegKey5=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastSecFold RegKey6=HKCU\Software\Prismatic Software\PhotoBatch\Dups|LastSingleFold RegKey7=HKCU\Software\Prismatic Software\PhotoBatch\MRU [DupKiller *] LangSecRef=3024 DetectFile=%ProgramFiles%\DupKilIer FileKey1=%ProgramFiles%\DupKilIer|DupKiller.log [Duplicate Cleaner *] LangSecRef=3024 DetectFile=%AppData%\DigitalVolcano FileKey1=%AppData%\DigitalVolcano\DuplicateCleaner|*.data FileKey2=%UserProfile%\Documents|Duplicate Cleaner log.txt [Duplicate Photo Finder *] LangSecRef=3024 Detect=HKCU\Software\Duplicate Photo Finder RegKey1=HKCU\Software\Duplicate Photo Finder|AddFolderWiz RegKey2=HKCU\Software\Duplicate Photo Finder|last1 RegKey3=HKCU\Software\Duplicate Photo Finder|lastR1 [DUSK *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\519860 FileKey1=%UserProfile%\AppData\LocalLow\David Szymanski\Dusk|output_log.txt [DVBDream *] LangSecRef=3024 Detect=HKLM\Software\DVBDream FileKey1=%ProgramFiles%\dvbdream|*.log;*.bak;*levellog*|RECURSE FileKey2=%ProgramFiles%\dvbdream\Logs|*.* FileKey3=%SystemDrive%\dvbdream|*.log;*.bak;*levellog*|RECURSE FileKey4=%SystemDrive%\dvbdream\Logs|*.* [DVBViewer *] LangSecRef=3023 Detect=HKLM\Software\CM&V\DVBViewer FileKey1=%AppData%\CMUV\DVBViewer*|*.bak;*.log FileKey2=%ProgramData%\CMUV\DVBViewer*|*.bak;*.log FileKey3=%ProgramData%\CMUV\DVBViewer\backup|*|REMOVESELF FileKey4=%ProgramFiles%\DVBViewer\backup|*|REMOVESELF FileKey5=%ProgramFiles%\DVBViewer\GraphPresets|*.fgp FileKey6=%ProgramFiles%\DVBViewer\Remotes|* FileKey7=%ProgramFiles%\DVBViewer\setup|* FileKey8=%ProgramFiles%\DVBViewer\Transponders|* [DVD-Cloner *] LangSecRef=3023 Detect1=HKCU\Software\Dvd-cloner Detect2=HKCU\Software\DVD-Cloner Gold FileKey1=%AppData%\DVD-Cloner*|*.log FileKey2=%ProgramData%\DVD-Cloner*|*.log FileKey3=%ProgramFiles%\DVD-Cloner Platinum\*\readcache|* FileKey4=%ProgramFiles%\DVD-Cloner*|*.log|RECURSE FileKey5=%SystemDrive%|dtdlog.txt FileKey6=%UserProfile%\Documents|Smart.log;Smart_result.log FileKey7=%WinDir%\System32|dvdtest10024.dat [DVD-Ranger *] LangSecRef=3021 Detect=HKLM\Software\DVD-Ranger FileKey1=%ProgramData%\DVDRanger\DDF626ADdvdcss|* FileKey2=%ProgramData%\DVDRanger\Logs|* FileKey3=%SystemDrive%\DVDRanger|*|REMOVESELF FileKey4=%UserProfile%\Documents\DVDRanger\Screenshots|*|RECURSE FileKey5=%UserProfile%\Documents\DVDRanger\Temp|*|REMOVESELF [DVD Flick *] LangSecRef=3023 DetectFile=%ProgramFiles%\DVD Flick FileKey1=%AppData%\DVD Flick|dvdflick.log;report.txt [DVD Shrink *] LangSecRef=3023 Detect=HKCU\Software\DVD Shrink FileKey1=%ProgramData%\DVD Shrink|* [dvdcss *] LangSecRef=3023 DetectFile1=%AppData%\.dvdcss DetectFile2=%AppData%\dvdcss* DetectFile3=%UserProfile%\.dvdcss FileKey1=%AppData%\.dvdcss|*.*|REMOVESELF FileKey2=%AppData%\dvdcss*|*.*|REMOVESELF FileKey3=%UserProfile%\.dvdcss|*.*|REMOVESELF [DVDFab *] LangSecRef=3023 Detect1=HKCU\Software\DVDFab Detect2=HKCU\Software\DVDFab Passkey Detect3=HKCU\Software\FabPlayer FileKey1=%AppData%\DVDFab Player*\Advertis*|*|RECURSE FileKey2=%AppData%\DVDFab\DVDFab*\regRecord|*.rec FileKey3=%AppData%\DVDFab\DVDFab*\SceneData|*|RECURSE FileKey4=%AppData%\DVDFab\DVDFabCommon|*.bin FileKey5=%AppData%\LiveUpdate|*.log FileKey6=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*|RECURSE FileKey7=%LocalAppData%\DVDFab*\cache\QtWebEngine\Default\Cache|* FileKey8=%LocalAppData%\DVDFab*\QtWebEngine\Default\GPUCache|*|REMOVESELF FileKey9=%LocalAppData%\DVDFab*\QtWebEngine\Default\Service Worker\Database|LOG;LOG.old FileKey10=%UserProfile%\Documents\DVDFab*|*.log FileKey11=%UserProfile%\Documents\DVDFab*\Log|*|RECURSE FileKey12=%UserProfile%\Documents\DVDFab*\SceneData|*|RECURSE FileKey13=%UserProfile%\Documents\DVDFab*\Temp|*|RECURSE FileKey14=%UserProfile%\Documents\DVDFab\DVDFab*\Cinavia|*|RECURSE FileKey15=%UserProfile%\Documents\DVDFab\DVDFab*\Log|*|RECURSE FileKey16=%UserProfile%\Documents\DVDFab\DVDFab*\Temp|*|RECURSE FileKey17=%UserProfile%\Documents\DVDFab\updateLog|*|REMOVESELF FileKey18=%UserProfile%\Documents\LiveUpdate|*|REMOVESELF FileKey19=%UserProfile%\Documents\PcSetup|*|RECURSE RegKey1=HKCU\Software\FabPlayer|DefaultDir RegKey2=HKCU\Software\FabPlayer|DefaultFile [DVDSmith *] LangSecRef=3023 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DVDSmith Movie Backup_is1 FileKey1=%UserProfile%\Documents\dvdsmith|*.log [DVDVideoSoft *] LangSecRef=3023 Detect1=HKCU\Software\AppDataLow\Software\DVDVideoSoftTB Detect2=HKCU\Software\DVDVideoSoft FileKey1=%AppData%\DVDVideoSoft\*\History|*.*|RECURSE FileKey2=%AppData%\DVDVideoSoft\*Logs|*.*|RECURSE FileKey3=%AppData%\DVDVideoSoft\Backup|*.*|RECURSE FileKey4=%LocalAppData%\DVDVideoSoftTB\Logs|*.*|RECURSE FileKey5=%UserProfile%\Documents\DVDVideoSoft|*log.txt|RECURSE [DVDx *] LangSecRef=3023 Detect=HKCU\Software\DVDx FileKey1=%ProgramFiles%\DVDx|*.tmp RegKey1=HKCU\Software\DVDx\LastDir RegKey2=HKCU\Software\DVDx\LastOutput [DVIPS Shell *] LangSecRef=3021 Detect=HKCU\Software\Juan M. Aguirregabiria\DVIPSsh\Version 1.00 RegKey1=HKCU\Software\Juan M. Aguirregabiria\DVIPSsh\Version 1.00|Options [DxO Photo Suite *] LangSecRef=3021 DetectFile1=%LocalAppData%\DxO* DetectFile2=%UserProfile%\Documents\DxO* FileKey1=%LocalAppData%\DxO*\DataCache|*|RECURSE FileKey2=%LocalAppData%\DxO*\DxO*\*Cache|*|RECURSE FileKey3=%LocalAppData%\DxO*\DxO*\CrashReports|*|RECURSE FileKey4=%LocalAppData%\DxO*\DxO*\Logs|* FileKey5=%LocalAppData%\DxO*\Logs|* FileKey6=%UserProfile%\Documents\DxO * crash*s|* FileKey7=%UserProfile%\Documents\DxO * logs|* FileKey8=%UserProfile%\Documents\DxO*\CrashReports|*|RECURSE FileKey9=%UserProfile%\Documents\DxO*\log|* [Dying Light *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\239140 DetectFile=%UserProfile%\Documents\Dying*Light FileKey1=%UserProfile%\Documents\Dying*Light\Out\Logs|*.* FileKey2=%UserProfile%\Documents\Dying*Light\Out\Screenshots|screen_*.tga [Dyn Updater *] LangSecRef=3022 Detect=HKCU\Software\Dyn\Dyn Updater FileKey1=%ProgramData%\Dyn\Updater|*.log;*.msi [Dynamo *] LangSecRef=3021 DetectFile=%AppData%\Dynamo FileKey1=%AppData%\Dynamo\*\Logs|*Log_*.txt [EA App *] Section=Games Detect1=HKCU\Software\EA Games\EA Core Detect2=HKLM\Software\EA Games\EA Core Detect3=HKLM\SOFTWARE\Electronic Arts\EA Desktop Detect4=HKLM\Software\Electronic Arts\EADM FileKey1=%LocalAppData%\EA Core\Cache|*|REMOVESELF FileKey2=%LocalAppData%\EADesktop\cache|*|REMOVESELF FileKey3=%LocalAppData%\EADesktop\QtWebEngine\Default|*state;quota*;visited* FileKey4=%LocalAppData%\EADesktop\QtWebEngine\Default\*cache|*|RECURSE FileKey5=%LocalAppData%\EADesktop\QtWebEngine\Default\blob_storage|*|REMOVESELF FileKey6=%LocalAppData%\EALaunchHelper\cache\qmlcache|*|RECURSE FileKey7=%LocalAppData%\Electronic Arts\EA Desktop\*Cache|*|RECURSE FileKey8=%LocalAppData%\Electronic Arts\EA Desktop\Logs|* FileKey9=%LocalAppData%\Electronic Arts\EA Desktop\OfflineTelemetry|* FileKey10=%LocalAppData%\Electronic Arts\EADMUI\Web Cache|*|RECURSE FileKey11=%ProgramData%\EA Core\Cache|*|REMOVESELF FileKey12=%ProgramData%\EA Desktop\Logs|* FileKey13=%ProgramData%\EA Logs|* FileKey14=%ProgramData%\Electronic Arts\EA Core\logs|* FileKey15=%ProgramData%\Origin\Logs|* FileKey16=%WinDir%\System32\config\systemprofile\AppData\Local\Electronic Arts\EA Desktop|*|REMOVESELF [EA App Game Installers *] Section=Games Detect=HKLM\SOFTWARE\Electronic Arts\EA Desktop FileKey1=%ProgramFiles%\EA Games\*\__Installer|InstallLog.txt FileKey2=%ProgramFiles%\EA Games\*\__Installer\directx|*|REMOVESELF FileKey3=%ProgramFiles%\EA Games\*\__Installer\vc|*|REMOVESELF [EA Games Battlefield 5 *] Section=Games DetectFile=%UserProfile%\Documents\Battlefield V FileKey1=%LocalAppData%\Battlefield V\shaders|*.cache FileKey2=%UserProfile%\Documents\Battlefield V\twinkle\temp\*http*|*|RECURSE [EA Games Battlefield 2042 *] Section=Games DetectFile=%UserProfile%\Documents\Battlefield 2042 FileKey1=%UserProfile%\Documents\Battlefield 2042\Cache|*|RECURSE FileKey2=%UserProfile%\Documents\Battlefield 2042\CrashDumps|*|RECURSE [EA Games Battlefield 2042 Screenshots *] Section=Games DetectFile=%UserProfile%\Documents\Battlefield 2042 FileKey1=%UserProfile%\Documents\Battlefield 2042\Screenshots|*|RECURSE [Earth 2160 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\19000 FileKey1=%UserProfile%\Documents\Earth 2160\FontsCache|*.* [Earth Alerts *] LangSecRef=3022 Detect=HKCU\Software\South Wind Technologies\Earth Alerts FileKey1=%AppData%\Earth Alerts\Images|*.*|RECURSE FileKey2=%AppData%\Earth Alerts\Messages|*.*|RECURSE [EaseUS Data Recovery Wizard *] LangSecRef=3024 DetectFile=%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard FileKey1=%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard|*.log ExcludeKey1=FILE|%ProgramFiles%\EaseUS\EaseUS Data Recovery Wizard\|install.log [EaseUS KeyFinder *] LangSecRef=3024 DetectFile=%LocalAppData%\EaseUS\KeyFinder FileKey1=%LocalAppData%\EaseUS\KeyFinder\Cache\qmlcache|*.* [EaseUS MobiSaver *] LangSecRef=3021 Detect1=HKLM\Software\EASEUS\EASEUS IPhone Wizard Detect2=HKLM\Software\EaseUS\Mobisaver for Android FileKey1=%ProgramFiles%\EaseUS\EaseUS MobiSaver*\bin|CommDbg.txt;*.log;Eaolog;mbs FileKey2=%SystemDrive%\EaseUS MobiSaver * Temp Backup|*|RECURSE [EaseUS Partition Master *] LangSecRef=3024 Detect=HKCU\Software\EASEUS\EASEUS Partition Manager FileKey1=%ProgramFiles%\EASEUS\EASEUS Partition Master*\bin|*.log|RECURSE FileKey2=%WinDir%|EPMBatch.ept;OutLog.txt [EaseUS ToDo Backup *] LangSecRef=3024 Detect=HKCU\Software\EaseUS\EaseUS Todo Backup FileKey1=%ProgramFiles%\EaseUS\Todo Backup\bin|easeus.log;TbLogsysClient.tblog [East-Tec Eraser *] LangSecRef=3024 Detect=HKLM\Software\East-Tec\east-tec Eraser FileKey1=%ProgramData%\East-Tec\east-tec Eraser\Updates|*|RECURSE FileKey2=%ProgramFiles%\east-tec Eraser|except.log [Easy Anti-Cheat *] Section=Games DetectFile=%AppData%\EasyAntiCheat FileKey1=%AppData%\EasyAntiCheat|*.log|REMOVESELF [Easy CD-DA Extractor *] LangSecRef=3024 Detect=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8 RegKey1=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k8c RegKey2=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k80 RegKey3=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k81 RegKey4=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k91 RegKey5=HKCU\Software\Poikosoft\Easy CD-DA Extractor 8|k92 [Easy Duplicate Finder *] LangSecRef=3024 Detect=HKCU\Software\Easy Duplicate Finder DetectFile=%ProgramFiles%\Easy Duplicate Finder 4 FileKey1=%AppData%\EasyDuplicateFinder\Logs|*.log [EasyGPS *] LangSecRef=3024 Detect=HKCU\Software\TopoGrafix\EasyGPS FileKey1=%LocalAppData%\TopoGrafix\Error Logs|*.txt RegKey1=HKCU\Software\TopoGrafix\EasyGPS\Error Log RegKey2=HKCU\Software\TopoGrafix\EasyGPS\Recent File List [EC XTRA Timer *] LangSecRef=3021 DetectFile=%AppData%\The Toro Company FileKey1=%AppData%\The Toro Company|ECXTRAoutput.txt [Eclipse Project *] LangSecRef=3021 DetectFile=%UserProfile%\desenvolvimento\Eclipse FileKey1=%UserProfile%\desenvolvimento\Eclipse\configuration|*.log FileKey2=%UserProfile%\desenvolvimento\Eclipse\configuration\org.eclipse.update\history|*.xml FileKey3=%UserProfile%\desenvolvimento\Eclipse\p2\org.eclipse.equinox.p2.repository\Cache|*.* [Ecobyte Replace Text *] LangSecRef=3024 Detect=HKLM\Software\BK\BK ReplaceEm RegKey1=HKLM\Software\BK\BK ReplaceEm|destPath RegKey2=HKLM\Software\BK\BK ReplaceEm|sourceExcludeFilter RegKey3=HKLM\Software\BK\BK ReplaceEm|sourcePath [Edna & Harvey: Harvey's New Eyes *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219910 DetectFile=%LocalAppData%\Daedalic Entertainment\Harvey FileKey1=%LocalAppData%\Daedalic Entertainment\Harvey|*.log FileKey2=%ProgramFiles%\Steam\Steamapps\common\Edna and Harvey Harvey's New Eyes|stderr.txt [Effective File Search *] LangSecRef=3024 Detect=HKCU\Software\SOW\EFS FileKey1=%ProgramFiles%\efs|cblist*.dat [EffeTech HTTP Sniffer *] LangSecRef=3024 Detect=HKCU\Software\EffeTech\EffeTech HTTP Sniffer RegKey1=HKCU\Software\EffeTech\EffeTech HTTP Sniffer\Recent File List [Efficient Calendar *] LangSecRef=3021 DetectFile=%AppData%\Efficient Calendar FileKey1=%AppData%\Efficient Calendar\MRUItems|*.*|RECURSE [EFSoftware *] LangSecRef=3024 DetectFile=%AppData%\EFSoftware FileKey1=%AppData%\EFSoftware|*Cache [EH Reminder *] LangSecRef=3021 Detect=HKCU\Software\Juan M. Aguirregabiria\Eh Reminder RegKey1=HKCU\Software\Juan M. Aguirregabiria\Eh Reminder\Previous [Elcomsoft Advanced EFS Data Recovery *] LangSecRef=3021 Detect=HKCU\Software\ElcomSoft\Advanced EFS Data Recovery FileKey1=%SystemDrive%|aefsdr.log [Elcomsoft Advanced Registry Tracer *] LangSecRef=3024 Detect=HKCU\Software\Elcom\ART RegKey1=HKCU\Software\Elcom\ART\Recent File List [Elcomsoft Password Digger *] LangSecRef=3021 Detect=HKCU\Software\ElcomSoft\Elcomsoft Password Digger FileKey1=%AppData%\Elcomsoft\*Password Digger|journal.sqlite [Elcomsoft Password Recovery *] LangSecRef=3021 Detect1=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery Detect2=HKCU\Software\ElcomSoft\Advanced Office Password Recovery Detect3=HKCU\Software\ElcomSoft\Advanced PDF Password Recovery Detect4=HKCU\Software\ElcomSoft\Distributed Password Recovery Detect5=HKCU\Software\ElcomSoft\Elcomsoft Internet Password Breaker Detect6=HKCU\Software\ElcomSoft\Elcomsoft Phone Password Breaker Detect7=HKCU\Software\ElcomSoft\Elcomsoft Proactive Password Auditor Detect8=HKCU\Software\ElcomSoft\Elcomsoft Wireless Security Auditor FileKey1=%AppData%\Elcomsoft\Elcomsoft Phone Password Breaker|*.log FileKey2=%ProgramData%\Elcomsoft Password Recovery\Distributed Password Recovery\Logs|* FileKey3=%ProgramFiles%\Elcomsoft Password Recovery\*|*.log;*log.txt RegKey1=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery\Paths RegKey2=HKCU\Software\ElcomSoft\Advanced Archive Password Recovery\Recent Files RegKey3=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 1 RegKey4=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 2 RegKey5=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 3 RegKey6=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 4 RegKey7=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 5 RegKey8=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 6 RegKey9=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 7 RegKey10=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 8 RegKey11=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 9 RegKey12=HKCU\Software\ElcomSoft\Advanced Office Password Recovery|Recent file 10 RegKey13=HKCU\Software\ElcomSoft\Advanced PDF Password Recovery\Recent Files [Electric Sheep *] LangSecRef=3021 DetectFile=%ProgramData%\ElectricSheep FileKey1=%ProgramData%\ElectricSheep\Logs|* [ElsterFormular *] LangSecRef=3021 DetectFile=%AppData%\elsterformular FileKey1=%AppData%\elsterformular\*\log|*.log* FileKey2=%AppData%\elsterformular\*\tmp|*|RECURSE FileKey3=%AppData%\elsterformular\pluginmanager\data|*_cpy.zip FileKey4=%LocalAppData%\.elfohilfe|*|REMOVESELF FileKey5=%LocalAppData%\elfopatch|*|REMOVESELF FileKey6=%ProgramData%\elsterformular\log|*.log [Eltima SWF Player *] LangSecRef=3023 DetectFile=%AppData%\Eltima Software\SWF Player FileKey1=%AppData%\Eltima Software\SWF Player|last_playlist;recent [eM Client *] LangSecRef=3022 Detect=HKCU\Software\eM Client FileKey1=%AppData%\eM Client\Logs|*.* [Email Address Collector *] LangSecRef=3022 DetectFile=%AppData%\DS Development\EAC FileKey1=%AppData%\DS Development\EAC|*.log [EmailTray *] LangSecRef=3024 Detect=HKCU\Software\EmailTray FileKey1=%UserProfile%\AppData\LocalLow\EmailTray|*.log|RECURSE [EMCO Software *] LangSecRef=3024 DetectFile=%ProgramData%\EMCO FileKey1=%ProgramData%\EMCO\Setup|*|REMOVESELF [EmEditor *] LangSecRef=3024 Detect=HKCU\Software\EmSoft\EmEditor v3 RegKey1=HKCU\Software\EmSoft\EmEditor v3\Recent File List RegKey2=HKCU\Software\EmSoft\EmEditor v3\Recent Folder List RegKey3=HKCU\Software\EmSoft\EmEditor v3\Recent Font List [emesene2 *] LangSecRef=3022 DetectFile=%AppData%\emesene\emesene2 FileKey1=%AppData%\emesene\emesene2\*\*\*\avatars|*.*|RECURSE FileKey2=%AppData%\emesene\emesene2\*\*\*avatars|*.*|RECURSE FileKey3=%AppData%\emesene\emesene2\*\*\log|*.*|RECURSE [Empire Earth *] Section=Games DetectFile=%ProgramFiles%\Empire Earth FileKey1=%ProgramFiles%\Empire Earth|*Error.log [Emsisoft Emergency Kit *] LangSecRef=3024 DetectFile=%SystemDrive%\EEK FileKey1=%SystemDrive%\EEK\Logs|*.* [Emsisoft HiJackFree *] LangSecRef=3024 Detect=HKLM\Software\Emsi Software GmbH\a-squared HiJackFree FileKey1=%ProgramFiles%\Emsisoft HiJackFree|*.old FileKey2=%ProgramFiles%\Emsisoft HiJackFree\Logs|*.* [eMule *] LangSecRef=3022 Detect=HKCU\Software\eMule FileKey1=%LocalAppData%\eMule\config|*.bak;*.old FileKey2=%LocalAppData%\eMule\logs|* FileKey3=%ProgramData%\eMule\config|*.bak;*.old FileKey4=%ProgramData%\eMule\logs|* FileKey5=%ProgramFiles%\eMule\config|*.bak;*.old FileKey6=%ProgramFiles%\eMule\logs|* [Encryption Xpert *] LangSecRef=3024 Detect=HKCU\Software\Enplase Research\Encryption Xpert RegKey1=HKCU\Software\Enplase Research\Encryption Xpert\Settings|LastFile [Endless Legend *] Section=Games DetectFile=%UserProfile%\Documents\Endless Legend FileKey1=%UserProfile%\Documents\Endless Legend\Temporary Files|*.*|RECURSE [Endless Space *] Section=Games DetectFile=%UserProfile%\Documents\Endless Space* FileKey1=%UserProfile%\Documents\Endless Space*\Temporary Files|*.html [EndNote X6 *] LangSecRef=3021 Detect=HKLM\Software\ISI ResearchSoft\EndNote FileKey1=%AppData%\EndNote|*.log;*.16 FileKey2=%CommonProgramFiles%\Risxtd|*.LOG;*.txt FileKey3=%ProgramData%\Thomson.ResearchSoft.Installers|*|REMOVESELF FileKey4=%ProgramFiles%\EndNote X6\Product-Support\ThirdParty\Apache2|NOTICE FileKey5=%ProgramFiles%\EndNote*|*.txt FileKey6=%UserProfile%\Documents\My EndNote Library.Data\Trash|*|RECURSE [EnhanceMy XP/Vista/Se7en/8 *] LangSecRef=3024 DetectFile=%AppData%\SeriousBit\EnhanceMy* FileKey1=%AppData%\SeriousBit\EnhanceMy*|Logs.txt FileKey2=%AppData%\SeriousBit\EnhanceMy*\Backups|*.*|RECURSE [Enhanso *] LangSecRef=3024 DetectFile=%AppData%\SeriousBit\Enhanso FileKey1=%AppData%\SeriousBit\Enhanso|Logs.txt FileKey2=%AppData%\SeriousBit\Enhanso\Backups|*.*|RECURSE [Epic Games Launcher *] Section=Games Detect=HKCU\Software\Epic Games\EpicGamesLauncher FileKey1=%LocalAppData%\CrashReportClient\Saved\Logs|*|REMOVESELF FileKey2=%LocalAppData%\EpicGames\eosoverlay|*.log FileKey3=%LocalAppData%\EpicGames\eosoverlay\BrowserCache|*|RECURSE FileKey4=%LocalAppData%\EpicGamesLauncher\Saved\Crashes|*|REMOVESELF FileKey5=%LocalAppData%\EpicGamesLauncher\Saved\Logs|*|REMOVESELF FileKey6=%LocalAppData%\EpicGamesLauncher\Saved\WebCache*|*|REMOVESELF FileKey7=%UserProfile%\AppData\LocalLow\EpicGamesLauncher\Logs|* [Epson *] LangSecRef=3021 Detect=HKCU\Software\EPSON DetectFile=%AppData%\com.epson.printlayout FileKey1=%AppData%\com.epson.printlayout\Local Store\#SharedObjects|*.*|RECURSE FileKey2=%AppData%\com.epson.printlayout\Local Store\tmpImageFolder|*.* FileKey3=%AppData%\com.epson.printlayout\Local Store\tmpPageFolder|*.* FileKey4=%AppData%\EPSON\Epson_Windows_Installer\EPSON*|*.log FileKey5=%AppData%\Epson\FAX Utility\FAXLOG|*.* [Eraser *] LangSecRef=3024 Detect=HKCU\Software\Heidi Computers Ltd\Eraser\5.5 FileKey1=%ProgramFiles%\Eraser*|schedlog.txt [ESET *] LangSecRef=3021 Detect=HKLM\Software\ESET\ESET Security FileKey1=%ProgramData%\ESET\ESET*\Logs|*|RECURSE FileKey2=%ProgramData%\ESET\ESET*\Oldfiles|*|RECURSE FileKey3=%ProgramData%\ESET\ESET*\Updfiles|*|REMOVESELF FileKey4=%ProgramFiles%\ESET\ESET Online Scanner|log.txt FileKey5=%ProgramFiles%\ESET\ESET Online Scanner\Modules\data\updfiles\temp|* FileKey6=%ProgramFiles%\ESET\ESET Online Scanner\Quarantine|* [eSignaDesktop *] LangSecRef=3024 DetectFile=%AppData%\Indenova\eSigna Desktop FileKey1=%AppData%\Indenova\eSigna Desktop\log|*.* [eSobi *] LangSecRef=3022 DetectFile=%AppData%\eSobi FileKey1=%AppData%\eSobi\*\temp|*.*|RECURSE [Essential NetTools 3 *] LangSecRef=3022 Detect=HKCU\Software\ENT3 DetectFile=%ProgramFiles%\Essential NetTools FileKey1=%ProgramFiles%\Essential NetTools\LOGS|*.* FileKey2=%UserProfile%\Documents\EssNetTools\LOGS|*.csv RegKey1=HKCU\Software\ENT3\Recent [EssentialPIM *] LangSecRef=3021 Detect=HKLM\Software\clients\mail\essentialpim pro DetectFile=%AppData%\EssentialPIM FileKey1=%AppData%\EssentialPIM*\Logs|*.* [Esumsoft POP Peeper *] LangSecRef=3022 DetectFile=%AppData%\POP Peeper FileKey1=%AppData%\POP Peeper|*.bak;Search.db FileKey2=%AppData%\POP Peeper\PluginData\Profile\Cache|*.png [Etherscan Password Sniffer *] LangSecRef=3022 Detect=HKCU\Software\Win Sniffer\Etherscan Password Sniffer RegKey1=HKCU\Software\Win Sniffer\Etherscan Password Sniffer\Recent File List RegKey2=HKCU\Software\Win Sniffer\Etherscan Password Sniffer\Recent Item List [Etwok NetSpot *] LangSecRef=3024 DetectFile=%AppData%\Etwok\NetSpot FileKey1=%AppData%\Etwok\NetSpot Installer\Logs|*.* FileKey2=%AppData%\Etwok\NetSpot\Logs|*.* [Eudora *] LangSecRef=3022 DetectFile=%AppData%\Qualcomm\Eudora FileKey1=%AppData%\Qualcomm\Eudora|*.log [Euro Truck Simulator *] Section=Games DetectFile1=%UserProfile%\Documents\ETS2MP DetectFile2=%UserProfile%\Documents\Euro Truck Simulator* FileKey1=%UserProfile%\Documents\ETS2MP\logs|*.log FileKey2=%UserProfile%\Documents\Euro Truck Simulator*|*.log;*log.txt;*.crash FileKey3=%UserProfile%\Documents\Euro Truck Simulator*\cache|*.navcache FileKey4=%UserProfile%\Documents\Euro Truck Simulator*\online\lscr_cache|*.jpg [Euro Truck Simulator Profile Backups *] Section=Games DetectFile1=%UserProfile%\Documents\ETS2MP DetectFile2=%UserProfile%\Documents\Euro Truck Simulator* FileKey1=%UserProfile%\Documents\Euro Truck Simulator*|backups.txt FileKey2=%UserProfile%\Documents\Euro Truck Simulator*\profiles*.bak|*|REMOVESELF [EuroSYSTEMS CoCut Professional 2011 *] LangSecRef=3021 Detect=HKCU\Software\EuroSYSTEMS\CoCut Professional 2011 FileKey1=%AppData%\EUROSYSTEMS\CoCut Professional 2011 15|*.bak FileKey2=%ProgramFiles%\EUROSYSTEMS\CoCut Professional 2011|*.log;*.bak;*.tmp FileKey3=%ProgramFiles%\EUROSYSTEMS\CoCut Professional 2011\log|*.* [EuroSYSTEMS SmartCut Pro *] LangSecRef=3021 Detect=HKCU\Software\EuroSYSTEMS FileKey1=%ProgramFiles%\EUROSYSTEMS\SmartCut Pro|*.bak;*.tmp FileKey2=%ProgramFiles%\EUROSYSTEMS\SmartCut Pro\Temp|*.*|RECURSE [Eusing Cleaner *] LangSecRef=3024 DetectFile=%AppData%\Eusing\Eusing Cleaner FileKey1=%AppData%\Eusing\Eusing Cleaner\Backup|*.reg [Eusing Free Registry Cleaner *] LangSecRef=3024 DetectFile=%AppData%\Eusing\Free Registry Cleaner FileKey1=%AppData%\Eusing\Free Registry Cleaner\Backup|*.reg [Eusing Launcher *] LangSecRef=3024 DetectFile=%AppData%\Eusing\Eusing Launcher FileKey1=%AppData%\Eusing\Eusing Launcher|*.bak [EVE Online *] Section=Games Detect=HKCU\Software\CCP FileKey1=%AppData%\EVEMon|*.bak FileKey2=%LocalAppData%\CCP\EVE|history.txt FileKey3=%UserProfile%\Documents\EVE\Logs|*.*|RECURSE [Evernote *] LangSecRef=3021 DetectFile=%UserProfile%\AppData\LocalLow\Evernote FileKey1=%LocalAppData%\Evernote\Evernote\AutoUpdate|*.exe FileKey2=%LocalAppData%\Evernote\Evernote\Updates|*.* FileKey3=%UserProfile%\AppData\LocalLow\Evernote\Evernote\Logs|*.* [Everyday Genius: SquareLogic *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\32150 DetectFile=%AppData%\SquareLogic FileKey1=%AppData%\SquareLogic|*.log [Everything *] LangSecRef=3024 DetectFile1=%AppData%\Everything DetectFile2=%ProgramFiles%\Everything FileKey1=%AppData%\Everything|*.csv;*.txt;*.tmp FileKey2=%LocalAppData%\EverythingToolbar|history.xml FileKey3=%ProgramFiles%\Everything|*.csv;*.txt;*.tmp ExcludeKey1=FILE|%AppData%\Everything\|Filters.csv ExcludeKey2=FILE|%ProgramFiles%\Everything\|Filters.csv [Evince Document Viewer *] LangSecRef=3021 DetectFile=%LocalAppData%\Apps\Evince-* FileKey1=%UserProfile%\.gnome*\evince|ev-metadata.xml [ExactFile *] LangSecRef=3024 Detect=HKCU\Software\ExactFile RegKey1=HKCU\Software\ExactFile|CDLastFolderSelected RegKey2=HKCU\Software\ExactFile\FormMain_Properties|EditCDFolderOutputFileName.Text RegKey3=HKCU\Software\ExactFile\FormMain_Properties|EditCDFolderPath.Text RegKey4=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditsfcFile.Text RegKey5=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTDBaseFolder.Text RegKey6=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTestDigestFile.Text RegKey7=HKCU\Software\ExactFile\FormMain_Properties|LabeledEditTFPath.Text [ExamDiff Pro *] LangSecRef=3024 Detect=HKCU\Software\PrestoSoft\ExamDiff Pro RegKey1=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Binary Find Strings RegKey2=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Center Merged Files RegKey3=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Left Merged Files RegKey4=HKCU\Software\PrestoSoft\ExamDiff Pro\Recent Sessions [ExeIco *] LangSecRef=3024 Detect=HKCU\Software\XTZY\ExeIcon FileKey1=%ProgramFiles%\ExeIco|*.log [Exif Tag Remover *] LangSecRef=3024 Detect=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover RegKey1=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover|sLastAddDir RegKey2=HKCU\Software\VB and VBA Program Settings\RL Vision\Exif Tag Remover|sLastDir [Exifer *] LangSecRef=3024 Detect=HKCU\Software\Exifer RegKey1=HKCU\Software\Exifer\Browse\History [ExifPro *] LangSecRef=3024 Detect=HKCU\Software\MKowalski\ExifPro FileKey1=%ProgramData%\MiK\ExifPro|Cache* RegKey1=HKCU\Software\MKowalski\ExifPro\1.0\Browser\View 0|LastPath RegKey2=HKCU\Software\MKowalski\ExifPro\1.0\HTMLAlbumGen\RecentDestPaths RegKey3=HKCU\Software\MKowalski\ExifPro\1.0\RecentPaths RegKey4=HKCU\Software\MKowalski\ExifPro\1.0\ResizeDlg\RecentDestPaths [Exodus *] LangSecRef=3022 Detect=HKCU\Software\Jabber\Exodus FileKey1=%AppData%\Exodus\avatars|cache.xml [Exodus Chat Logs *] LangSecRef=3022 Detect=HKCU\Software\Jabber\Exodus FileKey1=%UserProfile%\Documents\Exodus-Logs|*.*|RECURSE [ExpertGHID *] LangSecRef=3021 Detect1=HKCU\Software\ExpertGHID Detect2=HKCU\Software\Local AppWizard-Generated Applications\ExpertGHID RegKey1=HKCU\Software\ExpertGHID\Recent File List RegKey2=HKCU\Software\Local AppWizard-Generated Applications\ExpertGHID\Recent File List [ExplorerXP *] LangSecRef=3024 DetectFile=%ProgramFiles%\ExplorerXP FileKey1=%ProgramFiles%\ExplorerXP|DirSizeCache.dat [Exportizer *] LangSecRef=3024 Detect=HKCU\Software\Vitaliy Levchenko\Exportizer 5 RegKey1=HKCU\Software\Vitaliy Levchenko\Exportizer 5\Settings|LastExt RegKey2=HKLM\Software\ODBC\Temporary (volatile) Jet DSN for process 0x5ac Thread 0x3d8 DBC 0x2bd1e84 Xbase|DefaultDir RegKey3=HKLM\Software\ODBC\Temporary (volatile) Jet DSN for process 0x858 Thread 0xfb0 DBC 0x2ca3a74 Paradox|DefaultDir [Express Burn *] LangSecRef=3021 Detect=HKCU\Software\NCH Software\ExpressBurn FileKey1=%ProgramFiles%\NCH Software\ExpressBurn|expressburnsetup_*.exe RegKey1=HKCU\Software\NCH Software\ExpressBurn\Settings|InstallDate RegKey2=HKCU\Software\NCH Software\ExpressBurn\Settings|InstallDateFirst RegKey3=HKCU\Software\NCH Software\ExpressBurn\Settings|LoadFromFolder RegKey4=HKCU\Software\NCH Software\ExpressBurn\Settings|MinutesRunSinceLastInstall RegKey5=HKCU\Software\NCH Software\ExpressBurn\Settings|Runs RegKey6=HKCU\Software\NCH Software\ExpressBurn\Settings|RunsSinceLastInstall RegKey7=HKLM\Software\NCH Software\ExpressBurn\Software|Installer [Express Photo Digital *] LangSecRef=3023 DetectFile=%ProgramFiles%\Express Digital\ExpressPhoto* FileKey1=%ProgramFiles%\Express Digital\ExpressPhoto*|*.log [Express Points *] LangSecRef=3023 Detect=HKCU\Software\NCH Software\ExpressPoints RegKey1=HKCU\Software\NCH Software\ExpressPoints\RecentFileList [Express Rip CD Ripper *] LangSecRef=3023 DetectFile=%ProgramFiles%\NCH Software\ExpressRip FileKey1=%ProgramFiles%\NCH Software\ExpressRip|expressripsetup_*.exe [Express Zip *] LangSecRef=3024 DetectFile=%AppData%\NCH Software\ExpressZip FileKey1=%AppData%\NCH Software\ExpressZip\Logs|*.* [EZ Backup Ultimate *] LangSecRef=3024 Detect=HKCU\Software\Perception\EZ Backup Ultimate FileKey1=%AppData%\EZ Backup Ultimate|lastlog.html [F-Secure *] LangSecRef=3024 DetectFile=%LocalAppData%\F-Secure FileKey1=%LocalAppData%\F-Secure\Antivirus\ScanningReports|scan_report*.html FileKey2=%LocalAppData%\F-Secure\Log|*.*|RECURSE FileKey3=%UserProfile%\AppData\LocalLow\F-Secure\Log|*.*|RECURSE [F-Secure Password Manager *] LangSecRef=3021 Detect=HKCU\Software\F-Secure FileKey1=%LocalAppData%\F-Secure\Pwmgr|*.log FileKey2=%LocalAppData%\F-Secure\Pwmgr\LocalStorage|*.*|RECURSE [Facebook *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Facebook.Facebook_* FileKey1=%LocalAppData%\Packages\Facebook.Facebook_*\AC|*|RECURSE [Facebook Messenger *] LangSecRef=3022 DetectFile=%LocalAppData%\Facebook\Messenger FileKey1=%LocalAppData%\Facebook\Messenger|*.log|RECURSE FileKey2=%LocalAppData%\Facebook\Messenger\fbmessenger.cache|index;data_* [FACEIT Client *] Section=Games DetectFile=%AppData%\FACEIT FileKey1=%AppData%\FACEIT\*Cache|*.* FileKey2=%AppData%\FACEIT\FACEIT Client|debug.log [Faceprov *] LangSecRef=3023 Detect=HKCU\Software\Lenovo FileKey1=%SystemDrive%|Faceprov.* [Factorio *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\427520 FileKey1=%AppData%\Factorio|*log [Fallout Shelter *] Section=Games DetectFile=%LocalAppData%\FalloutShelter FileKey1=%LocalAppData%\FalloutShelter|*.log;*.bkp [Fantasy Wars *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\63900 FileKey1=%ProgramFiles%\Steam\Steamapps\common\Fantasy Wars|gui_log.txt [FAR Manager *] LangSecRef=3021 Detect1=HKCU\Software\Far Detect2=HKCU\Software\Far2 Detect3=HKCU\Software\Far18 RegKey1=HKCU\Software\Far\Editor\LastPositions RegKey2=HKCU\Software\Far\SavedDialogHistory RegKey3=HKCU\Software\Far\SavedDialogHistory\PersPath RegKey4=HKCU\Software\Far\SavedFolderHistory RegKey5=HKCU\Software\Far\SavedHistory RegKey6=HKCU\Software\Far\SavedViewHistory RegKey7=HKCU\Software\Far\Viewer\LastPositions RegKey8=HKCU\Software\Far2\Editor\LastPositions RegKey9=HKCU\Software\Far2\SavedDialogHistory RegKey10=HKCU\Software\Far2\SavedDialogHistory\PersPath RegKey11=HKCU\Software\Far2\SavedFolderHistory RegKey12=HKCU\Software\Far2\SavedHistory RegKey13=HKCU\Software\Far2\SavedViewHistory RegKey14=HKCU\Software\Far2\Viewer\LastPositions RegKey15=HKCU\Software\Far18\Editor\LastPositions RegKey16=HKCU\Software\Far18\SavedDialogHistory RegKey17=HKCU\Software\Far18\SavedDialogHistory\PersPath RegKey18=HKCU\Software\Far18\SavedFolderHistory RegKey19=HKCU\Software\Far18\SavedHistory RegKey20=HKCU\Software\Far18\SavedViewHistory RegKey21=HKCU\Software\Far18\Viewer\LastPositions [Farming Simulator *] Section=Games Detect=HKLM\Software\SCS Software FileKey1=%UserProfile%\Documents\My Games\FarmingSimulator*|*.txt FileKey2=%UserProfile%\Documents\My Games\FarmingSimulator*\pdlc*|*.dlc|REMOVESELF FileKey3=%UserProfile%\Documents\My Games\FarmingSimulator*\shader_cache|*.shc;*.xml|REMOVESELF [Farming Simulator Old AutoSaves *] Section=Games Detect=HKLM\Software\SCS Software FileKey1=%UserProfile%\Documents\My Games\FarmingSimulator*\savegame*|*.*|REMOVESELF ExcludeKey1=PATH|%UserProfile%\Documents\My Games\FarmingSimulator*\savegame1\|*.* ExcludeKey2=PATH|%UserProfile%\Documents\My Games\FarmingSimulator*\savegameBackup\|*.* [Fast Clean Pro *] LangSecRef=3024 DetectFile=%LocalAppData%\Fastcleanpro FileKey1=%LocalAppData%\Fastcleanpro\logs|*.* [FastCopy *] LangSecRef=3024 DetectFile=%AppData%\FastCopy FileKey1=%AppData%\FastCopy|*.log [FastStone Capture *] LangSecRef=3024 Detect=HKCU\Software\FastStone Capture DetectFile=%AppData%\FastStone\FSC FileKey1=%AppData%\FastStone\FSC|*.bak;fsc.db FileKey2=%LocalAppData%\FastStone\FSC|fsc.db RegKey1=HKCU\Software\FastStone|_LastClipPlayed RegKey2=HKCU\Software\FastStone|_LastRecordingFileName RegKey3=HKCU\Software\FastStone\APP.FSRecorder\Global|_GrbId RegKey4=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastClipPlayed RegKey5=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastRecordingFileName [FastStone Image Viewer *] LangSecRef=3023 Detect=HKLM\Software\FastStone Image Viewer FileKey1=%AppData%\FastStone\FSIV|FSViewer.db [FatBatt *] LangSecRef=3024 Detect=HKCU\Software\MiserWare, Inc.\FatBatt FileKey1=%ProgramData%\MiserWare\FatBatt\logs|*.log [FBReader *] LangSecRef=3021 Detect=HKCU\Software\FBReader DetectFile=%ProgramFiles%\FBReader FileKey1=%UserProfile%\.FBReader|books.db;network.db;state.db [FCleaner *] LangSecRef=3024 Detect=HKCU\Software\FTweak\FCleaner RegKey1=HKCU\Software\FTweak\FCleaner|programfile [FEZ *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\224760 FileKey1=%AppData%\FEZ|Debug Log.txt [FFsplit *] LangSecRef=3023 DetectFile=%ProgramFiles%\FFsplit FileKey1=%AppData%\FFsplit|FFsourceLog.txt FileKey2=%AppData%\FFsplit\logs|*.* [FIGHTERStools *] LangSecRef=3024 Detect=HKCU\Software\Fighters FileKey1=%AppData%\Fighters\*\Logs|*.log;*log.txt FileKey2=%ProgramData%\Common Toolkit Suite\Tools\Logs|*.log FileKey3=%ProgramData%\Fighters\*\Logs|*.log [File Renamer Basic *] LangSecRef=3024 DetectFile=%LocalAppData%\File Renamer Basic FileKey1=%LocalAppData%\File Renamer Basic|*log*.txt [File Shredder *] LangSecRef=3024 Detect=HKCU\Software\Shredder RegKey1=HKCU\Software\Shredder\{FF14D9EE-48EB-4873-80AC-8E224BEE5823} [File Type Doctor *] LangSecRef=3024 Detect=HKCU\Software\Creative Element\File Type Doctor RegKey1=HKCU\Software\Creative Element\File Type Doctor|LastSelected [FileCleaner *] LangSecRef=3024 Detect=HKCU\Software\WebMinds, Inc\FileCleaner FileKey1=%AppData%\FileCleaner|log.txt [FileLocator Pro *] LangSecRef=3024 Detect=HKCU\Software\Mythicsoft\FileLocatorPro RegKey1=HKCU\Software\Mythicsoft\FileLocatorPro\RecentContains RegKey2=HKCU\Software\Mythicsoft\FileLocatorPro\RecentFileName RegKey3=HKCU\Software\Mythicsoft\FileLocatorPro\RecentFolders [FileMind QuickFix *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92789900-80D0-4B61-B742-7897964A69AB}_is1 FileKey1=%ProgramFiles%\Metability Software\FileMindQuickFix|*.log|RECURSE [FileSearchEX *] LangSecRef=3024 Detect=HKCU\Software\GOFF Concepts\FileSearchEX RegKey1=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_ContainingTextHistory RegKey2=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_LookinHistory RegKey3=HKCU\Software\GOFF Concepts\FileSearchEX|Sys_SearchHistory [FileZilla *] LangSecRef=3022 Detect=HKLM\Software\FileZilla Client FileKey1=%ProgramFiles%\FileZilla FTP Client|*.tmp [FINAM Forex Terminal *] LangSecRef=3021 DetectFile=%ProgramFiles%\FINAM Forex Terminal FileKey1=%ProgramFiles%\FINAM Forex Terminal\logs|*.* FileKey2=%ProgramFiles%\FINAM Forex Terminal\MQL*\Logs|*.* FileKey3=%ProgramFiles%\FINAM Forex Terminal\tester\logs|*.* [Find Junk Files *] LangSecRef=3024 DetectFile=%ProgramFiles%\Find Junk Files FileKey1=%ProgramFiles%\Find Junk Files\System\logs|*.*|RECURSE [Finders Keepers *] LangSecRef=3021 Detect=HKCU\Software\Yadu Digital\Finders Keepers RegKey1=HKCU\Software\Yadu Digital\Finders Keepers\Options\General|Last file [Firebird Project *] LangSecRef=3023 Detect=HKLM\Software\Firebird Project FileKey1=%ProgramFiles%\Firebird\Firebird_2_1|*.log [Fishdom H2O *] Section=Games DetectFile=%AppData%\Playrix Entertainment\Fishdom H2O Final FileKey1=%AppData%\Playrix Entertainment\Fishdom H2O Final|log.html [FixCleaner *] LangSecRef=3024 DetectFile=%AppData%\FixCleaner FileKey1=%AppData%\FixCleaner\Logs|*.* [FL Studio *] LangSecRef=3023 DetectFile=%ProgramFiles%\Image-Line\FL Studio* FileKey1=%ProgramFiles%\Image-Line\Downloader|*.log [FlashFXP *] LangSecRef=3022 Detect=HKLM\Software\FlashFXP FileKey1=%ProgramFiles%\FlashFXP|quick.dat [FlashIntegro *] LangSecRef=3023 DetectFile=%ProgramFiles%\FlashIntegro FileKey1=%AppData%\FlashIntegro\filecache|*.cache FileKey2=%AppData%\ScreenRecorder|*.log FileKey3=%AppData%\VideoCapture|*.log FileKey4=%AppData%\VideoEditor|*.log [Flashpoint Launcher *] Section=Games DetectFile=%AppData%\Flashpoint-Launcher FileKey1=%AppData%\Flashpoint-Launcher|*.old;LOG;Network Persistent State|RECURSE FileKey2=%AppData%\Flashpoint-Launcher\*Cache|*.*|RECURSE FileKey3=%AppData%\Flashpoint-Launcher\blob_storage|*.*|RECURSE [FLEXnet *] LangSecRef=3021 Detect1=HKCU\Software\FlexNet Detect2=HKLM\System\CurrentControlSet\services\FLEXnet Licensing Service FileKey1=%ProgramData%\FLEXnet|*.data_backup.*;*.log [FlipBooks *] LangSecRef=3021 Detect=HKCU\Software\EBooksys\FlipBook CD 1 RegKey1=HKCU\Software\EBooksys\FlipBook CD 1\Typed URLs [Flipshare *] LangSecRef=3023 DetectFile=%AppData%\Flip Video\Flipshare FileKey1=%AppData%\Flip Video\Flipshare\Logs|*.* FileKey2=%LocalAppData%\VirtualStore|logFile.xsl [FocusOn Image Viewer *] LangSecRef=3023 Detect=HKLM\Software\Pintosoft\FocusOn Image Viewer FileKey1=%LocalAppData%\Pintosoft\FocusOn Image Viewer|Images.fds FileKey2=%ProgramFiles%\Pintosoft\FocusOn Image Viewer|ImageMagick_*.txt [FocusOn Renamer *] LangSecRef=3024 Detect=HKCU\Software\Pintosoft\FocusOn Renamer RegKey1=HKCU\Software\Pintosoft\FocusOn Renamer|BRMRN1 RegKey2=HKCU\Software\Pintosoft\FocusOn Renamer|BRReplaceFrom RegKey3=HKCU\Software\Pintosoft\FocusOn Renamer|BRReplaceWith [FolderSecurityViewer *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\FolderSecurityViewer FileKey1=%UserProfile%\Documents\FolderSecurityViewer\Logs|*.* [FolderShare *] LangSecRef=3022 DetectFile=%LocalAppData%\FolderShare FileKey1=%LocalAppData%\FolderShare\Logs|*.* [FonePaw Data Recovery *] LangSecRef=3024 DetectFile=%LocalAppData%\FonePaw\FonePaw*Data Recovery FileKey1=%LocalAppData%\FonePaw\FonePaw*Data Recovery|*.log FileKey2=%LocalAppData%\FonePaw\FonePaw*Data Recovery\Log|*.* [FontBase *] LangSecRef=3021 DetectFile=%AppData%\FontBase FileKey1=%AppData%\FontBase|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE FileKey2=%AppData%\FontBase\*Cache|*.*|RECURSE FileKey3=%AppData%\FontBase\blob_storage|*.*|RECURSE [Foobar2000 *] LangSecRef=3023 Detect=HKLM\Software\foobar2000 DetectFile=%ProgramFiles%\foobar2000 FileKey1=%AppData%\foobar2000|*.log;failure.txt;history.flg;library-error-log.txt;PlayCount.sdf;wavecache.db FileKey2=%AppData%\foobar2000\autobackup|autobackup*.zip FileKey3=%AppData%\foobar2000\component-updates|*.zip FileKey4=%AppData%\foobar2000\crash reports|failure*.dmp;failure*.txt FileKey5=%AppData%\foobar2000\foo_youtube\cache|*.*|RECURSE FileKey6=%AppData%\foobar2000\index-data|*.*|RECURSE FileKey7=%ProgramFiles%\foobar2000|*.log;failure.txt;history.flg;library-error-log.txt;PlayCount.sdf;wavecache.db FileKey8=%ProgramFiles%\foobar2000\crash reports|failure*.dmp;failure*.txt FileKey9=%ProgramFiles%\foobar2000\index-data|*.*|RECURSE [fopnu *] LangSecRef=3022 DetectFile=%AppData%\fopnu FileKey1=%AppData%\fopnu|*.lastloadok.dat;chat.dat;downloads.dat FileKey2=%UserProfile%\Desktop|Fopnu_*_log_*.txt [Ford Sync My iTunes *] LangSecRef=3023 DetectFile=%AppData%\Ford Motor Company FileKey1=%AppData%\Ford Motor Company\logs|*.* [ForgetBox *] LangSecRef=3022 Detect=HKCU\Software\ForgetBox SAS FileKey1=%AppData%\ForgetBox\cache|*|RECURSE [Form Pilot Office *] LangSecRef=3021 Detect=HKCU\Software\Two Pilots\Form Pilot FileKey1=%AppData%\Two Pilots\PDF Library|Log.txt FileKey2=%UserProfile%\Documents\Form Pilot|error.log RegKey1=HKCU\Software\Two Pilots\Form Pilot\Settings|GraphicInitialDir RegKey2=HKCU\Software\Two Pilots\Form Pilot\Settings|InitialDir [Format Factory *] LangSecRef=3023 DetectFile=%ProgramFiles%\FormatFactory FileKey1=%ProgramFiles%\FormatFactory|*log.txt [Fort Firewall *] LangSecRef=3022 DetectFile=%LocalAppData%\Fort Firewall FileKey1=%LocalAppData%\Fort Firewall\Logs|*.* [Forte Agent *] LangSecRef=3022 Detect=HKLM\Software\Forte FileKey1=%AppData%\Forte\Agent|errorlog.xml;*.log|RECURSE FileKey2=%SystemDrive%\My Data\ForteAgent|*.bak;*.log [Fortnite *] Section=Games DetectFile=%LocalAppData%\FortniteGame* FileKey1=%LocalAppData%\FortniteGame*\Saved\Crashes|*.*|REMOVESELF FileKey2=%LocalAppData%\FortniteGame*\Saved\Demos|UnsavedReplay*.replay|REMOVESELF FileKey3=%LocalAppData%\FortniteGame*\Saved\Logs|*.*|REMOVESELF FileKey4=%LocalAppData%\FortniteGame*\Saved\WebCache*|*.*|REMOVESELF [Forward Observer *] LangSecRef=3021 DetectFile=%ProgramFiles%\AAForwardObserver FileKey1=%ProgramFiles%\AAForwardObserver|FO.log [Fotoboeken *] LangSecRef=3023 DetectFile=%LocalAppData%\Albelli.be Fotoboeken FileKey1=%LocalAppData%\Albelli.be Fotoboeken\Config|List.mru [Fotoworks XL *] LangSecRef=3023 DetectFile=%ProgramFiles%\FotoWorksXL* FileKey1=%ProgramFiles%\FotoWorksXL*|*.log [Found: Free to Play *] Section=Games DetectFile=%AppData%\Elephant Games\Found - Free to Play FileKey1=%AppData%\Elephant Games\Found - Free to Play|logfile.txt [Fox Digital Copy *] LangSecRef=3023 DetectFile=%AppData%\Fox Dgital Copy FileKey1=%AppData%\Fox Dgital Copy|data_*;f_*;index [Foxit PDF Editor *] LangSecRef=3021 DetectFile=%AppData%\Foxit Software\Foxit PDF Editor* FileKey1=%AppData%\Foxit Software\Addon\Foxit PDF Editor\Install|*|RECURSE FileKey2=%AppData%\Foxit Software\Foxit PDF Editor\Cache|*|RECURSE FileKey3=%AppData%\Foxit Software\Foxit PDF Editor\cacheData|*.dat FileKey4=%AppData%\Foxit Software\Foxit PDF Editor\FormFiller|AutoComplete.ds FileKey5=%AppData%\Foxit Software\Foxit PDF Editor\StartPage\*\Start\en-US|index.html FileKey6=%AppData%\Foxit Software\RMS|FXRMS_Log.txt FileKey7=%ProgramData%\Foxit Software\Foxit PDF Editor\Foxit*\Log|*|RECURSE FileKey8=%UserProfile%\AppData\LocalLow\Foxit\Search|*|RECURSE RegKey1=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\CommentPanel\Filter RegKey2=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\MRU\File MRU RegKey3=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\MRU\Place MRU RegKey4=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\plugins\JSPlugins RegKey5=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\Preferences\History [Foxit PhantomPDF *] LangSecRef=3021 Detect1=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0 Detect2=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0 Detect3=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0 Detect4=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0 FileKey1=%AppData%\Foxit Software\Foxit PDF Creator|*_foxittemp.xml|RECURSE FileKey2=%AppData%\Foxit Software\Foxit PDF Creator\Creator-Log|*.*|RECURSE FileKey3=%AppData%\Foxit Software\Foxit PhantomPDF\FormFiller|AutoComplete.ds FileKey4=%AppData%\Foxit Software\Foxit PhantomPDF\StartPage\*\Start\en-US|index.html FileKey5=%AppData%\Foxit Software\RMS|FXRMS_Log.txt FileKey6=%LocalAppData%\Foxit PhantomPDF|*.log FileKey7=%LocalAppData%\Foxit PhantomPDF\msilog|*.log FileKey8=%ProgramFiles%\Foxit Software\Foxit PhantomPDF\Foxit PDF IFilter\log|*.* FileKey9=%ProgramFiles%\Foxit Software\Foxit PhantomPDF\plugins\OCR\FX_Abbyy_OCR\Resource\CMap|*.lst FileKey10=%WinDir%\System32\config\systemprofile\AppData\Roaming\Foxit Software\Foxit PDF Creator|*_foxittemp.xml|RECURSE RegKey1=HKCU\Software\Foxit Software Company\Foxit PDF Editor|Recent File List RegKey2=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\History RegKey3=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\Others|csFileSavePLGEXT RegKey4=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\Others|csInitialOpenDir RegKey5=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\RecentFiles RegKey6=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\File MRU RegKey7=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\Place MRU RegKey8=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\plugins\JSPlugins RegKey9=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Preferences\History RegKey10=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Recent File List RegKey11=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\CommentPanel\Filter RegKey12=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Foxit PhantomPDF Advanced Editor\Recent File List RegKey13=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\File MRU RegKey14=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\Place MRU RegKey15=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\plugins\JSPlugins RegKey16=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Preferences\History RegKey17=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Recent File List RegKey18=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\CommentPanel\Filter RegKey19=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Foxit PhantomPDF Advanced Editor\Recent File List RegKey20=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\File MRU RegKey21=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\Place MRU RegKey22=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\plugins\JSPlugins RegKey23=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Preferences\History RegKey24=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Recent File List [Foxit Reader *] LangSecRef=3021 Detect1=HKCU\Software\Foxit Software\Foxit Reader 6.0 Detect2=HKCU\Software\Foxit Software\Foxit Reader 7.0 DetectFile=%AppData%\Foxit Software\Foxit Reader FileKey1=%AppData%\Foxit Software\Foxit PDF Creator\Foxit Reader PDF Printer|*_foxittemp.xml FileKey2=%AppData%\Foxit Software\Foxit Reader\StartPage*\Advertisement|*|REMOVESELF FileKey3=%AppData%\Foxit Software\Foxit Reader\StartPage*\Start|history.txt FileKey4=%LocalAppData%\Foxit Reader|*.TXT;*.zip;*.reg FileKey5=%ProgramData%\Foxit Software\Foxit PDF Reader\FoxitSensor\Log|* FileKey6=%ProgramData%\Foxit Software\Foxit*Reader\Foxit Service\Log|* FileKey7=%ProgramFiles%\Foxit Software\Foxit Reader\Release Note|*.*|REMOVESELF FileKey8=%SystemDrive%\Documents and Settings\NetworkService*\Application Data\Foxit Software\Foxit Cloud|*log.txt RegKey1=HKCU\Software\Foxit Software\Foxit Reader 6.0\Preferences\History\Options RegKey2=HKCU\Software\Foxit Software\Foxit Reader 6.0\Preferences\Others|csFileSavePLGEXT RegKey3=HKCU\Software\Foxit Software\Foxit Reader 7.0\MRU [Fractal: Make Blooms Not War *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\61310 FileKey1=%ProgramFiles%\Steam\Steamapps\common\Fractal\fractal_data|output_log.txt [Franzis CutOut *] LangSecRef=3023 Detect=HKCU\Software\Stepok\Light Developer RegKey1=HKCU\Software\Stepok\Light Developer\Last Path [Fre:ac *] LangSecRef=3024 DetectFile=%AppData%\freac FileKey1=%AppData%\Freac\cddb|*.*|REMOVESELF [Free Blu-ray Ripper *] LangSecRef=3023 DetectFile=%LocalAppData%\Blu-ray Master\Free Blu-ray Ripper FileKey1=%LocalAppData%\Blu-ray Master\Free Blu-ray Ripper|*.log;*log.txt [Free Download Manager *] LangSecRef=3022 Detect=HKCU\Software\FreeDownloadManager.ORG\Free Download Manager FileKey1=%AppData%\Free Download Manager|downloads.del.sav [Free Editor *] LangSecRef=3021 DetectFile=%ProgramFiles%\Free Editor FileKey1=%ProgramFiles%\Free Editor|mostRecentFiles.ini FileKey2=%ProgramFiles%\Free Editor\NGEN\x64|ngen.log FileKey3=%ProgramFiles%\Free Editor\NGEN\x86|ngen.log [Free Hex Editor *] LangSecRef=3024 Detect=HKCU\Software\Frhed RegKey1=HKCU\Software\Frhed\Settings\0|MRU_File1 RegKey2=HKCU\Software\Frhed\Settings\0|MRU_File2 RegKey3=HKCU\Software\Frhed\Settings\0|MRU_File3 RegKey4=HKCU\Software\Frhed\Settings\0|MRU_File4 RegKey5=HKCU\Software\Frhed\Settings\0|MRU_File5 RegKey6=HKCU\Software\Frhed\Settings\0|MRU_File6 RegKey7=HKCU\Software\Frhed\Settings\0|MRU_File7 RegKey8=HKCU\Software\Frhed\Settings\0|MRU_File8 RegKey9=HKCU\Software\Frhed\Settings\0|MRU_File9 [Free Image Editor *] LangSecRef=3023 Detect=HKCU\Software\RasterVect Software\Free Image Editor RegKey1=HKCU\Software\RasterVect Software\Free Image Editor\Options|CurrDir RegKey2=HKCU\Software\RasterVect Software\Free Image Editor\Recent File List [Free Opener *] LangSecRef=3021 DetectFile=%ProgramFiles%\Free Opener FileKey1=%ProgramFiles%\Free Opener|mostRecentFiles.ini FileKey2=%ProgramFiles%\Free Opener\NGEN\x64|ngen.log FileKey3=%ProgramFiles%\Free Opener\NGEN\x86|ngen.log [Free PDF XP *] LangSecRef=3024 Detect=HKCU\Software\shbox\FreePdfXP FileKey1=%SystemDrive%|IfpRedmon.log [Free Snipping Tool *] LangSecRef=3023 DetectFile=%AppData%\Free Snipping Tool FileKey1=%AppData%\Free Snipping Tool\Free Snipping Tool\updates\updates|*.msi [Free Viewer *] LangSecRef=3021 DetectFile=%ProgramFiles%\Free Viewer FileKey1=%ProgramFiles%\Free Viewer|mostRecentFiles.ini FileKey2=%ProgramFiles%\Free Viewer\NGEN\x64|ngen.log FileKey3=%ProgramFiles%\Free Viewer\NGEN\x86|ngen.log [FreeCommander XE *] LangSecRef=3021 DetectFile=%LocalAppData%\FreeCommanderXE FileKey1=%LocalAppData%\FreeCommanderXE\Settings\Bkp_Settings_*|*.*|REMOVESELF FileKey2=%ProgramFiles%\FreeCommander XE\backup|*.*|REMOVESELF [FreeFileSync *] LangSecRef=3024 DetectFile=%AppData%\FreeFileSync FileKey1=%AppData%\FreeFileSync\Logs|*.* FileKey2=%ProgramFiles%\FreeFileSync|*log.txt [FreeFixer *] LangSecRef=3024 DetectFile=%LocalAppData%\FreeFixer FileKey1=%LocalAppData%\FreeFixer|itemtracking.txt FileKey2=%LocalAppData%\FreeFixer\icons|*.ico|RECURSE FileKey3=%LocalAppData%\FreeFixer\Logs|*.*|RECURSE [Freemake Video Converter *] LangSecRef=3023 DetectFile=%ProgramData%\Freemake\FreemakeVideoConverter FileKey1=%ProgramData%\Freemake\FreemakeUtilsService\ErrorReports\Logs|* FileKey2=%ProgramData%\Freemake\FreemakeUtilsService\Statistics\Targets|FVC_Statistics.ini FileKey3=%ProgramFiles%\Freemake|DotNet*.exe [Freemake Video Downloader *] LangSecRef=3022 Detect=HKCU\Software\Freemake\FreemakeVideoDownloader FileKey1=%ProgramFiles%\Freemake|*.txt FileKey2=%UserProfile%\Documents\Freemake\FreemakeVideoDownloader|fvd.bin [Freenet *] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Freenet DetectFile=%LocalAppData%\Freenet FileKey1=%LocalAppData%\Freenet|*.bak FileKey2=%LocalAppData%\Freenet\logs|*.gz;*.log FileKey3=%LocalAppData%\Freenet\persistent-temp|*.tmp FileKey4=%LocalAppData%\Freenet\temp|*.* FileKey5=%LocalAppData%\Freenet\wrapper|*.log [Freeplane *] LangSecRef=3021 DetectFile=%AppData%\Freeplane FileKey1=%AppData%\Freeplane\*\logs|*.* [Frigate3 *] LangSecRef=3024 DetectFile=%AppData%\Frigate3 FileKey1=%AppData%\Frigate3|History.XML [FrostWire *] LangSecRef=3022 Detect=HKLM\Software\FrostWire FileKey1=%AppData%\FrostWire\.AppSpecialShare|*.*|RECURSE FileKey2=%AppData%\FrostWire\azureus|*.*|RECURSE FileKey3=%UserProfile%\Documents\FrostWire\Incomplete|*.*|RECURSE [Frozen Synapse *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\98200 FileKey1=%ProgramFiles%\Steam\Steamapps\common\Frozen Synapse|*.log [FRSFileMgr *] LangSecRef=3024 Detect=HKCU\Software\FourthRaySoftware\FRSFileMgr FileKey1=%SystemDrive%\FRS\FRSFileMgr|FRSFileMgr.ffm [FTL: Faster Than Light *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\212680 DetectFile=%UserProfile%\Documents\My Games\FasterThanLight FileKey1=%ProgramFiles%\Steam\steamapps\common\FTL Faster Than Light\crashlogs|*.* [Full Bore *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\264060 FileKey1=%UserProfile%\Documents\Full Bore|log.txt [Full Tilt Poker *] Section=Games DetectFile=%ProgramFiles%\Full Tilt Poker.net FileKey1=%ProgramFiles%\Full Tilt Poker.net\Cache|*.* [G-Data *] LangSecRef=3023 Detect=HKCU\Software\G Data FileKey1=%CommonProgramFiles%\G Data\AVKScanP\G Data|*.log;*old FileKey2=%ProgramData%\G Data\AVK\Log|*|RECURSE FileKey3=%ProgramFiles%\G Data\AntiVirus\AVK\UpdatePGM|*.log [Gadu-Gadu *] LangSecRef=3022 Detect=HKCU\Software\Gadu-Gadu FileKey1=%WinDir%|TEMP*.htm* [Gajim *] LangSecRef=3022 DetectFile=%AppData%\Gajim FileKey1=%AppData%\Gajim|cache.db;Logs.db;gajim.log FileKey2=%AppData%\Gajim\Avatars|*.* [Galaxy *] Section=Games Detect=HKCU\Software\GOG.com\Galaxy FileKey1=%ProgramData%\GOG.com\Galaxy\logs|*.log FileKey2=%ProgramData%\GOG.com\Galaxy\temp\desktop-galaxy-updater|*|REMOVESELF FileKey3=%ProgramData%\GOG.com\Galaxy\webcache|*|REMOVESELF [Game-Cloner *] Section=Games DetectFile=%AppData%\Game-Cloner FileKey1=%AppData%\Game-Cloner|*.log [Game Maker *] LangSecRef=3021 Detect1=HKCU\Software\Game Maker 4 Detect2=HKCU\Software\Game Maker\Version 5 Detect3=HKCU\Software\Game Maker\Version 6 Detect4=HKCU\Software\Game Maker\Version 7 Detect5=HKCU\Software\Game Maker\Version 8 RegKey1=HKCU\Software\Game Maker 4\Preferences|GameDir RegKey2=HKCU\Software\Game Maker 4\Preferences|Recent0 RegKey3=HKCU\Software\Game Maker 4\Preferences|Recent1 RegKey4=HKCU\Software\Game Maker 4\Preferences|Recent2 RegKey5=HKCU\Software\Game Maker 4\Preferences|Recent3 RegKey6=HKCU\Software\Game Maker\Version 5\Preferences|GameDir RegKey7=HKCU\Software\Game Maker\Version 5\Preferences|Recent0 RegKey8=HKCU\Software\Game Maker\Version 5\Preferences|Recent1 RegKey9=HKCU\Software\Game Maker\Version 5\Preferences|Recent2 RegKey10=HKCU\Software\Game Maker\Version 5\Preferences|Recent3 RegKey11=HKCU\Software\Game Maker\Version 5\Preferences|Recent4 RegKey12=HKCU\Software\Game Maker\Version 5\Preferences|Recent5 RegKey13=HKCU\Software\Game Maker\Version 5\Preferences|Recent6 RegKey14=HKCU\Software\Game Maker\Version 5\Preferences|Recent7 RegKey15=HKCU\Software\Game Maker\Version 6\Preferences|GameDir RegKey16=HKCU\Software\Game Maker\Version 6\Preferences|Recent0 RegKey17=HKCU\Software\Game Maker\Version 6\Preferences|Recent1 RegKey18=HKCU\Software\Game Maker\Version 6\Preferences|Recent2 RegKey19=HKCU\Software\Game Maker\Version 6\Preferences|Recent3 RegKey20=HKCU\Software\Game Maker\Version 6\Preferences|Recent4 RegKey21=HKCU\Software\Game Maker\Version 6\Preferences|Recent5 RegKey22=HKCU\Software\Game Maker\Version 6\Preferences|Recent6 RegKey23=HKCU\Software\Game Maker\Version 6\Preferences|Recent7 RegKey24=HKCU\Software\Game Maker\Version 7\Preferences|GameDir RegKey25=HKCU\Software\Game Maker\Version 7\Preferences|Recent0 RegKey26=HKCU\Software\Game Maker\Version 7\Preferences|Recent1 RegKey27=HKCU\Software\Game Maker\Version 7\Preferences|Recent2 RegKey28=HKCU\Software\Game Maker\Version 7\Preferences|Recent3 RegKey29=HKCU\Software\Game Maker\Version 7\Preferences|Recent4 RegKey30=HKCU\Software\Game Maker\Version 7\Preferences|Recent5 RegKey31=HKCU\Software\Game Maker\Version 7\Preferences|Recent6 RegKey32=HKCU\Software\Game Maker\Version 7\Preferences|Recent7 RegKey33=HKCU\Software\Game Maker\Version 8\Preferences|GameDir RegKey34=HKCU\Software\Game Maker\Version 8\Preferences|Recent0 RegKey35=HKCU\Software\Game Maker\Version 8\Preferences|Recent1 RegKey36=HKCU\Software\Game Maker\Version 8\Preferences|Recent2 RegKey37=HKCU\Software\Game Maker\Version 8\Preferences|Recent3 RegKey38=HKCU\Software\Game Maker\Version 8\Preferences|Recent4 RegKey39=HKCU\Software\Game Maker\Version 8\Preferences|Recent5 RegKey40=HKCU\Software\Game Maker\Version 8\Preferences|Recent6 RegKey41=HKCU\Software\Game Maker\Version 8\Preferences|Recent7 [GameRanger *] Section=Games DetectFile=%AppData%\GameRanger\GameRanger FileKey1=%AppData%\GameRanger\GameRanger Prefs|Icon Cache;Image Cache FileKey2=%AppData%\GameRanger\GameRanger Prefs\WCache|*-journal;*.old;ChromeDWriteFontCache;data_*;f_*;index;LOG;Visited Links|RECURSE FileKey3=%AppData%\GameRanger\GameRanger Prefs\WCache\*Cache|*.* FileKey4=%AppData%\GameRanger\GameRanger Prefs\WCache\blob_storage|*.*|RECURSE [GameSave Manager *] LangSecRef=3021 Detect1=HKCR\GSM_gsba Detect2=HKCR\GSM_gsdu Detect3=HKCR\GSM_gsms FileKey1=%AppData%\GameSave Manager*\*Cache*|*.* FileKey2=%AppData%\GameSave Manager*\TaskLogs|*.* FileKey3=%ProgramFiles%\GameSave Manager*\settings|*.log;ScanResults.txt|RECURSE [Gardens Inc. 2: The Road to Fame *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBB8E5A9-EE43-491D-9A2D-84172C3C9384}_is1 FileKey1=%ProgramFiles%\*\Gardens Inc. 2*|*.ico;*.html;*msi;*.nfo;*.txt;*.url|RECURSE [Gardenscapes *] Section=Games DetectFile=%AppData%\Playrix Entertainment\Gardenscapes FileKey1=%AppData%\Playrix Entertainment\Gardenscapes|log.html [Garena Messenger *] Section=Games Detect=HKCU\Software\Garena\im DetectFile=%ProgramFiles%\Garena Plus FileKey1=%ProgramData%\GarenaMessenger|im.log* FileKey2=%ProgramData%\GarenaMessenger\cache\clan|*|RECURSE FileKey3=%ProgramData%\GarenaMessenger\cache\customAvatar\buddy|* FileKey4=%ProgramData%\GarenaMessenger\cache\emoticon|* FileKey5=%ProgramData%\GarenaMessenger\cache\screencapture|* FileKey6=%ProgramData%\GarenaMessenger\garena.game.plugins|*.tmp FileKey7=%ProgramData%\GarenaMessenger\update*|*|RECURSE [Garmin Express *] LangSecRef=3024 Detect=HKCU\Software\Garmin\Express FileKey1=%ProgramData%\Garmin\Logs|*.log;*.txt|RECURSE FileKey2=%UserProfile%\Documents\Garmin\Backups\*|*|RECURSE [Garmin MapSource *] LangSecRef=3024 Detect=HKCU\Software\Garmin\MapSource FileKey1=%AppData%\GARMIN\MapSource\TileCache|*.*|REMOVESELF [GarrysMod *] Section=Games DetectFile=%ProgramFiles%\Steam\steamapps\common\GarrysMod FileKey1=%ProgramFiles%\Steam\steamapps\common\GarrysMod|*.cache|RECURSE [Gatewatch *] Section=Games DetectFile=%UserProfile%\Documents\Gatewatch_Logs FileKey1=%UserProfile%\Documents\Gatewatch_Logs\DownloadLog|*.log [gBurner *] LangSecRef=3021 Detect=HKCU\Software\gBurner RegKey1=HKCU\Software\gBurner|Reopen0 RegKey2=HKCU\Software\gBurner|Reopen1 RegKey3=HKCU\Software\gBurner|Reopen2 RegKey4=HKCU\Software\gBurner|Reopen3 [GEAR DIFx *] LangSecRef=3024 Detect1=HKCR\Installer\Products\CACFC38969C58104B8CE6D8561446C45 Detect2=HKLM\Software\GEAR Software\DIFx Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EC13FCAF38E85F44B0F1137C7FB5037 FileKey1=%AppData%\34BE82C4-E596-4e99-A191-52C6199EBF69|*|REMOVESELF FileKey2=%AppData%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*|REMOVESELF FileKey3=%AppData%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*|REMOVESELF FileKey4=%AppData%\Downloaded Installations|*|REMOVESELF FileKey5=%LocalAppData%\Downloaded Installations|*|REMOVESELF FileKey6=%ProgramData%\{755AC846-7372-4AC8-8550-C52491DAA8BD}|*|REMOVESELF FileKey7=%ProgramData%\34BE82C4-E596-4e99-A191-52C6199EBF69|*|REMOVESELF FileKey8=%ProgramData%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*|REMOVESELF FileKey9=%ProgramData%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*|REMOVESELF FileKey10=%ProgramData%\9727E41D-AD6A-47cd-B9BC-CF630B6013FD|*|REMOVESELF FileKey11=%ProgramData%\A73B37F8-7A4D-41f4-98A8-7F608CE8B98F|*|REMOVESELF FileKey12=%ProgramData%\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB|*.log|RECURSE FileKey13=%ProgramData%\E1864A66-75E3-486a-BD95-D1B7D99A84A7|*|REMOVESELF FileKey14=%ProgramFiles%\34BE82C4-E596-4e99-A191-52C6199EBF69|*|REMOVESELF FileKey15=%ProgramFiles%\38FDB89C-1EBD-4366-84B2-336D12CC3209|*|REMOVESELF FileKey16=%ProgramFiles%\93E26451-CD9A-43A5-A2FA-C42392EA4001|*|REMOVESELF FileKey17=%ProgramFiles%\188F1432-103A-4ffb-80F1-36B633C5C9E1|*|REMOVESELF FileKey18=%ProgramFiles%\9223B3E6-70DD-4e2f-965B-DD8E02D2E20B|*|REMOVESELF FileKey19=%ProgramFiles%\9727E41D-AD6A-47cd-B9BC-CF630B6013FD|*|REMOVESELF [Geek Uninstaller *] LangSecRef=3024 Detect=HKCU\Software\Geek Uninstaller FileKey1=%AppData%\Geek Uninstaller|*.log;*cache.dat [GeekSquad *] LangSecRef=3024 DetectFile=%ProgramData%\Geek Squad FileKey1=%ProgramData%\Geek Squad\MRI|EventLog.gsl|RECURSE FileKey2=%ProgramData%\Geek Squad\MRI\Automation Reports|*|REMOVESELF FileKey3=%ProgramData%\Geek Squad\MRI\Downloads|*|REMOVESELF [Genie-Soft *] LangSecRef=3024 Detect=HKCU\Software\Genie-Soft FileKey1=%AppData%\Genie-soft\*\logs|*.* [Genieo *] LangSecRef=3022 DetectFile=%AppData%\Genieo FileKey1=%AppData%\Genieo\log|*.*|RECURSE FileKey2=%AppData%\Genieo\sp_cache|*.*|RECURSE FileKey3=%AppData%\Genieo\tmp|*.*|RECURSE [Genymobile *] LangSecRef=3024 Detect=HKCU\Software\Genymobile FileKey1=%LocalAppData%\Genymobile|*.log FileKey2=%UserProfile%\VirtualBox VMs\*|genymotion-player*.log;logcat*.txt [GeoVid Video Avatar *] LangSecRef=3023 DetectFile1=%AppData%\GeoVid\Video To Avatar DetectFile2=%ProgramFiles%\GeoVid\Video Avatar FileKey1=%AppData%\GeoVid\Video To Avatar|log.txt FileKey2=%ProgramFiles%\GeoVid\Video Avatar|vcredist_*.exe [GetDiz *] LangSecRef=3021 Detect=HKCU\Software\Outertech\GetDiz RegKey1=HKCU\Software\Outertech\GetDiz|Recent Files_1 RegKey2=HKCU\Software\Outertech\GetDiz|Recent Files_2 RegKey3=HKCU\Software\Outertech\GetDiz|Recent Files_3 RegKey4=HKCU\Software\Outertech\GetDiz|Recent Files_4 RegKey5=HKCU\Software\Outertech\GetDiz|Recent Files_5 RegKey6=HKCU\Software\Outertech\GetDiz|Recent Files_6 RegKey7=HKCU\Software\Outertech\GetDiz|Recent Files_7 RegKey8=HKCU\Software\Outertech\GetDiz|Recent Files_8 RegKey9=HKCU\Software\Outertech\GetDiz|Recent Files_9 RegKey10=HKCU\Software\Outertech\GetDiz|Recent Files_10 [GetFLV *] LangSecRef=3023 Detect=HKCU\Software\GetFLV DetectFile=%ProgramFiles%\GetFLV FileKey1=%ProgramFiles%\GetFLV|history.xml;URLHistory.dat;setting.ini FileKey2=%ProgramFiles%\GetFLV\cache|Visited Links FileKey3=%ProgramFiles%\GetFLV\cache\*Cache|*.* FileKey4=%ProgramFiles%\GetFLV\libav\cache\*Cache|*.* FileKey5=%ProgramFiles%\GetFLV\site_files|*.tmp FileKey6=%ProgramFiles%\GetFLV\temp|*.* FileKey7=%ProgramFiles%\GetFLV\thumb|*.* FileKey8=%ProgramFiles%\GetFLV\tmp|*.* FileKey9=%ProgramFiles%\GetFLV\Youtube Zilla\libav\cache\*Cache|*.* RegKey1=HKCU\Software\GetFLV|AutoCaptureURL RegKey2=HKCU\Software\GetFLV|DownloadDir RegKey3=HKCU\Software\GetFLV|FLVTitle RegKey4=HKCU\Software\GetFLV|FLVURL [GetMyIP *] LangSecRef=3024 Detect=HKCU\Software\CubicDesign\GetMyIP RegKey1=HKCU\Software\CubicDesign\GetMyIP [GetRight *] LangSecRef=3022 Detect=HKCU\Software\Headlight\GetRight FileKey1=%AppData%\GetRight*|GetRight.lst;*.data|RECURSE RegKey1=HKCU\Software\Headlight\GetRight\FileQueue RegKey2=HKCU\Software\Headlight\GetRight\ResumeServers RegKey3=HKCU\Software\Headlight\GetRight\Stats RegKey4=HKCU\Software\Headlight\GetRight\UserAgent [Getting Over It with Bennett Foddy *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Bennett Foddy\Getting Over It FileKey1=%UserProfile%\AppData\LocalLow\Bennett Foddy\Getting Over It|output_log.txt FileKey2=%UserProfile%\AppData\LocalLow\Bennett Foddy\Getting Over It\Crashes|* [GFI LanGuard *] LangSecRef=3022 DetectFile1=%ProgramData%\GFI Software\LanGuard* DetectFile2=%ProgramFiles%\GFI\LANguard* FileKey1=%ProgramData%\GFI Software\LanGuard*|newfileslog.* FileKey2=%ProgramData%\GFI Software\LanGuard*\*Logs|*|RECURSE FileKey3=%ProgramData%\GFI Software\LanGuard*\Cache|*|REMOVESELF FileKey4=%ProgramFiles%\GFI\LANguard*\DebugLogs|*.* FileKey5=%WinDir%\Patches|*.log.txt;*.log [Ghostbuster *] LangSecRef=3021 DetectFile=%AppData%\Ghostbuster FileKey1=%AppData%\Ghostbuster|*.*|REMOVESELF [GhostMouse *] LangSecRef=3024 DetectFile=%ProgramFiles%\GhostMouse FileKey1=%UserProfile%\Documents\AutomaticSolution Software\GhostMouse\conf\temp|*.tmp [GIGABYTE *] LangSecRef=3024 DetectFile1=%ProgramFiles%\GIGABYTE\EasyTuneEngineService DetectFile2=%ProgramFiles%\GIGABYTE\RGBFusion FileKey1=%ProgramFiles%\GIGABYTE\EasyTuneEngineService|logFile.txt FileKey2=%ProgramFiles%\GIGABYTE\RGBFusion\AtiTool|*.log [GIGABYTE ControlCenter *] LangSecRef=3024 DetectFile1=%ProgramFiles%\ControlCenter DetectFile2=%ProgramFiles%\GIGABYTE\Control Center FileKey1=%ProgramFiles%\ControlCenter|erLog.txt FileKey2=%ProgramFiles%\GIGABYTE\Control Center|*Eventlog*.txt FileKey3=%ProgramFiles%\GIGABYTE\Control Center\logs|* [GIGABYTE EasyTune6 *] LangSecRef=3024 DetectFile=%ProgramFiles%\A58-Easytune6 FileKey1=%ProgramFiles%\A58-Easytune6|*.log [Gigantic *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Gigantic FileKey1=%UserProfile%\Documents\My Games\Gigantic\RxGame\Logs|*.log;*.dmg|RECURSE [GigaTribe *] LangSecRef=3022 Detect=HKCU\Software\ShalSoft\GigaTribe FileKey1=%LocalAppData%\Shalsoft\Gigatribe\*\re*sources|*.*|RECURSE [GIMP *] LangSecRef=3021 DetectFile1=%LocalAppData%\GIMP DetectFile2=%UserProfile%\.gimp-* FileKey1=%LocalAppData%|recently-used.xbel FileKey2=%LocalAppData%\GIMP\*\CrashLog|*.*|RECURSE FileKey3=%LocalAppData%\GIMP\*\tmp|*.*|RECURSE FileKey4=%LocalAppData%\webkit|*.*|REMOVESELF FileKey5=%UserProfile%\.gegl-*|documents FileKey6=%UserProfile%\.gimp-*|documents FileKey7=%UserProfile%\.gimp-*\tmp|*.*|RECURSE FileKey8=%UserProfile%\.thumbnails\normal|*.*|RECURSE [Ginger *] LangSecRef=3021 DetectFile=%ProgramFiles%\Ginger FileKey1=%ProgramFiles%\Ginger|*.log;*.tmp|RECURSE FileKey2=%SystemDrive%|GingerSetup.log [GitHub Desktop *] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\GitHubDesktop DetectFile=%LocalAppData%\GitHub FileKey1=%AppData%\GitHub*Desktop\*Cache|*|REMOVESELF FileKey2=%AppData%\GitHub*Desktop\logs|*|REMOVESELF FileKey3=%LocalAppData%\GitHub|*log.txt;*.log|RECURSE FileKey4=%LocalAppData%\GitHubDesktop|*.log FileKey5=%LocalAppData%\GitHubDesktop\packages\SquirrelTemp|*|REMOVESELF [Gizmo *] LangSecRef=3021 DetectFile=%AppData%\Gizmo FileKey1=%AppData%\Gizmo|mru.xml [Glary Utilities *] LangSecRef=3024 Detect=HKCU\Software\GlarySoft\Glary Utilities 5 FileKey1=%AppData%\GlarySoft\Glary Utilities\Backups|* FileKey2=%CommonProgramFiles%\Glarysoft\StartupManager\1.0\Log|* RegKey1=HKCU\Software\GlarySoft\Glary Utilities 5\RegistryRepair|History [Globus Privacy *] LangSecRef=3022 DetectFile=%ProgramData%\Globus Privacy FileKey1=%ProgramData%\Globus Privacy\install_log|*.log [GMote *] LangSecRef=3024 DetectFile=%AppData%\Gmote FileKey1=%AppData%\Gmote|*.log [GNU *] LangSecRef=3021 Detect=HKCU\Software\GNU FileKey1=%LocalAppData%\GNU\Cache\*|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Gnu\Cache|*.*|RECURSE FileKey3=%WinDir%\System32\config\systemprofile\local settings\application data\gnu\cache|*.*|RECURSE FileKey4=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\GNU\Cache|*.*|RECURSE [GnuCash *] LangSecRef=3021 Detect=HKCU\Software\GSettings\org\gnucash FileKey1=%UserProfile%\*|*.gnucash.*.log;*.gnucash.*.gnucash;translog.*.log|RECURSE RegKey1=HKCU\Software\GSettings\org\gnucash\history [Go!Zilla *] LangSecRef=3022 Detect=HKCU\Software\Go!Zilla FileKey1=%ProgramFiles%\Go!Zilla|golog.htm;download.log;leech.hst [Goalscape *] LangSecRef=3021 DetectFile=%ProgramFiles%\GoalScape FileKey1=%AppData%\com.goalscape.app.*\Logging|*.*|RECURSE [Goat Simulator *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\265930 FileKey1=%UserProfile%\Documents\my games\GoatSim\GoatGame\Logs|*.* [Going Under *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\1154810 FileKey1=%UserProfile%\AppData\LocalLow\Aggro Crab\Going Under|output_log.txt [Golden Records *] LangSecRef=3023 DetectFile=%AppData%\NCH Software\Golden FileKey1=%AppData%\NCH Software\Golden\Logs|*.* [GoldenCheetah *] LangSecRef=3021 DetectFile=%LocalAppData%\GoldenCheetah FileKey1=%LocalAppData%\GoldenCheetah\*\Logs|*.* [Gom Player *] LangSecRef=3023 Detect=HKCU\Software\GRETECH\GomPlayer FileKey1=%AppData%\GRETECH\GomPlayer|*.bmk FileKey2=%SystemDrive%|nsispromotion_log.txt RegKey1=HKCU\Software\GRETECH\GomPlayer\OPTION|sRecentPLFolder [Goodix Fingerprint Driver *] LangSecRef=3024 DetectFile=%ProgramData%\Goodix FileKey1=%ProgramData%\Goodix|*.log;*.bak [GoodSync *] LangSecRef=3024 Detect=HKCU\Software\Siber Systems\GoodSync FileKey1=%AppData%\GoodSync|*.log|RECURSE FileKey2=%UserProfile%\Documents\_gsdata_|*.log|RECURSE [Google Apps Sync *] LangSecRef=3022 DetectFile=%LocalAppData%\Google\Google Apps* FileKey1=%AppData%\Google\Google Apps*|*.log|RECURSE FileKey2=%AppData%\Google\Identity|*.txt FileKey3=%LocalAppData%\Google\Google Apps*|*.log|RECURSE [Google Calendar Sync *] LangSecRef=3022 DetectFile=%LocalAppData%\Google\Google Calendar Sync FileKey1=%LocalAppData%\Google\Google Calendar Sync|*.log|RECURSE [Google Drive *] LangSecRef=3024 Detect=HKCU\Software\Google\Drive DetectFile=%ProgramFiles%\Google\Drive FileKey1=%LocalAppData%\Google\Drive|*.log FileKey2=%LocalAppData%\Google\Drive Plugin for Office|*.log FileKey3=%LocalAppData%\Google\Drive Plugin for Office\Logs|*.log* FileKey4=%LocalAppData%\Google\Drive\CrashReports|*.*|RECURSE FileKey5=%LocalAppData%\Google\Drive\User_Default|*.log FileKey6=%LocalAppData%\Google\Drive\User_Default\TempData|*.*|RECURSE FileKey7=%LocalAppData%\Google\Drive\User_Default\UsageStatistics|*.* FileKey8=%LocalAppData%\Google\drivefs\*\Content_Cache|*.*|RECURSE FileKey9=%LocalAppData%\Google\drivefs\*\Thumbnails_Cache|*.*|RECURSE FileKey10=%LocalAppData%\Google\drivefs\Cef_Cache|*.old;LOG|RECURSE FileKey11=%LocalAppData%\Google\drivefs\Cef_Cache\*cache|*.*|RECURSE FileKey12=%LocalAppData%\Google\drivefs\Crashpad\Reports|*.dmp FileKey13=%LocalAppData%\Google\drivefs\Logs|*.* FileKey14=%LocalAppData%\Google\Identity|ClientMigration*.txt FileKey15=%ProgramFiles%\Google\Drive|*.log [Google Earth *] LangSecRef=3021 DetectFile=%UserProfile%\AppData\LocalLow\Google\GoogleEarth FileKey1=%ProgramFiles%\Google\GoogleEarth\client|*.log FileKey2=%UserProfile%\AppData\LocalLow\Google\GoogleEarth|*.tmp;*.log|RECURSE FileKey3=%UserProfile%\AppData\LocalLow\Google\GoogleEarth\Cache|*|RECURSE [Google Nearby Share *] LangSecRef=3022 DetectFile=%LocalAppData%\Nearby FileKey1=%LocalAppData%\Nearby\Sharing\*log*|*|REMOVESELF FileKey2=%LocalAppData%\Nearby\Sharing\CrashDumps|*|REMOVESELF [Google Update *] LangSecRef=3021 Detect=HKCU\Software\Google\Update FileKey1=%LocalAppData%\Google\Chrome*\Application|old_chrome.exe FileKey2=%LocalAppData%\Google\Update\Download|*.*|RECURSE FileKey3=%LocalAppData%\Google\Update\Install|*.*|RECURSE FileKey4=%LocalAppData%\Google\Update\Offline|*.*|RECURSE FileKey5=%ProgramFiles%\Google\Chrome*\Application|old_chrome.exe FileKey6=%ProgramFiles%\Google\Update\Download|*.*|RECURSE FileKey7=%ProgramFiles%\Google\Update\Install|*.*|RECURSE FileKey8=%ProgramFiles%\Google\Update\Offline|*.*|RECURSE RegKey1=HKLM\Software\Google\Update|LastCodeRedCheck RegKey2=HKLM\Software\Google\Update|LastStartedAU [GoPlayer *] LangSecRef=3023 DetectFile=%ProgramFiles%\GoPlayer FileKey1=%ProgramFiles%\GoPlayer|*.log [Gotham City Impostors *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\206210 FileKey1=%UserProfile%\Documents\WB Games\Gotham City Impostors - Free To Play|*.log [Gothic 3 *] Section=Games Detect=HKCU\Software\JoWooD Productions Software AG\Gothic III FileKey1=%ProgramFiles%\Gothic III|setup*.txt [GradeKeeper *] LangSecRef=3021 Detect=HKCU\Software\Gradekeeper FileKey1=%AppData%\Gradekeeper|*.* [Grand Theft Auto *] Section=Games DetectFile=%ProgramFiles%\GTA* FileKey1=%ProgramFiles%\GTA*\Test|*.log [Gratuitous Space Battles *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\41800 FileKey1=%ProgramFiles%\Steam\Steamapps\common\gratuitous space battles\data\temp|*.*|RECURSE FileKey2=%UserProfile%\Documents\My Games\GratuitousSpaceBattles\debug|*.* [Green Ranch *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Green RanchFINAL FileKey1=%AppData%\Palaplay\GreenRanch_Survey|*.txt [Greenfish Icon Editor Pro *] LangSecRef=3021 DetectFile=%LocalAppData%\gfie\recent.txt FileKey1=%LocalAppData%\gfie|recent.txt [Greenshot *] LangSecRef=3024 DetectFile=%LocalAppData%\Greenshot FileKey1=%LocalAppData%\Greenshot|*.log* [grepWin *] LangSecRef=3024 Detect=HKCU\Software\grepWin RegKey1=HKCU\Software\grepWin|searchpath RegKey2=HKCU\Software\grepWin\History [GridinSoft Notepad *] LangSecRef=3021 Detect=HKCU\Software\GridinSoft\Notepad3 RegKey1=HKCU\Software\GridinSoft\Notepad3\Files RegKey2=HKCU\Software\GridinSoft\Notepad3\Search|ReplaceTextHistory RegKey3=HKCU\Software\GridinSoft\Notepad3\Search|TextHistory [Grim Tales: The Wishes CE *] Section=Games DetectFile=%AppData%\Elephant Games\Grim Tales The Wishes CE FileKey1=%AppData%\Elephant Games\Grim Tales The Wishes CE|logfile.txt [Groove Media Player *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.ZuneMusic_* FileKey1=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\Image|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState|*.tmp;AppState.json*;*.db* FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\Database\*|*.log FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageCache|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageRetrievalFailure|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageStore|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\navigationHistory|*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\PlayReady|*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\Settings|*.log* FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory [GroupWise Messenger *] LangSecRef=3021 Detect=HKCU\Software\Novell\Messenger FileKey1=%LocalAppData%\Novell\GroupWise Messenger\history\%UserName%|*.* [Growl *] LangSecRef=3024 Detect=HKCU\Software\Growl FileKey1=%LocalAppData%\Growl\*\History|*.*|RECURSE FileKey2=%LocalAppData%\Growl\*\ImageCache|*.*|RECURSE FileKey3=%LocalAppData%\Growl\*\Log|*.*|RECURSE [GS RichCopy 360 *] LangSecRef=3024 DetectFile=%ProgramFiles%\GuruSquad\GS RichCopy 360 FileKey1=%ProgramData%|Microsoft.SqlServer.Compact.400.*.bc FileKey2=%ProgramFiles%\GuruSquad\GS RichCopy 360\Log|* FileKey3=%SystemDrive%\GSRichCopy360Log|*|RECURSE [GSpot *] LangSecRef=3024 Detect=HKCU\Software\GSpot Appliance Corp RegKey1=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|ExportFile RegKey2=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|ExportNameOfFileForFormat RegKey3=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|ExportPath RegKey4=HKCU\Software\GSpot Appliance Corp\GSpot\v2.6 Settings|LastMediaFile [gSyncit *] LangSecRef=3022 DetectFile=%AppData%\gSyncit FileKey1=%AppData%\gSyncit|gsyncit*.* [GT Interactive Driver *] Section=Games DetectFile=%ProgramFiles%\GT Interactive\Driver FileKey1=%ProgramFiles%\GT Interactive\Driver|debug.log [Guild Wars *] Section=Games DetectFile=%ProgramFiles%\Guild Wars* FileKey1=%AppData%\Guild Wars*\Coherent Dumps|*.* FileKey2=%ProgramFiles%\Guild Wars*|*.tmp [Gwent - The Witcher Card Game *] Section=Games Detect=HKCU\Software\CDProjektRED\Gwent DetectFile=%UserProfile%\AppData\LocalLow\CDProjektRED\Gwent FileKey1=%ProgramData%\CDProjekt RED\Gwent\Logs|*.log FileKey2=%UserProfile%\AppData\LocalLow\CDProjektRED\Gwent|*_log.txt [Hacknet *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\365450 FileKey1=%UserProfile%\Documents\My Games\Hacknet\Reports|*.txt [Halite *] LangSecRef=3021 DetectFile=%LocalAppData%\Halite FileKey1=%LocalAppData%\Halite|Halite.xml.*;HaliteLog.txt|RECURSE [Halo: Spartan Assault *] Section=Games DetectFile=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_* FileKey1=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_*\AC|*|RECURSE [Hancom Office *] LangSecRef=3021 DetectFile=%AppData%\HNC\Office FileKey1=%AppData%\HNC\Office\Recent|*.lnk [HandBrake *] LangSecRef=3021 DetectFile=%ProgramFiles%\HandBrake FileKey1=%AppData%\HandBrake\logs|*.*|REMOVESELF FileKey2=%ProgramFiles%\HandBrake|*.stackdump [Handle Regshot *] LangSecRef=3024 DetectFile=%SystemDrive%\Hive FileKey1=%SystemDrive%\Hive|*.css;*.html;*.reg;*.hive [Handy Backup *] LangSecRef=3024 Detect=HKCU\Software\Novosoft\Handy Backup FileKey1=%AppData%\Novosoft\Handy Backup\logs|*.* [Happy Cloud *] Section=Games Detect=HKCU\Software\HappyCloud FileKey1=%ProgramData%\HappyCloud|*.log FileKey2=%ProgramData%\HappyCloud\cache|* [Hard Disk Sentinel *] LangSecRef=3024 DetectFile=%ProgramFiles%\Hard Disk Sentinel FileKey1=%ProgramFiles%\Hard Disk Sentinel|*.bak;*Log.txt [Hard Drive Inspector *] LangSecRef=3024 DetectFile=%ProgramData%\AltrixSoft\Hard Drive Inspector FileKey1=%ProgramData%\AltrixSoft\Hard Drive Inspector|log.err [Hauppauge WinTV *] LangSecRef=3024 Detect=HKLM\Software\Hauppauge FileKey1=%Public%\WinTV|Settings-old.xml FileKey2=%Public%\WinTV\Channel Database|hcwChanDB_5-lastgood.mdb FileKey3=%Public%\WinTV\Installation Log|*.*|RECURSE FileKey4=%Public%\WinTV\Logs|*.log;*.txt FileKey5=%Public%\WinTV\Logs\minidump|*.*|RECURSE FileKey6=%SystemDrive%|hcwDriverInstall.txt [HDCleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\HDCleaner FileKey1=%ProgramFiles%\HDCleaner\Settings\Stats|*.ini [HDD Health *] LangSecRef=3022 Detect=HKLM\System\CurrentControlSet\services\HDDHealth FileKey1=%ProgramFiles%\HDD Health|*.tmp [HDD Regenerator *] LangSecRef=3024 DetectFile=%ProgramFiles%\HDD Regenerator FileKey1=%ProgramFiles%\HDD Regenerator|*.log|RECURSE [HDD Thermometer *] LangSecRef=3024 Detect=HKCU\Software\RSD Software, Inc.\HDD Thermometer FileKey1=%ProgramData%\HDD Thermometer|*.log|RECURSE [HDDExpert *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\HDDExpert FileKey1=%AppData%\KC Softwares\HDDExpert|*.log [Hearthstone *] Section=Games Detect=HKCU\Software\Blizzard Entertainment\Hearthstone FileKey1=%LocalAppData%\Blizzard\Hearthstone\Cache|*.*|RECURSE FileKey2=%LocalAppData%\Blizzard\Hearthstone\Logs|*.* FileKey3=%ProgramFiles%\Hearthstone|*.log;*log.txt;*.dmp|RECURSE [Hearts of Iron IV *] Section=Games DetectFile=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV FileKey1=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\_backup_*|*.*|REMOVESELF FileKey2=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Cache|*.* FileKey3=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Crashes|*.*|REMOVESELF FileKey4=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Dumps|*.* FileKey5=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\History_Dumps|*.* FileKey6=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\Logs|*.* FileKey7=%UserProfile%\Documents\Paradox Interactive\Hearts of Iron IV\ShaderCache|*.*|RECURSE [Heatsoft Handy File Tool *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\HFT FileKey1=%UserProfile%\Documents\HFT\Logs|*.* [Hedgewars *] Section=Games Detect=HKLM\Software\Hedgewars FileKey1=%UserProfile%\Documents\Hedgewars\Logs|*.* FileKey2=%UserProfile%\Documents\Hedgewars\VideoTemp|*.* [Helium Music Manager *] LangSecRef=3023 DetectFile=%AppData%\Intermedia Software\Helium * FileKey1=%AppData%\Intermedia Software\Helium *\Logs|* [herdProtect Anti-Malware Scanner *] LangSecRef=3024 Detect=HKCU\Software\Reason\herdProtect DetectFile=%ProgramFiles%\Reason\herdProtect\Scanner FileKey1=%ProgramFiles%\Reason\herdProtect\Scanner*|Errors.dat FileKey2=%ProgramFiles%\Reason\herdProtect\Scanner*\Cache|*.*|RECURSE FileKey3=%ProgramFiles%\Reason\herdProtect\Scanner*\Logs|*.* [Heroes of a Broken Land *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\314470 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Heroes of a Broken Land\hobl_data|output_log.txt [Heroes of Hammerwatch *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\677120 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Heroes of Hammerwatch|*.log|RECURSE [Heroes of the Storm *] Section=Games Detect=HKLM\Software\Blizzard Entertainment\Heroes of the Storm FileKey1=%LocalAppData%\Blizzard Entertainment\Heroes of the Storm\BrowserCookies|*.*|RECURSE FileKey2=%UserProfile%\Documents\Heroes of the Storm\GameLogs|*.* [Hex Editor Neo *] LangSecRef=3024 Detect=HKCU\Software\HHD Software\Hex Editor 6.sm RegKey1=HKCU\Software\HHD Software\Hex Editor 6.sm\MRU RegKey2=HKCU\Software\HHD Software\Hex Editor 6.sm\Structure Editor|Recent RegKey3=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Diff|DiffFirstSelectedDoc RegKey4=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Diff|DiffSecondSelectedDoc RegKey5=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Disasm\Disasm|SelectedFiles RegKey6=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Disasm\Find|History RegKey7=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Disasm\Find|Patterns RegKey8=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\ExtEditor\Find|Recent RegKey9=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\ExtEditor\Replace|Recent RegKey10=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\ExtEditor\Replace|Recent2 RegKey11=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Find|History RegKey12=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Find|Patterns RegKey13=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Replace|History RegKey14=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Replace|Patterns RegKey15=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Settings|RecentMasks RegKey16=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\FindInFiles\Settings|RecentPaths RegKey17=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Arith|Recent RegKey18=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Bitwise|History RegKey19=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Bitwise|Patterns RegKey20=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Fill|History RegKey21=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Fill|Patterns RegKey22=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Find|History RegKey23=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Find|Patterns RegKey24=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Goto|Recent RegKey25=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Insert|History RegKey26=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Insert|Patterns RegKey27=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\Insert|Recent RegKey28=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceFind|History RegKey29=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceFind|Patterns RegKey30=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceReplace|History RegKey31=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\ReplaceReplace|Patterns RegKey32=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\HexView\SetSize|Recent RegKey33=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\OpenDevice|Recent RegKey34=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\Pattern|History RegKey35=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\Pattern|Patterns RegKey36=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\RuleEdit|History RegKey37=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\PSH\RuleEdit|Patterns RegKey38=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Streams\Locate|Exclude RegKey39=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Streams\Locate|Masks RegKey40=HKCU\Software\HHD Software\Hex Editor 6.sm\Windows\Streams\Locate|Paths [Hex Workshop Hex Editor *] LangSecRef=3024 Detect1=HKCU\Software\BreakPoint\Hex Workshop 3.1 Detect2=HKCU\Software\BreakPoint\Hex Workshop v5 Detect3=HKCU\Software\BreakPoint\Hex Workshop v6.7 Detect4=HKCU\Software\BreakPoint\Hex Workshop v6.8 RegKey1=HKCU\Software\BreakPoint\Hex Workshop 3.1\Recent File List RegKey2=HKCU\Software\BreakPoint\Hex Workshop v5\FileGoto|lastStr RegKey3=HKCU\Software\BreakPoint\Hex Workshop v5\Paths RegKey4=HKCU\Software\BreakPoint\Hex Workshop v5\SectorGoto|lastStr RegKey5=HKCU\Software\BreakPoint\Hex Workshop v5\SelectBlock|last RegKey6=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0sourceFile RegKey7=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0sourceLength RegKey8=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0sourceOffset RegKey9=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0targetFile RegKey10=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0targetLength RegKey11=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_0targetOffset RegKey12=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|recent_MRU_count RegKey13=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|Source File RegKey14=HKCU\Software\BreakPoint\Hex Workshop v6.7\Compare|Target File RegKey15=HKCU\Software\BreakPoint\Hex Workshop v6.7\Expression Calc|LastExpression RegKey16=HKCU\Software\BreakPoint\Hex Workshop v6.7\FileGoto|goto_MRU_0 RegKey17=HKCU\Software\BreakPoint\Hex Workshop v6.7\FileGoto|goto_MRU_count RegKey18=HKCU\Software\BreakPoint\Hex Workshop v6.7\FileGoto|lastStr RegKey19=HKCU\Software\BreakPoint\Hex Workshop v6.7\Find|Value0 RegKey20=HKCU\Software\BreakPoint\Hex Workshop v6.7\Find|Value1 RegKey21=HKCU\Software\BreakPoint\Hex Workshop v6.7\LastPaths RegKey22=HKCU\Software\BreakPoint\Hex Workshop v6.7\Replace|FindString RegKey23=HKCU\Software\BreakPoint\Hex Workshop v6.7\Replace|ReplaceString RegKey24=HKCU\Software\BreakPoint\Hex Workshop v6.7\SectorGoto|goto_MRU_count RegKey25=HKCU\Software\BreakPoint\Hex Workshop v6.7\SectorGoto|lastStr RegKey26=HKCU\Software\BreakPoint\Hex Workshop v6.7\SelectBlock|last RegKey27=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0sourceFile RegKey28=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0sourceLength RegKey29=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0sourceOffset RegKey30=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0targetFile RegKey31=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0targetLength RegKey32=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_0targetOffset RegKey33=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|recent_MRU_count RegKey34=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|Source File RegKey35=HKCU\Software\BreakPoint\Hex Workshop v6.8\Compare|Target File RegKey36=HKCU\Software\BreakPoint\Hex Workshop v6.8\Expression Calc|LastExpression RegKey37=HKCU\Software\BreakPoint\Hex Workshop v6.8\FileGoto|goto_MRU_0 RegKey38=HKCU\Software\BreakPoint\Hex Workshop v6.8\FileGoto|goto_MRU_count RegKey39=HKCU\Software\BreakPoint\Hex Workshop v6.8\FileGoto|lastStr RegKey40=HKCU\Software\BreakPoint\Hex Workshop v6.8\Find|Value0 RegKey41=HKCU\Software\BreakPoint\Hex Workshop v6.8\Find|Value1 RegKey42=HKCU\Software\BreakPoint\Hex Workshop v6.8\LastPaths RegKey43=HKCU\Software\BreakPoint\Hex Workshop v6.8\Replace|FindString RegKey44=HKCU\Software\BreakPoint\Hex Workshop v6.8\Replace|ReplaceString RegKey45=HKCU\Software\BreakPoint\Hex Workshop v6.8\SectorGoto|goto_MRU_count RegKey46=HKCU\Software\BreakPoint\Hex Workshop v6.8\SectorGoto|lastStr RegKey47=HKCU\Software\BreakPoint\Hex Workshop v6.8\SelectBlock|last [HexChat *] LangSecRef=3022 DetectFile=%AppData%\HexChat FileKey1=%AppData%\HexChat\logs|*.*|REMOVESELF FileKey2=%AppData%\HexChat\scrollback|*.*|REMOVESELF [Hi-Rez Studios *] Section=Games Detect=HKLM\Software\Hi-Rez Studios FileKey1=%ProgramData%\Hi-Rez Studios\BrowserCacheTribes\Default|*|RECURSE FileKey2=%ProgramData%\Hi-Rez Studios\HiPatchService\log|* FileKey3=%ProgramFiles%\Hi-Rez Studios\hireztemp|* FileKey4=%SystemDrive%|HiRezUpdateInstallLog.txt [HiBit Uninstaller *] LangSecRef=3024 DetectFile=%AppData%\HiBitSoftware\HiBit Uninstaller FileKey1=%AppData%\HiBitSoftware\HiBit Uninstaller|ListCach.dbu;ListN.dbu [Hide.me VPN *] LangSecRef=3022 DetectFile=%AppData%\Hide.me FileKey1=%AppData%\Hide.me\Logs|*.* [HistoryKill *] LangSecRef=3024 DetectFile=%ProgramFiles%\HistoryKill* FileKey1=%LocalAppData%\HistoryKill|hk.dat;reseller.txt [HitmanPro *] LangSecRef=3024 Detect1=HKCU\Software\HitMan Pro Detect2=HKCU\Software\HitMan Pro 2 Detect3=HKCU\Software\HitMan Pro 3 Detect4=HKLM\Software\HitmanPro FileKey1=%ProgramData%\HitmanPro\Logs|* FileKey2=%ProgramFiles%\Hitman Pro*\downloads|* FileKey3=%ProgramFiles%\Hitman Pro*\logs|*.htm FileKey4=%ProgramFiles%\Hitman Pro*\updates|* FileKey5=%WinDir%\System32|HitmanPro*.log FileKey6=%WinDir%\SysWOW64|HitmanPro*.log [HM NIS Edit *] LangSecRef=3021 Detect=HKCU\Software\HM Software\Nis Edit RegKey1=HKCU\Software\HM Software\Nis Edit\Recent [Holiday Express *] Section=Games Detect1=HKLM\Software\GameHouse\Holiday Express Detect2=HKLM\Software\HipSoft\Holiday Express FileKey1=%ProgramFiles%\GameHouse Games Collection\Holiday Express|*.txt FileKey2=%ProgramFiles%\Holiday Express|*html;*.txt [Homeworld Remastered Collection *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\244160 FileKey1=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\CACHE|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\LOGFILES|*.* FileKey3=%ProgramFiles%\Steam\steamapps\common\Homeworld\Homeworld*\Bin\Release|*.dmp;*.log;*.mdmp;*ErrorLog.txt [Homeworld: Deserts of Kharak Backups *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\281610 FileKey1=%ProgramFiles%\Steam\steamapps\common\Deserts of Kharak\out\backup|*.*|RECURSE [Honeyview *] LangSecRef=3023 Detect=HKCU\Software\Honeyview RegKey1=HKCU\Software\Honeyview|sExtProg0 RegKey2=HKCU\Software\Honeyview|sLastCheckDay RegKey3=HKCU\Software\Honeyview|transf.sFileNameHeader RegKey4=HKCU\Software\Honeyview\BMPath0 RegKey5=HKCU\Software\Honeyview\BMPath1 RegKey6=HKCU\Software\Honeyview\BMPath2 RegKey7=HKCU\Software\Honeyview\BMPath3 RegKey8=HKCU\Software\Honeyview\BMPath4 RegKey9=HKCU\Software\Honeyview\BMPath5 RegKey10=HKCU\Software\Honeyview\BMPath6 RegKey11=HKCU\Software\Honeyview\BMPath7 RegKey12=HKCU\Software\Honeyview\BMPath8 RegKey13=HKCU\Software\Honeyview\BMPath9 RegKey14=HKCU\Software\Honeyview\BMPath10 RegKey15=HKCU\Software\Honeyview\BMPath11 RegKey16=HKCU\Software\Honeyview\BMPath12 RegKey17=HKCU\Software\Honeyview\BMPath13 RegKey18=HKCU\Software\Honeyview\BMPath14 RegKey19=HKCU\Software\Honeyview\BMPath15 RegKey20=HKCU\Software\Honeyview\BMPath16 RegKey21=HKCU\Software\Honeyview\BMPath17 RegKey22=HKCU\Software\Honeyview\BMPath18 RegKey23=HKCU\Software\Honeyview\BMPath19 RegKey24=HKCU\Software\Honeyview\BMPath20 RegKey25=HKCU\Software\Honeyview\BMPath21 RegKey26=HKCU\Software\Honeyview\BMPath22 RegKey27=HKCU\Software\Honeyview\BMPath23 RegKey28=HKCU\Software\Honeyview\BMPath24 RegKey29=HKCU\Software\Honeyview\BMPath25 RegKey30=HKCU\Software\Honeyview\BMPath26 RegKey31=HKCU\Software\Honeyview\BMPath27 RegKey32=HKCU\Software\Honeyview\BMPath28 RegKey33=HKCU\Software\Honeyview\BMPath29 RegKey34=HKCU\Software\Honeyview\RecentFolder0 RegKey35=HKCU\Software\Honeyview\RecentFolder1 RegKey36=HKCU\Software\Honeyview\RecentFolder2 RegKey37=HKCU\Software\Honeyview\RecentFolder3 RegKey38=HKCU\Software\Honeyview\RecentFolder4 RegKey39=HKCU\Software\Honeyview\RecentFolder5 RegKey40=HKCU\Software\Honeyview\RecentFolder6 RegKey41=HKCU\Software\Honeyview\RecentFolder7 RegKey42=HKCU\Software\Honeyview\RecentFolder8 RegKey43=HKCU\Software\Honeyview\RecentFolder9 RegKey44=HKCU\Software\Honeyview\sRecentFolder RegKey45=HKCU\Software\Honeyview\transf.sTargetFolder [Hostile Makeover *] Section=Games DetectFile=%AppData%\Merscom\Hostile Makeover FileKey1=%AppData%\Merscom\Hostile Makeover|logfile.txt [HostsMan Backups *] LangSecRef=3024 DetectFile=%ProgramData%\abelhadigital.com\HostsMan FileKey1=%Public%\Documents\HostsMan Backups|*|REMOVESELF FileKey2=%WinDir%\System32\drivers\etc|HOSTS.bak;HOSTS.tmp [HostsMan HostsServer *] LangSecRef=3024 Detect=HKLM\Software\abelhadigital.com\HostsServer DetectFile=%ProgramFiles%\HostsMan\hostssrv.exe FileKey1=%AppData%\abelhadigital.com\HostsServer|*.log|RECURSE FileKey2=%UserProfile%\AppData\LocalLow\abelhadigital.com\HostsServer\Logs|*.log [Hotbar *] LangSecRef=3022 Detect=HKCU\Software\Hotbar FileKey1=%ProgramFiles%\Hotbar\*\dynamic|*.*|RECURSE FileKey2=%ProgramFiles%\Hotbar\*\static|*.* RegKey1=HKCU\Software\Hotbar\hotbar\ImagesHistory [Hotline Miami *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219150 FileKey1=%UserProfile%\Documents\My Games\HotlineMiami|debug.log [Hotspot Shield *] LangSecRef=3021 Detect=HKLM\Software\HotspotShield DetectFile=%ProgramFiles%\Hotspot Shield FileKey1=%ProgramFiles%\Hotspot Shield\log|*.log FileKey2=%UserProfile%\AppData\LocalLow\Hotspot_Shield\Logs|*.*|RECURSE [Hover Desk *] LangSecRef=3024 DetectFile=%ProgramFiles%\HoverDesk FileKey1=%ProgramFiles%\HoverDesk\User|hdcmdrec.txt [HP *] LangSecRef=3021 Detect=HKCU\Software\HP DetectFile1=%AppData%\hpqlog DetectFile2=%LocalAppData%\Hewlett-Packard DetectFile3=%LocalAppData%\TouchSmartData DetectFile4=%ProgramData%\Hewlett-Packard DetectFile5=%ProgramData%\HP DetectFile6=%ProgramFiles%\HPQ\Shared\Sierra Wireless DetectFile7=%UserProfile%\HPRemote\RGReceiver FileKey1=%AppData%\hp active health\app analytics\*logs|*.*|RECURSE FileKey2=%AppData%\HP\*Logs|*Log.txt FileKey3=%AppData%\hpqlog|*.log FileKey4=%LocalAppData%\Hewlett-Packard\HP Support Framework\Profile\Upload|*.log FileKey5=%LocalAppData%\HP\AtInstall|*.log;*log.txt|REMOVESELF FileKey6=%LocalAppData%\TouchSmartData\Log|* FileKey7=%ProgramData%|hpzinstall.log FileKey8=%ProgramData%\Hewlett-Packard|*.log*.*;*Log.txt|RECURSE FileKey9=%ProgramData%\Hewlett-Packard\HP*\Log*|*|RECURSE FileKey10=%ProgramData%\HP Audio Switch|*.log* FileKey11=%ProgramData%\HP\HP Audio Switch|*.log FileKey12=%ProgramData%\HP\HP Touchpoint Analytics Client\Logs|* FileKey13=%ProgramData%\HP\HP Touchpoint Analytics Client\Monitor-History|* FileKey14=%ProgramData%\HP\HP Touchpoint Analytics Client\MRU|* FileKey15=%ProgramData%\HP\logs|*|RECURSE FileKey16=%ProgramData%\HP\StreamLog|*|RECURSE FileKey17=%ProgramFiles%\HPQ\Shared\Sierra Wireless|*.log|RECURSE FileKey18=%SystemDrive%|dism.log FileKey19=%SystemDrive%\hp\bin\logs|*.log FileKey20=%SystemDrive%\HP\Diagnostics\PSDR|logFile.txt FileKey21=%SystemDrive%\system.sav\logs|*|RECURSE FileKey22=%UserProfile%\HPRemote\RGReceiver|*.log FileKey23=%WinDir%\HP|Installer.log [HP Drive Key Boot Utility *] LangSecRef=3024 Detect=HKLM\Software\microsoft\windows\currentversion\uninstall\HP Drive Key Boot Utility FileKey1=%SystemDrive%\CPQSYSTEM|*.*|REMOVESELF [HP Guide *] LangSecRef=3024 DetectFile=%LocalAppData%\HP Guide FileKey1=%LocalAppData%\HP Guide|log1.* FileKey2=%LocalAppData%\HP Guide\mp_cache|*.* [HP Installation Files *] LangSecRef=3024 Detect=HKCU\Software\HP DetectFile1=%ProgramData%\HP DetectFile2=%SystemDrive%\HP Universal Print Driver DetectFile3=%SystemDrive%\swsetup FileKey1=%ProgramData%\HP\Installer\Temp|* FileKey2=%ProgramData%\HP\Temp|* FileKey3=%ProgramFiles%\HP\Temp|*|RECURSE FileKey4=%SystemDrive%\HP Universal Print Driver|*|REMOVESELF FileKey5=%SystemDrive%\swsetup|*|REMOVESELF FileKey6=%WinDir%|*.dat.temp [HP Jumpstart *] LangSecRef=3021 DetectFile=%LocalAppData%\HP Jumpstart Apps FileKey1=%LocalAppData%\HP Jumpstart Apps\User Data\Default|*-journal;LOG;LOG.old;Extension Cookies;Network Persistent State;Top Sites;Visited Links;Web Data|RECURSE FileKey2=%LocalAppData%\HP Jumpstart Apps\User Data\Default\*Cache|*.*|RECURSE FileKey3=%LocalAppData%\HP Jumpstart Apps\User Data\ShaderCache\GPUCache|*.* [HP MediaSmart Photo *] LangSecRef=3023 DetectFile=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo FileKey1=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo|subsys.cache FileKey2=%LocalAppData%\Hewlett-Packard\MediaSmart\Photo\tm*Cache|*.*|REMOVESELF [HP Scan and Capture *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\*.HPScanandCapture_* FileKey1=%LocalAppData%\Packages\*.HPScanandCapture_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\*.HPScanandCapture_*\LocalState|*|RECURSE [HP Smart *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\*.HPPrinterControl_* FileKey1=%LocalAppData%\Packages\*.HPPrinterControl_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\*.HPPrinterControl_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\*.HPPrinterControl_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\*.HPPrinterControl_*\TempState|*|RECURSE [HP Support Assistant *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\*.HPSupportAssistant_* FileKey1=%LocalAppData%\Packages\*.HPSupportAssistant_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\*.HPSupportAssistant_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\*.HPSupportAssistant_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\*.HPSupportAssistant_*\TempState|*|RECURSE [HP Update *] LangSecRef=3021 DetectFile=%AppData%\HPUpdate FileKey1=%AppData%\HpUpdate|*.* [HTC *] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Installer\Products\34180280D77760A4BB4517FBA01DBB07\SourceList FileKey1=%SystemDrive%\Temp|HSM*.txt [HTC Home Apis *] LangSecRef=3021 DetectFile=%ProgramFiles%\HTC Home FileKey1=%ProgramFiles%\HTC Home\log|*.*|RECURSE [HTC Sync *] LangSecRef=3024 DetectFile=%ProgramFiles%\HTC\HTC Sync 3.0 FileKey1=%AppData%\HTC\Logs|*.log [Huawei *] LangSecRef=3023 Detect=HKLM\Software\Huawei technologies FileKey1=%ProgramData%\MobileBrServ\log|*|REMOVESELF FileKey2=%ProgramFiles%\BILDmobil\Log|* FileKey3=%ProgramFiles%\HUAWEI Modem Driver|*.log [Huawei Hisuite *] LangSecRef=3021 DetectFile=%LocalAppData%\Hisuite FileKey1=%LocalAppData%\Hisuite\log|*.log;*.zip FileKey2=%LocalAppData%\Hisuite\UserData\AppIcon|*.png FileKey3=%LocalAppData%\Hisuite\UserData\driver\all|*.log FileKey4=%LocalAppData%\Hisuite\UserData\DropTemp|*.* FileKey5=%LocalAppData%\HiSuite\UserData\hwtools\old|*.* FileKey6=%ProgramFiles%\HiSuite\HandSetService\log|*.log [Hulu *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\HuluLLC.HuluPlus_* FileKey1=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\LocalState|*.tmp|RECURSE FileKey3=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\HuluLLC.HuluPlus_*\TempState|*|RECURSE [Humble App *] Section=Games DetectFile=%AppData%\Humble App FileKey1=%AppData%\Humble App|*-journal;*.old;LOG;QuotaManager|RECURSE FileKey2=%AppData%\Humble App\*Cache|*|REMOVESELF FileKey3=%AppData%\Humble App\blob_storage|*|RECURSE FileKey4=%AppData%\Humble App\Crashpad\Reports|* FileKey5=%AppData%\Humble App\Logs|* FileKey6=%AppData%\Humble App\Service Worker\*Cache*|*|RECURSE FileKey7=%LocalAppData%\humble-client-updater\pending|*.exe [Huru Beach Party *] Section=Games DetectFile=%AppData%\HuruBeachParty FileKey1=%AppData%\HuruBeachParty|*log.html [HxD Hexeditor *] LangSecRef=3021 Detect=HKCU\Software\Mael\HxD RegKey1=HKCU\Software\Mael\HxD\History Lists\Recent Files [HyperSnap *] LangSecRef=3021 Detect1=HKCU\Software\Hyperionics\HyperSnap 7 Detect2=HKCU\Software\Hyperionics\HyperSnap 8 FileKey1=%ProgramFiles%\HyperSnap *|*.url RegKey1=HKCU\Software\Hyperionics\HyperSnap 7\Recent File List RegKey2=HKCU\Software\Hyperionics\HyperSnap 8\Recent File List [I2P *] LangSecRef=3022 Detect=HKLM\System\CurrentControlSet\Services\i2p DetectFile1=%AppData%\I2P DetectFile2=%ProgramFiles%\i2p FileKey1=%AppData%\I2P\eepsite\logs|*.* FileKey2=%AppData%\I2P\netDb|*.* FileKey3=%ProgramFiles%\i2p|*.log FileKey4=%ProgramFiles%\i2p\eepsite\logs|*.* [IBM Security Trusteer Rapport *] LangSecRef=3022 Detect=HKCU\Software\Trusteer\Rapport FileKey1=%AppData%\Trusteer\Rapport\user\Logs|* FileKey2=%LocalAppData%\Trusteer\Rapport\user\logs|* FileKey3=%ProgramData%\Trusteer\Rapport\logs|* FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Trusteer\Rapport\user\logs|* [Icaros *] LangSecRef=3024 DetectFile=%LocalAppData%\Icaros FileKey1=%LocalAppData%\Icaros\IcarosCache|*.icdb [IceChat *] LangSecRef=3022 DetectFile=%LocalAppData%\IceChat Networks\IceChat FileKey1=%LocalAppData%\IceChat Networks\IceChat\Logs|*.log|RECURSE [Icecream Screen Recorder *] LangSecRef=3024 DetectFile=%LocalAppData%\Icecream\Icecream Screen Recorder FileKey1=%LocalAppData%\Icecream\Icecream Screen Recorder|history.json FileKey2=%UserProfile%\.Icecream Screen Recorder\log|log_*.txt [Icewind Dale *] Section=Games DetectFile=%ProgramFiles%\Black Isle\Icewind Dale FileKey1=%ProgramFiles%\Black Isle\Icewind Dale\Temp|*.* [IcoFX *] LangSecRef=3023 DetectFile=%AppData%\IcoFX* FileKey1=%AppData%\IcoFX*\Settings|filebrecentcul.cfg;recent.cfg;recentIcl.cfg [IconCool Editor *] LangSecRef=3024 DetectFile=%ProgramFiles%\IconCoolEditor FileKey1=%ProgramFiles%\IconCoolEditor|IconFileList.src;Recentlyused.src [Icons from File *] LangSecRef=3024 Detect=HKCU\Software\Vitaliy Levchenko\Icons from File RegKey1=HKCU\Software\Vitaliy Levchenko\Icons from File\Recent [ID Privacy Shield *] LangSecRef=3024 DetectFile=%ProgramFiles%\ID Security Suite\ID Privacy Shield FileKey1=%ProgramFiles%\ID Security Suite\ID Privacy Shield\logs|*.*|RECURSE [IdeaSoft Scrapbooks Plus 1.0 *] LangSecRef=3021 Detect=HKCU\Software\IdeaSoft\Scrapbooks Plus\1.0 RegKey1=HKCU\Software\IdeaSoft\Scrapbooks Plus\1.0\Recent File List [IDLE *] LangSecRef=3024 Detect=HKCU\Software\Python FileKey1=%UserProfile%\.idlerc|recent-files.lst [idoo Video Editor *] LangSecRef=3023 DetectFile=%ProgramFiles%\idoo\Video Editor FileKey1=%ProgramFiles%\idoo\Video Editor|*.log [IDPhotoStudio *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\IDPhotoStudio FileKey1=%AppData%\KC Softwares\IDPhotoStudio|*.log [IDrive *] LangSecRef=3021 DetectFile1=%LocalAppData%\IDrive DetectFile2=%ProgramFiles%\IDriveWindows FileKey1=%LocalAppData%\IDrive\IBCOMMON|SerTraceFile.txt FileKey2=%ProgramData%\IDrive\IBCOMMON|Tracefile.txt FileKey3=%ProgramFiles%\IDriveWindows\IBCOMMON|SerTraceFile.txt [IDT NetGUI *] LangSecRef=3022 DetectFile=%AppData%\IDT\NetGUI FileKey1=%AppData%\IDT\NetGUI\Log|*.log [IE Toy *] LangSecRef=3024 Detect=HKCU\Software\MySoftware\IEToy FileKey1=%ProgramFiles%\IE Toy\Data|history;history_ad RegKey1=HKCU\Software\MySoftware\IEToy|FRAGS_ad RegKey2=HKCU\Software\MySoftware\IEToy|FRAGS_popup [iExpert Registry Clean Expert *] LangSecRef=3024 Detect=HKCU\Software\iExpertSoft\Registry Clean Expert DetectFile=%ProgramFiles%\Registry Clean Expert FileKey1=%AppData%\iExpert Software\Registry Clean Expert\UndoCenter|*.* FileKey2=%ProgramFiles%\Registry Clean Expert|*.LOG RegKey1=HKCU\Software\iExpertSoft\Registry Clean Expert\Recent File List [iFunbox *] LangSecRef=3024 DetectFile=%ProgramFiles%\i-Funbox DevTeam FileKey1=%ProgramFiles%\i-Funbox DevTeam|debug.log [Ignition *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\Ignition FileKey1=%AppData%\KC Software\Ignition|*.log [IISExpress *] LangSecRef=3022 DetectFile=%UserProfile%\Documents\IISExpress FileKey1=%UserProfile%\Documents\IISExpress\Logs|*.* FileKey2=%UserProfile%\Documents\IISExpress\TraceLogFiles|*.*|RECURSE [ImageDupeless *] LangSecRef=3023 Detect=HKCU\Software\ImageDupeless\ImageDupeless RegKey1=HKCU\Software\ImageDupeless\ImageDupeless\Parameters|Last Decoded File RegKey2=HKCU\Software\ImageDupeless\ImageDupeless\Recent File List [ImagePrinter Pro *] LangSecRef=3021 Detect=HKCU\Software\Code Industry\ImagePrinterPro FileKey1=%LocalAppData%\ImagePrinter Pro\Temp|*.* RegKey1=HKCU\Software\Code Industry\ImagePrinterPro|path RegKey2=HKCU\Software\Code Industry\ImagePrinterPro|temp_path [ImageRanger *] LangSecRef=3023 DetectFile=%ProgramFiles%\ImageRanger FileKey1=%ProgramFiles%\ImageRanger|vc*redist*x*.exe [ImgBurn *] LangSecRef=3021 Detect=HKCU\Software\ImgBurn RegKey1=HKCU\Software\ImgBurn|ISOREAD_RecentFiles_Destination RegKey2=HKCU\Software\ImgBurn|ISOREAD_RecentFolders_Destination [Immunet *] LangSecRef=3021 Detect=HKLM\Software\Immunet Protect FileKey1=%AppData%\Immunet|*|REMOVESELF FileKey2=%ProgramData%\Immunet|*.log FileKey3=%ProgramFiles%\Immunet|*.log|RECURSE [Imo Messenger *] LangSecRef=3022 DetectFile=%AppData%\Imo Messenger FileKey1=%AppData%\Imo Messenger\Data\*\images|*.* FileKey2=%AppData%\Imo Messenger\Logs|*.* FileKey3=%AppData%\Imo Messenger\updates|*.* [iMobie *] LangSecRef=3024 DetectFile=%AppData%\iMobie FileKey1=%AppData%\iMobie\*|iTunesPrefs FileKey2=%AppData%\iMobie\*\AutoUpdate|*.*|RECURSE FileKey3=%AppData%\iMobie\*\Configue|Settings.plist FileKey4=%AppData%\iMobie\*\EasyLoseFiles|*.*|RECURSE FileKey5=%AppData%\iMobie\*\ErrorLog|*.*|RECURSE FileKey6=%AppData%\iMobie\*\Files|*.*|RECURSE FileKey7=%AppData%\iMobie\*\iMobieConfig|*.*|RECURSE FileKey8=%AppData%\iMobie\*\TempFiles|*.*|RECURSE ExcludeKey1=FILE|%AppData%\iMobie\*\iMobieConfig\|ConfigReg.ini [iMobie Backups *] LangSecRef=3024 DetectFile=%AppData%\iMobie FileKey1=%AppData%\iMobie\*\*Backup|*.*|RECURSE FileKey2=%AppData%\iMobie\Backup|*.*|RECURSE [Imperator Rome *] Section=Games DetectFile=%UserProfile%\Documents\Paradox Interactive\Imperator FileKey1=%UserProfile%\Documents\Paradox Interactive\Imperator\*Cache|*.*|RECURSE FileKey2=%UserProfile%\Documents\Paradox Interactive\Imperator\Crashes|*.*|REMOVESELF FileKey3=%UserProfile%\Documents\Paradox Interactive\Imperator\Dumps|*.* FileKey4=%UserProfile%\Documents\Paradox Interactive\Imperator\Logs|*.* [ImTOO iPad Video Converter *] LangSecRef=3023 Detect=HKCU\Software\ImTOO\iPad Video Converter FileKey1=%ProgramFiles%\ImTOO\iPad Video Converter|*.log;ERRORLOG.TXT [ImTOO Video Converter Ultimate *] LangSecRef=3023 Detect=HKCU\Software\ImTOO\Video Converter Ultimate FileKey1=%ProgramData%\ImTOO\Video Converter Ultimate\customdata|settings.old RegKey1=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_openfile_dir RegKey2=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_output_dir RegKey3=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_profile_group RegKey4=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|last_profile_url RegKey5=HKCU\Software\ImTOO\Video Converter Ultimate\Settings|recent_profiles RegKey6=HKCU\Software\ImTOO\Video Converter Ultimate\Settings\output [IMVU *] Section=Games Detect=HKCU\Software\IMVU DetectFile=%AppData%\IMVU* FileKey1=%AppData%\IMVU|*.chk|RECURSE FileKey2=%AppData%\IMVU|*.db;mini.dmp.bak;*.pickle;*.jpg;*.txt;*.log* FileKey3=%AppData%\IMVU Desktop*|cookies*;network persistent state FileKey4=%AppData%\IMVU Desktop*\*Cache|*|REMOVESELF FileKey5=%AppData%\IMVU Desktop*\blob_storage|*|REMOVESELF FileKey6=%AppData%\IMVU Desktop*\Crashpad\Reports|*|RECURSE FileKey7=%AppData%\IMVU\*Cache|*|REMOVESELF FileKey8=%AppData%\IMVUApp|*.log FileKey9=%AppData%\IMVUClient|*.icns|RECURSE FileKey10=%AppData%\IMVUClient\installer|*|RECURSE FileKey11=%AppData%\IMVUClient\ui\profile|*.sqlite;*.js;*.dat;*.mfl FileKey12=%AppData%\IMVUClient\ui\profile\cache|*|REMOVESELF FileKey13=%LocalAppData%\IMVU*|*.log [iMyFone Umate *] LangSecRef=3024 Detect=HKLM\Software\iMyFone\Umate FileKey1=%ProgramFiles%\iMyFone\iMyFone Umate|mate.log FileKey2=%ProgramFiles%\iMyFone\iMyFone Umate\cache|*.*|RECURSE FileKey3=%ProgramFiles%\iMyFone\iMyFone Umate\Log|*.*|RECURSE FileKey4=%ProgramFiles%\iMyFone\iMyFone Umate\temp|*.*|RECURSE [Infinity Engine *] Section=Games DetectFile=%UserProfile%\Documents\Infinity Engine - Enhanced Edition FileKey1=%UserProfile%\Documents\Infinity Engine - Enhanced Edition\Crash|*.dmp [Infix PDF Editor *] LangSecRef=3021 DetectFile=%LocalAppData%\Iceni\Infix FileKey1=%LocalAppData%\Iceni\Infix\*|fontcache;lastFileOpenned.txt RegKey1=HKCU\Software\Iceni Technology Limited\Infix\Find Replace|Find Save RegKey2=HKCU\Software\Iceni Technology Limited\Infix\Find Replace|Replace Save RegKey3=HKCU\Software\Iceni Technology Limited\Infix\Find Replace File|Find Save RegKey4=HKCU\Software\Iceni Technology Limited\Infix\Find Replace File|Replace Save RegKey5=HKCU\Software\Iceni Technology Limited\Infix\Watermark dialog|Find Save RegKey6=HKCU\Software\Iceni Technology Limited\Infix\Watermark dialog|Replace Save [inFlow Inventory *] LangSecRef=3021 DetectFile=%AppData%\inFlow Inventory FileKey1=%AppData%\inFlow Inventory|log.txt FileKey2=%ProgramData%\inFlow Inventory\Logs|* [Infonautics File Date Corrector *] LangSecRef=3024 Detect=HKCU\Software\Infonautics\FileDateCorrector FileKey1=%AppData%\FileDateCorrector\Logs|*.* [InfraRecorder *] LangSecRef=3023 DetectFile=%AppData%\InfraRecorder FileKey1=%AppData%\InfraRecorder\logs|*.* [Ingit MapGPS *] LangSecRef=3021 Detect=HKCU\Software\Ingit\MapGPS\MapGPS RegKey1=HKCU\Software\Ingit\MapGPS\MapGPS\RARU0205|LastOpenChart RegKey2=HKCU\Software\Ingit\MapGPS\MapGPS\RARU0205 Recent Files [Injector DLL *] LangSecRef=3024 Detect=HKCU\Software\Drowse\Injector RegKey1=HKCU\Software\Drowse\Injector|DLL [InkScape *] LangSecRef=3023 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\inkscape.exe FileKey1=%LocalAppData%|recently-used.xbel [Inky *] LangSecRef=3022 Detect=HKCU\Software\Inky FileKey1=%LocalAppData%\Arcode\Plugin|*.log|RECURSE FileKey2=%LocalAppData%\Inky|data_*;f_*;index;*.log FileKey3=%LocalAppData%\Inky\Local Storage|*.* [Inno Setup *] LangSecRef=3021 Detect=HKCU\Software\Jordan Russell\Inno Setup RegKey1=HKCU\Software\Jordan Russell\Inno Setup\ScriptFileHistoryNew [InnoExtractor *] LangSecRef=3024 DetectFile1=%AppData%\InnoExtractor DetectFile2=%LocalAppData%\InnoExtractor DetectFile3=%ProgramFiles%\InnoExtractor DetectFile4=%SystemDrive%\Programs\InnoExtractor FileKey1=%AppData%\InnoExtractor|Historial.dat FileKey2=%LocalAppData%\InnoExtractor|Historial.dat FileKey3=%ProgramFiles%\InnoExtractor|Historial.dat FileKey4=%SystemDrive%\Programs\InnoExtractor|Historial.dat [InnoTab *] LangSecRef=3021 DetectFile=%ProgramData%\VTech\DA FileKey1=%ProgramData%\VTech\DA|*.log;InnoTab.txt;IntallLog.txt|RECURSE FileKey2=%ProgramData%\VTech\DA\InnoTab\ConsoleLog|* FileKey3=%ProgramData%\VTech\DA\InnoTab\Games\tmp|*|REMOVESELF [Inpaint *] LangSecRef=3021 Detect=HKCU\Software\Teorex\Inpaint RegKey1=HKCU\Software\Teorex\Inpaint\Recent File List RegKey2=HKCU\Software\Teorex\Inpaint\RecentFileList RegKey3=HKCU\Software\Teorex\Inpaint\Settings|Folder [inSSIDer Home *] LangSecRef=3024 Detect=HKCU\Software\MetaGeek, LLC\inSSIDer Home FileKey1=%LocalAppData%\MetaGeek,_LLC|ConnectionErrorLog;MetaGeek-OUI.backup [InstallShield *] LangSecRef=3024 Detect=HKCU\Software\InstallShield FileKey1=%ProgramFiles%|_ISTMP1.DIR FileKey2=%ProgramFiles%\InstallShield Installation Information|*.log|RECURSE FileKey3=%SystemDrive%|_ISTMP*.DIR RegKey1=HKCU\Software\InstallShield\16.0\Professional\Recent File List RegKey2=HKCU\Software\InstallShield\17.0\Professional\Recent File List RegKey3=HKCU\Software\InstallShield\18.0\Professional\Recent File List RegKey4=HKCU\Software\InstallShield\19.0\Professional\Recent File List RegKey5=HKCU\Software\InstallShield\20.0\Professional\Recent File List RegKey6=HKCU\Software\InstallShield\21.0\Professional\Recent File List RegKey7=HKCU\Software\InstallShield\InstallShield Cabinet and Log File Viewer\Recent File List RegKey8=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU1 RegKey9=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU2 RegKey10=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU3 RegKey11=HKCU\Software\InstallShield\InstallShield Professional\6.0\IsCabVu|MRU4 [Instant Dungeon! *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\326720 FileKey1=%AppData%\Instant Dungeon|log.txt [Instantbird *] LangSecRef=3022 DetectFile=%AppData%\Instantbird FileKey1=%AppData%\Instantbird\Crash Reports|*.*|RECURSE FileKey2=%AppData%\Instantbird\Profiles\*|*.corrupt|RECURSE FileKey3=%AppData%\Instantbird\Profiles\*|extensions.log FileKey4=%AppData%\Instantbird\Profiles\*\icons|*.*|RECURSE FileKey5=%AppData%\Instantbird\Profiles\*\logs|*.*|RECURSE FileKey6=%AppData%\Instantbird\Profiles\*\minidumps|*.*|RECURSE FileKey7=%LocalAppData%\Instantbird\Profiles\*\*cache|*.*|RECURSE FileKey8=%LocalAppData%\Instantbird\Profiles\*\Updates|*.log|RECURSE FileKey9=%ProgramFiles%\Instantbird|install.log [InstEd *] LangSecRef=3024 Detect=HKCU\Software\instedit.com\insted RegKey1=HKCU\Software\instedit.com\insted\MRU [Intel *] LangSecRef=3024 Detect1=HKCU\Software\Intel Detect2=HKLM\Software\Intel Detect3=HKLM\Software\RivetNetworks FileKey1=%AppData%\Intel\Wireless\CrashDumps|* FileKey2=%LocalAppData%\Intel\GCC|*log* FileKey3=%LocalAppData%\Intel\SUR\QueenCreek\Collected Data|*error_stack-*.txt FileKey4=%ProgramData%\Intel|*.log;*.bak;*Log*.txt|RECURSE FileKey5=%ProgramData%\Intel(R) Update Manager\AppData|ium.log FileKey6=%ProgramData%\Intel\*\Log*|* FileKey7=%ProgramData%\Intel\DSA\Logs|*.bak;*.log;*.txt FileKey8=%ProgramData%\Intel\Intel Extreme Tuning Utility\Logs|*|RECURSE FileKey9=%ProgramData%\Intel\Logs|*|RECURSE FileKey10=%ProgramData%\RivetNetworks\ImageCache|* FileKey11=%ProgramData%\RivetNetworks\Killer|*.log FileKey12=%ProgramFiles%\Intel\*|*.log;*Log.txt|RECURSE FileKey13=%ProgramFiles%\Intel\InfInst|*|REMOVESELF FileKey14=%SystemDrive%|IFRToolLog.txt FileKey15=%SystemDrive%\Driver_allOS\MEI\Drivers\MEI\INTERNAL|*.log|RECURSE FileKey16=%SystemDrive%\Intel|*.log|REMOVESELF FileKey17=%SystemDrive%\Intel\GfxCPLBatchFiles|*|REMOVESELF FileKey18=%SystemDrive%\Intel\Logs|*|REMOVESELF FileKey19=%UserProfile%|BullseyeCoverageError.txt FileKey20=%UserProfile%\AppData\LocalLow\Intel\ShaderCache|* FileKey21=%UserProfile%\Intel\Logs|*|REMOVESELF FileKey22=%WinDir%\debug\Intel\Logs|*|REMOVESELF FileKey23=%WinDir%\INF\Intel Storage Counters|*.tmp|RECURSE FileKey24=%WinDir%\System32|Default_error_Stack-*.txt;Gms.log FileKey25=%WinDir%\System32\config\systemprofile\AppData\Local\Intel\GCC|*.txt FileKey26=%WinDir%\System32\config\systemprofile\Intel\Logs|*|REMOVESELF FileKey27=%WinDir%\System32\drivers\RivetNetworks\Killer|*.log FileKey28=%WinDir%\SysWOW64|Gms.log FileKey29=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\collected_data\DebugLogs|* FileKey30=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\collected_data\intermediate_data|* FileKey31=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData|*.log;*.bak FileKey32=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\captured_logs|* FileKey33=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\history|* FileKey34=%WinDir%\SysWOW64\config\systemprofile\Intel\Logs|*|REMOVESELF [Intel Graphics Command Center *] LangSecRef=3024 DetectFile=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience* FileKey1=%LocalAppData%\Intel\GCC|gcc*_log_*.txt FileKey2=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\AC|*|RECURSE FileKey3=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\LocalCache|*|RECURSE FileKey4=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\LocalState|gcc*_log_*.txt|RECURSE FileKey5=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\LocalState\Games2\cache|*|RECURSE FileKey6=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\LocalState\MetroLogs|*|RECURSE FileKey7=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\LocalState\Promotions|*|RECURSE FileKey8=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\Settings|*.log* FileKey9=%LocalAppData%\Packages\AppUp.IntelGraphicsExperience*\TempState|*|RECURSE FileKey10=%ProgramData%\Packages\AppUp.IntelGraphicsExperience*\*\SystemAppData\Helium\Cache|* [Intel Processor Diagnostic Tool *] LangSecRef=3024 Detect=HKCU\Software\Intel Corporation\Intel Processor Diagnostic Tool 64bit FileKey1=%ProgramFiles%\Intel Corporation\Intel Processor Diagnostic Tool 64bit|*Results.txt;System_Info.txt;TestResults_Full.txt [Intel Shader Cache *] LangSecRef=3024 DetectFile1=%ProgramData%\Intel\ShaderCache DetectFile2=%UserProfile%\AppData\LocalLow\Intel\ShaderCache FileKey1=%ProgramData%\Intel\ShaderCache|* FileKey2=%UserProfile%\AppData\LocalLow\Intel\ShaderCache|* [Inter-Tel Device *] LangSecRef=3022 DetectFile=%ProgramFiles%\Inter-Tel FileKey1=%ProgramFiles%\Inter-Tel|*.log|RECURSE [Internet Business Promoter *] LangSecRef=3022 DetectFile=%AppData%\IBP FileKey1=%AppData%\IBP|*Log.txt;*.bak|RECURSE [Internet Download Manager *] LangSecRef=3022 Detect=HKCU\Software\DownloadManager FileKey1=%AppData%\IDM|*.Log;*.txt FileKey2=%AppData%\IDM\DwnlData|*.*|REMOVESELF FileKey3=%ProgramFiles%\Internet Download Manager|*.log FileKey4=%SystemDrive%|IDMSetup2.log RegKey1=HKCU\Software\DownloadManager\1 RegKey2=HKCU\Software\DownloadManager\2 RegKey3=HKCU\Software\DownloadManager\3 RegKey4=HKCU\Software\DownloadManager\4 RegKey5=HKCU\Software\DownloadManager\5 RegKey6=HKCU\Software\DownloadManager\6 RegKey7=HKCU\Software\DownloadManager\7 RegKey8=HKCU\Software\DownloadManager\8 RegKey9=HKCU\Software\DownloadManager\9 RegKey10=HKCU\Software\DownloadManager\10 RegKey11=HKCU\Software\DownloadManager\11 RegKey12=HKCU\Software\DownloadManager\12 RegKey13=HKCU\Software\DownloadManager\13 RegKey14=HKCU\Software\DownloadManager\14 RegKey15=HKCU\Software\DownloadManager\15 RegKey16=HKCU\Software\DownloadManager\16 RegKey17=HKCU\Software\DownloadManager\17 RegKey18=HKCU\Software\DownloadManager\18 RegKey19=HKCU\Software\DownloadManager\19 RegKey20=HKCU\Software\DownloadManager\20 RegKey21=HKCU\Software\DownloadManager\21 RegKey22=HKCU\Software\DownloadManager\22 RegKey23=HKCU\Software\DownloadManager\23 RegKey24=HKCU\Software\DownloadManager\24 RegKey25=HKCU\Software\DownloadManager\25 RegKey26=HKCU\Software\DownloadManager\26 RegKey27=HKCU\Software\DownloadManager\27 RegKey28=HKCU\Software\DownloadManager\28 RegKey29=HKCU\Software\DownloadManager\29 RegKey30=HKCU\Software\DownloadManager\30 RegKey31=HKCU\Software\DownloadManager\31 RegKey32=HKCU\Software\DownloadManager\32 RegKey33=HKCU\Software\DownloadManager\33 RegKey34=HKCU\Software\DownloadManager\34 RegKey35=HKCU\Software\DownloadManager\35 RegKey36=HKCU\Software\DownloadManager\36 RegKey37=HKCU\Software\DownloadManager\37 RegKey38=HKCU\Software\DownloadManager\38 RegKey39=HKCU\Software\DownloadManager\39 RegKey40=HKCU\Software\DownloadManager\40 RegKey41=HKCU\Software\DownloadManager\41 RegKey42=HKCU\Software\DownloadManager\42 RegKey43=HKCU\Software\DownloadManager\43 RegKey44=HKCU\Software\DownloadManager\44 RegKey45=HKCU\Software\DownloadManager\45 RegKey46=HKCU\Software\DownloadManager\46 RegKey47=HKCU\Software\DownloadManager\47 RegKey48=HKCU\Software\DownloadManager\48 RegKey49=HKCU\Software\DownloadManager\49 RegKey50=HKCU\Software\DownloadManager\50 RegKey51=HKCU\Software\DownloadManager\51 RegKey52=HKCU\Software\DownloadManager\52 RegKey53=HKCU\Software\DownloadManager\53 RegKey54=HKCU\Software\DownloadManager\54 RegKey55=HKCU\Software\DownloadManager\55 RegKey56=HKCU\Software\DownloadManager\56 RegKey57=HKCU\Software\DownloadManager\57 RegKey58=HKCU\Software\DownloadManager\58 RegKey59=HKCU\Software\DownloadManager\59 RegKey60=HKCU\Software\DownloadManager\60 RegKey61=HKCU\Software\DownloadManager\61 RegKey62=HKCU\Software\DownloadManager\62 RegKey63=HKCU\Software\DownloadManager\63 RegKey64=HKCU\Software\DownloadManager\64 RegKey65=HKCU\Software\DownloadManager\65 RegKey66=HKCU\Software\DownloadManager\66 RegKey67=HKCU\Software\DownloadManager\67 RegKey68=HKCU\Software\DownloadManager\68 RegKey69=HKCU\Software\DownloadManager\69 RegKey70=HKCU\Software\DownloadManager\70 RegKey71=HKCU\Software\DownloadManager\71 RegKey72=HKCU\Software\DownloadManager\72 RegKey73=HKCU\Software\DownloadManager\73 RegKey74=HKCU\Software\DownloadManager\74 RegKey75=HKCU\Software\DownloadManager\75 RegKey76=HKCU\Software\DownloadManager\maxID [Intuit Data Protect *] LangSecRef=3024 DetectFile=%LocalAppData%\Intuit\Intuit Data Protect FileKey1=%LocalAppData%\Intuit\Intuit Data Protect|*.log FileKey2=%ProgramData%\Intuit\Intuit Data Protect|*.log [Intuit Entitlement Client *] LangSecRef=3021 DetectFile=%ProgramData%\Intuit\Entitlement Client FileKey1=%ProgramData%\Intuit\Entitlement Client\*|IntuitEntitlementLog* [Intuit Proline Tax Import *] LangSecRef=3021 DetectFile=%AppData%\Intuit\PTI FileKey1=%AppData%\Intuit\PTI\Log|*.* [Intuit QuickBooks *] LangSecRef=3021 Detect=HKLM\Software\Intuit\QuickBooks FileKey1=%CommonProgramFiles%\Intuit\Quickbooks\QBUpdate\Log|*.* FileKey2=%LocalAppData%\Intuit\QuickBooks\Log|*.*|RECURSE FileKey3=%ProgramData%\Common Files\Intuit\Quickbooks\qbupdate\log|* FileKey4=%ProgramData%\Intuit\QBWebConnector\log|* FileKey5=%ProgramData%\Intuit\Quickbooks|*.log;qbsdklog.txt FileKey6=%ProgramData%\Intuit\QuickBooks DB Server Manager|*.log;*.old [Intuit Quicken *] LangSecRef=3021 Detect1=HKLM\Software\Intuit\Quicken Detect2=HKLM\Software\Quicken FileKey1=%AppData%\Intuit\Quicken\Log|*.txt;*.log FileKey2=%AppData%\Quicken\Log|*.txt;*.log FileKey3=%LocalAppData%\Intuit\Common\Authorization\V1\Logs|*.txt FileKey4=%LocalAppData%\Quicken\Common\Authorization\V1\Logs|*.txt FileKey5=%ProgramData%\Intuit\Quicken\Log|*.log FileKey6=%ProgramData%\Intuit\Quicken\Log\installer|*|REMOVESELF FileKey7=%ProgramData%\Intuit\SendError|*.log FileKey8=%ProgramData%\Quicken\Inet\QWWebData|LOG.old|RECURSE FileKey9=%ProgramData%\Quicken\Inet\QWWebData\Cache|* FileKey10=%ProgramData%\Quicken\Inet\QWWebData\GPUCache|*|REMOVESELF FileKey11=%ProgramData%\Quicken\Inet\QWWebData\Local Storage\leveldb|*tmp FileKey12=%ProgramData%\Quicken\Log|*.log FileKey13=%ProgramData%\Quicken\Log\installer|*|REMOVESELF FileKey14=%ProgramData%\Quicken\SendError|*.log FileKey15=%ProgramFiles%\Quicken\PDFDrv|install.log;InstallPDFConverter.log FileKey16=%UserProfile%\Documents\Quicken\GPUCache|*.*|REMOVESELF [Intuit TurboTax *] LangSecRef=3021 DetectFile=%ProgramFiles%\TurboTax* FileKey1=%AppData%\Intuit*|*.log|RECURSE FileKey2=%CommonProgramFiles%\Intuit\Internet Client|Msdun13.exe FileKey3=%ProgramData%|*.bc FileKey4=%ProgramData%\Intuit*|*.log|RECURSE FileKey5=%ProgramData%\Intuit\Common\*\*\Logs|* FileKey6=%ProgramData%\Intuit\TurboTax\MSI\*\Logs|* FileKey7=%ProgramFiles%\TurboTax*|*.txt [IObit Advanced SystemCare *] LangSecRef=3024 DetectFile1=%AppData%\IObit\Advanced SystemCare* DetectFile2=%ProgramData%\IObit\Advanced SystemCare* DetectFile3=%ProgramFiles%\IObit\Advanced SystemCare* FileKey1=%AppData%\IObit\Advanced SystemCare*|*.log;*_UndeleteReg.dat FileKey2=%AppData%\IObit\Advanced SystemCare*\Backup|*.reg FileKey3=%AppData%\IObit\Advanced SystemCare*\Boottime|*.log FileKey4=%AppData%\IObit\Advanced SystemCare*\ClonedFilesScanner|*_log.txt FileKey5=%AppData%\IObit\Advanced SystemCare*\EmptyFolder|*|RECURSE FileKey6=%AppData%\IObit\Advanced SystemCare*\Homepage*|*.new;*.old FileKey7=%AppData%\IObit\Advanced SystemCare*\Log|*|RECURSE FileKey8=%AppData%\IObit\Advanced SystemCare*\LogBackup*|*|RECURSE FileKey9=%AppData%\IObit\Advanced SystemCare*\TrayProductData|StatCache.db FileKey10=%ProgramData%\IObit\Advanced SystemCare*\Homepage*|*.log FileKey11=%ProgramData%\IObit\Advanced SystemCare*\Log|*|REMOVESELF FileKey12=%ProgramData%\IObit\ASCDownloader|*.log FileKey13=%ProgramFiles%\IObit\Advanced SystemCare Ultimate\Antivirus\BackupRec|*|RECURSE FileKey14=%ProgramFiles%\IObit\Advanced SystemCare*|*.log;*.tmp;*.txt|RECURSE FileKey15=%ProgramFiles%\IObit\Advanced SystemCare*\*.cab_Temp|*|REMOVESELF FileKey16=%ProgramFiles%\IObit\Advanced SystemCare*\ASCServiceLog|*|RECURSE FileKey17=%ProgramFiles%\IObit\Advanced SystemCare*\DumpFile|*.dmp FileKey18=%ProgramFiles%\IObit\Advanced SystemCare*\LatestNews|*.dat FileKey19=%ProgramFiles%\IObit\Advanced SystemCare*\Update|UpdateHistory.ini FileKey20=%SystemDrive%\Users\Default\AppData\Roaming\IObit\Advanced SystemCare*|*.log FileKey21=%WinDir%\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare*|*.log FileKey22=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare*|*.log RegKey1=HKLM\Software\IObit\Advanced SystemCare|LastUseDate RegKey2=HKLM\Software\IObit\Advanced SystemCare|LastWrite RegKey3=HKLM\Software\IObit\ASC|UninstallDate [IObit Driver Booster *] LangSecRef=3024 DetectFile1=%AppData%\IObit\Driver Booster DetectFile2=%ProgramFiles%\IObit\Driver Booster FileKey1=%AppData%\IObit\Driver Booster|*.log|RECURSE FileKey2=%AppData%\IObit\Driver Booster\Logs|*.*|RECURSE FileKey3=%ProgramFiles%\IObit\Driver Booster|*.log FileKey4=%ProgramFiles%\IObit\Driver Booster\Update|*.tmp [IObit KB Downloader *] LangSecRef=3024 DetectFile=%ProgramData%\IObit\KBDownloader FileKey1=%ProgramData%\IObit\KBDownloader|*|RECURSE [IObit LiveUpdate *] LangSecRef=3024 DetectFile=%ProgramFiles%\IObit\LiveUpdate FileKey1=%ProgramFiles%\IObit\LiveUpdate|*.log|RECURSE [IObit Malware Fighter *] LangSecRef=3024 DetectFile=%ProgramFiles%\IObit\IObit Malware Fighter FileKey1=%ProgramFiles%\IObit\IObit Malware Fighter\adsremoval\IE|*.log FileKey2=%ProgramFiles%\IObit\IObit Malware Fighter\log|*.*|RECURSE [IObit Smart Defrag *] LangSecRef=3024 DetectFile=%ProgramFiles%\IObit\Smart Defrag* FileKey1=%ProgramFiles%\IObit\Smart Defrag*|*.log FileKey2=%ProgramFiles%\IObit\Smart Defrag*\Log|*.* FileKey3=%ProgramFiles%\IObit\Smart Defrag*\Temp|*.*|RECURSE FileKey4=%ProgramFiles%\IObit\Smart Defrag*\Update|*.tmp [IObit Software Updater *] LangSecRef=3024 DetectFile=%AppData%\IObit\Software Updater FileKey1=%AppData%\IObit\Software Updater|*.log;UpdateInfo.ini FileKey2=%AppData%\IObit\Software Updater\*Log|*.* [IObit StartMenu8 *] LangSecRef=3024 Detect=HKLM\Software\IObit\StartMenu FileKey1=%AppData%\IObit\StartMenu 8|*.log FileKey2=%ProgramFiles%\IObit\Start Menu 8\Freeware|*.exe [IObit Uninstaller *] LangSecRef=3024 DetectFile=%AppData%\IObit\IObit Uninstaller FileKey1=%AppData%\IObit\IObit Uninstaller\*Log|*.* FileKey2=%AppData%\IObit\IObit Uninstaller\Installer|*.dbg FileKey3=%ProgramFiles%\IObit\iObit Uninstaller|*.log|RECURSE [IP Hider Pro *] LangSecRef=3022 DetectFile=%AppData%\IP Hider Pro FileKey1=%AppData%\IP Hider Pro\Logs|*.* [Iperius Backup *] LangSecRef=3021 DetectFile=%ProgramFiles%\Iperius Backup FileKey1=%ProgramData%\IperiusBackup\Logs|*|RECURSE [IPinside LWS Agent *] LangSecRef=3021 DetectFile=%UserProfile%\AppData\LocalLow\IPinside FileKey1=%UserProfile%\AppData\LocalLow\IPinside|*.log [iPod-Cloner *] LangSecRef=3023 Detect=HKCU\Software\iPod-Cloner FileKey1=%ProgramFiles%\iPod-Cloner|*.log FileKey2=%ProgramFiles%\iPod-Cloner\ReadCache|*.* FileKey3=%SystemDrive%|dtdlog.txt [iResizer *] LangSecRef=3021 Detect=HKCU\Software\Teorex\iResizer RegKey1=HKCU\Software\Teorex\iResizer\RecentFileList [iSkysoft Helper Compact *] LangSecRef=3023 DetectFile=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact FileKey1=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact|ProductUpdateLists.xml;ISHelper*.exe_temp FileKey2=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\DATADICT|*.*|RECURSE FileKey3=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\log|*.*|RECURSE FileKey4=%CommonProgramFiles%\iSkysoft\iSkysoft Helper Compact\Temp|*.*|RECURSE RegKey1=HKLM\Software\iSkysoft\iSkysoft Helper Compact RegKey2=HKLM\Software\Wow6432Node\iSkysoft\iSkysoft Helper Compact [iSkysoft Video Converter *] LangSecRef=3023 Detect1=HKLM\Software\iSkysoft\iSkysoft Video Converter Detect2=HKLM\Software\iSkysoft\iSkysoft Video Converter Ultimate FileKey1=%ProgramData%\iSkysoft Video Converter*|*.dat.bak FileKey2=%ProgramData%\iSkysoft Video Converter*\Temp*Dir|*|RECURSE FileKey3=%ProgramFiles%\iSkysoft\Video Converter*\Log|*|RECURSE FileKey4=%ProgramFiles%\iSkysoft\Video Converter*\TempThumbDir|*|RECURSE [iSkysoft Video Editor *] LangSecRef=3023 DetectFile=%ProgramFiles%\iSkysoft\Video Editor FileKey1=%ProgramFiles%\iSkysoft\Video Editor\Log|*.txt [IsoBuster *] LangSecRef=3021 Detect=HKCU\Software\Smart Projects\IsoBuster RegKey1=HKCU\Software\Smart Projects\IsoBuster\RecentImages [iSpy *] LangSecRef=3021 Detect=HKCU\Software\ISpy\ISPY FileKey1=%AppData%\iSpy\WebServerRoot\Media|*.*|RECURSE FileKey2=%LocalAppData%\iSpy\WebServerRoot\Media|*.*|RECURSE [iSysCleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Utils\iSysCleaner FileKey1=%ProgramFiles%\Utils\iSysCleaner\traces|*.* [iTop Screen Recorder *] LangSecRef=3023 DetectFile=%AppData%\iTop Screen Recorder FileKey1=%AppData%\iTop Screen Recorder\Logs|*.* [iTop Screenshot *] LangSecRef=3024 DetectFile=%AppData%\iTop Screenshot FileKey1=%AppData%\iTop Screenshot\Log|*.log [iTop VPN *] LangSecRef=3022 DetectFile=%AppData%\iTop VPN FileKey1=%AppData%\iTop VPN\Log|*.bak*;*.log [iTunes *] LangSecRef=3023 Detect=HKLM\Software\Apple Computer, Inc.\iTunes DetectFile=%LocalAppData%\Packages\AppleInc.iTunes* FileKey1=%AppData%\Apple Computer\iTunes|*.ipcc;*.ipsw;*.log FileKey2=%AppData%\Apple Computer\iTunes\Cookies|Cookies.binarycookies FileKey3=%AppData%\Apple Computer\Logs*|*|RECURSE FileKey4=%LocalAppData%\Apple Computer\iTunes|Cache.db FileKey5=%LocalAppData%\Packages\AppleInc.iTunes*\AC|*|RECURSE FileKey6=%LocalAppData%\Packages\AppleInc.iTunes*\LocalCache\Local\Apple Computer\iTunes|Cache.db;*.xml FileKey7=%LocalAppData%\Packages\AppleInc.iTunes*\LocalCache\Local\Microsoft\Windows\Caches|*|RECURSE FileKey8=%LocalAppData%\Packages\AppleInc.iTunes*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE FileKey9=%LocalAppData%\Packages\AppleInc.iTunes*\LocalCache\Roaming\Apple Computer\iTunes\Cookies|Cookies.binarycookies FileKey10=%LocalAppData%\Packages\AppleInc.iTunes*\LocalCache\Roaming\Apple Computer\Logs|*|RECURSE FileKey11=%LocalAppData%\Packages\AppleInc.iTunes*\Settings|*.log* FileKey12=%LocalAppData%\Packages\AppleInc.iTunes*\SystemAppData\Helium\Cache|*|RECURSE FileKey13=%LocalAppData%\Packages\AppleInc.iTunes*\TempState|*|RECURSE FileKey14=%ProgramData%\Apple Computer\iTunes\iPhone Temporary Files|*|RECURSE FileKey15=%UserProfile%\Desktop\iTunes Crash Logs|*.dmp FileKey16=%UserProfile%\Music\iTunes|*.tmp|RECURSE FileKey17=%UserProfile%\Music\iTunes\Album Artwork\Cache|*|RECURSE FileKey18=%WinDir%\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*|RECURSE FileKey19=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*|RECURSE [iWisoft Free Video Converter *] LangSecRef=3023 DetectFile=%ProgramFiles%\iWisoft Free Video Converter FileKey1=%ProgramFiles%\iWisoft Free Video Converter|VideoConverter.log [iXL *] LangSecRef=3021 DetectFile=%AppData%\Fisher-Price\iXL FileKey1=%AppData%\Fisher-Price\iXL\Log|*.* [iZotope RX 2 *] LangSecRef=3021 DetectFile=%AppData%\iZotope\iZotope RX 2 Session Data FileKey1=%AppData%\iZotope\iZotope RX 2 Session Data|*.*|RECURSE [Jabbear *] LangSecRef=3022 Detect=HKCU\Software\Jabbear FileKey1=%ProgramFiles%\Jabbear|*.log|RECURSE FileKey2=%ProgramFiles%\Jabbear\avatars|*.*|RECURSE FileKey3=%ProgramFiles%\Jabbear\cachedir|*.*|RECURSE [Jabbear Chat History *] LangSecRef=3022 Detect=HKCU\Software\Jabbear FileKey1=%ProgramFiles%\Jabbear\Users|*.dat;*.html|RECURSE [Jade Empire *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\7110 FileKey1=%ProgramFiles%\Steam\steamapps\common\Jade Empire\logs|*.* [Jagex Launcher *] Section=Games DetectFile=%UserProfile%\jagexcache FileKey1=%ProgramData%\Jagex|*.jcache|RECURSE FileKey2=%UserProfile%\jagex*|*|RECURSE FileKey3=%WinDir%\.jagex*|*|REMOVESELF ExcludeKey1=PATH|%UserProfile%\jagexcache\jagexlauncher\|* [JAJC *] LangSecRef=3022 DetectFile=%UserProfile%\JAJC FileKey1=%UserProfile%\JAJC\Avatars|*.*|RECURSE FileKey2=%UserProfile%\JAJC\Logs|*.*|RECURSE [Jalatext *] LangSecRef=3021 DetectFile=%UserProfile%\.jalatext FileKey1=%UserProfile%\.jalatext\log|*.* [James Patterson's Women's Murder Club: Twice in a Blue Moon *] Section=Games DetectFile=%AppData%\Flood Light Games\WMC3 FileKey1=%AppData%\Flood Light Games\WMC3|*.log [jAnrufmonitor *] LangSecRef=3022 DetectFile=%ProgramFiles%\jAnrufmonitor FileKey1=%ProgramFiles%\jAnrufmonitor\data|*.log FileKey2=%ProgramFiles%\jAnrufmonitor\lib\cache|classloader.cache.log FileKey3=%ProgramFiles%\jAnrufmonitor\logs|*.* [Jasc Animation Shop *] LangSecRef=3023 Detect1=HKCU\Software\JASC\Animation Shop Detect2=HKCU\Software\Jasc\Animation Shop 2 RegKey1=HKCU\Software\Jasc\Animation Shop 2\Recent File List RegKey2=HKCU\Software\JASC\Animation Shop\Cache [Java *] LangSecRef=3022 Detect1=HKLM\Software\JavaSoft\Java Plug-in Detect2=HKLM\Software\JavaSoft\Java Runtime Environment Detect3=HKLM\Software\JavaSoft\Java Web Start DetectFile=%ProgramData%\Oracle\Java FileKey1=%AppData%\Sun\Java\Deployment\SystemCache|*|RECURSE FileKey2=%AppData%\Sun\Java\jre*|*|REMOVESELF FileKey3=%LocalAppData%\javasharedresources|* FileKey4=%LocalAppData%\Sun\Java\Deployment\*Cache|*|RECURSE FileKey5=%ProgramData%\Oracle\Java\.oracle_jre_usage|* FileKey6=%ProgramData%\Oracle\Java\installcache|*|RECURSE FileKey7=%ProgramFiles%\Java\jre*|*PATCH.ERR FileKey8=%ProgramFiles%\Java\jre*\lib\security|*.bak FileKey9=%SystemDrive%\Users\*\.oracle_jre_usage|*|REMOVESELF FileKey10=%UserProfile%\AppData\LocalLow\Oracle\Java\jdk*|*|REMOVESELF FileKey11=%UserProfile%\AppData\LocalLow\Oracle\Java\jre*|*|REMOVESELF FileKey12=%UserProfile%\AppData\LocalLow\Sun\Java\Deployment\SystemCache|*|RECURSE FileKey13=%UserProfile%\AppData\LocalLow\Sun\Java\Deployment\tmp|*|RECURSE FileKey14=%UserProfile%\AppData\LocalLow\Sun\Java\jdk*|*|REMOVESELF FileKey15=%UserProfile%\AppData\LocalLow\Sun\Java\jre*|*|REMOVESELF FileKey16=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\*Cache|*|RECURSE FileKey17=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\*Cache|*|RECURSE [JavaRa *] LangSecRef=3022 DetectFile=%ProgramFiles%\JavaRa* FileKey1=%ProgramFiles%\JavaRa 2.0|*.log|RECURSE FileKey2=%SystemDrive%|JavaRa.log [Javelin PDF Reader *] LangSecRef=3021 DetectFile=%AppData%\DrumlinSecurity\JavelinNew FileKey1=%AppData%\DrumlinSecurity\JavelinNew|*history.xml FileKey2=%AppData%\DrumlinSecurity\JavelinNew\logs|*.* [JDownloader *] LangSecRef=3022 Detect1=HKLM\Software\Classes\JDownloader2 Detect2=HKLM\Software\JDownloader DetectFile1=%ProgramFiles%\JDownloader DetectFile2=%ProgramFiles%\JDownloader 2 FileKey1=%LocalAppData%\JDownloader*2*|*.log;SessionInstallLog.json.*|RECURSE FileKey2=%LocalAppData%\JDownloader*2*\.install4j|*.log FileKey3=%LocalAppData%\JDownloader*2*\captchas|*|RECURSE FileKey4=%LocalAppData%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json FileKey5=%LocalAppData%\JDownloader*2*\logs|*|RECURSE FileKey6=%LocalAppData%\JDownloader*2*\tmp|*|RECURSE FileKey7=%ProgramFiles%\JDownloader*|*.log;updateLog.txt;*.lck;*.log.*;SessionInstallLog.json.*|RECURSE FileKey8=%ProgramFiles%\JDownloader*\.junique|* FileKey9=%ProgramFiles%\JDownloader*\captchas|*|RECURSE FileKey10=%ProgramFiles%\JDownloader*\container|* FileKey11=%ProgramFiles%\JDownloader*\downloads|* FileKey12=%ProgramFiles%\JDownloader*\tmp\linksave|* FileKey13=%ProgramFiles%\JDownloader*2*\.install4j|*.log FileKey14=%ProgramFiles%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json FileKey15=%ProgramFiles%\JDownloader*2*\logs|*|RECURSE FileKey16=%ProgramFiles%\JDownloader*2*\tmp|*|RECURSE FileKey17=%UserProfile%\.jd_home|JDownloader.log FileKey18=%UserProfile%\.jd_home\logs|*.0 ExcludeKey1=FILE|%LocalAppData%\JDownloader 2.0\.install4j\|files.log ExcludeKey2=PATH|%LocalAppData%\JDownloader*2*\cfg\|subconf_*.ejs ExcludeKey3=PATH|%ProgramFiles%\JDownloader*2*\cfg\|subconf_*.ejs [JDownloader Backups *] LangSecRef=3022 Detect=HKLM\Software\JDownloader DetectFile=%ProgramFiles%\JDownloader FileKey1=%ProgramFiles%\JDownloader*\backup|*.* [jEdit *] LangSecRef=3021 DetectFile=%UserProfile%\.jedit FileKey1=%UserProfile%\.jedit|*.log|RECURSE FileKey2=%UserProfile%\.jedit\jars-cache|*.*|RECURSE [Jet Downloader *] LangSecRef=3022 DetectFile=%ProgramFiles%\CloudTech\Jet Downloader FileKey1=%ProgramFiles%\CloudTech\Jet Downloader|*.log [JetBrains dotPeek v1.1 *] LangSecRef=3024 Detect=HKLM\Software\JetBrains\dotPeek FileKey1=%LocalAppData%\JetBrains\dotPeek\v1.1\Caches|*.*|REMOVESELF [Jetbrains IntelliJ IDEA *] LangSecRef=3024 Detect1=HKCU\Software\JetBrains\IntelliJ IDEA Detect2=HKCU\Software\JetBrains\IntelliJ IDEA Community Edition FileKey1=%UserProfile%\.IdeaC*\System\Caches|*.* FileKey2=%UserProfile%\.IdeaC*\System\LocalHistory|*.* FileKey3=%UserProfile%\.IdeaC*\System\Logs|*.* FileKey4=%UserProfile%\.IdeaC*\System\tmp|*.*|RECURSE FileKey5=%UserProfile%\.IntelliJIdea12\system\Caches|*.* FileKey6=%UserProfile%\.IntelliJIdea12\system\LocalHistory|*.* FileKey7=%UserProfile%\.IntelliJIdea12\system\log|*.* FileKey8=%UserProfile%\.IntelliJIdea12\system\tmp|*.*|RECURSE [Jetbrains Pycharm *] LangSecRef=3024 Detect=HKCU\Software\JetBrains\PyCharm FileKey1=%UserProfile%\.PyCharm*\system\caches|*.* FileKey2=%UserProfile%\.PyCharm*\system\log|*.* [Jetbrains WebStorm *] LangSecRef=3024 Detect=HKCU\Software\JetBrains\WebStorm FileKey1=%UserProfile%\.WebIde50\system\Caches|*.*|RECURSE FileKey2=%UserProfile%\.WebIde50\system\LocalHistory|*.*|RECURSE FileKey3=%UserProfile%\.WebIde50\system\Log|*.*|RECURSE FileKey4=%UserProfile%\.WebIde50\system\tmp|*.*|RECURSE [Jetico Personal Firewall *] LangSecRef=3022 Detect=HKCU\Software\Jetico\Personal Firewall FileKey1=%ProgramFiles%\Jetico\Jetico Personal Firewall|*.log [Jitsi *] LangSecRef=3022 DetectFile=%ProgramFiles%\Jitsi FileKey1=%AppData%\Jitsi\avatarcache|*.*|RECURSE FileKey2=%AppData%\Jitsi\Log|*.*|RECURSE [Jitsi Chat/File History *] LangSecRef=3022 DetectFile=%ProgramFiles%\Jitsi FileKey1=%AppData%\Jitsi\History*|*.*|RECURSE [Joboshare DVD Toolkit *] LangSecRef=3023 Detect=HKCU\Software\Joboshare FileKey1=%SystemDrive%|*temp.txt;*test.txt FileKey2=%UserProfile%\Documents\Joboshare\DVD Copy\ifo_temp|*.*|REMOVESELF FileKey3=%UserProfile%\Documents\Joboshare\DVD Copy\log|*.*|REMOVESELF [Join.Me *] LangSecRef=3022 Detect=HKCU\Software\join.me FileKey1=%LocalAppData%\join.me|*.log FileKey2=%LocalAppData%\join.me\join.me.*.*.*.*|*.*|REMOVESELF [Jojo's Fashion Show *] Section=Games DetectFile=%AppData%\Gamelab\Jojos Fashion Show FileKey1=%AppData%\Gamelab\Jojos Fashion Show|log.txt [JOSM *] LangSecRef=3021 DetectFile=%LocalAppData%\JOSM FileKey1=%LocalAppData%\JOSM\cache\tiles|*.*|RECURSE [JRecoverer Software *] LangSecRef=3024 DetectFile=%UserProfile%\.jrecoverer-* FileKey1=%UserProfile%\.jrecoverer-*\logs|*.log FileKey2=%UserProfile%\.jrecoverer-*\reports|*.*|RECURSE [Jubler Subtitle Editor *] LangSecRef=3023 DetectFile=%AppData%\Jubler FileKey1=%AppData%\Jubler|log.txt [Juniper Networks *] LangSecRef=3021 Detect1=HKCU\Software\Juniper Networks Detect2=HKLM\Software\Juniper Networks FileKey1=%AppData%\Juniper Networks|*.old;*.log|RECURSE FileKey2=%LocalAppData%\Juniper Networks\Logging|*.* RegKey1=HKLM\Software\Juniper Networks\Default [Just Manager *] LangSecRef=3021 Detect=HKLM\Software\JustManager DetectFile=%ProgramFiles%\JustManager FileKey1=%LocalAppData%\JustManager|Log.txt [JustVoip *] LangSecRef=3022 DetectFile=%AppData%\JustVoip FileKey1=%AppData%\JustVoip|History_*.dat [jv16 PowerTools *] LangSecRef=3024 DetectFile=%ProgramFiles%\jv16 PowerTools* FileKey1=%LocalAppData%\jv16PowerTools|*.log FileKey2=%ProgramFiles%\jv16 PowerTools*|*.log FileKey3=%ProgramFiles%\jv16 PowerTools*\Settings|*.log FileKey4=%ProgramFiles%\jv16 PowerTools*\Temp|*|RECURSE FileKey5=%ProgramFiles%\jv16 PowerTools\Debug|*.log;*.txt [jv16 PowerTools Backups *] LangSecRef=3024 DetectFile=%ProgramFiles%\jv16 PowerTools* FileKey1=%ProgramFiles%\jv16 PowerTools*|*.reg FileKey2=%ProgramFiles%\jv16 PowerTools*\Backups|*|RECURSE [jv16 RegCleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\RegCleaner FileKey1=%ProgramFiles%\RegCleaner|old.dat FileKey2=%ProgramFiles%\RegCleaner\Backups|*.* [K-Lite Codec Pack *] LangSecRef=3023 Detect=HKLM\Software\KLCodecPack FileKey1=%ProgramFiles%\K-Lite*|*.log;*.txt|RECURSE FileKey2=%SystemDrive%|*klcp_itp_*.tmp;*klcp_iph_*.tmp FileKey3=%UserProfile%\Desktop|klcp_codec_log.txt RegKey1=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path0 RegKey2=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path1 RegKey3=HKCU\Software\Gabest\vsfilter\DefTextPathes|Path2 [Kakao Talk *] LangSecRef=3022 DetectFile=%LocalAppData%\Kakao\KakaoTalk FileKey1=%LocalAppData%\Kakao\KakaoTalk\Dump|*.*|RECURSE [Kalypso Launcher *] Section=Games DetectFile=%AppData%\Kalypso Media\Launcher FileKey1=%AppData%\Kalypso Media\Launcher|log*.txt [Kamo *] LangSecRef=3024 Detect=HKCU\Software\Piriform\Kamo FileKey1=%LocalAppData%\Kamo\TempBrowserDB|*.* FileKey2=%ProgramFiles%\Kamo|*.log;*.old FileKey3=%ProgramFiles%\Kamo\cache|*.old;LOG|RECURSE FileKey4=%ProgramFiles%\Kamo\cache\*Cache|*.*|RECURSE FileKey5=%ProgramFiles%\Kamo\NetFilter|*Log.txt FileKey6=%ProgramFiles%\Kamo\Support\Log|ErrorLog_*.txt FileKey7=%SystemDrive%\Support\Log|ErrorLog_*.txt RegKey1=HKCU\Software\Piriform\Kamo|epochAtInstall RegKey2=HKCU\Software\Piriform\Kamo|epochAtLastIPM RegKey3=HKCU\Software\Piriform\Kamo|epochForNextIPM RegKey4=HKCU\Software\Piriform\Kamo|epochSinceUILastUsed ExcludeKey1=FILE|%ProgramFiles%\Kamo\|install.log [KarenWare Hasher *] LangSecRef=3024 Detect=HKCU\Software\KarenWare\Power Tools\Hasher RegKey1=HKCU\Software\KarenWare\Power Tools\Hasher|LastRun [Kaseto *] LangSecRef=3023 DetectFile=%LocalAppData%\Kaseto FileKey1=%LocalAppData%\Kaseto|*.backup FileKey2=%LocalAppData%\Kaseto\Logs|*.* [Kaspersky *] LangSecRef=3024 Detect=HKCU\Software\KasperskyLab FileKey1=%ProgramData%\Kaspersky Lab|*.dmp*;*.log FileKey2=%ProgramData%\Kaspersky Lab\*\Bases|hdhm_temp_drives_* FileKey3=%ProgramData%\Kaspersky Lab\*\Bases\*|log*;strg*|RECURSE FileKey4=%ProgramData%\Kaspersky Lab\*\Bases\*\Cache|*|RECURSE FileKey5=%ProgramData%\Kaspersky Lab\*\Bases\Cache|*|RECURSE FileKey6=%ProgramData%\Kaspersky Lab\*\Data|*.bak*;*.*-shm;*.*-wal|RECURSE FileKey7=%ProgramData%\Kaspersky Lab\*\Data\KDSCRL|log* FileKey8=%ProgramData%\Kaspersky Lab\*\Data\Updater\Temporary Files|*|RECURSE FileKey9=%ProgramData%\Kaspersky Lab\*\Logs|*|RECURSE FileKey10=%ProgramData%\Kaspersky Lab\*\Report|*|RECURSE FileKey11=%ProgramData%\Kaspersky Lab\*\Temp|*|RECURSE FileKey12=%ProgramData%\Kaspersky Lab\Kaspersky Password Manager*\Logs|* FileKey13=%ProgramData%\Kaspersky Lab\UCPStorage|ucp_agent.bin.bak FileKey14=%ProgramFiles%\Kaspersky Lab\Kaspersky Password Manager*|*.bak* FileKey15=%ProgramFiles%\Kaspersky Lab\NetworkAgent\~dumps|* [Kate's Video Toolkit *] LangSecRef=3023 Detect=HKCU\Software\Web Solution Mart\Kate's Video Toolkit FileKey1=%ProgramData%\Web Solution Mart\*|*.log|RECURSE [Kazaa Lite Resurrection *] LangSecRef=3022 Detect=HKCU\Software\Kazaa\Kazaa Lite Resurrection RegKey1=HKCU\Software\Kazaa\Kazaa Lite Resurrection\Recent File List [KCleaner *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\KCleaner FileKey1=%AppData%\KC Softwares\KCleaner|*.log [KDE *] LangSecRef=3021 Detect=HKCU\Software\KDE.org FileKey1=%UserProfile%\.kde\cache*|*.*|RECURSE [Kerish Doctor *] LangSecRef=3024 Detect=HKLM\Software\Kerish Products\Kerish Doctor FileKey1=%ProgramData%\Kerish Products\Kerish Doctor\Reports|* RegKey1=HKLM\Software\Kerish Products\Kerish Doctor|InstallDate RegKey2=HKLM\Software\Kerish Products\Kerish Doctor|LastScan RegKey3=HKLM\Software\Kerish Products\Kerish Doctor|LastStart RegKey4=HKLM\Software\Kerish Products\Kerish Doctor|LastUpdate RegKey5=HKLM\Software\Kerish Products\Kerish Doctor|LastWeeklyReport RegKey6=HKLM\Software\Kerish Products\Kerish Doctor|ServerDate [Keroon Reset Local Password Pro *] LangSecRef=3024 DetectFile=%ProgramFiles%\Reset Local Password Pro FileKey1=%ProgramFiles%\Reset Local Password Pro|*.log [Keyboard Tracer *] LangSecRef=3024 DetectFile=%ProgramData%\Keyboard Tracer FileKey1=%ProgramData%\Keyboard Tracer|*.log [KeyMapper *] LangSecRef=3024 DetectFile=%LocalAppData%\KeyMapper FileKey1=%LocalAppData%\KeyMapper|*.log [KFK *] LangSecRef=3023 Detect=HKCU\Software\KC Softwares\KFK FileKey1=%AppData%\KC Softwares\KFK|*.log [Killing Floor 2 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\232090 FileKey1=%UserProfile%\Documents\My Games\KillingFloor2\KFGame\Logs|*.*|RECURSE [Kinetic Jump Updater *] LangSecRef=3021 DetectFile=%LocalAppData%\Kjs.AppLife.Update FileKey1=%LocalAppData%\Kjs.AppLife.Update|*.log [Kingo Root *] LangSecRef=3021 DetectFile=%LocalAppData%\Kingosoft\Kingo Root FileKey1=%LocalAppData%\Kingosoft\Kingo Root|*.log FileKey2=%LocalAppData%\Kingosoft\Kingo Root\LastLog|*.* [Kingsoft Office *] LangSecRef=3021 Detect=HKCU\Software\Kingsoft DetectFile=%AppData%\Kingsoft\Office* FileKey1=%AppData%\Kingsoft\*|*.bak FileKey2=%AppData%\Kingsoft\*\backup|*.* FileKey3=%AppData%\Kingsoft\*\update\log|*.log FileKey4=%AppData%\Kingsoft\Office*\log\setup|*.log FileKey5=%AppData%\Kingsoft\Office*\OfficeSpace\log|*.log FileKey6=%LocalAppData%\Kingsoft\*\cache\http*|*.* FileKey7=%LocalAppData%\Kingsoft\WPS Cloud Files\UserData\Default\WebCache\http*|*.* FileKey8=%ProgramFiles%\Kingsoft\Kingsoft Office\*|*.log [Kingston SSD Manager *] LangSecRef=3024 DetectFile=%ProgramFiles%\Kingston_SSD_Manager FileKey1=%ProgramFiles%\Kingston_SSD_Manager|*.log;*log.txt [Kite Plugin *] LangSecRef=3024 DetectFile=%AppData%\Kite FileKey1=%AppData%\Kite\*Cache|*.* [Kleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Skyler Lyon\Kleaner FileKey1=%ProgramFiles%\Skyler Lyon\Kleaner|*.txt [KlokworkTeamConsole *] LangSecRef=3024 DetectFile=%ProgramFiles%\KlokworkTeamConsole FileKey1=%AppData%\com.mcgraphix.KlokworkTeamConsole\local store|debug.txt [KMS Emulator *] LangSecRef=3024 DetectFile1=%ProgramData%\KMSAuto* DetectFile2=%ProgramData%\Online_KMS_Activation DetectFile3=%ProgramFiles%\KMSpico DetectFile4=%WinDir%\AutoKMS FileKey1=%ProgramData%\KMSAuto*\bin|*.log FileKey2=%ProgramData%\Online_KMS_Activation|Logs.txt FileKey3=%ProgramFiles%\KMSpico\Logs|* FileKey4=%WinDir%\AutoKMS|*.log [Kobo Desktop *] LangSecRef=3021 DetectFile=%LocalAppData%\Kobo\Kobo Desktop Edition FileKey1=%LocalAppData%\Kobo\Kobo Desktop Edition\WebCache|*.*|RECURSE [Kodak *] LangSecRef=3021 Detect1=HKCU\Software\Kodak Detect2=HKLM\Software\Eastman Kodak Company\KODAK AiO Home Center Detect3=HKLM\Software\Kodak\Kodak AiO Software DetectFile=%AppData%\Kodak\Share Button App FileKey1=%AppData%\Kodak\Share Button App|*.log FileKey2=%LocalAppData%|LaunchHomeCenter.log FileKey3=%LocalAppData%\Kodak\Diagnostics|UploadLog.xml FileKey4=%LocalAppData%\Kodak\Inkjet Logging|Status Monitor Log.* FileKey5=%ProgramData%\Kodak\Diagnostics|* FileKey6=%ProgramData%\Kodak\Inkjet Logging|*|RECURSE RegKey1=HKCU\Software\Kodak\Imaging\Recent File List [Kodi *] LangSecRef=3023 DetectFile=%AppData%\kodi* FileKey1=%AppData%\kodi*|*.log;*.dmp;*.txt FileKey2=%AppData%\kodi*\Addons\Packages|*.*|RECURSE FileKey3=%AppData%\kodi*\Cache|*.*|RECURSE FileKey4=%AppData%\kodi*\UserData\Cache|*.*|RECURSE FileKey5=%AppData%\kodi*\UserData\Thumbnails|*.*|RECURSE [Koffix Blocker *] LangSecRef=3024 DetectFile=%ProgramFiles%\Koffix Blocker FileKey1=%UserProfile%\Documents\My Koffix Blocker Logs|*.* [Koinonein Bittorrent Client *] LangSecRef=3022 DetectFile=%ProgramFiles%\Koinonein BitTorrent Client FileKey1=%LocalAppData%\Koinonein BitTorrent Client*\Application|log.db [KoolPlaya *] LangSecRef=3023 Detect=HKCU\Software\AKi-Software\Kool-Playa RegKey1=HKCU\Software\AKi-Software\Kool-Playa\VideoHistory RegKey2=HKCU\Software\AKi-Software\Kool-Playa\Videos RegKey3=HKCU\Software\AKi-Software\Kool-PlayaX64\VideoHistory RegKey4=HKCU\Software\AKi-Software\Kool-PlayaX64\Videos [KoPlayer *] LangSecRef=3021 DetectFile=%LocalAppData%\KoPlayerData FileKey1=%LocalAppData%\KoPlayerData|*.log [Krita *] LangSecRef=3023 Detect=HKLM\Software\Krita FileKey1=%LocalAppData%|krita*.log FileKey2=%LocalAppData%\krita\cache|*.*|RECURSE [L0pht AntiSniff *] LangSecRef=3024 Detect=HKCU\Software\L0pht\AntiSniff RegKey1=HKCU\Software\L0pht\AntiSniff\Recent File List [L0phtCrack *] LangSecRef=3024 Detect=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6 DetectFile=%ProgramFiles%\L0phtCrack* FileKey1=%ProgramFiles%\L0phtCrack *|vc*redist*x*.exe RegKey1=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Recent File List RegKey2=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last LC File RegKey3=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last Remote Machine RegKey4=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last SAM File RegKey5=HKCU\Software\L0pht Holdings LLC\L0phtCrack 6\Settings|Last SYSTEM File [Lantern *] LangSecRef=3022 DetectFile=%AppData%\Lantern FileKey1=%AppData%\Lantern|*.old;proxystats.csv FileKey2=%AppData%\Lantern\logs|*.log [Last.FM *] LangSecRef=3023 DetectFile=%LocalAppData%\Last.fm FileKey1=%LocalAppData%\Last.fm|*_recent_tracks.xml [LastPass *] LangSecRef=3024 DetectFile=%UserProfile%\AppData\LocalLow\LastPass FileKey1=%UserProfile%\AppData\LocalLow\LastPass|debug.txt [Launchy *] LangSecRef=3021 DetectFile=%AppData%\Launchy FileKey1=%AppData%\Launchy\*-icon-cache|*.* [Lavender's Botanicals *] Section=Games DetectFile=%AppData%\MysteryStudio\Lavender FileKey1=%AppData%\MysteryStudio\Lavender|*.log [Layers of Fear *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\391720 FileKey1=%AppData%\Aspyr Media\GameGuide\Cache|*.*|RECURSE [LBRY *] LangSecRef=3022 DetectFile=%AppData%\LBRY FileKey1=%AppData%\LBRY|*-journal;*.old;LOG;QuotaManager|RECURSE FileKey2=%AppData%\LBRY\*Cache|*.* [LDPlayer *] LangSecRef=3021 DetectFile=%AppData%\lddownloader FileKey1=%AppData%\lddownloader|*.log FileKey2=%UserProfile%\.Ld2VirtualBox|VBoxSVC.log [Leadtek WinFast *] LangSecRef=3023 Detect=HKCU\Software\Leadtek\Video\WFFM FileKey1=%WinDir%\System32\WinFast\Multimedia\DirectBurn|*.log RegKey1=HKCU\Software\Leadtek\Video\WFFM|Last Name [League of Legends *] Section=Games DetectFile=%LocalAppData%\Riot Games\*League of Legends* FileKey1=%LocalAppData%\Riot Games\*League of Legends*\logs|*.*|RECURSE FileKey2=%SystemDrive%\Riot Games\League of Legends|*.log*;*.tmp;*.pandurl;Localization_Errors.txt;*r3dlog.txt;*netlog.txt|RECURSE FileKey3=%UserProfile%\riotsGamesLogs|*.* [Leapfrog Connect *] LangSecRef=3021 DetectFile=%ProgramFiles%\LeapFrog\LeapFrog Connect FileKey1=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\cookies|* FileKey2=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\data7\*|* FileKey3=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\http*|* FileKey4=%ProgramData%\Leapfrog\LeapFrog Connect\cache\*\prepared|* FileKey5=%ProgramData%\Leapfrog\LeapFrog Connect\DownloadCache|* [LeapFTP *] LangSecRef=3022 DetectFile=%ProgramFiles%\LeapFTP FileKey1=%ProgramFiles%\LeapFTP|stats.dat [Leawo Blu-ray Ripper *] LangSecRef=3023 DetectFile=%AppData%\Leawo\Blu-ray Ripper FileKey1=%AppData%\Leawo\Blu-ray Ripper\Burn|*.log FileKey2=%AppData%\Leawo\Blu-ray Ripper\CrashReport|*.* FileKey3=%AppData%\Leawo\Blu-ray Ripper\Download\WebCache|*.* FileKey4=%AppData%\Leawo\Blu-ray Ripper\Download\WebFiles|WebpageIcons.db FileKey5=%AppData%\Leawo\Blu-ray Ripper\Log|*.* FileKey6=%LocalAppData%\Leawo Blu-ray Ripper\Cache|*.*|RECURSE [Leawo Prof. Media *] LangSecRef=3023 Detect=HKCU\Software\Leawo Software\SoftwarePassport\Leawo Prof. Media FileKey1=%AppData%\Leawo\Prof. Media|*.xml FileKey2=%AppData%\Leawo\Prof. Media\Burn|*.log FileKey3=%AppData%\Leawo\Prof. Media\Burn\MenuTemplate\Cache|*.*|RECURSE FileKey4=%AppData%\Leawo\Prof. Media\CrashReport|*.*|RECURSE FileKey5=%AppData%\Leawo\Prof. Media\Download|*.dat;*.db;*log;*.xml FileKey6=%AppData%\Leawo\Prof. Media\Download\Thumbnails|*.*|RECURSE FileKey7=%AppData%\Leawo\Prof. Media\Download\WebCache|*.*|RECURSE FileKey8=%AppData%\Leawo\Prof. Media\Download\WebFiles|*.*|RECURSE FileKey9=%AppData%\Leawo\Prof. Media\Log|*.*|RECURSE FileKey10=%LocalAppData%\Leawo Prof\cache|*.*|RECURSE [Leawo Video Converter *] LangSecRef=3023 DetectFile=%AppData%\Leawo\Video Converter* FileKey1=%AppData%\Leawo\Video Converter*|*.log FileKey2=%AppData%\Leawo\Video Converter*\CrashReport|*.*|RECURSE FileKey3=%LocalAppData%\Video Converter*\cache|*.*|RECURSE [Legacy Games Launcher *] Section=Games DetectFile=%AppData%\legacy-games-launcher FileKey1=%AppData%\legacy-games-launcher|Cookies*;*state FileKey2=%AppData%\legacy-games-launcher\*cache|*|REMOVESELF FileKey3=%AppData%\legacy-games-launcher\blob_storage|*|REMOVESELF FileKey4=%AppData%\legacy-games-launcher\logs|* [Legends of Amberland *] Section=Games DetectFile=%AppData%\Legends of Amberland FileKey1=%AppData%\Legends of Amberland|logs.txt [LEGO Universe *] Section=Games DetectFile=%LocalAppData%\LEGO Software\LEGO Universe FileKey1=%LocalAppData%\LEGO Software\LEGO Universe\Log Files|*.* [Leica Cyclone *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\Cyclone FileKey1=%UserProfile%\Documents\Cyclone\Log|*.err FileKey2=%UserProfile%\Documents\Cyclone\Temp|*.* [Lenovo SWTOOLS *] LangSecRef=3024 DetectFile=%SystemDrive%\SWTOOLS FileKey1=%SystemDrive%\SWTOOLS|*.*|REMOVESELF [Lenovo System Update *] LangSecRef=3024 DetectFile=%ProgramData%\Lenovo\SystemUpdate FileKey1=%ProgramData%\Lenovo\SystemUpdate\sessionSE\Repository|*|RECURSE FileKey2=%ProgramData%\Lenovo\SystemUpdate\sessionSE\system\SSClientCommon|*.xml [Letasoft Sound Booster *] LangSecRef=3024 DetectFile=%ProgramData%\Letasoft\Sound Booster FileKey1=%ProgramData%\Letasoft\Sound Booster\Logs|* [Leviev Sales Information Portal *] LangSecRef=3021 DetectFile=%ProgramFiles%\Leviev Sales Information Portal FileKey1=%ProgramFiles%\JMS|JMSErrors.txt FileKey2=%ProgramFiles%\Leviev Sales Information Portal|JMSErrors.txt [Lexmark *] LangSecRef=3021 DetectFile=%ProgramData%\gn_logs FileKey1=%ProgramData%\gn_logs\*|* [Lexmark Inkjet *] LangSecRef=3021 Detect=HKLM\Software\LexmarkInkjet FileKey1=%SystemDrive%|lxbt.log FileKey2=%SystemDrive%\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}|*.*|REMOVESELF RegKey1=HKLM\Software\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}\lxbt\Product|CdRoot RegKey2=HKLM\Software\Lexmark\5200 Series|Path [Lexmark Photo Editor *] LangSecRef=3021 Detect=HKCU\Software\LexmarkPhoto\Lexmark Photo Software\pheditor DetectFile=%ProgramFiles%\Lexmark 5200 Series\pheditor.exe RegKey1=HKCU\Software\LexmarkPhoto\Lexmark Photo Software\pheditor\Recent File List [Lexware *] LangSecRef=3021 DetectFile=%LocalAppData%\Lexware FileKey1=%AppData%\Lexware|*.log|RECURSE FileKey2=%CommonProgramFiles%\Lexware|*.log|RECURSE FileKey3=%LocalAppData%\Lexware|*.log*|RECURSE FileKey4=%ProgramData%\Lexware|*.log*|RECURSE FileKey5=%ProgramData%\Lexware\elster\Log|*|REMOVESELF FileKey6=%ProgramData%\Lexware\logs|*|REMOVESELF FileKey7=%ProgramFiles%\Lexware|*.log*|RECURSE FileKey8=%SystemDrive%|LxDasi.Log [LG ODD Auto Firmware Update *] LangSecRef=3024 DetectFile=%ProgramFiles%\ODD Auto Firmware Update FileKey1=%ProgramFiles%\ODD Auto Firmware Update\Log|*.*|RECURSE [LG PC Suite *] LangSecRef=3021 DetectFile=%LocalAppData%\LG Electronics\LG PC Suite FileKey1=%LocalAppData%\LG Electronics\LG PC Suite\Connection|*.log FileKey2=%LocalAppData%\LG Electronics\LG PC Suite\ocbr\bnr_ui_log|*.log FileKey3=%LocalAppData%\LG Electronics\LG PC Suite\Upgrade\UpgradeLog|*.* [LibreCAD *] LangSecRef=3021 Detect=HKCU\Software\LibreCAD RegKey1=HKCU\Software\LibreCAD\/LibreCAD\Paths|Open RegKey2=HKCU\Software\LibreCAD\/LibreCAD\Paths|Save RegKey3=HKCU\Software\LibreCAD\/LibreCAD\RecentFiles RegKey4=HKCU\Software\LibreCAD\LibreCAD\Paths|Open RegKey5=HKCU\Software\LibreCAD\LibreCAD\Paths|Save RegKey6=HKCU\Software\LibreCAD\LibreCAD\RecentFiles [LibreOffice *] LangSecRef=3021 Detect=HKLM\Software\LibreOffice FileKey1=%AppData%\LibreOffice\*\cache|*.log FileKey2=%AppData%\LibreOffice\*\crash|*.* FileKey3=%AppData%\LibreOffice\*\User\backup|*.* FileKey4=%AppData%\LibreOffice\*\User\extensions\shared|log.* FileKey5=%AppData%\LibreOffice\*\User\temp|*.* FileKey6=%AppData%\LibreOffice\*\User\uno_packages\cache|log.* FileKey7=%ProgramFiles%\LibreOffice*\program_old*|*.*|REMOVESELF [LightScribe *] LangSecRef=3023 Detect=HKCU\Software\LightScribe FileKey1=%ProgramData%\LightScribe\log|*.xml [LightShot *] LangSecRef=3022 DetectFile1=%LocalAppData%\Skillbrains\lightshot DetectFile2=%ProgramFiles%\Skillbrains\Updater FileKey1=%LocalAppData%|updater.log FileKey2=%ProgramFiles%\Skillbrains\Updater|*.log [Lightworks *] LangSecRef=3021 Detect=HKLM\Software\Lightworks FileKey1=%Public%\Documents\Lightworks\Logs|*.*|REMOVESELF [Lili: Child of Geos - Complete Edition *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\266490 FileKey1=%UserProfile%\Documents\my games\UnrealEngine3-MazeGame\MazeGame\Logs|*.* [LimePro *] LangSecRef=3022 Detect=HKCU\Software\LimePro RegKey1=HKCU\Software\LimePro|GUI.LastChatRoomBrowse RegKey2=HKCU\Software\LimePro|GUI.LastSearch [LimeWire *] LangSecRef=3022 Detect=HKLM\Software\LimeWire FileKey1=%AppData%\LimeWire|fileurns.cache;createtimes.cache;responses.cache;ttree.cache;gnutella.net FileKey2=%UserProfile%\Incomplete|*.*|RECURSE [LINE Messenger *] LangSecRef=3022 DetectFile=%LocalAppData%\LINE FileKey1=%LocalAppData%\LINE\bin|update_log*.txt FileKey2=%LocalAppData%\LINE\bin\current|*_CrashLog.txt FileKey3=%LocalAppData%\LINE\Cache|*.*|RECURSE FileKey4=%LocalAppData%\LINE\QtWebEngine\Default|Visited Links [LinkAlyzer *] LangSecRef=3024 Detect=HKCU\Software\Sanderson Forensics\LinkAlyzer RegKey1=HKCU\Software\Sanderson Forensics\LinkAlyzer|LastOpenFolder RegKey2=HKCU\Software\Sanderson Forensics\LinkAlyzer|LastSaveFolder [Listary *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1 FileKey1=%AppData%\Listary\CrashRpt|*.*|REMOVESELF FileKey2=%AppData%\Listary\UserData|*.log;DiskSearch.db;History_v2.sqlite FileKey3=%ProgramFiles%\Listary|*.log [Loadout *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\208090 FileKey1=%LocalAppData%\EdgeOfReality\Loudout\CrashReports|*.* [Locate32 *] LangSecRef=3024 Detect=HKCU\Software\Update\Locate32 RegKey1=HKCU\Software\Update\Locate32\Dialogs|Advanced/ContainData RegKey2=HKCU\Software\Update\Locate32\Dialogs|Name/LookIn RegKey3=HKCU\Software\Update\Locate32\Dialogs|Name/Name RegKey4=HKCU\Software\Update\Locate32\Dialogs|Name/Type RegKey5=HKCU\Software\Update\Locate32\Recent Strings [LockHunter *] LangSecRef=3024 Detect=HKCU\Software\LockHunter FileKey1=%AppData%\LockHunter|*.txt;*.log FileKey2=%ProgramData%\LHService|*.txt;*.log [Logitech *] LangSecRef=3024 Detect1=HKCU\Software\Logitech Detect2=HKLM\Software\Logitech FileKey1=%AppData%\Logishrd|*.log|RECURSE FileKey2=%AppData%\Logishrd\sp*_Log|*|REMOVESELF FileKey3=%AppData%\Logishrd\Updater|UpdateList.csv FileKey4=%AppData%\LogiTune|*.log;LOG.old|RECURSE FileKey5=%CommonProgramFiles%\Logishrd|*.log|RECURSE FileKey6=%LocalAppData%\LogiBolt|*|REMOVESELF FileKey7=%LocalAppData%\Logishrd\Vid|*|RECURSE FileKey8=%LocalAppData%\Logitech\Logi Bolt|*|REMOVESELF FileKey9=%ProgramData%\Logishrd|*.log|RECURSE FileKey10=%ProgramData%\Logishrd\LogiBolt|*|REMOVESELF FileKey11=%ProgramData%\Logishrd\unifying|EngineLog.*;*.txt FileKey12=%ProgramData%\Logitech\KHAL\Battery|*.log FileKey13=%ProgramFiles%\Logitech\Desktop Messenger|*.log;*.bak|RECURSE FileKey14=%ProgramFiles%\Logitech\LogiOptions\LogiBolt|*|REMOVESELF FileKey15=%WinDir%\System32|lvcoinst.log [Logitech G HUB *] LangSecRef=3024 Detect=HKCU\SOFTWARE\Logitech\LGHUB FileKey1=%AppData%\LGHUB\*Cache|*|REMOVESELF FileKey2=%AppData%\LGHUB\*Storage|*.old;LOG|RECURSE FileKey3=%AppData%\LGHUB\blob_storage|*|REMOVESELF FileKey4=%AppData%\LGHUB\logs|*.log FileKey5=%AppData%\LGHUB\Network|* FileKey6=%ProgramData%\LGHUB\cache|* [Logitech Harmony *] LangSecRef=3024 Detect=HKCU\Software\JavaSoft\Prefs\Com\Logitech\harmony FileKey1=%UserProfile%\Logitech\browser - logitech\Cache|*.* [LogMeIn Hamachi *] LangSecRef=3022 Detect=HKLM\Software\LogMeIn, Inc. FileKey1=%WinDir%\System32\config\systemprofile\*\*\LogMeIn Hamachi|*.log;*.old;*.bak FileKey2=%WinDir%\SysWOW64\config\systemprofile\*\*\LogMeIn Hamachi|*.log;*.old;*.bak [LoL Replay *] Section=Games Detect=HKCU\Software\LOLReplay FileKey1=%UserProfile%\Documents\LOLReplay|*_log.txt;*.log;*.old|RECURSE [LoL Summonerinfo *] Section=Games DetectFile=%ProgramFiles%\LSI\logs FileKey1=%ProgramFiles%\LSI\logs|*.* [Lost Photos *] LangSecRef=3022 DetectFile=%ProgramFiles%\Lost Photos FileKey1=%LocalAppData%\Lost_Photos\*|ResultSearchFile.info FileKey2=%ProgramFiles%\Lost Photos\Logs|*.* [Lunascape6 *] LangSecRef=3022 Detect=HKLM\Software\Lunascape Corporation FileKey1=%AppData%\lunascape\Lunascape6\ApplicationData|rebar.bmp FileKey2=%AppData%\lunascape\Lunascape6\ApplicationData\icons|*.*|RECURSE FileKey3=%AppData%\lunascape\Lunascape6\ApplicationData\Temp|*.*|RECURSE FileKey4=%ProgramFiles%\Lunascape\Lunascape6\applicationdata|rebar.bmp [Lunascape6 Backups *] LangSecRef=3022 Detect=HKLM\Software\Lunascape Corporation FileKey1=%AppData%\Lunascape\Lunascape6\backup|*.*|RECURSE [Lunascape6 History *] LangSecRef=3022 Detect=HKLM\Software\Lunascape Corporation FileKey1=%AppData%\lunascape\Lunascape6\ApplicationData|history.ld2 FileKey2=%ProgramFiles%\Lunascape\Lunascape6\applicationdata|history.ld2 [Lupinho.Net Hardlink *] LangSecRef=3023 Detect=HKLM\Software\Lupinho.Net FileKey1=%LocalAppData%\Lupinho.Net|*.log|RECURSE [Lynx Web Browser *] LangSecRef=3022 DetectFile=%ProgramFiles%\Lynx - web browser FileKey1=%ProgramFiles%\Lynx - web browser\tmp|*.* [Lyrik *] LangSecRef=3023 Detect=HKLM\Software\Lyrik FileKey1=%LocalAppData%\Lyrik|*.* [Lyx *] LangSecRef=3021 DetectFile=%AppData%\LyX2.0 FileKey1=%AppData%\LyX2.0|*.log|RECURSE FileKey2=%AppData%\LyX2.0\Cache|*.*|RECURSE [Macaw *] LangSecRef=3022 DetectFile=%AppData%\Macaw FileKey1=%AppData%\Macaw\Cef_Data|cookies*.*;data*.;index. FileKey2=%AppData%\Macaw\Cef_Data\GPUCache|*.*|RECURSE FileKey3=%AppData%\Macaw\Cef_Data\Local Storage|*.* [Machete *] LangSecRef=3023 Detect=HKCU\Software\MacheteSoft\Machete DetectFile=%ProgramFiles%\MacheteSoft\Machete FileKey1=%AppData%\Machete|MacheteSettings.xml.bak RegKey1=HKCU\Software\Local AppWizard-Generated Applications\Machete\Recent File List RegKey2=HKCU\Software\MacheteSoft\Machete\Recent File List [Macrium Reflect *] LangSecRef=3024 Detect=HKCU\Software\Macrium\Reflect FileKey1=%ProgramData%\Macrium|*.log|RECURSE FileKey2=%ProgramData%\Macrium\Reflect|*.html;*.tmp;*.vsslog;loaderrors.txt FileKey3=%ProgramData%\Macrium\waik|waiklog.txt FileKey4=%SystemDrive%|Recovery.txt;ref~tmp~.txt;Reflect_Install.log;rescuepe.log [Magic: The Gathering Arena *] Section=Games DetectFile=%ProgramFiles%\MTG Arena FileKey1=%ProgramFiles%\MTG Arena\MTGA_Data\Logs|*.*|RECURSE [Magicka *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\42910 FileKey1=%ProgramFiles%\Steam\steamapps\common\magicka|errorReport*.txt [MagicLine4NX *] LangSecRef=3021 DetectFile=%LocalAppData%\DreamSecurity\MagicLine4NX FileKey1=%LocalAppData%\DreamSecurity\MagicLine4NX\Logs|*.* [MagicTweak Magic Utilities *] LangSecRef=3021 DetectFile=%ProgramFiles%\Mgutil FileKey1=%ProgramFiles%\Mgutil|*_log.txt [MAGIX ACID Pro *] LangSecRef=3023 DetectFile=%ProgramFiles%\Sony\ACID Pro 5.0 FileKey1=%ProgramFiles%\Sony\ACID Pro 5.0|Acid*.log FileKey2=%UserProfile%\Documents\ACID Pro 5.0 projects|*.bak [MAGIX Installation Manager *] LangSecRef=3023 Detect=HKCU\Software\Magix\MAGIX Installation manager FileKey1=%ProgramData%\MAGIX\*|*.log;*.reg FileKey2=%ProgramData%\MAGIX\*\download|*|RECURSE [MAGIX Photostory *] LangSecRef=3023 DetectFile=%AppData%\MAGIX\Photostory* FileKey1=%AppData%\MAGIX\Photostory*\Crash|*.* [MAGIX Vegas Pro *] LangSecRef=3023 Detect1=HKLM\Software\Sony Creative Software\Vegas Detect2=HKLM\Software\Sony Media Software\Vegas FileKey1=%AppData%\Sony|*.log FileKey2=%LocalAppData%\Sony\Vegas Pro\*|*.log [MAGIX Video Easy TERRATEC Edition *] LangSecRef=3023 Detect=HKLM\Software\MAGIX\Video_easy_3_TerraTec FileKey1=%AppData%\MAGIX\Video_easy_TERRATEC_Edition|*.log|RECURSE [MAGIX Video Pro *] LangSecRef=3023 Detect1=HKCU\Software\MAGIX AG\Videodeluxe18_pro Detect2=HKCU\Software\MAGIX AG\Videodeluxe19_pro FileKey1=%AppData%\MAGIX\Video*Pro*|*.log FileKey2=%UserProfile%\Documents\MAGIX\Video*Pro*\AudioTemp|*.*|RECURSE RegKey1=HKCU\Software\MAGIX AG\Videodeluxe19_pro\ExportConfigurator\DialogItems|LastFile RegKey2=HKCU\Software\MAGIX AG\Videodeluxe19_pro\ExportConfigurator\DialogItems|LastPreset [MailWasher Pro *] LangSecRef=3022 DetectFile=%AppData%\Firetrust\MailWasher FileKey1=%AppData%\Firetrust\MailWasher\cache|*|RECURSE ExcludeKey1=FILE|%AppData%\Firetrust\MailWasher\cache\|MWP.db3 ExcludeKey2=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_conv.dat ExcludeKey3=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_exw.dat ExcludeKey4=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_inw.dat ExcludeKey5=FILE|%AppData%\Firetrust\MailWasher\cache\|mwp_pmap.dat [MakeHuman *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\makehuman FileKey1=%UserProfile%\Documents\makehuman\v1|makehuman.log;makehuman-debug.txt;python_err.txt;python_out.txt FileKey2=%UserProfile%\Documents\makehuman\v1\cache|*.mhc [MAL Updater *] LangSecRef=3023 DetectFile=%ProgramFiles%\Mal Updater 2 FileKey1=%AppData%\Mal Updater\*Pics|*.* FileKey2=%AppData%\Mal Updater\SeasonData|*.* FileKey3=%AppData%\Mal Updater\Users|*.log|RECURSE [Malwarebytes *] LangSecRef=3024 Detect1=HKCU\Software\Malwarebytes Detect2=HKLM\Software\Malwarebytes FileKey1=%AppData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|* FileKey2=%LocalAppData%\Crashdumps\Malwarebytes|*|REMOVESELF FileKey3=%LocalAppData%\MBAM*\Cache\qmlcache|* FileKey4=%ProgramData%\Malwarebytes Anti-Exploit|*.log;mbae*.bak FileKey5=%ProgramData%\Malwarebytes\Malwarebytes*Anti-Malware|mbam-setup.exe FileKey6=%ProgramData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|* FileKey7=%ProgramData%\Malwarebytes\MBAMService|*.log;*.bak;*.regtrans-ms;*.TM.blf;*-ntuser.dat;*.LOG*;*-UsrClass.dat FileKey8=%ProgramData%\Malwarebytes\MBAMService\config|*.bak FileKey9=%ProgramData%\Malwarebytes\MBAMService\logs|* FileKey10=%ProgramData%\Malwarebytes\MBAMService\ScanResults|* FileKey11=%ProgramData%\Malwarebytes\MBAMService\tmp|* FileKey12=%ProgramFiles%\Malwarebytes Anti-Exploit|mbae-uninstall.log;changelog.txt FileKey13=%SystemDrive%\Malwarebytes|*|REMOVESELF FileKey14=%UserProfile%\AppData\LocalLow\IGDump|*|REMOVESELF [ManiacTools mp3Tag Pro *] LangSecRef=3023 Detect=HKCU\Software\ManiacTools\mp3Tag Pro FileKey1=%AppData%\mp3tagpro|Temp.~Txt RegKey1=HKCU\Software\ManiacTools\mp3Tag Pro|fmImageOpen RegKey2=HKCU\Software\ManiacTools\mp3Tag Pro|fmImageSave RegKey3=HKCU\Software\ManiacTools\mp3Tag Pro|fmTextOpen RegKey4=HKCU\Software\ManiacTools\mp3Tag Pro|fmTextSave RegKey5=HKCU\Software\ManiacTools\mp3Tag Pro|StartDir RegKey6=HKCU\Software\ManiacTools\mp3Tag Pro|StartFile [ManiacTools Music Duplicate *] LangSecRef=3023 Detect=HKCU\Software\ManiacTools\MusicDuplicate RegKey1=HKCU\Software\ManiacTools\MusicDuplicate|DateLastLaunch RegKey2=HKCU\Software\ManiacTools\MusicDuplicate|DuplicatesFolders RegKey3=HKCU\Software\ManiacTools\MusicDuplicate|MoveFilesFolder RegKey4=HKCU\Software\ManiacTools\MusicDuplicate|NotDuplicatesFolders RegKey5=HKCU\Software\ManiacTools\MusicDuplicate|SavedFoldersList [ManiaPlanet *] Section=Games DetectFile=%ProgramData%\ManiaPlanet FileKey1=%ProgramData%\ManiaPlanet\Cache|* [ManyCam *] LangSecRef=3023 Detect1=HKCU\Software\ManyCam Detect2=HKLM\Software\ManyCam DetectFile=%LocalAppData%\Visicom Media\ManyCam FileKey1=%AppData%\ManyCam\Logs|*.* FileKey2=%AppData%\ManyCam\Settings\MoviesThumbnails|*.*|RECURSE FileKey3=%LocalAppData%\ManyCam|*.log|RECURSE FileKey4=%LocalAppData%\ManyCam\cache\gallery|*.*|RECURSE FileKey5=%LocalAppData%\Visicom Media\ManyCam\Cache\QtWebEngine\Default\Cache|*.* [Marine Sharpshooter 3 *] Section=Games DetectFile=%ProgramFiles%\Groove Games\Marine Sharpshooter 3 FileKey1=%ProgramFiles%\Groove Games\Marine Sharpshooter 3|*.*dmp|RECURSE [Mass Downloader *] LangSecRef=3022 DetectFile=%ProgramFiles%\Mass Downloader FileKey1=%ProgramFiles%\Mass Downloader|*.bak;massdown.dat;history.dat|RECURSE FileKey2=%ProgramFiles%\Mass Downloader\Index|*.*|RECURSE [Mass Effect *] Section=Games DetectFile=%UserProfile%\Documents\Bioware\Mass Effect* FileKey1=%UserProfile%\Documents\BioWare\Mass Effect*\BIOGame\Logs|* FileKey2=%UserProfile%\Documents\BioWare\Mass Effect*\Logs|* [MassTube *] LangSecRef=3024 DetectFile1=%AppData%\MassTube DetectFile2=%LocalAppData%\MassTube DetectFile3=%ProgramFiles%\MassTube DetectFile4=%SystemDrive%\Programs\MassTube FileKey1=%AppData%\MassTube|Historial.dat FileKey2=%AppData%\MassTube\Miniaturas|*.jpg FileKey3=%LocalAppData%\MassTube|Historial.dat FileKey4=%LocalAppData%\MassTube\Miniaturas|*.jpg FileKey5=%ProgramFiles%\MassTube|Historial.dat FileKey6=%ProgramFiles%\MassTube\Miniaturas|*.jpg FileKey7=%SystemDrive%\Programs\MassTube|Historial.dat FileKey8=%SystemDrive%\Programs\MassTube\Miniaturas|*.jpg [Master PDF Editor *] LangSecRef=3021 Detect=HKCU\Software\Code Industry\Master PDF Editor 5 RegKey1=HKCU\Software\Code Industry\Master PDF Editor 5|ImportFilePath RegKey2=HKCU\Software\Code Industry\Master PDF Editor 5|openFilePath RegKey3=HKCU\Software\Code Industry\Master PDF Editor 5|saveFilePath RegKey4=HKCU\Software\Code Industry\Master PDF Editor 5|str_destination_save_as RegKey5=HKCU\Software\Code Industry\Master PDF Editor 5\pinned_files_history RegKey6=HKCU\Software\Code Industry\Master PDF Editor 5\resent_files_history [MATLAB *] LangSecRef=3021 DetectFile=%ProgramFiles%\MATLAB\R20* FileKey1=%AppData%\MathWorks\MATLAB\R20*|*.prev;cwdhistory.m;History.xml;matlab.prf;MATLABDesktop.xml FileKey2=%AppData%\MathWorks\MATLAB\R20*\HtmlPanel\cache|*.*|RECURSE FileKey3=%ProgramFiles%\MATLAB\R20*\polyspace\examples\cxx\*|*.log|RECURSE FileKey4=%ProgramFiles%\MATLAB\R20*\sys\jxbrowser-chromium\win32\chromium|*.log FileKey5=%ProgramFiles%\MATLAB\R20*\sys\tex\latex\base|*.log FileKey6=%ProgramFiles%\MATLAB\R20*\sys\tomcat\temp|*.tmp FileKey7=%ProgramFiles%\MATLAB\R20*\toolbox\rtw\rtwdemos\tlctutorial\tlcdebug\solutions|*.log [Mavis Beacon *] LangSecRef=3021 DetectFile=%AppData%\Broderbund\Mavis FileKey1=%AppData%\Broderbund\Mavis|logfile.* [Max Recorder *] LangSecRef=3023 Detect=HKLM\Software\MaxRecorder FileKey1=%LocalAppData%\MaxRecorder|*.tmp|RECURSE [Maxprog iCash *] LangSecRef=3021 Detect=HKCR\iCash FileKey1=%ProgramFiles%\iCash\vlogs|*.*|REMOVESELF FileKey2=%UserProfile%\Documents\Maxprog\iCash\Database Logs|*.*|REMOVESELF FileKey3=%UserProfile%\Documents\Maxprog\iCash\Error Logs|*.*|REMOVESELF FileKey4=%UserProfile%\Documents\Maxprog\iCash\XML Dumps|*.*|REMOVESELF [MAXQDA Reader *] LangSecRef=3021 DetectFile=%ProgramFiles%\MAXQDA*_Reader FileKey1=%AppData%\MAXQDA* Reader|*Log_*.html FileKey2=%LocalAppData%\MAXQDA*_Reader\cache\QtWebEngine\Default\Cache|*.* FileKey3=%LocalAppData%\MAXQDA*_Reader\QtWebEngine\Default\GPUCache|*.* FileKey4=%ProgramFiles%\MAXQDA*_Reader|debug.log FileKey5=%UserProfile%\Documents\MAXQDA*\_MAXQDA_System|MAXQDA*_Support.zip [Maxthon 5 Backups *] LangSecRef=3022 Detect=HKCU\Software\Maxthon5 FileKey1=%AppData%\Maxthon5\Users\*\Backups|*.*|RECURSE [Maxthon 5 Cookies *] LangSecRef=3022 Detect=HKCU\Software\Maxthon5 FileKey1=%AppData%\Maxthon5\Users\*|Cookies*;QuotaManager FileKey2=%AppData%\Maxthon5\Users\*\IndexedDB\http*_*.indexeddb.*|*.*|REMOVESELF FileKey3=%AppData%\Maxthon5\Users\*\Local Storage|*.*|RECURSE [Maxthon 5 Internet Cache *] LangSecRef=3022 Detect=HKCU\Software\Maxthon5 FileKey1=%AppData%\Maxthon5\Users\*|*-journal;*.tmp|RECURSE FileKey2=%AppData%\Maxthon5\Users\*\File System|*.*|REMOVESELF FileKey3=%AppData%\Maxthon5\Users\*\GPUCache|*.* FileKey4=%AppData%\Maxthon5\Users\*\Service Worker|*.*|REMOVESELF [Maxthon 5 Internet History *] LangSecRef=3022 Detect=HKCU\Software\Maxthon5 FileKey1=%AppData%\Maxthon5\Public\JumpList|*.* FileKey2=%AppData%\Maxthon5\Users\*\History|*.* [Maxthon 5 Saved Form Information and Passwords *] LangSecRef=3022 Detect=HKCU\Software\Maxthon5 FileKey1=%AppData%\Maxthon5\Users\*|Web Data [McAfee *] LangSecRef=3024 DetectFile=%ProgramData%\McAfee FileKey1=%ProgramData%\McAfee\AMCore\datreputation\Logs|*|RECURSE FileKey2=%ProgramData%\McAfee\Common Framework\AgentEvents|* FileKey3=%ProgramData%\McAfee\CSP\ETW|*.bak FileKey4=%ProgramData%\McAfee\Jcm|*.tmp FileKey5=%ProgramData%\McAfee\MCLOGS|*.bak;*.log|RECURSE FileKey6=%ProgramData%\McAfee\MHN|*.bak FileKey7=%ProgramData%\McAfee\modulecoreservice.exe|*.txt FileKey8=%ProgramData%\McAfee\MPF|*.tmp FileKey9=%ProgramData%\McAfee\MPF\data|*|RECURSE FileKey10=%ProgramData%\McAfee\MSC\Cache|McSubDB.Bak FileKey11=%ProgramData%\McAfee\MSC\Logs|*.log FileKey12=%ProgramData%\McAfee\SiteAdvisor|*.txt;*.log;*.tmp|RECURSE FileKey13=%ProgramData%\McAfee\Uninstall.exe|log.txt FileKey14=%ProgramData%\McAfee\Update|*|RECURSE FileKey15=%ProgramData%\McAfee\VirusScan\Data|*.log;*.old FileKey16=%ProgramData%\McAfee\VirusScan\Logs|*|RECURSE FileKey17=%ProgramData%\Network Associates\Common Framework\AgentEvents|* [McAfee Real Protect *] LangSecRef=3024 DetectFile=%ProgramFiles%\McAfee\Real Protect FileKey1=%ProgramFiles%\McAfee\Real Protect|*.log [McAfee Safe Connect *] LangSecRef=3024 DetectFile=%AppData%\McAfee Safe Connect FileKey1=%AppData%\McAfee Safe Connect|*.log [McPixel *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\220860 FileKey1=%ProgramFiles%\Steam\Steamapps\common\mcpixel|log.txt [Media Center 18 *] LangSecRef=3023 Detect=HKCU\Software\J. River\Media Center 18 FileKey1=%AppData%\J River\Media Center 18\Library|field (filename).jmd;field (name).jmd FileKey2=%UserProfile%\Documents\J River\Media Center 18\Library|*.*|RECURSE [Media Jukebox *] LangSecRef=3023 Detect=HKCU\Software\J. River\Music Exchange\1.0\Media Jukebox FileKey1=%ProgramFiles%\J River\Media Jukebox\Data|*.jmd [Media Player Classic *] LangSecRef=3023 Detect1=HKCU\Software\Gabest\Media Player Classic Detect2=HKCU\Software\MPC-BE Detect3=HKCU\Software\MPC-HC\MPC-HC FileKey1=%AppData%\Media Player Classic|*.dmp FileKey2=%AppData%\MPC-*|*.dmp RegKey1=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 0 RegKey2=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 1 RegKey3=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 2 RegKey4=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 3 RegKey5=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 4 RegKey6=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 5 RegKey7=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 6 RegKey8=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 7 RegKey9=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 8 RegKey10=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 9 RegKey11=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 10 RegKey12=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 11 RegKey13=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 12 RegKey14=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 13 RegKey15=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 14 RegKey16=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 15 RegKey17=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 16 RegKey18=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 17 RegKey19=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 18 RegKey20=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 19 RegKey21=HKCU\Software\Gabest\Media Player Classic\Settings|DVD Position 20 RegKey22=HKCU\Software\MPC-BE\RecentFiles RegKey23=HKCU\Software\MPC-BE\Settings|DVDPath RegKey24=HKCU\Software\MPC-BE\Settings|LastOpenDir RegKey25=HKCU\Software\MPC-BE\Settings|LastOpenFilterDir RegKey26=HKCU\Software\MPC-BE\Settings|LastSavedPlaylistDir RegKey27=HKCU\Software\MPC-BE\Settings|SnapShotPath RegKey28=HKCU\Software\MPC-HC\MPC-HC\Settings|SnapshotPath [Mediachance UtraSnap Pro *] LangSecRef=3023 Detect=HKCU\Software\Mediachance\UtraSnapPRO RegKey1=HKCU\Software\Mediachance\UtraSnapPRO\Disk|Filename RegKey2=HKCU\Software\Mediachance\UtraSnapPRO\Recent File List [MEGAsync *] LangSecRef=3022 DetectFile=%LocalAppData%\Mega Limited\MEGAsync FileKey1=%LocalAppData%\Mega Limited\MEGAsync|*.bak FileKey2=%LocalAppData%\Mega Limited\MEGAsync\crashDumps|* FileKey3=%LocalAppData%\Mega Limited\MEGAsync\logs|* [Melbits World *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Melbot Studios\Melbits World FileKey1=%UserProfile%\AppData\LocalLow\Melbot Studios\Melbits World|*log [Melodics *] LangSecRef=3023 DetectFile=%LocalAppData%\Melodics\Melodics FileKey1=%LocalAppData%\Melodics\Melodics\Cache\qmlcache|*.* FileKey2=%LocalAppData%\Melodics\Melodics\Crashes|*.*|RECURSE FileKey3=%LocalAppData%\Melodics\Melodics\Logs|*.* FileKey4=%LocalAppData%\Melodics\Melodics\NetworkCache|*.*|RECURSE [Meltytech Shotcut *] LangSecRef=3023 DetectFile=%LocalAppData%\Meltytech\Shotcut FileKey1=%LocalAppData%\Meltytech\Shotcut|*-log.txt [Memeo *] LangSecRef=3024 DetectFile=%AppData%\Memeo FileKey1=%AppData%\Memeo\AutoBackup\Logs|*.* FileKey2=%AppData%\Memeo\Memeo Send\Logs|*.* [MemoMaster 5 *] LangSecRef=3021 Detect=HKCU\Software\JBSoftware\MemoMaster5 RegKey1=HKCU\Software\JBSoftware\MemoMaster5|FileMRU1 RegKey2=HKCU\Software\JBSoftware\MemoMaster5|FileMRU2 RegKey3=HKCU\Software\JBSoftware\MemoMaster5|FileMRU3 RegKey4=HKCU\Software\JBSoftware\MemoMaster5|FileMRU4 RegKey5=HKCU\Software\JBSoftware\MemoMaster5|FileMRU5 RegKey6=HKCU\Software\JBSoftware\MemoMaster5|FileMRU6 RegKey7=HKCU\Software\JBSoftware\MemoMaster5|FileMRU7 RegKey8=HKCU\Software\JBSoftware\MemoMaster5|FileMRU8 RegKey9=HKCU\Software\JBSoftware\MemoMaster5|FileMRU9 RegKey10=HKCU\Software\JBSoftware\MemoMaster5|FileMRU10 RegKey11=HKCU\Software\JBSoftware\MemoMaster5|FileMRU11 RegKey12=HKCU\Software\JBSoftware\MemoMaster5|FileMRU12 RegKey13=HKCU\Software\JBSoftware\MemoMaster5|FileMRU13 RegKey14=HKCU\Software\JBSoftware\MemoMaster5|FileMRU14 RegKey15=HKCU\Software\JBSoftware\MemoMaster5|FileMRU15 [MemoQ *] LangSecRef=3022 DetectFile=%AppData%\MemoQ FileKey1=%AppData%\MemoQ\Log|*.log FileKey2=%ProgramData%\MemoQ Server\Log|*.log [MEmu Android Emulator *] LangSecRef=3021 DetectFile=%LocalAppData%\Microvirt\MEmu FileKey1=%LocalAppData%\Microvirt\dump|*.* FileKey2=%LocalAppData%\Microvirt\MEmu|*.log FileKey3=%LocalAppData%\Microvirt\Setup|*.log [Men of War *] Section=Games DetectFile1=%UserProfile%\Documents\My Games\Men of War* DetectFile2=%UserProfile%\Documents\My Games\mow * FileKey1=%UserProfile%\Documents\My Games\men of war*\log|*.* FileKey2=%UserProfile%\Documents\My Games\men of war*\shader_cache|*.*|RECURSE FileKey3=%UserProfile%\Documents\My Games\mow *\log|*.* FileKey4=%UserProfile%\Documents\My Games\mow *\shader_cache|*.*|RECURSE [Mention *] LangSecRef=3022 Detect=HKCU\Software\Mention FileKey1=%LocalAppData%\Mention\Mention|WebpageIcons.db;cookies FileKey2=%LocalAppData%\Mention\Mention\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Mention\Mention\LocalStorage|*.*|RECURSE [Messenger for Desktop *] LangSecRef=3022 DetectFile=%LocalAppData%\Programs\messengerfordesktop FileKey1=%LocalAppData%\messengerfordesktop-updater|*.*|RECURSE [Metadata Analyzer *] LangSecRef=3024 Detect=HKCU\Software\Smart PC Solutions\Metadata Analyzer RegKey1=HKCU\Software\Smart PC Solutions\Metadata Analyzer|LastFile RegKey2=HKCU\Software\Smart PC Solutions\Metadata Analyzer|LastFolder [Metamorphose *] LangSecRef=3024 DetectFile=%ProgramFiles%\metamorphose FileKey1=%AppData%\.metamorphose\undo|*.* [Metapad *] LangSecRef=3021 Detect=HKCU\Software\metapad RegKey1=HKCU\Software\metapad|mru_1 RegKey2=HKCU\Software\metapad|mru_2 RegKey3=HKCU\Software\metapad|mru_3 RegKey4=HKCU\Software\metapad|mru_4 RegKey5=HKCU\Software\metapad|mru_5 RegKey6=HKCU\Software\metapad|mru_6 RegKey7=HKCU\Software\metapad|mru_7 RegKey8=HKCU\Software\metapad|mru_8 RegKey9=HKCU\Software\metapad|mru_9 RegKey10=HKCU\Software\metapad|mru_10 RegKey11=HKCU\Software\metapad|szLastDirectory [MetaTrader *] LangSecRef=3021 DetectFile=%ProgramFiles%\MetaTrader* FileKey1=%ProgramFiles%\MetaTrader*\experts|*.log|RECURSE FileKey2=%ProgramFiles%\MetaTrader*\Logs|*.* [MetaX *] LangSecRef=3024 Detect=HKCU\Software\No Bull Software\MetaX FileKey1=%UserProfile%\Documents\MetaX|*.log RegKey1=HKCU\Software\No Bull Software\MetaX\Preferences|lastDir [Metin2 *] Section=Games DetectFile=%ProgramFiles%\Metin2 FileKey1=%ProgramFiles%\Metin2|*.log FileKey2=%ProgramFiles%\Metin2\hshield|*.log FileKey3=%ProgramFiles%\Metin2\hshield\Update|*.log FileKey4=%ProgramFiles%\Metin2\temp|*.log [Microangelo *] LangSecRef=3021 Detect1=HKCU\Software\Eclipsit\Microangelo\Toolset 6 Detect2=HKCU\Software\Impact\Microangelo RegKey1=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Animator\MRU List RegKey2=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Librarian\MRU List RegKey3=HKCU\Software\Eclipsit\Microangelo\Toolset 6\Studio\MRU List RegKey4=HKCU\Software\Impact\Microangelo\Animator\MRU List RegKey5=HKCU\Software\Impact\Microangelo\Librarian\MRU List RegKey6=HKCU\Software\Impact\Microangelo\Studio\MRU List [Micron Storage Executive *] LangSecRef=3024 Detect=HKLM\Software\Micron\StorageExecutive FileKey1=%ProgramFiles%\Micron Technology\Micron Storage Executive\logs|*.txt [Microsoft 3D Builder *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.3DBuilder_* FileKey1=%LocalAppData%\Packages\Microsoft.3DBuilder_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.3DBuilder_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.3DBuilder_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.3DBuilder_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.3DBuilder_*\TempState|*|RECURSE [Microsoft 3D Viewer *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_* FileKey1=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed [Microsoft App-V *] LangSecRef=3022 DetectFile=%AppData%\SoftGrid Client FileKey1=%AppData%\SoftGrid Client|*.tmp|RECURSE FileKey2=%AppData%\SoftGrid Client\Icon Cache|* FileKey3=%LocalAppData%\SoftGrid Client|*.tmp|RECURSE FileKey4=%ProgramData%\Microsoft\Application Virtualization Client\SoftGrid Client|*.tmp|RECURSE [Microsoft Backup *] LangSecRef=3025 DetectFile=%WinDir%\System32\ntbackup.exe FileKey1=%LocalAppData%\Microsoft\Windows NT\NTBackup\Data|*.log [Microsoft Deployment Toolkit *] LangSecRef=3024 DetectFile=%ProgramFiles%\Microsoft Deployment Toolkit FileKey1=%ProgramFiles%\Microsoft Deployment Toolkit\Downloads|*.*|RECURSE [Microsoft Diagnostics and Recovery Toolkit *] LangSecRef=3025 Detect=HKCU\Software\MSDART RegKey1=HKCU\Software\MSDART\Explorer\Recent File List [Microsoft DirectX *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%\D3DSCache|*|REMOVESELF FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\D3DSCache|*|RECURSE RegKey1=HKCU\Software\Microsoft\Direct3D\MostRecentApplication RegKey2=HKCU\SOFTWARE\Microsoft\DirectInput\MostRecentApplication RegKey3=HKCU\Software\Microsoft\MPEG2Demultiplexer|WriteCaptureDir RegKey4=HKCU\Software\Microsoft\MPEG2Demultiplexer|WriteCapturePath RegKey5=HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache RegKey6=HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache64 RegKey7=HKLM\Software\Microsoft\Direct3D\MostRecentApplication RegKey8=HKLM\Software\Microsoft\DirectDraw\MostRecentApplication RegKey9=HKLM\Software\Wow6432Node\Microsoft\Direct3D\MostRecentApplication RegKey10=HKLM\Software\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication [Microsoft Expression Encoder *] LangSecRef=3023 DetectFile=%UserProfile%\Documents\Expression\Expression Encoder FileKey1=%UserProfile%\Documents\Expression\Expression Encoder\Logs|*.* [Microsoft Expression Web *] LangSecRef=3024 Detect=HKCU\Software\Microsoft\Expression\Web Designer RegKey1=HKCU\Software\Microsoft\Expression\Web Designer\FindMRU [Microsoft File Transfer Manager *] LangSecRef=3025 DetectFile=%AppData%\Microsoft\File Transfer Manager FileKey1=%AppData%\Microsoft\File Transfer Manager|*.bak;ftm_History.xml [Microsoft Flight Simulator X *] Section=Games Detect=HKLM\Software\Microsoft\Microsoft Games\Flight Simulator\10.0 FileKey1=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL FileKey2=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\|kiosk.rtf ExcludeKey2=PATH|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\|readme.* [Microsoft Garage Mouse Without Borders *] LangSecRef=3024 DetectFile=%ProgramFiles%\Microsoft Garage\Mouse without Borders FileKey1=%ProgramFiles%\Microsoft Garage\Mouse without Borders|*.log [Microsoft HTML Help *] LangSecRef=3025 Detect1=HKCU\Software\Microsoft\HTML Help Workshop Detect2=HKCU\Software\Microsoft\Microsoft Help Workshop Detect3=HKLM\Software\Microsoft\HTMLHelp FileKey1=%AppData%\Microsoft\HTML Help|hh.dat;hhcolreg.dat;*.chw FileKey2=%ProgramData%\Microsoft\HTML Help|hh.dat;hhcolreg.dat FileKey3=%SystemDrive%\Documents and Settings\LocalService\Application Data\Microsoft\HTML Help|hh.dat FileKey4=%WinDir%\Application Data\Microsoft\HTML Help|hh.dat FileKey5=%WinDir%\Help|*.cnt;*.chw RegKey1=HKCU\Software\Microsoft\HTML Help Workshop\Compressed HTML RegKey2=HKCU\Software\Microsoft\HTML Help Workshop\Html Titles RegKey3=HKCU\Software\Microsoft\HTML Help Workshop\Project Files RegKey4=HKCU\Software\Microsoft\HTML Help Workshop\Recent File List RegKey5=HKCU\Software\Microsoft\HTML Help Workshop\Settings|LastProject RegKey6=HKCU\Software\Microsoft\Microsoft Help Workshop\Cnt Files RegKey7=HKCU\Software\Microsoft\Microsoft Help Workshop\Forage Files RegKey8=HKCU\Software\Microsoft\Microsoft Help Workshop\Hlp Files RegKey9=HKCU\Software\Microsoft\Microsoft Help Workshop\Hpj Files RegKey10=HKCU\Software\Microsoft\Microsoft Help Workshop\Map Files RegKey11=HKCU\Software\Microsoft\Microsoft Help Workshop\Recent File List RegKey12=HKCU\Software\Microsoft\Microsoft HTML Help Image Editor\Folders RegKey13=HKCU\Software\Microsoft\Microsoft HTML Help Image Editor\Recent File List [Microsoft Management Console *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\MMC FileKey1=%AppData%\Microsoft\MMC|* RegKey1=HKCU\SOFTWARE\Microsoft\Microsoft Management Console\Recent File List [Microsoft Message Analyzer *] LangSecRef=3024 DetectFile=%LocalAppData%\Microsoft\MessageAnalyzer FileKey1=%LocalAppData%\Microsoft\MessageAnalyzer|*.log FileKey2=%UserProfile%\Documents\MessageAnalyzer\Traces|*.*|RECURSE [Microsoft Messaging *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Microsoft.Messaging_* FileKey1=%LocalAppData%\Packages\Microsoft.Messaging_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Messaging_*\LocalCache|*.etl;*.xml FileKey3=%LocalAppData%\Packages\Microsoft.Messaging_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Messaging_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.Messaging_*\TempState|*|RECURSE [Microsoft Mixed Reality Portal *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_* FileKey1=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\TempState|*|RECURSE [Microsoft Mouse and Keyboard Center *] LangSecRef=3021 DetectFile1=%ProgramFiles%\Microsoft Device Center DetectFile2=%ProgramFiles%\Microsoft Mouse and Keyboard Center Warning=This will also delete all app-specific settings. RegKey1=HKCU\Software\Microsoft\IntelliPoint\AppSpecific RegKey2=HKCU\Software\Microsoft\IntelliType Pro\AppSpecific [Microsoft Network Speed Test *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_* FileKey1=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\Settings|*.log* FileKey3=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\TempState|*|RECURSE [Microsoft News *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.BingNews_* FileKey1=%LocalAppData%\Packages\Microsoft.BingNews_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.BingNews_*\LocalState\Cache\Images|* FileKey3=%LocalAppData%\Packages\Microsoft.BingNews_*\LocalState\navigationHistory|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.BingNews_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.BingNews_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe\SearchHistory [Microsoft Office *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\Office DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_* FileKey1=%AppData%\Microsoft\Clip Organizer|mstore*.mgc;Offic*.MGC FileKey2=%AppData%\Microsoft\Document Building Blocks|*|RECURSE FileKey3=%AppData%\Microsoft\Office|*.tmp|RECURSE FileKey4=%AppData%\Microsoft\OIS|Toolbars.dat FileKey5=%AppData%\Microsoft\Templates|*.xlt*;*.pot*;*.dot* FileKey6=%AppData%\Microsoft\UProof|*.bin;*.XML FileKey7=%LocalAppData%\Microsoft Help|* FileKey8=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache FileKey9=%LocalAppData%\Microsoft\Office\*\BackstageInAppNavCache|*|RECURSE FileKey10=%LocalAppData%\Microsoft\Office\DLP\mip\Logs|* FileKey11=%LocalAppData%\Microsoft\Office\OTele|*|RECURSE FileKey12=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache FileKey13=%LocalAppData%\Microsoft\OneNote\*\cache|*|RECURSE FileKey14=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*|RECURSE FileKey15=%LocalAppData%\Microsoft\Visio|thumbs.dat FileKey16=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC|*|RECURSE FileKey17=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalCache|*|RECURSE FileKey18=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\AppData\Local\Office\*\WebServiceCache|*|RECURSE FileKey19=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\Cache|*|RECURSE FileKey20=%LocalAppData%\Packages\oice_*\AC|*|RECURSE FileKey21=%LocalAppData%\TempOffice*|*|REMOVESELF FileKey22=%SystemDrive%|propfix.log FileKey23=%UserProfile%\Documents|~*.ppt*;~*.doc*|RECURSE FileKey24=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*|RECURSE FileKey25=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*|RECURSE RegKey1=HKCU\Software\Microsoft\ClipArt Gallery\2.0\MRUDescription RegKey2=HKCU\Software\Microsoft\Office\11.0\Common\General|SymbolMRU RegKey3=HKCU\Software\Microsoft\Office\11.0\Excel|FontInfoCache RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution RegKey5=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList RegKey6=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList RegKey7=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList RegKey8=HKCU\Software\Microsoft\Office\11.0\Word|FontInfoCache RegKey9=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation RegKey10=HKCU\Software\Microsoft\Office\12.0\Common\OfficeStart\Web\Templates RegKey11=HKCU\Software\Microsoft\Office\12.0\Excel\Recent Templates RegKey12=HKCU\Software\Microsoft\Office\12.0\PowerPoint\Recent Templates RegKey13=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations RegKey14=HKCU\Software\Microsoft\Office\12.0\Word\Recent Templates RegKey15=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation RegKey16=HKCU\Software\Microsoft\Office\14.0\Common\OfficeStart\Web\Templates RegKey17=HKCU\Software\Microsoft\Office\14.0\Common\Open Find\Microsoft Word\Settings\Print to file\File Name MRU RegKey18=HKCU\Software\Microsoft\Office\14.0\Excel\Recent Templates RegKey19=HKCU\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents\TrustRecords RegKey20=HKCU\Software\Microsoft\Office\14.0\PowerPoint\Recent Templates RegKey21=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations RegKey22=HKCU\Software\Microsoft\Office\14.0\Word\Recent Templates RegKey23=HKCU\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents\TrustRecords RegKey24=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation RegKey25=HKCU\Software\Microsoft\Office\15.0\Common\OfficeStart\Web\Templates RegKey26=HKCU\Software\Microsoft\Office\15.0\Excel\Recent Templates RegKey27=HKCU\Software\Microsoft\Office\15.0\PowerPoint\Recent Templates RegKey28=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations RegKey29=HKCU\Software\Microsoft\Office\15.0\Word\Recent Templates RegKey30=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation RegKey31=HKCU\Software\Microsoft\Office\16.0\Common\OfficeStart\Web\Templates RegKey32=HKCU\Software\Microsoft\Office\16.0\Excel\Recent Templates RegKey33=HKCU\Software\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData|BootDiagnosticsLogFile RegKey34=HKCU\Software\Microsoft\Office\16.0\PowerPoint\Recent Templates RegKey35=HKCU\Software\Microsoft\Office\16.0\PowerPoint\RecentAnimationList RegKey36=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations RegKey37=HKCU\Software\Microsoft\Office\16.0\Word\Recent Templates RegKey38=HKCU\Software\Microsoft\Office\Common|FontBmpCache RegKey39=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList RegKey40=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList RegKey41=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList RegKey42=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\Internet Explorer\DOMStore\*\|www.office[1].xml [Microsoft Office Unsaved Files *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\Office FileKey1=%AppData%\Microsoft\Excel|*.*|RECURSE FileKey2=%AppData%\Microsoft\PowerPoint|*.*|RECURSE FileKey3=%AppData%\Microsoft\Word|*.*|RECURSE FileKey4=%LocalAppData%\Microsoft\Office\UnsavedFiles|*.*|RECURSE ExcludeKey1=FILE|%AppData%\Microsoft\Word\|listgal.dat ExcludeKey2=PATH|%AppData%\Microsoft\Excel\XLSTART\|*.* ExcludeKey3=PATH|%AppData%\Microsoft\PowerPoint\|PPT*.pcb ExcludeKey4=PATH|%AppData%\Microsoft\Word\STARTUP\|*.* [Microsoft OneDrive *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\OneDrive DetectFile=%LocalAppData%\Packages\microsoft.microsoftskydrive_* FileKey1=%LocalAppData%\Microsoft\OneDrive\Logs|*|RECURSE FileKey2=%LocalAppData%\Microsoft\OneDrive\Setup\Logs|*|RECURSE FileKey3=%LocalAppData%\Microsoft\Windows\OneDrive\logs|*|RECURSE FileKey4=%LocalAppData%\OneDrive\Cache|*|RECURSE FileKey5=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC|*|RECURSE FileKey6=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\LocalCache|*|RECURSE FileKey7=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\LocalState\Logs|*.log FileKey8=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\Settings|*.log* FileKey9=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\TempState|*|RECURSE FileKey10=%ProgramFiles%\Microsoft OneDrive\Setup\Logs|* FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\Logs|*|RECURSE FileKey12=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\Setup\Logs|*|RECURSE FileKey13=%WinDir%\System32\LogFiles\CloudFiles|*|RECURSE FileKey14=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\Logs|*|RECURSE FileKey15=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\Setup\Logs|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\PersistedPickerData\microsoft.microsoftskydrive_8wekyb3d8bbwe!Microsoft.MicrosoftSkyDrive\DefaultOpenFileMultiple|LastLocation RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\SearchHistory [Microsoft OneNote *] LangSecRef=3021 DetectFile=%LocalAppData%\Packages\Microsoft.Office.OneNote_* FileKey1=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local|msodata*.dat FileKey3=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\office*client.microsoft.com|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\Office\OTele|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\OneNote\16.0|*.onecache FileKey6=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\OneNote\16.0\OneNote*Cache_Files|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.OneNote_8wekyb3d8bbwe\SearchHistory [Microsoft Orca *] LangSecRef=3024 Detect=HKCU\Software\Microsoft\Orca RegKey1=HKCU\Software\Microsoft\Orca\Recent File List [Microsoft Outlook *] LangSecRef=3021 Detect1=HKCU\Software\Microsoft\Office\9.0\Outlook Detect2=HKCU\Software\Microsoft\Office\11.0\Outlook Detect3=HKCU\Software\Microsoft\Office\12.0\Outlook Detect4=HKCU\Software\Microsoft\Office\14.0\Outlook Detect5=HKCU\Software\Microsoft\Office\15.0\Outlook Detect6=HKCU\Software\Microsoft\Office\16.0\Outlook FileKey1=%AppData%\Microsoft\Outlook|Outlook.NK2 FileKey2=%LocalAppData%\Packages\ActiveSync\LocalState\DiagOutputDir|*.* RegKey1=HKCU\Identities\{9745A9A1-95D3-4584-B4E8-C9C2374B3BD3}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List RegKey2=HKCU\Software\Microsoft\Office\9.0\Outlook\Preferences|LocationMRU RegKey3=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|MRU 1 RegKey4=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|MRU 2 RegKey5=HKCU\Software\Microsoft\Office\11.0\Outlook\Office Finder|MRU 3 RegKey6=HKCU\Software\Microsoft\Office\11.0\Outlook\Preferences|LocationMRU RegKey7=HKCU\Software\Microsoft\Office\12.0\Outlook\Office Finder|MRU 1 RegKey8=HKCU\Software\Microsoft\Office\12.0\Outlook\Office Finder|MRU 2 RegKey9=HKCU\Software\Microsoft\Office\12.0\Outlook\Office Finder|MRU 3 RegKey10=HKCU\Software\Microsoft\Office\12.0\Outlook\Preferences|LocationMRU RegKey11=HKCU\Software\Microsoft\Office\13.0\Outlook\Office Finder|MRU 1 RegKey12=HKCU\Software\Microsoft\Office\13.0\Outlook\Office Finder|MRU 2 RegKey13=HKCU\Software\Microsoft\Office\13.0\Outlook\Office Finder|MRU 3 RegKey14=HKCU\Software\Microsoft\Office\14.0\Outlook\Office Finder|MRU 1 RegKey15=HKCU\Software\Microsoft\Office\14.0\Outlook\Office Finder|MRU 2 RegKey16=HKCU\Software\Microsoft\Office\14.0\Outlook\Office Finder|MRU 3 RegKey17=HKCU\Software\Microsoft\Office\14.0\Outlook\Preferences|LocationMRU RegKey18=HKCU\Software\Microsoft\Office\15.0\Outlook\Office Finder|MRU 1 RegKey19=HKCU\Software\Microsoft\Office\15.0\Outlook\Office Finder|MRU 2 RegKey20=HKCU\Software\Microsoft\Office\15.0\Outlook\Office Finder|MRU 3 RegKey21=HKCU\Software\Microsoft\Office\15.0\Outlook\Preferences|LocationMRU RegKey22=HKCU\Software\Microsoft\Office\16.0\Outlook\Office Finder|MRU 1 RegKey23=HKCU\Software\Microsoft\Office\16.0\Outlook\Office Finder|MRU 2 RegKey24=HKCU\Software\Microsoft\Office\16.0\Outlook\Office Finder|MRU 3 RegKey25=HKCU\Software\Microsoft\Office\16.0\Outlook\Preferences|LocationMRU [Microsoft Paint 3D *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.MSPaint_* FileKey1=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.MSPaint_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.MSPaint_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\Microsoft.MSPaint_*\TempState|*|RECURSE [Microsoft People *] LangSecRef=3021 DetectFile=%LocalAppData%\Packages\Microsoft.People* FileKey1=%LocalAppData%\Packages\Microsoft.People*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.People*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.People*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.People*\LocalState\DiagOutputDir|*.etl FileKey5=%LocalAppData%\Packages\Microsoft.People*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.People*\TempState|*|RECURSE [Microsoft Phone Link *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Microsoft.YourPhone_* FileKey1=%LocalAppData%\Packages\Microsoft.YourPhone_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.YourPhone_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.YourPhone_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.YourPhone_*\Settings|*.log*;*.lock FileKey5=%LocalAppData%\Packages\Microsoft.YourPhone_*\SystemAppData\Helium|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.YourPhone_*\TempState|*|RECURSE [Microsoft Picture It! *] LangSecRef=3023 DetectFile=%AppData%\Microsoft\Picture It!* FileKey1=%AppData%\Microsoft\Picture It!*|piorg.db [Microsoft PlayReady *] LangSecRef=3025 DetectFile1=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient* DetectFile2=%ProgramData%\Microsoft\Windows\DRM FileKey1=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient*\LocalState\Cache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient*\LocalState\navigationHistory|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient*\TempState|*|RECURSE FileKey6=%ProgramData%\Microsoft\PlayReady|*.hds FileKey7=%ProgramData%\Microsoft\PlayReady\Cache|* FileKey8=%ProgramData%\Microsoft\Windows\DRM|*.log FileKey9=%ProgramData%\Microsoft\Windows\DRM\Cache|*|RECURSE FileKey10=%ProgramData%\Microsoft\Windows\DRM\PreUpgrade|*.log [Microsoft PowerToys *] LangSecRef=3024 Detect=HKCU\Software\Microsoft\PowerToys FileKey1=%LocalAppData%\Microsoft\PowerToys|*.log;*log*.txt;*-*-*.txt|RECURSE [Microsoft Print 3D *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.Print3D_* FileKey1=%LocalAppData%\Packages\Microsoft.Print3D_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Print3D_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Print3D_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Print3D_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.Print3D_*\TempState|*|RECURSE [Microsoft Project 2010 *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\Office\14.0\MS Project RegKey1=HKCU\Software\Microsoft\Office\14.0\MS Project\Recent File List RegKey2=HKCU\Software\Microsoft\Office\14.0\MS Project\Recent Templates [Microsoft Robocopy GUI *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Microsoft Robocopy GUI FileKey1=%AppData%\Microsoft Robocopy GUI\Logs|*.* FileKey2=%ProgramFiles%\Microsoft\Microsoft Robocopy GUI\Logs|*.* [Microsoft Search Helper Extension *] LangSecRef=3021 DetectFile1=%LocalAppData%\Microsoft\BingBar\Apps\Search_* DetectFile2=%UserProfile%\AppData\LocalLow\Microsoft\Search Enhancement Pack\Search Box Extension FileKey1=%LocalAppData%\Microsoft\BingBar\Apps\Search_*\VersionIndependent|searchhs.dat FileKey2=%LocalAppData%\Microsoft\Search Enhancement Pack\Search Box Extension|history.dat FileKey3=%UserProfile%\AppData\LocalLow\Microsoft\Search Enhancement Pack\Search Box Extension|history.dat FileKey4=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\Search Enhancement Pack\Search Box Extension|history.dat;searchhs.dat FileKey5=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\Search Enhancement Pack\Search Box Extension|history.dat;searchhs.dat [Microsoft Small Basic *] LangSecRef=3021 DetectFile=%LocalAppData%\SmallBasic\SB.exe.settings.catalog FileKey1=%LocalAppData%\SmallBasic|* [Microsoft Solitaire Collection *] Section=Games DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_* FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\Settings|*.log* FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftSolitaireCollection_*\TempState|*|RECURSE [Microsoft SQL Server *] LangSecRef=3021 Detect1=HKCU\Software\Microsoft\Microsoft SQL Server Detect2=HKLM\Software\Microsoft\Microsoft SQL Server FileKey1=%ProgramFiles%\Microsoft SQL Server\*\*\Log|*|RECURSE RegKey1=HKCU\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\FileMRUList RegKey2=HKCU\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\ProjectMRUList RegKey3=HKCU\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\FileMRUList RegKey4=HKCU\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\ProjectMRUList RegKey5=HKCU\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\FileMRUList RegKey6=HKCU\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\ProjectMRUList RegKey7=HKCU\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\FileMRUList RegKey8=HKCU\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\ProjectMRUList RegKey9=HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\FileMRUList RegKey10=HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Shell\ProjectMRUList RegKey11=HKLM\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\FileMRUList RegKey12=HKLM\Software\Microsoft\Microsoft SQL Server\90\Tools\Shell\ProjectMRUList RegKey13=HKLM\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\FileMRUList RegKey14=HKLM\Software\Microsoft\Microsoft SQL Server\100\Tools\Shell\ProjectMRUList RegKey15=HKLM\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\FileMRUList RegKey16=HKLM\Software\Microsoft\Microsoft SQL Server\110\Tools\Shell\ProjectMRUList [Microsoft Standalone System Sweeper Tool *] LangSecRef=3024 Detect=HKCU\Software\Microsoft\Microsoft Standalone System Sweeper Tool FileKey1=%ProgramData%\Microsoft\Microsoft Standalone System Sweeper Tool\Support|*.log [Microsoft Sticky Notes *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_* FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\LocalState|log*.txt|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftStickyNotes_*\TempState|*|RECURSE [Microsoft Store *] LangSecRef=3025 DetectFile1=%LocalAppData%\Packages\Microsoft.WindowsStore_* DetectFile2=%LocalAppData%\Packages\winstore_* FileKey1=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.StorePurchaseApp_*\TempState|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.WindowsStore_*\LocalCache|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.WindowsStore_*\LocalState\Cache|*|RECURSE FileKey9=%LocalAppData%\Packages\winstore_*\AC|*|RECURSE FileKey10=%LocalAppData%\Packages\winstore_*\LocalCache|*|RECURSE FileKey11=%LocalAppData%\Packages\winstore_*\LocalState\Cache|*|RECURSE FileKey12=%LocalAppData%\Packages\winstore_*\LocalState\LiveTile|*|RECURSE FileKey13=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\InstallService|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PolicyCache RegKey2=HKLM\Software\Microsoft\Windows\CurrentVersion\InstallService\State\CategoryCache [Microsoft Support and Recovery Assistant *] LangSecRef=3024 DetectFile=%LocalAppData%\SaRALogs FileKey1=%LocalAppData%\SaRALogs|*.*|RECURSE FileKey2=%LocalAppData%\SaraResults|SaraResult_*.xml [Microsoft Sway *] LangSecRef=3021 DetectFile=%LocalAppData%\Packages\Microsoft.Office.Sway_* FileKey1=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Office.Sway_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Office.Sway_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Office.Sway_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.Office.Sway_*\TempState|*|RECURSE [Microsoft Teams *] LangSecRef=3021 DetectFile1=%LocalAppData%\Microsoft\Teams DetectFile2=%LocalAppData%\Packages\MicrosoftTeams_* FileKey1=%AppData%\Microsoft Teams\Logs|* FileKey2=%AppData%\Microsoft\Teams|*.log;*logs*.txt;watchdog.txt;watchdog_*.json FileKey3=%AppData%\Microsoft\Teams\*Cache|*|RECURSE FileKey4=%AppData%\Microsoft\Teams\*Storage|*.old;LOG|RECURSE FileKey5=%AppData%\Microsoft\Teams\blob_storage|*|RECURSE FileKey6=%AppData%\Microsoft\Teams\databases|*|RECURSE FileKey7=%AppData%\Microsoft\Teams\IndexedDB|*|RECURSE FileKey8=%AppData%\Microsoft\Teams\Local Storage|*|RECURSE FileKey9=%AppData%\Microsoft\Teams\media-stack|*.bak;*.blog;*.etl FileKey10=%AppData%\Microsoft\Teams\Service Worker\*Cache*|*|REMOVESELF FileKey11=%AppData%\Microsoft\Teams\skylib|*.blog;*.data-shm;*.data-wal FileKey12=%AppData%\Microsoft\Teams\tmp|*|RECURSE FileKey13=%LocalAppData%\Microsoft\Teams|*.log FileKey14=%LocalAppData%\Microsoft\Teams*Addin|*-logs.txt FileKey15=%LocalAppData%\Microsoft\Teams\current|*.log FileKey16=%LocalAppData%\Microsoft\Teams\current\resources\tmp|*|REMOVESELF FileKey17=%LocalAppData%\Microsoft\Teams\packaqes\squirreltemp|* FileKey18=%LocalAppData%\Microsoft\Teams\previous|*|REMOVESELF FileKey19=%LocalAppData%\Packages\MicrosoftTeams_*\AC|*|RECURSE FileKey20=%LocalAppData%\Packages\MicrosoftTeams_*\LocalCache|*|RECURSE FileKey21=%LocalAppData%\Packages\MicrosoftTeams_*\Settings|*.log* FileKey22=%LocalAppData%\Packages\MicrosoftTeams_*\TempState|*|RECURSE [Microsoft Tips *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.Getstarted_* FileKey1=%LocalAppData%\Packages\Microsoft.Getstarted_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Getstarted_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Getstarted_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Getstarted_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.Getstarted_*\TempState|*|RECURSE [Microsoft To Do *] LangSecRef=3021 DetectFile=%LocalAppData%\Packages\Microsoft.Todos_* FileKey1=%LocalAppData%\Packages\Microsoft.Todos_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Todos_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Todos_*\Settings|*.log* FileKey4=%LocalAppData%\Packages\Microsoft.Todos_*\TempState|*|RECURSE [Microsoft Ultimate Word Games *] Section=Games DetectFile=%LocalAppData%\Packages\Microsoft.Studios.Wordament_* FileKey1=%LocalAppData%\Packages\Microsoft.Studios.Wordament_*\Settings|*.log* FileKey2=%LocalAppData%\Packages\Microsoft.Studios.Wordament_*\TempState|*.log [Microsoft Visual Studio *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\VisualStudio FileKey1=%AppData%\Visual Studio Setup\*Cache|*.* FileKey2=%LocalAppData%\Microsoft\VisualStudio\*\ComponentModelCache|*.* FileKey3=%LocalAppData%\Microsoft\VisualStudio\*\Extensions|*.cache FileKey4=%LocalAppData%\Microsoft\VisualStudio\*\ImageLibrary|*.cache FileKey5=%LocalAppData%\Microsoft\VisualStudio\*\MEFCacheBackup|*.* FileKey6=%LocalAppData%\Microsoft\VisualStudio\*\Notifications|*.cache FileKey7=%LocalAppData%\Microsoft\VisualStudio\*\ProjectAssemblies|* FileKey8=%LocalAppData%\Microsoft\VisualStudio\*\TextMateCache|* FileKey9=%LocalAppData%\Microsoft\VisualStudio\SettingsLogs|*|RECURSE FileKey10=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache|*.pma|RECURSE FileKey11=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache\*\EBWebView\*cache*|* FileKey12=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache\*\EBWebView\Crashpad\Reports|* FileKey13=%LocalAppData%\Microsoft\VisualStudio\WebView2Cache\*\EBWebView\default\*cache*|* FileKey14=%LocalAppData%\Microsoft\websiteCache|*|RECURSE FileKey15=%LocalAppData%\NuGet\Cache|*|RECURSE FileKey16=%LocalAppData%\NuGet\v3-cache|*|REMOVESELF FileKey17=%LocalAppData%\PerfWatson|* FileKey18=%ProgramFiles%\Microsoft Visual Studio*\*\Logs|*|RECURSE FileKey19=%UserProfile%\.nuget|*|RECURSE RegKey1=HKCU\Software\Microsoft\DevStudio\6.0\Recent File List RegKey2=HKCU\Software\Microsoft\Visual Studio\10.0\FileMRUList RegKey3=HKCU\Software\Microsoft\Visual Studio\10.0\ProjectMRUList RegKey4=HKCU\Software\Microsoft\VisualStudio\8.0\FileMRUList RegKey5=HKCU\Software\Microsoft\VisualStudio\8.0\ProjectMRUList RegKey6=HKCU\Software\Microsoft\VisualStudio\9.0\FileMRUList RegKey7=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 0 RegKey8=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 1 RegKey9=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 2 RegKey10=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 3 RegKey11=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 4 RegKey12=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 5 RegKey13=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 6 RegKey14=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 7 RegKey15=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 8 RegKey16=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 9 RegKey17=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 10 RegKey18=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 11 RegKey19=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 12 RegKey20=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 13 RegKey21=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 14 RegKey22=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 15 RegKey23=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 16 RegKey24=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 17 RegKey25=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 18 RegKey26=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Find 19 RegKey27=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 0 RegKey28=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 1 RegKey29=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 2 RegKey30=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 3 RegKey31=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 4 RegKey32=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 5 RegKey33=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 6 RegKey34=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 7 RegKey35=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 8 RegKey36=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 9 RegKey37=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 10 RegKey38=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 11 RegKey39=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 12 RegKey40=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 13 RegKey41=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 14 RegKey42=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 15 RegKey43=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 16 RegKey44=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 17 RegKey45=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 18 RegKey46=HKCU\Software\Microsoft\VisualStudio\9.0\Find|Replace 19 RegKey47=HKCU\Software\Microsoft\VisualStudio\9.0\LastLoadedSolution RegKey48=HKCU\Software\Microsoft\VisualStudio\9.0\ProjectMRUList RegKey49=HKCU\Software\Microsoft\VisualStudio\10.0\FileMRUList RegKey50=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 0 RegKey51=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 1 RegKey52=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 2 RegKey53=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 3 RegKey54=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 4 RegKey55=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 5 RegKey56=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 6 RegKey57=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 7 RegKey58=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 8 RegKey59=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 9 RegKey60=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 10 RegKey61=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 11 RegKey62=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 12 RegKey63=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 13 RegKey64=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 14 RegKey65=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 15 RegKey66=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 16 RegKey67=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 17 RegKey68=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 18 RegKey69=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Find 19 RegKey70=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 0 RegKey71=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 1 RegKey72=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 2 RegKey73=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 3 RegKey74=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 4 RegKey75=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 5 RegKey76=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 6 RegKey77=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 7 RegKey78=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 8 RegKey79=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 9 RegKey80=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 10 RegKey81=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 11 RegKey82=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 12 RegKey83=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 13 RegKey84=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 14 RegKey85=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 15 RegKey86=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 16 RegKey87=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 17 RegKey88=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 18 RegKey89=HKCU\Software\Microsoft\VisualStudio\10.0\Find|Replace 19 RegKey90=HKCU\Software\Microsoft\VisualStudio\10.0\LastLoadedSolution RegKey91=HKCU\Software\Microsoft\VisualStudio\10.0\ProjectMRUList RegKey92=HKCU\Software\Microsoft\VisualStudio\11.0\FileMRUList RegKey93=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 0 RegKey94=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 1 RegKey95=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 2 RegKey96=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 3 RegKey97=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 4 RegKey98=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 5 RegKey99=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 6 RegKey100=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 7 RegKey101=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 8 RegKey102=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 9 RegKey103=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 10 RegKey104=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 11 RegKey105=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 12 RegKey106=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 13 RegKey107=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 14 RegKey108=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 15 RegKey109=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 16 RegKey110=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 17 RegKey111=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 18 RegKey112=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Find 19 RegKey113=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 0 RegKey114=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 1 RegKey115=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 2 RegKey116=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 3 RegKey117=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 4 RegKey118=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 5 RegKey119=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 6 RegKey120=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 7 RegKey121=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 8 RegKey122=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 9 RegKey123=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 10 RegKey124=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 11 RegKey125=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 12 RegKey126=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 13 RegKey127=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 14 RegKey128=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 15 RegKey129=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 16 RegKey130=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 17 RegKey131=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 18 RegKey132=HKCU\Software\Microsoft\VisualStudio\11.0\Find|Replace 19 RegKey133=HKCU\Software\Microsoft\VisualStudio\11.0\LastLoadedSolution RegKey134=HKCU\Software\Microsoft\VisualStudio\11.0\ProjectMRUList RegKey135=HKCU\Software\Microsoft\VisualStudio\12.0\FileMRUList RegKey136=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find RegKey137=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 0 RegKey138=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 1 RegKey139=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 2 RegKey140=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 3 RegKey141=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 4 RegKey142=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 5 RegKey143=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 6 RegKey144=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 7 RegKey145=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 8 RegKey146=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 9 RegKey147=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 10 RegKey148=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 11 RegKey149=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 12 RegKey150=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 13 RegKey151=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 14 RegKey152=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 15 RegKey153=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 16 RegKey154=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 17 RegKey155=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 18 RegKey156=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Find 19 RegKey157=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace RegKey158=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 0 RegKey159=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 1 RegKey160=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 2 RegKey161=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 3 RegKey162=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 4 RegKey163=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 5 RegKey164=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 6 RegKey165=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 7 RegKey166=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 8 RegKey167=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 9 RegKey168=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 10 RegKey169=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 11 RegKey170=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 12 RegKey171=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 13 RegKey172=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 14 RegKey173=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 15 RegKey174=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 16 RegKey175=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 17 RegKey176=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 18 RegKey177=HKCU\Software\Microsoft\VisualStudio\12.0\Find|Replace 19 RegKey178=HKCU\Software\Microsoft\VisualStudio\12.0\LastLoadedSolution RegKey179=HKCU\Software\Microsoft\VisualStudio\12.0\ProjectMRUList RegKey180=HKCU\Software\Microsoft\VisualStudio\14.0\FileMRUList RegKey181=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace RegKey182=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 0 RegKey183=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 1 RegKey184=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 2 RegKey185=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 3 RegKey186=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 4 RegKey187=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 5 RegKey188=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 6 RegKey189=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 7 RegKey190=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 8 RegKey191=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 9 RegKey192=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 10 RegKey193=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 11 RegKey194=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 12 RegKey195=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 13 RegKey196=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 14 RegKey197=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 15 RegKey198=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 16 RegKey199=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 17 RegKey200=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 18 RegKey201=HKCU\Software\Microsoft\VisualStudio\14.0\Find|Replace 19 RegKey202=HKCU\Software\Microsoft\VisualStudio\14.0\LastLoadedSolution RegKey203=HKCU\Software\Microsoft\VisualStudio\14.0\ProjectMRUList [Microsoft Visual Studio Backups *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\VisualStudio FileKey1=%UserProfile%\Documents\Visual Studio*\Backup Files|*.*|RECURSE [Microsoft Visual Studio Express *] LangSecRef=3021 Detect1=HKCU\Software\Microsoft\VBExpress\10.0 Detect2=HKCU\Software\Microsoft\VCExpress\10.0 Detect3=HKCU\Software\Microsoft\VCSExpress\10.0 RegKey1=HKCU\Software\Microsoft\VBExpress\10.0\FileMRUList RegKey2=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find RegKey3=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 0 RegKey4=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 1 RegKey5=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 2 RegKey6=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 3 RegKey7=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 4 RegKey8=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 5 RegKey9=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 6 RegKey10=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 7 RegKey11=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 8 RegKey12=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 9 RegKey13=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 10 RegKey14=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 11 RegKey15=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 12 RegKey16=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 13 RegKey17=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 14 RegKey18=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 15 RegKey19=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 16 RegKey20=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 17 RegKey21=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 18 RegKey22=HKCU\Software\Microsoft\VBExpress\10.0\Find|Find 19 RegKey23=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace RegKey24=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 0 RegKey25=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 1 RegKey26=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 2 RegKey27=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 3 RegKey28=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 4 RegKey29=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 5 RegKey30=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 6 RegKey31=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 7 RegKey32=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 8 RegKey33=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 9 RegKey34=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 10 RegKey35=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 11 RegKey36=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 12 RegKey37=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 13 RegKey38=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 14 RegKey39=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 15 RegKey40=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 16 RegKey41=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 17 RegKey42=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 18 RegKey43=HKCU\Software\Microsoft\VBExpress\10.0\Find|Replace 19 RegKey44=HKCU\Software\Microsoft\VBExpress\10.0\ProjectMRUList RegKey45=HKCU\Software\Microsoft\VCExpress\10.0\FileMRUList RegKey46=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find RegKey47=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 0 RegKey48=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 1 RegKey49=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 2 RegKey50=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 3 RegKey51=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 4 RegKey52=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 5 RegKey53=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 6 RegKey54=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 7 RegKey55=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 8 RegKey56=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 9 RegKey57=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 10 RegKey58=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 11 RegKey59=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 12 RegKey60=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 13 RegKey61=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 14 RegKey62=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 15 RegKey63=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 16 RegKey64=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 17 RegKey65=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 18 RegKey66=HKCU\Software\Microsoft\VCExpress\10.0\Find|Find 19 RegKey67=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace RegKey68=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 0 RegKey69=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 1 RegKey70=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 2 RegKey71=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 3 RegKey72=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 4 RegKey73=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 5 RegKey74=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 6 RegKey75=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 7 RegKey76=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 8 RegKey77=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 9 RegKey78=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 10 RegKey79=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 11 RegKey80=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 12 RegKey81=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 13 RegKey82=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 14 RegKey83=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 15 RegKey84=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 16 RegKey85=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 17 RegKey86=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 18 RegKey87=HKCU\Software\Microsoft\VCExpress\10.0\Find|Replace 19 RegKey88=HKCU\Software\Microsoft\VCExpress\10.0\ProjectMRUList RegKey89=HKCU\Software\Microsoft\VCSExpress\10.0\FileMRUList RegKey90=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find RegKey91=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 0 RegKey92=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 1 RegKey93=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 2 RegKey94=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 3 RegKey95=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 4 RegKey96=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 5 RegKey97=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 6 RegKey98=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 7 RegKey99=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 8 RegKey100=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 9 RegKey101=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 10 RegKey102=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 11 RegKey103=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 12 RegKey104=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 13 RegKey105=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 14 RegKey106=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 15 RegKey107=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 16 RegKey108=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 17 RegKey109=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 18 RegKey110=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Find 19 RegKey111=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace RegKey112=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 0 RegKey113=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 1 RegKey114=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 2 RegKey115=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 3 RegKey116=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 4 RegKey117=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 5 RegKey118=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 6 RegKey119=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 7 RegKey120=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 8 RegKey121=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 9 RegKey122=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 10 RegKey123=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 11 RegKey124=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 12 RegKey125=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 13 RegKey126=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 14 RegKey127=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 15 RegKey128=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 16 RegKey129=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 17 RegKey130=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 18 RegKey131=HKCU\Software\Microsoft\VCSExpress\10.0\Find|Replace 19 RegKey132=HKCU\Software\Microsoft\VCSExpress\10.0\ProjectMRUList [Microsoft Visual Studio Express Backups *] LangSecRef=3021 DetectFile=%AppData%\Microsoft\VCExpress\10.0 FileKey1=%AppData%\Microsoft\VCExpress\10.0|*.winprf_backup [Microsoft Visual Studio Installation Packages *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\VisualStudio FileKey1=%ProgramData%\Microsoft\VisualStudio\Packages|*|RECURSE ExcludeKey1=PATH|%ProgramData%\Microsoft\VisualStudio\Packages\_Instances\|* [Microsoft VS Code *] LangSecRef=3021 DetectFile=%AppData%\Code FileKey1=%AppData%\Code|cookies* FileKey2=%AppData%\Code\GPUCache|*.* FileKey3=%AppData%\Code\Local Storage|*.* [Microsoft Web Platform Installer *] LangSecRef=3025 DetectFile=%LocalAppData%\Microsoft\Web Platform Installer\logs\webpi FileKey1=%LocalAppData%\Microsoft\Web Platform Installer\logs\webpi|*.txt [Microsoft Whiteboard *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.Whiteboard_* FileKey1=%LocalAppData%\Packages\Microsoft.Whiteboard_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalState\EBWebView|*.pma|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalState\EBWebView\*Cache|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalState\EBWebView\Crashpad\reports|* FileKey6=%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalState\EBWebView\Default\*Cache|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalState\SURFACE*|*|REMOVESELF FileKey8=%LocalAppData%\Packages\Microsoft.Whiteboard_*\Settings|*.log*;*.lock FileKey9=%LocalAppData%\Packages\Microsoft.Whiteboard_*\SystemAppData\Helium|*.log* FileKey10=%LocalAppData%\Packages\Microsoft.Whiteboard_*\TempState|*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Whiteboard_*\LocalCache\|.msalcache.bin3 [Microsoft Works Suite 2006 *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\Works\8.0 RegKey1=HKCU\Software\Microsoft\Works\8.0\Recent File List [Microsoft XML Notepad *] LangSecRef=3024 Detect=HKCU\Software\Microsoft\XML Notepad RegKey1=HKCU\Software\Microsoft\XML Notepad\Recent File List [Microsoft XNA Game Studio *] Section=Games Detect=HKLM\Software\Microsoft\XNA FileKey1=%ProgramFiles%\Microsoft XNA\XNA Game Studio\*\Redist|*.*|REMOVESELF [Microsys Backgammon Classic *] Section=Games DetectFile=%UserProfile%\Documents\Microsys\Backgammon Classic* FileKey1=%UserProfile%\Documents\Microsys\Backgammon Classic*|bc.gam;history.csv;history.txt;last*.gam;users.txt FileKey2=%UserProfile%\Documents\Microsys\Backgammon Classic*\Games|bcp.gam;bcp.txt;last*.gam;last*.txt [Microsys Gammonet *] Section=Games DetectFile=%UserProfile%\Documents\Microsys\Gammonet FileKey1=%UserProfile%\Documents\Microsys\Gammonet|users.csv [Midori *] LangSecRef=3022 Detect=HKLM\Software\Midori FileKey1=%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Midori|*.*|RECURSE FileKey2=%LocalAppData%\Midori|cookies.db;history.*;session.xbel [MiKTeX *] LangSecRef=3021 Detect=HKCU\Software\MiKTeX.org\MiKTeX FileKey1=%LocalAppData%\MiKTeX\*\miktex\log|*.log FileKey2=%ProgramData%\MiKTeX\*\miktex\log|*.log FileKey3=%ProgramFiles%\MiKTeX\miktex\config|*.log [MindGems Audio Dedupe *] LangSecRef=3023 Detect=HKCU\Software\MindGems\Audio Dedupe FileKey1=%LocalAppData%\MindGems\Audio Dedupe|*.dat;*.idx RegKey1=HKCU\Software\MindGems\Audio Dedupe|MRU1 RegKey2=HKCU\Software\MindGems\Audio Dedupe|MRU2 RegKey3=HKCU\Software\MindGems\Audio Dedupe|MRU3 RegKey4=HKCU\Software\MindGems\Audio Dedupe|MRU4 RegKey5=HKCU\Software\MindGems\Audio Dedupe|MRU5 RegKey6=HKCU\Software\MindGems\Audio Dedupe\Settings|ExcludeExt RegKey7=HKCU\Software\MindGems\Audio Dedupe\Settings|ExcludeFileNameWords RegKey8=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeExt RegKey9=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeFileNameWords RegKey10=HKCU\Software\MindGems\Audio Dedupe\Settings|FiltExcludeFolderNameWords RegKey11=HKCU\Software\MindGems\Audio Dedupe\Settings|LastFolder RegKey12=HKCU\Software\MindGems\Audio Dedupe\Settings|MoveToFolder RegKey13=HKCU\Software\MindGems\Audio Dedupe\Settings|QuickCheckExt RegKey14=HKCU\Software\MindGems\Audio Dedupe\Settings|QuickCheckFileNameWords [MindGems Easy Web Gallery Builder *] LangSecRef=3023 Detect=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2 RegKey1=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU1 RegKey2=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU2 RegKey3=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU3 RegKey4=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU4 RegKey5=HKCU\Software\MindGems\Easy Web Gallery Builder\2.2|MRU5 [MindGems Fast Duplicate File Finder *] LangSecRef=3023 Detect=HKCU\Software\MindGems\Fast Duplicate File Finder RegKey1=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU1 RegKey2=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU2 RegKey3=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU3 RegKey4=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU4 RegKey5=HKCU\Software\MindGems\Fast Duplicate File Finder|MRU5 RegKey6=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|ExcludeExt RegKey7=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|ExcludeFileNameWords RegKey8=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeExt RegKey9=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeFileNameWords RegKey10=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|FiltExcludeFolderNameWords RegKey11=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|LastFolder RegKey12=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|MoveToFolder RegKey13=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|QuickCheckExt RegKey14=HKCU\Software\MindGems\Fast Duplicate File Finder\Settings|QuickCheckFileNameWords [MindGems Folder Size *] LangSecRef=3024 DetectFile=%ProgramFiles%\Folder Size FileKey1=%ProgramData%\MindGems\FolderSize|FolderSizeLog.txt [MindGems Visual Similarity Duplicate Image Finder *] LangSecRef=3023 Detect=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder FileKey1=%LocalAppData%\MindGems\VSDIF|*.dat;*.idx RegKey1=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU1 RegKey2=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU2 RegKey3=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU3 RegKey4=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU4 RegKey5=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder|MRU5 RegKey6=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|ExcludeExt RegKey7=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|ExcludeFileNameWords RegKey8=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeExt RegKey9=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeFileNameWords RegKey10=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|FiltExcludeFolderNameWords RegKey11=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|LastFolder RegKey12=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|MoveToFolder RegKey13=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|QuickCheckExt RegKey14=HKCU\Software\MindGems\Visual Similarity Duplicate Image Finder\Settings|QuickCheckFileNameWords [MindManager *] LangSecRef=3021 DetectFile=%LocalAppData%\Mindjet\MindManager FileKey1=%LocalAppData%\Mindjet\MindManager\*\Connect\*Cache|*.*|RECURSE FileKey2=%LocalAppData%\Mindjet\MindManager\*\MindManager Explorer for SharePoint\Logs|*.* FileKey3=%LocalAppData%\Mindjet\MindManager\*\Temp|*.*|RECURSE [Minecraft *] Section=Games DetectFile1=%AppData%\.minecraft DetectFile2=%LocalAppData%\Packages\Microsoft.MinecraftUWP_8wekyb3d8bbwe DetectFile3=%ProgramFiles%\Minecraft DetectFile4=%UserProfile%\Twitch\Minecraft FileKey1=%AppData%\.minecraft|*.log*;*log.txt|RECURSE FileKey2=%AppData%\.minecraft\crash-reports|* FileKey3=%AppData%\.minecraft\debug|* FileKey4=%AppData%\.minecraft\stats|*.old FileKey5=%AppData%\.minecraft\webcache2|visited* FileKey6=%AppData%\.minecraft\webcache2\*cache|*|RECURSE FileKey7=%AppData%\.minecraft\webcache2\*Storage|*.old;LOG|RECURSE FileKey8=%AppData%\.minecraft\webcache2\blob_storage|*|REMOVESELF FileKey9=%LocalAppData%\Packages\Microsoft.MinecraftUWP_*\AC|*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.MinecraftUWP_*\LocalCache|*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.MinecraftUWP_*\LocalState\Cache|*|RECURSE FileKey12=%LocalAppData%\Packages\Microsoft.MinecraftUWP_*\Settings|*.log* FileKey13=%LocalAppData%\Packages\Microsoft.MinecraftUWP_*\TempState|*|RECURSE FileKey14=%ProgramFiles%\Minecraft|*.log FileKey15=%UserProfile%\Twitch\Minecraft\Install|launcher_log.txt FileKey16=%UserProfile%\Twitch\Minecraft\Install\logs|* FileKey17=%UserProfile%\Twitch\Minecraft\Instances\*|*.log FileKey18=%UserProfile%\Twitch\Minecraft\Instances\*\crash-reports|* FileKey19=%UserProfile%\Twitch\Minecraft\Instances\*\logs|* [MiniTool Partition Wizard *] LangSecRef=3024 Detect=HKCU\Software\MiniTool Software Limited\MiniTool Partition Wizard FileKey1=%ProgramFiles%\MiniTool Partition Wizard *|log.txt [MiniTool ShadowMaker *] LangSecRef=3024 DetectFile=%ProgramFiles%\MiniTool ShadowMaker FileKey1=%ProgramFiles%\MiniTool ShadowMaker|*log.txt FileKey2=%ProgramFiles%\MiniTool ShadowMaker\dump|*.dmp FileKey3=%ProgramFiles%\MiniTool ShadowMaker\log|*.* [Miranda IM *] LangSecRef=3022 DetectFile=%ProgramFiles%\Miranda IM FileKey1=%AppData%\Miranda IM\Profiles|*.*|REMOVESELF [Miranda IM Chat Logs *] LangSecRef=3022 DetectFile=%ProgramFiles%\Miranda IM FileKey1=%AppData%\Miranda IM\Profiles\*\Logs\Chat|*.*|REMOVESELF [mIRC Chat Logs *] LangSecRef=3022 Detect=HKCU\Software\mIRC FileKey1=%AppData%\mIRC\Logs|*.* FileKey2=%ProgramFiles%\mIRC\logs|*.* [Mirkes.De Tiny Hexer *] LangSecRef=3021 Detect=HKCU\Software\mirkes.de\Tiny Hexer FileKey1=%AppData%\mirkes.de\Tiny Hexer\*|*.bak [MirrorFolder *] LangSecRef=3024 DetectFile=%ProgramData%\Techsoft\MirrorFolder FileKey1=%ProgramData%\Techsoft\MirrorFolder\Log|* [Mirrors Edge Catalyst Backup *] Section=Games Detect=HKLM\Software\EA Games\1026480 FileKey1=%UserProfile%\Documents\Mirrors Edge Catalyst\settings|PROF_SAVE_backup* [MiTeC DFM Editor *] LangSecRef=3021 Detect=HKCU\Software\MiTeC\DFM Editor RegKey1=HKCU\Software\MiTeC\DFM Editor\5.x\Main\MRUHistory RegKey2=HKCU\Software\MiTeC\DFM Editor\6.x\wnd_dfm_Main\Twnd_dfm_Main.MRUMan [MiTeC HexEditor *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\HexEditor RegKey1=HKCU\Software\MiTeC\HexEditor\4.x\wnd_hex_Main|od_InitialDir RegKey2=HKCU\Software\MiTeC\HexEditor\4.x\wnd_hex_Main|sd_InitialDir [MiTeC Icon Explorer *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\Icon Explorer RegKey1=HKCU\Software\MiTeC\Icon Explorer\4.x\wnd_icoexp_Main|de_Text RegKey2=HKCU\Software\MiTeC\Icon Explorer\4.x\wnd_icoexp_Main|ShellTree_StartInFolder [MiTeC INI Editor *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\INI Editor RegKey1=HKCU\Software\MiTeC\INI Editor\1.0|od_InitialDir [MiTeC SQLite Query *] LangSecRef=3024 DetectFile=%AppData%\MiTeC\SQLite Query FileKey1=%AppData%\MiTeC\SQLite Query|*.*|REMOVESELF [MiTeC Structured Storage Viewer *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\SSViewer RegKey1=HKCU\Software\MiTeC\SSViewer\3.x\MRU RegKey2=HKCU\Software\MiTeC\SSViewer\3.x\wnd_re_Main\MRUHistory RegKey3=HKCU\Software\MiTeC\SSViewer\4.x\MRU [MiTeC Windows Registry Analyzer *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\WRA RegKey1=HKCU\Software\MiTeC\WRA\1.x\Main\MRUHistory [MiTeC Windows Registry File Viewer *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\RFV RegKey1=HKCU\Software\MiTeC\RFV\2.x\Recent Files [MiTeC Windows Registry Recovery *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\WRR RegKey1=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find|eFind_Text RegKey2=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find\eFind_Items RegKey3=HKCU\Software\MiTeC\WRR\1.x\Main\MRUHistory RegKey4=HKCU\Software\MiTeC\WRR\1.x\wnd_wrr_Main\Twnd_wrr_Main.MRUMan RegKey5=HKCU\Software\MiTeC\WRR\3.x\MRU [MiTeC XMLViewer *] LangSecRef=3024 Detect=HKCU\Software\MiTeC\XMLViewer RegKey1=HKCU\Software\MiTeC\XMLViewer\4.x\wnd_xmlv_Main\Twnd_xmlv_Main.MRUManager [Mixed In Key *] LangSecRef=3023 DetectFile=%LocalAppData%\Mixed In Key\Mixed In Key FileKey1=%LocalAppData%\Mixed In Key\Mixed In Key\*|*.log FileKey2=%LocalAppData%\Mixed In Key\Mixed In Key\*\AudioAnalysisCache*|*.* FileKey3=%LocalAppData%\Mixed In Key\Mixed In Key\*\QueryLogs|*.* FileKey4=%LocalAppData%\Mixed In Key\Mixed In Key\*\Temp|*.* FileKey5=%LocalAppData%\Mixed In Key\Mixed In Key\*\Updates|update.exe [MixMeister *] LangSecRef=3023 DetectFile=%ProgramFiles%\MixMeister* FileKey1=%ProgramFiles%\MixMeister*|*.dmp [MixPad Multitrack Mixer *] LangSecRef=3023 DetectFile=%ProgramFiles%\NCH Software\MixPad FileKey1=%ProgramFiles%\NCH Software\MixPad|mixpadsetup_*.exe [Mixxx *] LangSecRef=3023 DetectFile=%LocalAppData%\Mixxx FileKey1=%LocalAppData%\Mixxx|*.log* [MKJogo MKLOL *] Section=Games DetectFile=%ProgramFiles%\MKJogo\MKLOL FileKey1=%ProgramFiles%\MKJogo\MKLOL|*.log [MKS_Vir Skaner Online *] LangSecRef=3024 DetectFile=%ProgramFiles%\SkanerOnline FileKey1=%ProgramFiles%\SkanerOnline\Raporty|*.* FileKey2=%ProgramFiles%\SkanerOnline\tmp|*.* FileKey3=%SystemDrive%|*.cpp.log [MKVToolNix GUI *] LangSecRef=3023 DetectFile=%LocalAppData%\bunkus.org\MKVToolNix-Gui FileKey1=%LocalAppData%\bunkus.org\MKVToolNix-Gui\Cache|*.*|RECURSE [MMOUI Minion *] Section=Games DetectFile=%AppData%\MMOUI\Minion FileKey1=%AppData%\MMOUI\Minion|log.* [Mo-Search *] LangSecRef=3024 Detect=HKCU\Software\Meauxsoft\Mo-Search FileKey1=%LocalAppData%\Meauxsoft\Mo-Search4.0\Logs|*.* RegKey1=HKCU\Software\Meauxsoft\Mo-Search\Mo-Search v4.0.13\Last Position [Mobile Plans *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Microsoft.OneConnect_* FileKey1=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalState\DiagOutputDir|*.txt FileKey5=%LocalAppData%\Packages\Microsoft.OneConnect_*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.OneConnect_*\TempState|*|RECURSE [Mobogenie *] LangSecRef=3021 DetectFile=%LocalAppData%\Mobogenie FileKey1=%LocalAppData%\Mobogenie|*.log FileKey2=%LocalAppData%\Mobogenie\Version\OldVersion\Mobogenie\log|*.log [ModelPort Object Importer for ArchiCAD *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\ModelPort FileKey1=%UserProfile%\Documents\ModelPort|*.log [Mojo *] LangSecRef=3022 DetectFile=%AppData%\Deusty\Mojo FileKey1=%AppData%\Deusty\Mojo\*|*.log FileKey2=%LocalAppData%\Deusty\Mojo|crash*.txt [Molotov.tv *] LangSecRef=3023 DetectFile=%AppData%\Molotov FileKey1=%AppData%\Molotov|Cookies*;QuotaManager* FileKey2=%AppData%\Molotov\*Cache|*.* FileKey3=%AppData%\Molotov\databases|*.* FileKey4=%AppData%\Molotov\IndexedDB|*.*|RECURSE FileKey5=%LocalAppData%\Molotov|SquirrelSetup.log [MonAlbumPhoto *] LangSecRef=3023 DetectFile=%LocalAppData%\MonAlbumPhoto FileKey1=%LocalAppData%\MonAlbumPhoto\Logs|*.log FileKey2=%LocalAppData%\MonAlbumPhoto\non enregistr*|*.log FileKey3=%UserProfile%\Documents\MonAlbumPhoto|*.log|RECURSE [Monkey's Audio *] LangSecRef=3023 Detect=HKCU\Software\Monkey's Audio RegKey1=HKCU\Software\Monkey's Audio\Settings|Add Files MRU List RegKey2=HKCU\Software\Monkey's Audio\Settings|Add Folder MRU List RegKey3=HKCU\Software\Monkey's Audio\Settings|Output Location Directory [MonoSnap *] LangSecRef=3023 DetectFile=%LocalAppData%\MonoSnap FileKey1=%LocalAppData%\MonoSnap\lastscreenshot|*.* FileKey2=%LocalAppData%\MonoSnap\logs|*.xml FileKey3=%LocalAppData%\MonoSnap\recent|*.* FileKey4=%LocalAppData%\MonoSnap\temp|*.* [Monster Prom *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Beautiful Glitch\Monster Prom FileKey1=%UserProfile%\AppData\LocalLow\Beautiful Glitch\Monster Prom|*txt [Moon Hunters *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\320040 FileKey1=%ProgramFiles%\Steam\steamapps\common\Moon Hunters|log*.txt [Moonlight Game Streaming *] LangSecRef=3022 Detect=HKCU\Software\Moonlight Game Streaming Project\Moonlight DetectFile1=%LocalAppData%\Moonlight Game Streaming Project\Moonlight DetectFile2=%ProgramFiles%\Moonlight Game Streaming FileKey1=%LocalAppData%\Moonlight Game Streaming Project\Moonlight|Moonlight-*.log FileKey2=%LocalAppData%\Moonlight Game Streaming Project\Moonlight\cache|gamecontrollerdb.txt FileKey3=%LocalAppData%\Moonlight Game Streaming Project\Moonlight\cache\boxart\*|*.* FileKey4=%ProgramFiles%\Moonlight Game Streaming|Moonlight-*.log FileKey5=%ProgramFiles%\Moonlight Game Streaming\boxart\*|*.* FileKey6=%ProgramFiles%\Moonlight Game Streaming\cache|gamecontrollerdb.txt [MoreTerra *] Section=Games DetectFile=%AppData%\MoreTerra FileKey1=%AppData%\MoreTerra\Logs|*.*|RECURSE [Morpheus *] LangSecRef=3023 Detect=HKCU\Software\Morpheus Warning=This will clear your shared folder and databases. FileKey1=%ProgramFiles%\Morpheus\DB|*.*|RECURSE FileKey2=%ProgramFiles%\Morpheus\My Shared Folder|*.*|RECURSE [Mortal Kombat Arcade Kollection *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\205350 FileKey1=%ProgramFiles%\Steam\steamapps\common\Mortal Kombat Arcade Kollection\Engine\EditorResources\FaceFX\Logs|*.* FileKey2=%ProgramFiles%\Steam\steamapps\common\Mortal Kombat Arcade Kollection\MKHDGame\Logs|*.* [Motherboard Monitor 5 *] LangSecRef=3023 Detect=HKCU\Software\Alexander van Kaam\MBM 5 FileKey1=%ProgramFiles%\Motherboard Monitor 5\Log|*.*|REMOVESELF [Motorola Device Manager *] LangSecRef=3024 Detect=HKLM\Software\Motorola FileKey1=%AppData%\Motorola\MotoHelper|*.log FileKey2=%ProgramData%\Motorola\SUE|*.log FileKey3=%ProgramData%\Motorola\SUE\Firmwares|* FileKey4=%ProgramFiles%\Motorola|*.log|RECURSE FileKey5=%ProgramFiles%\Motorola Mobility\DeviceSoftwareUpdate|*.log FileKey6=%ProgramFiles%\Motorola Mobility\Motorola Device Manager|*.log [Mount & Blade *] Section=Games DetectFile1=%ProgramFiles%\Mount&Blade* DetectFile2=%ProgramFiles%\Napoleonic Wars DetectFile3=%ProgramFiles%\Steam\steamapps\common\Mount&Blade* FileKey1=%ProgramFiles%\Mount&Blade*|rgl_log.txt|RECURSE FileKey2=%ProgramFiles%\Napoleonic Wars|rgl_log.txt|RECURSE FileKey3=%ProgramFiles%\Steam\steamapps\common\Mount&Blade*|rgl_log.txt|RECURSE [Mousotron *] LangSecRef=3021 DetectFile=%ProgramFiles%\Mousotron FileKey1=%ProgramFiles%\Mousotron|*.log [Movavi *] LangSecRef=3023 DetectFile=%AppData%\Movavi* FileKey1=%LocalAppData%\Movavi\Logs|*|RECURSE [Movavi Photo Editor *] LangSecRef=3022 DetectFile=%AppData%\Movavi Photo Editor* FileKey1=%LocalAppData%\Movavi\Photo Editor\*\Cache|*.*|RECURSE [Movavi Screen Recorder *] LangSecRef=3023 DetectFile=%AppData%\Movavi Screen Recorder* FileKey1=%LocalAppData%\Movavi Screen Recorder\Cache|*.*|RECURSE FileKey2=%LocalAppData%\Movavi\Screen Recorder\Cache|*.*|RECURSE [Movavi Video Converter *] LangSecRef=3023 Detect=HKCU\Software\MOVAVI FileKey1=%LocalAppData%\Movavi\*Video Converter*|Log.txt FileKey2=%LocalAppData%\Movavi\*Video Converter*\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Movavi\*Video Converter*\TranscoderTemp|*.*|RECURSE ExcludeKey1=PATH|%LocalAppData%\Movavi\*Video Converter*\Cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe [Movavi Video Editor *] LangSecRef=3022 DetectFile=%AppData%\Movavi Video Editor* FileKey1=%AppData%\Movavi Video Editor*|debug.log FileKey2=%LocalAppData%\Movavi\SharedData\VideoEditor\waveforms\cache|*.* FileKey3=%LocalAppData%\Movavi\Video Editor\Cache|*.*|RECURSE [Movavi Video Suite *] LangSecRef=3022 DetectFile=%AppData%\Movavi Video Suite* FileKey1=%LocalAppData%\Movavi\Video Suite|Log.txt FileKey2=%LocalAppData%\Movavi\Video Suite\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Movavi\Video Suite\QtWebEngine\Default\*Cache|*.* [Move Media Player *] LangSecRef=3023 Detect=HKCU\Software\Move Media Player FileKey1=%AppData%\Move Networks\QMCache00|*.* FileKey2=%AppData%\Move Networks\temp|*.* [Movie Collector - Collectorz *] LangSecRef=3023 Detect=HKCU\Software\Collectorz.com\Movie FileKey1=%LocalAppData%\Collectorz.com\Movie Collector\Temp\Images|*.* FileKey2=%UserProfile%\Documents\Movie Collector\Images|*.tmp [Movies & TV *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\Microsoft.ZuneVideo_* FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Database\anonymous|*.log FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageCache|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageRetrievalFailure|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageStore|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\navigationHistory|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\PlayReady|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\Settings|*.log* FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory\SearchHistory [MP3Gain *] LangSecRef=3023 Detect=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis FileKey1=%ProgramFiles%\MP3Gain|*.log [MP3Gain StartUp *] LangSecRef=3023 Detect=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis RegKey1=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|AddFilesPath RegKey2=HKCU\Software\VB and VBA Program Settings\MP3GainAnalysis\StartUp|AddFolderPath [MP3jam *] LangSecRef=3023 DetectFile=%AppData%\MP3jam FileKey1=%AppData%\MP3jam|DownloadsHistory.xml [Mp3Rocket *] LangSecRef=3023 DetectFile=%AppData%\Mp3Rocket FileKey1=%AppData%\Mp3Rocket|*.cache [Mp3tag *] LangSecRef=3021 Detect=HKLM\Software\Florian Heidenreich\Mp3tag FileKey1=%AppData%\Mp3tag|Mp3tagError.log [MPEG Audio Collection *] LangSecRef=3023 Detect=HKCU\Software\MPEG Audio Collection RegKey1=HKCU\Software\MPEG Audio Collection|LastNameText1 RegKey2=HKCU\Software\MPEG Audio Collection|LastNameText2 RegKey3=HKCU\Software\MPEG Audio Collection|LastNameText3 RegKey4=HKCU\Software\MPEG Audio Collection|LastNameText4 RegKey5=HKCU\Software\MPEG Audio Collection|LastNameText5 RegKey6=HKCU\Software\MPEG Audio Collection|LastNameText6 [MPK mini Software Manager *] LangSecRef=3023 DetectFile=%AppData%\MPK-mini-Software-Manager FileKey1=%AppData%\MPK-mini-Software-Manager|*.old;LOG|RECURSE FileKey2=%AppData%\MPK-mini-Software-Manager\*Cache|*|RECURSE FileKey3=%AppData%\MPK-mini-Software-Manager\*Storage|*|RECURSE FileKey4=%AppData%\MPK-mini-Software-Manager\blob_storage|*|RECURSE FileKey5=%AppData%\MPK-mini-Software-Manager\Logs|* FileKey6=%AppData%\MPK-mini-Software-Manager\MPK mini Software Manager\Logs|* FileKey7=%LocalAppData%\MPK-mini-Software-Manager-Updater|*|RECURSE [MPlayer *] LangSecRef=3023 DetectFile=%LocalAppData%\MPlayer FileKey1=%LocalAppData%\MPlayer|*.cache-3 [mRemoteNG *] LangSecRef=3021 Detect=HKLM\Software\mRemoteNG FileKey1=%AppData%\mRemoteNG|*.log;confCons.xml.*.backup [MrSafe *] LangSecRef=3021 DetectFile=%ProgramFiles%\MrSafe FileKey1=%ProgramFiles%\MrSafe|ClientLog.db;Supplier.db [MSI Afterburner Hardware Monitoring *] LangSecRef=3024 Detect=HKCU\Software\MSI FileKey1=%ProgramFiles%\Geeks3D\MSI Kombustor*\logs|*.* FileKey2=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml [MSI Remind Manager *] LangSecRef=3024 DetectFile=%ProgramFiles%\MSI\MSI Remind Manager FileKey1=%ProgramFiles%\MSI\MSI Remind Manager|Log_reminder.txt [MSN Money *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Microsoft.BingFinance_* FileKey1=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.BingFinance_*\Settings|*.log* FileKey3=%LocalAppData%\Packages\Microsoft.BingFinance_*\TempState|*|RECURSE [MSN Weather *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\Microsoft.BingWeather_* FileKey1=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState|*.tmp;UserActivity.json FileKey3=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\navigationHistory|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.BingWeather_*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.BingWeather_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe\SearchHistory [MTA: San Andreas *] Section=Games Detect=HKLM\Software\Multi Theft Auto: San Andreas All FileKey1=%ProgramData%\MTA San Andreas All\1.*|report.log FileKey2=%ProgramData%\MTA San Andreas All\1.*\temp|*|RECURSE FileKey3=%ProgramData%\MTA San Andreas All\1.*\upcache|*|RECURSE FileKey4=%ProgramData%\MTA San Andreas All\Common\Installer|nsis.log FileKey5=%ProgramFiles%\MTA San Andreas 1.*\mods\deathmatch\resources|*|RECURSE FileKey6=%ProgramFiles%\MTA San Andreas 1.*\MTA|core.dmp;core.log FileKey7=%ProgramFiles%\MTA San Andreas 1.*\MTA\CEF|cefdebug.txt FileKey8=%ProgramFiles%\MTA San Andreas 1.*\MTA\CEF\Cache|*|RECURSE FileKey9=%ProgramFiles%\MTA San Andreas 1.*\MTA\config|servercache.xml FileKey10=%ProgramFiles%\MTA San Andreas 1.*\MTA\dumps|*.dmp|RECURSE FileKey11=%ProgramFiles%\MTA San Andreas 1.*\MTA\logs|*|RECURSE [MTA: San Andreas Config/Login Data *] Section=Games Detect=HKLM\Software\Multi Theft Auto: San Andreas All FileKey1=%ProgramFiles%\MTA San Andreas 1.*\mods\deathmatch\priv|*.*|RECURSE [MTA: San Andreas Dedicated Server *] Section=Games Detect=HKLM\Software\Multi Theft Auto: San Andreas All FileKey1=%ProgramFiles%\MTA San Andreas 1.*\server\mods\deathmatch\logs|*.log FileKey2=%ProgramFiles%\MTA San Andreas 1.*\server\mods\deathmatch\resource-cache|*.*|RECURSE [Mullvad VPN *] LangSecRef=3022 Detect=HKLM\Software\Mullvad VPN FileKey1=%LocalAppData%\Mullvad VPN|Network Persistent State FileKey2=%LocalAppData%\Mullvad VPN\*Cache|*|RECURSE FileKey3=%LocalAppData%\Mullvad VPN\Local Storage|*|RECURSE FileKey4=%LocalAppData%\Mullvad VPN\logs|* FileKey5=%LocalAppData%\Mullvad VPN\Session Storage|* FileKey6=%ProgramData%\Mullvad VPN|*.log FileKey7=%ProgramData%\Mullvad VPN\cache|* FileKey8=%WinDir%\System32\config\systemprofile\AppData\Local\Mullvad VPN|account-history.json [Multi-Edit 2008 *] LangSecRef=3024 Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0 FileKey1=%AppData%\Multi Edit Software|*.log|RECURSE FileKey2=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP ExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|EVOLVE.LOG ExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|FILEPANE.LOG ExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|INSTALL.LOG ExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|POLYSTYLE.LOG ExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|TMPLPANE.LOG ExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|WINLIST.LOG [Multi Commander *] LangSecRef=3024 Detect=HKCU\Software\MultiCommander FileKey1=%AppData%\MultiCommander\Logs|*.log FileKey2=%ProgramFiles%\MultiCommander*|*Log.txt [Multi Password Recovery *] LangSecRef=3021 Detect=HKLM\System\CurrentControlSet\enum\root\legacy_block_reader RegKey1=HKLM\Software\Classes\.mpf RegKey2=HKLM\Software\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} RegKey3=HKLM\Software\Classes\MPR.DocHostUIHandler RegKey4=HKLM\System\CurrentControlSet\enum\root\legacy_block_reader RegKey5=HKLM\System\CurrentControlSet\Services\block_reader [MultiHasher *] LangSecRef=3024 Detect=HKLM\Software\abelhadigital.com\MultiHasher FileKey1=%ProgramFiles%\MultiHasher|*.txt;*.zip|RECURSE [MultiViewInpaint *] LangSecRef=3021 Detect=HKCU\Software\Teorex\MultiViewInpaint RegKey1=HKCU\Software\Teorex\MultiViewInpaint\Recent File List RegKey2=HKCU\Software\Teorex\MultiViewInpaint\RecentFileList [Mumble *] LangSecRef=3022 Detect=HKCU\Software\Mumble FileKey1=%AppData%\Mumble|console.txt [Murder, She Wrote *] Section=Games DetectFile=%AppData%\MysteryStudio\MSW FileKey1=%AppData%\MysteryStudio\MFW|*.log [MuseScore *] LangSecRef=3023 DetectFile=%LocalAppData%\MusE\MuseScore FileKey1=%LocalAppData%\MusE\MuseScore|cookies.txt [MusicBee *] LangSecRef=3023 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MusicBee FileKey1=%AppData%\MusicBee|*.dat FileKey2=%AppData%\MusicBee\InternalCache|*.*|REMOVESELF [MusicNet *] LangSecRef=3023 DetectFile=%AppData%\MusicNet FileKey1=%AppData%\MusicNet|*.log [My Family Tree *] LangSecRef=3021 DetectFile=%LocalAppData%\My Family Tree FileKey1=%LocalAppData%\My Family Tree\MapCache|*.*|RECURSE FileKey2=%LocalAppData%\My Family Tree\Temp|*.*|RECURSE [My Horse and Me *] Section=Games Detect=HKLM\Software\My Horse and Me 2 FileKey1=%ProgramFiles%\Atari\Mein Pferd und ich*\System|*log.txt;*.log|RECURSE FileKey2=%ProgramFiles%\Atari\My Horse and Me|*log.txt;*.log|RECURSE FileKey3=%ProgramFiles%\Atari\W!Games\My Horse and Me|*log.txt;*.log|RECURSE [My Movies Collection *] LangSecRef=3023 DetectFile=%ProgramData%\My Movies FileKey1=%ProgramData%\My Movies|vc*redist*.*;*log.txt FileKey2=%ProgramData%\My Movies\File Storage\Temp|*|RECURSE FileKey3=%ProgramData%\My Movies\Temp|*|RECURSE [My Riding Stables *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyRidingStables FileKey1=%ProgramFiles%\My Riding Stables*|*.txt;*.url [My Singing Monsters *] Section=Games DetectFile=%ProgramFiles%\My Singing Monsters FileKey1=%ProgramFiles%\My Singing Monsters|dotnetfx35setup.exe;vc*redist*.exe;*.log;*.txt|RECURSE [My ViewPad *] LangSecRef=3023 DetectFile=%ProgramFiles%\My ViewPad FileKey1=%ProgramFiles%\My ViewPad|ICP_MyViewPad.ini [MyCraft *] Section=Games DetectFile=%UserProfile%\Desktop\MyCraft FileKey1=%UserProfile%\Desktop\MyCraft|MyCraft Log.* [MyDefrag *] LangSecRef=3021 Detect=HKCU\Software\MyDefrag FileKey1=%ProgramFiles%\MyDefrag *|*.log FileKey2=%ProgramFiles%\MyDefrag *\LOGs|*.* [MyLanViewer *] LangSecRef=3022 DetectFile=%ProgramFiles%\MyLanViewer FileKey1=%LocalAppData%\MyLanViewer\Config|FriendlyNamesByMac.dat FileKey2=%LocalAppData%\MyLanViewer\Data\History|history_auto.dat FileKey3=%LocalAppData%\MyLanViewer\Data\Scanner|scanner_auto.dat FileKey4=%LocalAppData%\MyLanViewer\Data\SubnetMonitor|devices_auto.dat FileKey5=%LocalAppData%\MyLanViewer\Logs|*.*|RECURSE FileKey6=%ProgramFiles%\MyLanViewer\Data\History|history_auto.dat FileKey7=%ProgramFiles%\MyLanViewer\Data\Scanner|scanner_auto.dat FileKey8=%ProgramFiles%\MyLanViewer\Data\SubnetMonitor|devices_auto.dat FileKey9=%ProgramFiles%\MyLanViewer\Logs|*.*|RECURSE [MyNextbase Player *] LangSecRef=3023 DetectFile=%AppData%\MyNextbase Player FileKey1=%AppData%\MyNextbase Player|*-journal;*.old;LOG;QuotaManager|RECURSE FileKey2=%AppData%\MyNextbase Player\*Cache|*.*|RECURSE FileKey3=%AppData%\MyNextbase Player\Logs|*.* [MyPC Backup *] LangSecRef=3022 DetectFile=%ProgramFiles%\MyPC Backup FileKey1=%ProgramFiles%\MyPC Backup\log|*.* [MyPhoneExplorer *] LangSecRef=3024 Detect=HKCU\Software\MyPhoneExplorer FileKey1=%AppData%\MyPhoneExplorer|Debug.txt [MySMS *] LangSecRef=3022 Detect=HKCU\Software\sms.at\mysms FileKey1=%LocalAppData%\sms.at\mysms\LocalStorage|*.* RegKey1=HKCU\Software\sms.at\mysms\cookies [MySQL Workbench *] LangSecRef=3021 DetectFile=%AppData%\MySQL\Workbench FileKey1=%AppData%\MySQL\Workbench\cache|*.* FileKey2=%AppData%\MySQL\Workbench\log|*.log FileKey3=%AppData%\MySQL\Workbench\sql_history|*.* [MyToolkit *] LangSecRef=3024 Detect=HKCU\Software\FutureFog\MyToolkit\Options RegKey1=HKCU\Software\FutureFog\MyToolkit\Options|LastUsedFolder [myTube! *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_* FileKey1=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\LocalState\YouTubeCache|*|RECURSE FileKey4=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\59750RYKENAPPS.435307C335C44_*\TempState|*|RECURSE [MyWinLocker *] LangSecRef=3024 DetectFile=%ProgramFiles%\EgisTec\MyWinLocker* FileKey1=%LocalAppData%|MyWinLockerInstaller.* FileKey2=%ProgramFiles%\EgisTec\MyWinLocker*\log|*.* [Nahimic Companion *] LangSecRef=3023 DetectFile=%LocalAppData%\NhNotifSys\nahimic FileKey1=%LocalAppData%\NhNotifSys\shared|notif_history [Nancy Drew: The Secret of Shadow Ranch *] Section=Games DetectFile=%ProgramFiles%\Nancy Drew* FileKey1=%ProgramFiles%\Nancy Drew*|dxwebsetup.exe;*.html [Nanjing Swansoft SSCNC Simulator *] LangSecRef=3021 DetectFile=%ProgramFiles%\Nanjing Swansoft\SSCNC FileKey1=%ProgramFiles%\Nanjing Swansoft\SSCNC|*.log|RECURSE [Napoleon *] Section=Games DetectFile=%AppData%\The Creative Assembly\Napoleon FileKey1=%AppData%\The Creative Assembly\Napoleon\*_cache|*.* FileKey2=%AppData%\The Creative Assembly\Napoleon\Logs|*.* [NateOn RemoteCall *] LangSecRef=3022 DetectFile=%LocalAppData%\SK Communications\NATEON* FileKey1=%LocalAppData%\SK Communications\NATEON*\*\Display|*.tmp FileKey2=%LocalAppData%\SK Communications\NATEON*\*\Emoticons\Temp|*.* FileKey3=%LocalAppData%\SK Communications\NATEON*\*\Temp|*.*|RECURSE FileKey4=%LocalAppData%\SK Communications\NATEON*\Addin\*\rclog|*.*|RECURSE FileKey5=%LocalAppData%\SK Communications\NATEON*\Temp|*.*|RECURSE FileKey6=%UserProfile%\Documents\NateOn RemoteCall\rclog|*.*|RECURSE [Native Instruments Software *] LangSecRef=3023 DetectFile1=%LocalAppData%\Native Instruments DetectFile2=%UserProfile%\Documents\Native Instruments FileKey1=%LocalAppData%\Cache\Native Instruments\Native Access|*.log FileKey2=%LocalAppData%\Cache\Native Instruments\Native Access\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Native Instruments\Guitar Rig*\Temp|*.* FileKey4=%LocalAppData%\Native Instruments\Kontakt*\Kconvert Logs|*.* FileKey5=%LocalAppData%\Native Instruments\Kontakt*\Kconvert Temp|*.* FileKey6=%LocalAppData%\Native Instruments\Kontakt*\LibrariesCache|*.cache FileKey7=%LocalAppData%\Native Instruments\Native Access*\Cache|*.*|RECURSE FileKey8=%LocalAppData%\Native Instruments\Reaktor*\Cache|*.* FileKey9=%UserProfile%\Documents\Native Instruments\*\CrashLogs|*.* FileKey10=%UserProfile%\Documents\Native Instruments\Traktor*|*.log FileKey11=%UserProfile%\Documents\Native Instruments\Traktor*\History|*.* FileKey12=%UserProfile%\Documents\Native Instruments\Traktor*\Logs|*.* [Natural Selection 2 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\4920 DetectFile=%ProgramFiles%\Steam\steamapps\common\Natural Selection 2 FileKey1=%AppData%\Natural Selection 2|log.txt FileKey2=%AppData%\Natural Selection 2\cache|*.*|RECURSE [NaturalReader Free 12 *] LangSecRef=3021 Detect=HKLM\Software\Naturalreaderfree FileKey1=%ProgramFiles%\Naturalsoft\Free12\log|*.* FileKey2=%UserProfile%\Documents\Naturalsoft|*.msi;nrtemp.txt|RECURSE FileKey3=%UserProfile%\Documents\Naturalsoft\log|*.*|RECURSE [NCSOFT Game Launcher *] Section=Games DetectFile=%AppData%\NCSoft\ncDownloader FileKey1=%AppData%\NCSoft\ncDownloader\config|*.log FileKey2=%AppData%\NCSoft\ncDownloader\config\Log|*.* FileKey3=%LocalAppData%\NCStreaming\Cef_Cache|*-journal;Visited Links FileKey4=%LocalAppData%\NCStreaming\Cef_Cache\GPUCache|*.* [Neostar CMS Station Client *] LangSecRef=3024 Detect=HKLM\Software\company\Neostar CMS FileKey1=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\log|*.* FileKey2=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\StreamServer|*.log FileKey3=%ProgramFiles%\Neostar CMS Station\Neostar CMS\Neostar CMS Client\StreamServer\log|*.* [Nero *] LangSecRef=3021 Detect1=HKCU\Software\Ahead Detect2=HKCU\Software\Nero FileKey1=%AppData%\Nero|*.log|RECURSE FileKey2=%AppData%\Nero\Nero ControlCenter\Logs|* FileKey3=%AppData%\Nero\Nero Start\CefCache*|*.ldb;Cookies*;CURRENT;LOCK;LOG;LOG.old;MANIFEST-*;QuotaManager*;Visited Links FileKey4=%AppData%\Nero\Nero Start\CefCache*\*Cache|*|RECURSE FileKey5=%AppData%\Nero\Nero Start\CefCache*\IndexedDB|*|RECURSE FileKey6=%AppData%\Nero\Nero Start\CefCache*\Local Storage\leveldb|* FileKey7=%AppData%\Nero\Nero Start\CefCache*\Session Storage|*|RECURSE FileKey8=%AppData%\Nero\Nero Start\Logs|*|RECURSE FileKey9=%AppData%\Nero\Nero Start\temp|*|RECURSE FileKey10=%AppData%\Nero\Nero*\Nero BackItUp\Cache|* FileKey11=%AppData%\Nero\Nero*\Nero Recode\AnalysisData|*.dat FileKey12=%AppData%\Nero\Nero*\Nero Recode\Thumbs|* FileKey13=%AppData%\Nero\Nero*\Nero Vision|*.txt;*.bin FileKey14=%AppData%\Nero\Nero*\Nero Vision\NVFACache|* FileKey15=%LocalAppData%\Nero\Nero*\Nero Vision\Cache|* FileKey16=%LocalAppData%\Nero\Nero*\Nero Vision\Cache\GraphicObjectCache|* FileKey17=%LocalAppData%\Nero\NeroKnowHowPLUS|*.log FileKey18=%LocalAppData%\Nero\NeroKnowHowPLUS\*|*.cache FileKey19=%LocalAppData%\Nero\Transfer|*.log FileKey20=%ProgramData%\Ahead\Nero BackItUp*\Cache|* FileKey21=%ProgramData%\Nero|*.log|RECURSE FileKey22=%ProgramData%\Nero\Nero BackItUp*\Cache|* FileKey23=%ProgramData%\Nero\NeroUpdate\Logs|* FileKey24=%ProgramData%\Nero\PeakFiles|*.tmp RegKey1=HKCU\Software\ahead\Nero PhotoSnap\Recent File List RegKey2=HKCU\Software\Ahead\NeroSearch\NeroSavedSearches\SavedSearches RegKey3=HKCU\Software\ahead\NeroVision\2.0\RecentFiles RegKey4=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelAutoTemplate RegKey5=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelISOTemplate RegKey6=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumelabelJolietTemplate RegKey7=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Compilation|VolumeLabelUDFTemplate RegKey8=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Recent File List RegKey9=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|EncodingLastDir RegKey10=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|NeroCompilation RegKey11=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|TrackSaveDir RegKey12=HKCU\Software\Nero\Nero 11\Nero Burning ROM\Settings|WorkingDir RegKey13=HKCU\Software\Nero\Nero 11\Nero CoverDesigner\Recent File List RegKey14=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelAutoTemplate RegKey15=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelISOTemplate RegKey16=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumelabelJolietTemplate RegKey17=HKCU\Software\Nero\Nero 11\Nero Express\Compilation|VolumeLabelUDFTemplate RegKey18=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastAudioDir RegKey19=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastISODir RegKey20=HKCU\Software\Nero\Nero 11\Nero Express\General|OFDLastVideoDVDKey RegKey21=HKCU\Software\Nero\Nero 11\Nero Express\Recent File List RegKey22=HKCU\Software\Nero\Nero 11\Nero Express\Settings|BootImageDir RegKey23=HKCU\Software\Nero\Nero 11\Nero Express\Settings|BrowserDir RegKey24=HKCU\Software\Nero\Nero 11\Nero Express\Settings|ImageDir RegKey25=HKCU\Software\Nero\Nero 11\Nero Express\Settings|NeroCompilation RegKey26=HKCU\Software\Nero\Nero 11\Nero Express\Settings|TrackSaveDir RegKey27=HKCU\Software\Nero\Nero 11\Nero Express\Settings|WorkingDir RegKey28=HKCU\Software\Nero\Nero 11\Nero Toolkit\DiscSpeed\Capture|Folder RegKey29=HKCU\Software\Nero\Nero 11\Nero Toolkit\DiscSpeed\Save|Folder RegKey30=HKCU\Software\Nero\Nero 11\Nero Vision\Application|AudioDir RegKey31=HKCU\Software\Nero\Nero 11\Nero Vision\Application|CaptureDir RegKey32=HKCU\Software\Nero\Nero 11\Nero Vision\Application|DocDir RegKey33=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ExportAudioDir RegKey34=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ExportVideoDir RegKey35=HKCU\Software\Nero\Nero 11\Nero Vision\Application|ImportVideoDir RegKey36=HKCU\Software\Nero\Nero 11\Nero Vision\Application|MediaDir RegKey37=HKCU\Software\Nero\Nero 11\Nero Vision\Application|PicDir RegKey38=HKCU\Software\Nero\Nero 11\Nero Vision\Application|PicSaveDir RegKey39=HKCU\Software\Nero\Nero 11\Nero Vision\Application|TmpDir RegKey40=HKCU\Software\Nero\Nero 11\Nero Vision\Application|VideoDir RegKey41=HKCU\Software\Nero\Nero 11\Nero WaveEditor\Directories|Last RegKey42=HKCU\Software\Nero\Nero 11\Nero WaveEditor\Recent File List RegKey43=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelAutoTemplate RegKey44=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelISOTemplate RegKey45=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumelabelJolietTemplate RegKey46=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Compilation|VolumeLabelUDFTemplate RegKey47=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|EncodingLastDir RegKey48=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|TrackSaveDir RegKey49=HKCU\Software\Nero\Nero 12\Nero Burning ROM\Settings|WorkingDir RegKey50=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelAutoTemplate RegKey51=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelISOTemplate RegKey52=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumelabelJolietTemplate RegKey53=HKCU\Software\Nero\Nero 12\Nero Express\Compilation|VolumeLabelUDFTemplate RegKey54=HKCU\Software\Nero\Nero 12\Nero Express\Settings|BootImageDir RegKey55=HKCU\Software\Nero\Nero 12\Nero Express\Settings|ImageDir RegKey56=HKCU\Software\Nero\Nero 12\Nero Express\Settings|NeroCompilation RegKey57=HKCU\Software\Nero\Nero 12\Nero Express\Settings|TrackSaveDir RegKey58=HKCU\Software\Nero\Nero 12\Nero Toolkit\DiscSpeed\Capture|Folder RegKey59=HKCU\Software\Nero\Nero 12\Nero Toolkit\DiscSpeed\Save|Folder RegKey60=HKCU\Software\Nero\Nero 12\Nero Vision\Application|AudioDir RegKey61=HKCU\Software\Nero\Nero 12\Nero Vision\Application|CaptureDir RegKey62=HKCU\Software\Nero\Nero 12\Nero Vision\Application|DocDir RegKey63=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ExportAudioDir RegKey64=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ExportVideoDir RegKey65=HKCU\Software\Nero\Nero 12\Nero Vision\Application|ImportVideoDir RegKey66=HKCU\Software\Nero\Nero 12\Nero Vision\Application|MediaDir RegKey67=HKCU\Software\Nero\Nero 12\Nero Vision\Application|PicDir RegKey68=HKCU\Software\Nero\Nero 12\Nero Vision\Application|PicSaveDir RegKey69=HKCU\Software\Nero\Nero 12\Nero Vision\Application|TmpDir RegKey70=HKCU\Software\Nero\Nero 12\Nero Vision\Application|VideoDir RegKey71=HKCU\Software\Nero\Nero 12\Nero WaveEditor\Directories|Last RegKey72=HKCU\Software\Nero\Nero Blu-ray Player\Settings|DefFolder RegKey73=HKCU\Software\Nero\Nero8\Cover Designer\Recent File List RegKey74=HKCU\Software\Nero\Nero8\Nero - Burning Rom\Recent File List RegKey75=HKU\.DEFAULT\Software\Ahead\Cover Designer\Recent File List RegKey76=HKU\.DEFAULT\Software\Ahead\Nero - Burning Rom\Recent File List RegKey77=HKU\.DEFAULT\Software\Ahead\Nero Wave Editor\Recent File List [Nero TuneItUp *] LangSecRef=3024 DetectFile=%ProgramData%\Nero\Nero TuneItUp FileKey1=%ProgramData%\Nero\Nero TuneItUp|Setup Log*.log FileKey2=%ProgramData%\Nero\Nero TuneItUp\cache|*.*|RECURSE FileKey3=%ProgramData%\Nero\Nero TuneItUp\DriverUpdate|*.log FileKey4=%ProgramData%\Nero\Nero TuneItUp\ExceptionHandlerDll|*.dmp;*.*log FileKey5=%ProgramData%\Nero\Nero TuneItUp\RegCleanerDll\Log|*.log FileKey6=%ProgramData%\Nero\Nero TuneItUp\RegDefragDll\Log|*.log FileKey7=%ProgramData%\Nero\Nero TuneItUp\Reports|*.html|RECURSE FileKey8=%ProgramData%\Nero\Nero TuneItUp\Services|*.log FileKey9=%ProgramData%\Nero\Nero TuneItUp\SoftwareProducts|*.log FileKey10=%ProgramData%\Nero\Nero TuneItUp\Startup|*.log FileKey11=%ProgramData%\Nero\Nero TuneItUp\TemperatureMonitoringModule|*.log [NesterJ *] LangSecRef=3024 Detect=HKCU\Software\nesterJ RegKey1=HKCU\Software\nesterJ\Recent [Net-Peeker *] LangSecRef=3024 Detect=HKLM\Software\eMingSoftware\NetPeeker FileKey1=%ProgramData%\eMingSoftware\NetPeeker\Log|* RegKey1=HKCU\Software\eMingSoftware\Net-Peeker Group Console\Recent File List RegKey2=HKLM\Software\eMingSoftware\NetPeeker|ConsoleName [Net Vampire *] LangSecRef=3022 DetectFile=%ProgramFiles%\Net Vampire FileKey1=%ProgramFiles%\Net Vampire\Data\Jobs|*.*|RECURSE FileKey2=%ProgramFiles%\Net Vampire\Data\Sites|*.*|RECURSE FileKey3=%ProgramFiles%\Net Vampire\Data\State|*.*|RECURSE [Net2Printer RDP *] LangSecRef=3021 DetectFile=%AppData%\Net2Printer RDP Client FileKey1=%AppData%\Net2Printer RDP Client|*.* [NetAnts *] LangSecRef=3022 DetectFile=%ProgramFiles%\NetAnts FileKey1=%ProgramFiles%\NetAnts|*.job;history.txt;netantslog.htm RegKey1=HKCU\Software\Netants\MRU [NetBeans IDE *] LangSecRef=3024 DetectFile1=%AppData%\NetBeans DetectFile2=%UserProfile%\.nbi\log FileKey1=%AppData%\NetBeans\*\var\log|*.*|RECURSE FileKey2=%UserProfile%\.nbi\log|*.log|RECURSE [Netflix *] LangSecRef=3023 DetectFile=%LocalAppData%\Packages\4DF9E0F8.Netflix_* FileKey1=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AppData\Indexed DB|*.log FileKey3=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalCache|*|RECURSE FileKey4=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalState|*.tmp FileKey5=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalState\LiveTile|*|RECURSE FileKey6=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\Settings|*.log* FileKey7=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\4DF9E0F8.Netflix_mcm4njqhnhss8\SearchHistory ExcludeKey1=FILE|%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\Internet Explorer\DOMStore\*\|www.netflix[1].xml [NETGEAR Genie *] LangSecRef=3024 Detect=HKLM\Software\NETGEAR Genie FileKey1=%LocalAppData%\NETGEARGenie|*.txt FileKey2=%LocalAppData%\NETGEARGenie\log|*.log FileKey3=%LocalAppData%\NETGEARGenie\update_temp|*.* [NetLimiter *] LangSecRef=3022 Detect=HKCU\Software\LockTime\NetLimiter RegKey1=HKCU\Software\LockTime\NetLimiter\Recent File List [NetSurf Browser *] LangSecRef=3022 DetectFile=%AppData%\NetSurf FileKey1=%AppData%\NetSurf|Cookies;URLs [NetUtils WNetStat *] LangSecRef=3024 Detect=HKCU\Software\NetUtils\WNetStat RegKey1=HKCU\Software\NetUtils\WNetStat|LastFile [NetworkActiv AUTAPF *] LangSecRef=3024 DetectFile=%ProgramFiles%\NetworkActiv AUTAPF* FileKey1=%ProgramFiles%\NetworkActiv AUTAPF*|*log.txt [Neverwinter *] Section=Games Detect=HKCU\Software\Cryptic\Neverwinter FileKey1=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios|*.log|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios\localdata|_SWMWindowPosList.txt FileKey3=%Public%\Games\Cryptic Studios|*.log|RECURSE FileKey4=%Public%\Games\Cryptic Studios\localdata|_SWMWindowPosList.txt [New Yankee in Santa's Service *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\New Yankee 3 - In Santas ServiceFinal FileKey1=%AppData%\AlawarEntertainment|*_log.html|RECURSE FileKey2=%ProgramFiles%\New Yankee 3 - In Santas Service|*.nfo [Newsbin Pro *] LangSecRef=3021 Detect1=HKCU\Software\DJI Interprises\Newsbin Pro Detect2=HKCU\Software\DJI Interprises\Newsbin50 DetectFile=%LocalAppData%\Newsbin FileKey1=%LocalAppData%\Newsbin|Logfile.txt;Download*.db3* FileKey2=%LocalAppData%\Newsbin\SPOOL_V6|*.* FileKey3=%LocalAppData%\Newsbin\temp|*.* RegKey1=HKCU\Software\DJI Interprises\Newsbin Pro\FilterHistory RegKey2=HKCU\Software\DJI Interprises\Newsbin Pro\Recent File List [Newsleecher *] LangSecRef=3021 DetectFile=%AppData%\Newsleecher\Backups FileKey1=%AppData%\Newsleecher\Backups|*.* [neXBC *] LangSecRef=3022 DetectFile=%ProgramFiles%\neXBC FileKey1=%ProgramFiles%\neXBC|messages.txt FileKey2=%ProgramFiles%\neXBC\Logs\Hosted|*.* FileKey3=%ProgramFiles%\neXBC\Logs\Joined|*.* [Nexon Launcher *] Section=Games DetectFile=%AppData%\NexonLauncher* FileKey1=%AppData%\NexonLauncher|*-journal;*.old;LOG|RECURSE FileKey2=%AppData%\NexonLauncher\*Cache|*.* FileKey3=%AppData%\NexonLauncherSwapApp\GPUCache|*.* [Nextcloud *] LangSecRef=3022 DetectFile=%AppData%\Nextcloud FileKey1=%AppData%\Nextcloud|*.log;*.msi;nextcloud.cfg.backup_* FileKey2=%AppData%\Nextcloud\Logs|*.* FileKey3=%LocalAppData%\Nextcloud\Cache\qmlcache|*.*|RECURSE [NextSecurity GetKey *] LangSecRef=3024 Detect=HKCU\Software\NextSecurity\GetKey RegKey1=HKCU\Software\NextSecurity\GetKey\Recent File List [Nextup TextAloud *] LangSecRef=3021 Detect=HKCU\Software\NextUpTech\TextAloud3 FileKey1=%LocalAppData%\NextUp\TextAloud|*.adu;*.adl;*.dbg FileKey2=%LocalAppData%\NextUp\TextAloud\Articles|*.*|RECURSE RegKey1=HKCU\Software\NextUpTech\TextAloud3|AudioClipFileOpenDirectory RegKey2=HKCU\Software\NextUpTech\TextAloud3|DocFileOpenDirectory [Nexus Mod Manager *] Section=Games DetectFile=%UserProfile%\Documents\Nexus Mod Manager FileKey1=%UserProfile%\Documents\Nexus Mod Manager|*.txt [Nicotine+ *] LangSecRef=3022 DetectFile=%ProgramFiles%\Nicotine+ FileKey1=%AppData%\nicotine|*.backup;*.bak;*.old|RECURSE FileKey2=%AppData%\nicotine\logs|*.*|RECURSE FileKey3=%LocalAppData%|recently-used.xbel [Nidhogg *] Section=Games DetectFile=%AppData%\Nidhogg FileKey1=%AppData%\Nidhogg|*.log [Nikon Capture NX2 *] LangSecRef=3023 Detect=HKLM\Software\Nikon\Capture NX 2 FileKey1=%LocalAppData%\Nikon\Capture NX\ThumbnailCache|*.*|RECURSE [Nikon ViewNX 2 Pic Viewer *] LangSecRef=3023 Detect=HKLM\Software\Nikon\MCA2\ViewNX 2 FileKey1=%LocalAppData%\Nikon\mPT\*\CacheData\Original|*.* FileKey2=%LocalAppData%\Nikon\mPT\*\CacheData\Others|*.* FileKey3=%LocalAppData%\Nikon\mPT\*\CacheData\Screen|*.* FileKey4=%LocalAppData%\Nikon\mPT\*\CacheData\Thumbnail|*.* FileKey5=%LocalAppData%\Nikon\ViewNX 2\Cache|*.* [NirSoft AddrView *] LangSecRef=3024 Detect=HKCU\Software\NirSoft\AddrView RegKey1=HKCU\Software\NirSoft\AddrView|LastUrlAddr [NirSoft RegistryChangesView *] LangSecRef=3024 DetectFile=%ProgramFiles%\NirSoft\RegistryChangesView.exe FileKey1=%ProgramFiles%\NirSoft\RegSnapshot*|*.*|REMOVESELF FileKey2=%ProgramFiles%\NirSoft\x64\RegSnapshot*|*.*|REMOVESELF [NirSoft RegScanner *] LangSecRef=3024 Detect=HKCU\Software\NirSoft\RegScanner FileKey1=%ProgramFiles%\NirSoft|report.html FileKey2=%ProgramFiles%\NirSoft\x64|report.html RegKey1=HKCU\Software\NirSoft\RegScanner|BaseKey RegKey2=HKCU\Software\NirSoft\RegScanner|ExcludeList RegKey3=HKCU\Software\NirSoft\RegScanner|Find RegKey4=HKCU\Software\NirSoft\RegScanner|RemoteComputer RegKey5=HKCU\Software\NirSoft\RegScanner|TimeFrom RegKey6=HKCU\Software\NirSoft\RegScanner|TimeTo [Nitro PDF Reader *] LangSecRef=3021 Detect=HKCU\Software\Nitro PDF\Reader DetectFile=%AppData%\Nitro\Reader FileKey1=%AppData%\Nitro\Reader\*|*Log.txt;NitroPDFHistory.dat RegKey1=HKCU\Software\Nitro PDF\Reader\1.0\Recent File List RegKey2=HKCU\Software\Nitro PDF\Reader\2.0\Recent File List [Nitrous Backups *] Section=Games DetectFile=%AppData%\.nitrous FileKey1=%AppData%\.nitrous\backups|*.*|REMOVESELF [nLite *] LangSecRef=3024 DetectFile=%ProgramFiles%\nLite FileKey1=%ProgramFiles%\nLite\Presets|*.* [No-IP DUC *] LangSecRef=3022 Detect=HKCU\Software\Vitalwerks\DUC FileKey1=%LocalAppData%\Vitalwerks\DUC|*.log FileKey2=%ProgramData%\Vitalwerks\DUC|*.log [NoBot *] LangSecRef=3024 Detect=HKLM\Software\NoBot DetectFile=%SystemDrive%\NoBot FileKey1=%SystemDrive%\NoBot\Logs|*.* FileKey2=%SystemDrive%\NoBot\Quarantine|*.* [NodeSoft FileVer *] LangSecRef=3024 Detect=HKLM\Software\NodeSoft\FileVer RegKey1=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunFile RegKey2=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunPath RegKey3=HKLM\Software\NodeSoft\FileVer|LatestApplicationRunTime [Noise Blocker *] LangSecRef=3023 DetectFile=%AppData%\Noise Blocker FileKey1=%AppData%\Noise Blocker|info.log [Noise Engineering *] LangSecRef=3023 DetectFile=%UserProfile%\Noise Engineering\NE products FileKey1=%UserProfile%\Noise Engineering\NE products|*.log [Nokia Music Player *] LangSecRef=3023 DetectFile=%LocalAppData%\Nokia\Nokia Music* FileKey1=%LocalAppData%\Nokia\Nokia Music*|*.log [Nokia Software Updater *] LangSecRef=3021 Detect1=HKCU\Software\Nokia\NSU3 Detect2=HKLM\Software\Nokia\Nokia Suite DetectFile1=%CommonProgramFiles%\Nokia\Service Layer\A DetectFile2=%ProgramData%\Nokia\Nokia Service Layer\A FileKey1=%CommonProgramFiles%\Nokia\Service Layer\A|*|REMOVESELF FileKey2=%LocalAppData%\Nokia\NSU3\NOSSU2|*.*|RECURSE FileKey3=%ProgramData%\Nokia\Nokia Service Layer\A|*|REMOVESELF ExcludeKey1=FILE|%LocalAppData%\Nokia\NSU3\NOSSU2\|usergroups.cfg ExcludeKey2=PATH|%LocalAppData%\Nokia\NSU3\NOSSU2\Flash\|*.* [Nokia Suite *] LangSecRef=3021 DetectFile=%AppData%\Nokia Suite FileKey1=%AppData%\Nokia Suite\Nokia Connector|*.log FileKey2=%AppData%\Nokia\intellisync\*\configuration|*.log FileKey3=%ProgramData%\NokiaInstallerCache\PackageCache|*|RECURSE [NordVPN *] LangSecRef=3022 DetectFile=%LocalAppData%\NordVPN FileKey1=%LocalAppData%\NordVPN\logs|*.* [Norman Malware Cleaner *] LangSecRef=3024 DetectFile=%UserProfile%\Desktop\NFix_*.log FileKey1=%UserProfile%\Desktop|NFix_*.log [Norman Security Suite *] LangSecRef=3021 DetectFile=%ProgramFiles%\Norman FileKey1=%ProgramFiles%\Norman|*.log FileKey2=%ProgramFiles%\Norman\Download|*.* FileKey3=%ProgramFiles%\Norman\Logs|*.* FileKey4=%ProgramFiles%\Norman\Temp|*.* [Norton *] LangSecRef=3024 DetectFile=%ProgramData%\Norton FileKey1=%AppData%\Norton\logs|* FileKey2=%ProgramData%\Norton|*.log;*.txt FileKey3=%ProgramData%\Norton\LocalDumps|*.dmp FileKey4=%ProgramData%\NortonInstaller\Logs|*|RECURSE FileKey5=%ProgramData%\VPNService|*.log [Norton Online Backup *] LangSecRef=3024 DetectFile=%ProgramData%\Symantec\Norton Online Backup FileKey1=%ProgramData%\Symantec\Norton Online Backup|*.log*|RECURSE [Norton Power Eraser *] LangSecRef=3024 DetectFile=%ProgramData%\Norton\NPE\NPEsettings.dat FileKey1=%LocalAppData%\NPE|*|REMOVESELF FileKey2=%ProgramData%\Norton\NPE|*|REMOVESELF FileKey3=%UserProfile%\Desktop|NPE.exe [Norton Secure VPN *] LangSecRef=3022 DetectFile=%LocalAppData%\Norton Secure VPN FileKey1=%LocalAppData%\Norton Secure VPN|*.log FileKey2=%LocalAppData%\Norton Secure VPN\Cache\qmlcache|*.* [Norton Utilities *] LangSecRef=3021 DetectFile1=%ProgramFiles%\Norton SystemWorks Premier Edition\Norton Utilities DetectFile2=%ProgramFiles%\Norton Utilities* FileKey1=%AppData%\Norton Utilities *\cleanreports|pgscan_*.html FileKey2=%AppData%\Norton Utilities\log|pgscan_*.html FileKey3=%ProgramData%\Norton\NortonUtility\logs|*.log FileKey4=%ProgramFiles%\Norton SystemWorks Premier Edition\Norton Utilities|*.log;*.tmp [Notepad++ *] LangSecRef=3021 Detect=HKLM\Software\Notepad++ FileKey1=%AppData%\Notepad++|*.log FileKey2=%AppData%\Notepad++\plugins\config\plugin_install_temp|*.*|REMOVESELF [Notion *] LangSecRef=3021 DetectFile=%AppData%\Notion FileKey1=%AppData%\Notion|*.log FileKey2=%AppData%\Notion\*Cache|*.*|RECURSE FileKey3=%AppData%\Notion\partitions|*.old;LOG|RECURSE FileKey4=%AppData%\Notion\partitions\*Cache|*.*|RECURSE [NowSmart Cut *] LangSecRef=3023 Detect=HKLM\Software\NowSmart\Cut FileKey1=%LocalAppData%\Cut|log.txt;*.dmp [Nox *] LangSecRef=3024 Detect=HKLM\Software\BigNox DetectFile=%UserProfile%\.BigNox FileKey1=%LocalAppData%\Nox|*.log* FileKey2=%UserProfile%\.BigNox|*.log* FileKey3=%UserProfile%\vmlogs|Nox.log* [Npcap Loopback Adapter *] LangSecRef=3024 DetectFile=%ProgramFiles%\Npcap FileKey1=%ProgramFiles%\NpCap|*.log|RECURSE [nProtect Online Security *] LangSecRef=3021 DetectFile=%UserProfile%\AppData\LocalLow\nProtect FileKey1=%UserProfile%\AppData\LocalLow\nProtect\Log|* [NSIS *] LangSecRef=3021 Detect=HKLM\Software\NSIS RegKey1=HKLM\Software\NSIS\MRU [NT Registry Optimizer *] LangSecRef=3024 DetectFile=%ProgramFiles%\NT Registry Optimizer FileKey1=%LocalAppData%\Microsoft\Windows|UsrClass.bak FileKey2=%WinDir%\*\LocalService|NTUSER.bak FileKey3=%WinDir%\System32\config|COMPONENTS.bak;SYSTEM.bak;DEFAULT.bak;SAM.bak;SECURITY.bak;Software.bak [NTI Backup Now *] LangSecRef=3024 DetectFile=%ProgramFiles%\New Tech Infosystems\NTI Backup Now 5 FileKey1=%ProgramFiles%\New Tech Infosystems\NTI Backup Now 5\logs|*.* [Nuance Dragon Natually Speaking 12 *] LangSecRef=3021 Detect=HKCU\Software\ScanSoft\NaturallySpeaking12 FileKey1=%AppData%\Nuance\NaturallySpeaking12\RIA|*DragonNatuallySpeakingRIA_IE_Shim_log_*.txt [Nuclear Dawn Cache *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17710 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\config\html|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\cache|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\downloads|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\temp|*.vtf|RECURSE [Nuclear Dawn Custom Content *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17710 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*corner*;*roadwork*;*rock*;*frost*;*mars*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\models|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\materials\sprites|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\models|*.*|RECURSE FileKey5=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\sound\quake|*.*|RECURSE [Nuclear Dawn Developer Files *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17710 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\bin|*bsp*;*vtex*;SDKLauncher.exe;modelbrowser.exe|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*example*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps\ai_data|nd_codetest.nav|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\scripted_props|*.*|REMOVESELF FileKey5=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\units|*.*|REMOVESELF FileKey6=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\scripts\vehicles|*.*|REMOVESELF FileKey7=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\platform\AddOns|*.*|RECURSE FileKey8=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\sdk_content|*.*|REMOVESELF FileKey9=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\sdk_tools|*.*|REMOVESELF [Nuclear Dawn Mac/Linux Binaries *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17710 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\bin|client.so;client.dylib|RECURSE [Nuclear Dawn SK Gamemode *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17710 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*sk_*|RECURSE [Nuclear Dawn Tutorials *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17710 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps|*training*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\maps\ai_data|*training*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\media|*tutorial*|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Nuclear Dawn\nucleardawn\sound\voices\tutorial|*.*|REMOVESELF [NVIDIA *] LangSecRef=3024 Detect=HKLM\Software\NVIDIA Corporation FileKey1=%AppData%\NVIDIA\*Cache|*|RECURSE FileKey2=%LocalAppData%\NVIDIA Corporation|*.log;*.bak;*.old|RECURSE FileKey3=%LocalAppData%\NVIDIA Corporation\*\CefCache|Cookies*;QuotaManager*;Visited Links FileKey4=%LocalAppData%\NVIDIA Corporation\*\CefCache\*Cache|*|RECURSE FileKey5=%LocalAppData%\NVIDIA Corporation\NV_Cache|* FileKey6=%LocalAppData%\NVIDIA\*Cache|*|RECURSE FileKey7=%LocalAppData%\NVIDIA\NvBackend|*.log;*.bak FileKey8=%LocalAppData%\Packages\*\AC\*\NVIDIA Corporation\NV_Cache|* FileKey9=%LocalAppData%\Packages\*\AC\NVIDIA Corporation\NV_Cache|* FileKey10=%LocalAppData%\Packages\*\AC\NVIDIA\DXCache|*|REMOVESELF FileKey11=%LocalAppData%\Packages\NVIDIACorp.*\AC|*|RECURSE FileKey12=%LocalAppData%\Packages\NVIDIACorp.*\LocalCache|*|RECURSE FileKey13=%LocalAppData%\Packages\NVIDIACorp.*\Settings|*.log* FileKey14=%LocalAppData%\Packages\NVIDIACorp.*\SystemAppData\Helium|*.log* FileKey15=%ProgramData%|DisplaySessionContainer*.log*;NvcDispCorePlugin.log*;NVDisplay.Container*.log* FileKey16=%ProgramData%\NVIDIA|*.bak;Resource.old;*.log*|RECURSE FileKey17=%ProgramData%\NVIDIA Corporation|*.log*;*.bak;*.old;*.stat|RECURSE FileKey18=%ProgramData%\NVIDIA Corporation\CrashDumps|* FileKey19=%ProgramData%\NVIDIA Corporation\Downloader|*|RECURSE FileKey20=%ProgramData%\NVIDIA Corporation\GeForce Experience\Update|*|RECURSE FileKey21=%ProgramData%\NVIDIA Corporation\NV_Cache|* FileKey22=%ProgramData%\NVIDIA Corporation\NvFBCPlugin|log*.txt FileKey23=%ProgramData%\NVIDIA\NvBackend\Updatus\DownloadManager|* FileKey24=%ProgramData%\NVIDIA\Updatus|*.bak;*.log FileKey25=%ProgramData%\NVIDIA\Updatus\DownloadManager|* FileKey26=%ProgramFiles%\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs|* FileKey27=%ProgramFiles%\NVIDIA Corporation\NVIDIA GeForce Experience|*.log FileKey28=%SystemDrive%\NvidiaLogging\GFExperience|GridClientLog.log*|RECURSE FileKey29=%WinDir%\ServiceProfiles\LocalService\AppData\Local\NVIDIA\DXCache|* ExcludeKey1=PATH|%LocalAppData%\NVIDIA Corporation\*\CefCache\IndexedDB\|*.log [NVIDIA Broadcast *] LangSecRef=3024 DetectFile=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast FileKey1=%ProgramData%\NVIDIA Corporation\NVIDIA Broadcast|*.log;*.txt [O&O Defrag *] LangSecRef=3024 Detect=HKCU\Software\O&O\O&O Defrag FileKey1=%UserProfile%\Documents\O&O\O&O Defrag\data\reports|*.*|RECURSE [O&O SafeErase *] LangSecRef=3024 Detect=HKCU\Software\O&O\O&O SafeErase\7 FileKey1=%UserProfile%\Documents\O&O\O&O SafeErase\7\Reports|*.html RegKey1=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisAdditionalErrorMessage RegKey2=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisDateTime RegKey3=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisReportPath RegKey4=HKCU\Software\O&O\O&O SafeErase\7|LastAnalysisResultString [OBS *] LangSecRef=3023 DetectFile1=%AppData%\OBS DetectFile2=%AppData%\obs-studio FileKey1=%AppData%\OBS|*.log|RECURSE FileKey2=%AppData%\OBS\crashDumps|*.* FileKey3=%AppData%\obs-studio\crashes|*.* FileKey4=%AppData%\obs-studio\logs|* FileKey5=%AppData%\obs-studio\plugin_config\obs-browser|*|REMOVESELF FileKey6=%AppData%\obs-studio\profiler_data|* FileKey7=%AppData%\obs-studio\profiler_data|*.* ExcludeKey1=FILE|%AppData%\obs-studio\plugin_config\obs-browser\|LocalPrefs.json [Observer *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\514900 FileKey1=%AppData%\Aspyr Media\Game Guide 3\Cache|*.*|RECURSE FileKey2=%LocalAppData%\TheObserver\Saved\Logs|*.* [OcenAudio *] LangSecRef=3023 DetectFile=%LocalAppData%\OcenAudio FileKey1=%LocalAppData%\OcenAudio|ocen.database [Octoshape *] LangSecRef=3023 DetectFile=%LocalAppData%\Octoshape\Octoshape Streaming Services FileKey1=%LocalAppData%\Octoshape\Octoshape Streaming Services\temp|*.* [Oculus *] Section=Games DetectFile=%AppData%\Oculus FileKey1=%AppData%\Oculus\Logs|*.* FileKey2=%AppData%\OculusClient|*-journal;*.old;LOG;Network Persistent State|RECURSE FileKey3=%AppData%\OculusClient\*Cache|*.*|RECURSE FileKey4=%AppData%\OculusClient\webrtc_event_logs|*.* FileKey5=%LocalAppData%\Oculus|*.log;*.txt;PerfLog_*.json [OE Classic *] LangSecRef=3022 Detect=HKCU\Software\OEClassic FileKey1=%LocalAppData%\OEClassic\Prg\Res|*.*|RECURSE FileKey2=%LocalAppData%\OEClassic\Prg\T|*.*|RECURSE ExcludeKey1=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.aff ExcludeKey2=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.dic ExcludeKey3=PATH|%LocalAppData%\OEClassic\Prg\Res\|dict-*.license [OEM Logs *] LangSecRef=3021 DetectFile1=%ProgramData%\oem DetectFile2=%SystemDrive%\OEM DetectFile3=%WinDir%\System32\OEM DetectFile4=%WinDir%\SysWOW64\OEM FileKey1=%ProgramData%\oem|*.log|RECURSE FileKey2=%SystemDrive%\OEM|*.log|RECURSE FileKey3=%WinDir%\oem|*.log;*.log.txt|RECURSE FileKey4=%WinDir%\System32\OEM|*.log FileKey5=%WinDir%\SysWOW64\OEM|*.log [Off-Road Drive *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\200230 FileKey1=%UserProfile%\Documents\My Games\PP3\PP3WorkGame\Logs|*.* [Office Password Recovery *] LangSecRef=3024 Detect=HKCU\Software\Intelore\Office Password Recovery FileKey1=%AppData%\Intelore\Password Recovery\logs|*.* [Okular *] LangSecRef=3021 DetectFile=%LocalAppData%\okular FileKey1=%LocalAppData%\okular\docdata|*.xml [OmniTracker *] LangSecRef=3021 Detect=HKCU\Software\OmniNet\OmniTracker FileKey1=%LocalAppData%\OMNINET GmbH\OMNITRACKER\Temp|*.*|RECURSE RegKey1=HKCU\Software\OmniNet\OmniTracker\MRU RegKey2=HKCU\Software\OmniNet\OmniTracker\SearchTextHistory [One More Multiverse *] Section=Games DetectFile=%AppData%\OneMoreMultiverse FileKey1=%AppData%\OneMoreMultiverse|Cookies*;*State;Quota* FileKey2=%AppData%\OneMoreMultiverse\*cache|*|RECURSE FileKey3=%AppData%\OneMoreMultiverse\blob_storage|*|REMOVESELF FileKey4=%AppData%\OneMoreMultiverse\logs|* FileKey5=%AppData%\OneMoreMultiverse\One More Multiverse\logs|* [OneSafe PC Cleaner *] LangSecRef=3024 Detect=HKCU\Software\OneSafe PC Cleaner FileKey1=%AppData%\OneSafe PC Cleaner\Log|*.xml RegKey1=HKCU\Software\OneSafe PC Cleaner|InstallationDate RegKey2=HKCU\Software\OneSafe PC Cleaner|InstallerName RegKey3=HKCU\Software\OneSafe PC Cleaner|LastScanDate RegKey4=HKCU\Software\OneSafe PC Cleaner|LastUpdCheck [OneTeam *] LangSecRef=3022 Detect=HKCU\Software\OneTeam FileKey1=%AppData%\oneteam\profiles\*\oneteamcachefiles|*.*|RECURSE FileKey2=%LocalAppData%\oneteam\profiles\*\cache|*.*|RECURSE [Ontrack EasyRecovery *] LangSecRef=3024 DetectFile=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery* FileKey1=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery*|*er*_log.txt FileKey2=%ProgramFiles%\Kroll Ontrack\Ontrack EasyRecovery*\licman|*_log.txt;*.tmp [Ookla Speed Test *] LangSecRef=3022 DetectFile1=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla* DetectFile2=%UserProfile%\AppData\LocalLow\Ookla\Speedtest FileKey1=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla*\LocalState|*.tmp|RECURSE FileKey3=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla*\LocalState\Unity\Local.*\Analytics\ArchivedEvents\*|*|REMOVESELF FileKey4=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla*\TempState|*|RECURSE FileKey6=%UserProfile%\AppData\LocalLow\Ookla\Speedtest|*log.txt [OpalCalc *] LangSecRef=3021 DetectFile1=%AppData%\OpalCalc_prefs DetectFile2=%ProgramFiles%\OpalCalc FileKey1=%AppData%\OpalCalc_prefs|lastSession.txt [Open Blu-ray to DVD *] LangSecRef=3023 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Blu-ray to DVD Pro_is1 FileKey1=%ProgramFiles%\Blu-ray to DVD*|*.log;*.txt FileKey2=%ProgramFiles%\Blu-ray to DVD*\ReadCache|*.* [Open Blu-ray/DVD Ripper *] LangSecRef=3023 Detect1=HKCU\Software\OpenCloner\BDRipper Detect2=HKCU\Software\OpenCloner\DVDRipper FileKey1=%AppData%\Open * Ripper|O*R_LOG_FILE.txt FileKey2=%AppData%\Open * Ripper\ReadCache|*.*|REMOVESELF [Open Freely *] LangSecRef=3021 DetectFile=%ProgramFiles%\Open Freely FileKey1=%ProgramFiles%\Open Freely|mostRecentFiles.ini FileKey2=%ProgramFiles%\Open Freely\NGEN|*.log|RECURSE [Open With Arguments *] LangSecRef=3024 Detect=HKCU\Software\OpenArgs RegKey1=HKCU\Software\OpenArgs\History [OpenCandy *] LangSecRef=3021 DetectFile1=%AppData%\OpenCandy DetectFile2=%AppData%\RHEng DetectFile3=%AppData%\RPEng FileKey1=%AppData%\OpenCandy|*.*|REMOVESELF FileKey2=%AppData%\RHEng|*.*|REMOVESELF FileKey3=%AppData%\RPEng|*.*|REMOVESELF [OpenDNS Updater *] LangSecRef=3021 Detect=HKCU\Software\OpenDNS Updater FileKey1=%AppData%\OpenDNS Updater|*.txt [OpenFire *] LangSecRef=3022 DetectFile=%ProgramFiles%\Openfire FileKey1=%ProgramFiles%\Openfire\Logs|*.* [OpenMG *] LangSecRef=3023 DetectFile=%ProgramData%\Sony Corporation\OpenMG FileKey1=%ProgramData%\Sony Corporation\OpenMG|*.log FileKey2=%ProgramData%\Sony Corporation\OpenMG\CD Walkman\Temp|*|REMOVESELF [OpenMG Jukebox *] LangSecRef=3023 DetectFile=%AppData%\Sony\OpenMG Jukebox FileKey1=%AppData%\Sony\OpenMG Jukebox\Temp|*.* [OpenOffice.org *] LangSecRef=3021 Detect1=HKLM\Software\OpenOffice Detect2=HKLM\Software\OpenOffice.org FileKey1=%AppData%\OpenOffice*\*\user|*.log*;*.tmp;registrymodifications.xcu;registration.xml|RECURSE FileKey2=%AppData%\OpenOffice*\*\user\config\imagecache|*.* FileKey3=%AppData%\OpenOffice*\*\user\registry\cache|*.* FileKey4=%AppData%\OpenOffice*\*\user\registry\data\org\openoffice\Office|Views.xcu;Writer.xcu;Common.xcu;Histories.xcu FileKey5=%AppData%\OpenOffice*\*\user\registry\data\org\openoffice\ucb|Hierarchy.xcu;Store.xcu FileKey6=%ProgramFiles%\OpenOffice*\program|*.log|RECURSE FileKey7=%ProgramFiles%\OpenOffice*\program_old*|*.*|REMOVESELF FileKey8=%ProgramFiles%\OpenOffice*\share\uno_packages\cache\uno_packages|*.tmp;*.log;log.txt FileKey9=%UserProfile%\Desktop\OpenOffice.org * Installation Files|*.*|REMOVESELF [OpenRA *] Section=Games DetectFile=%UserProfile%\Documents\OpenRA FileKey1=%UserProfile%\Documents\OpenRA\Logs|*.* [OpenRGB *] LangSecRef=3024 DetectFile=%AppData%\OpenRGB FileKey1=%AppData%\OpenRGB\logs|*.log [OpenShot *] LangSecRef=3023 DetectFile1=%ProgramFiles%\OpenShot Video Editor DetectFile2=%UserProfile%\.openshot_qt FileKey1=%ProgramFiles%\OpenShot Video Editor\settings|*.log FileKey2=%UserProfile%\.openshot_qt|*.log FileKey3=%UserProfile%\.openshot_qt\*cache|*.* FileKey4=%UserProfile%\.openshot_qt\thumbnail|*.png [OpenVPN *] LangSecRef=3022 Detect=HKLM\Software\OpenVPN FileKey1=%ProgramFiles%\OpenVPN\Log|*.log FileKey2=%UserProfile%\OpenVPN\log|*.*|RECURSE [Optimizer Pro *] LangSecRef=3024 Detect=HKCU\Software\Optimizer Pro FileKey1=%AppData%\Optimizer Pro\Log|*.* [OptimumLink *] LangSecRef=3021 DetectFile=%AppData%\OptimumLink FileKey1=%AppData%\OptimumLink|TrayLogs*.* [Orcs Must Die! Unchained *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Orcs Must Die Unchained FileKey1=%UserProfile%\Documents\My Games\Orcs Must Die Unchained\SpitfireGame\Logs|*.log;*.dmg|RECURSE [Osmos *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\29180 FileKey1=%UserProfile%\Documents\Osmos|osmos.log [OSO Update *] LangSecRef=3022 DetectFile=%UserProfile%\CC-Logs FileKey1=%UserProfile%\CC-Logs\osoupd|*.log [osu! *] Section=Games Detect=HKCU\Software\Osu! FileKey1=%LocalAppData%\osu!\logs|*.* FileKey2=%ProgramFiles%\Osu!|debug-import.txt [Outlast *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Outlast* FileKey1=%UserProfile%\Documents\My Games\Outlast*\OLGame\Logs|*.* [Outward *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Nine Dots Studio\Outward FileKey1=%UserProfile%\AppData\LocalLow\Nine Dots Studio\Outward|*log.txt [Oxygen 14 *] LangSecRef=3021 DetectFile=%ProgramFiles%\Oxygen XML Editor 14 FileKey1=%ProgramFiles%\Oxygen XML Editor 14|*.properties;*.log FileKey2=%ProgramFiles%\Oxygen XML Editor 14\.install4j|*.log FileKey3=%ProgramFiles%\Oxygen XML Editor 14\dicts|*.txt;*.html FileKey4=%ProgramFiles%\Oxygen XML Editor 14\lib|*.txt|RECURSE ExcludeKey1=FILE|%ProgramFiles%\Oxygen XML Editor 14\.install4j\|files.log [PACE Eden *] LangSecRef=3021 DetectFile=%LocalAppData%\PACE\Eden FileKey1=%LocalAppData%\PACE\Eden\Logs|*|RECURSE FileKey2=%LocalAppData%\PaceAp\iLok License Manager\Cache\Images|*|RECURSE FileKey3=%ProgramData%\PACE\Eden\LdLogs|* [Pacific Storm *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\11250 DetectFile=%ProgramFiles%\Buka\Pacific Storm FileKey1=%ProgramFiles%\Buka\Pacific Storm|*.log|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\Common\Pacific Storm*|*.log|RECURSE [PageTech PCLReader *] LangSecRef=3024 Detect=HKLM\SOFTWARE\PageTech DetectFile=%ProgramData%\PageTech FileKey1=%ProgramData%\PageTech|*.log [Painkiller Hell & Damnation *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\214870 FileKey1=%UserProfile%\Documents\My Games\Painkiller Hell and Damnation\PKHDGame\Logs|*.* [Paint Shop Pro *] LangSecRef=3023 Detect=HKCU\Software\Jasc\Paint Shop Pro 6 FileKey1=%ProgramFiles%\Jasc Software Inc\Paint Shop Pro*\Cache|*.* RegKey1=HKCU\Software\Jasc\Paint Shop Pro 6\Recent File List [Paint.NET *] LangSecRef=3021 Detect=HKCU\Software\Paint.NET FileKey1=%AppData%\CustomBrushesMini\ThumbCache|*.*|RECURSE FileKey2=%LocalAppData%\Paint.NET|*.*|RECURSE RegKey1=HKCU\Software\Paint.NET|LastFileDialogDirectory [PaintTool SAI *] LangSecRef=3023 DetectFile=%AppData%\SYSTEMAX Software Development\SAI* FileKey1=%AppData%\SYSTEMAX Software Development\SAI*|recent.txt FileKey2=%UserProfile%\Documents\SYSTEMAX Software Development\SAI*\error|*.txt [Paltalk Messenger *] LangSecRef=3022 DetectFile=%ProgramFiles%\Paltalk Messenger FileKey1=%AppData%\Paltalk|*.*|RECURSE [Panasonic HD Writer *] LangSecRef=3023 DetectFile=%LocalAppData%\Panasonic\HD Writer* FileKey1=%LocalAppData%\Panasonic\HD Writer*\Log|* FileKey2=%ProgramData%\Panasonic\HD Writer*|EventLog.evl|RECURSE [Panda Antivirus *] LangSecRef=3024 Detect=HKLM\Software\Panda Security FileKey1=%ProgramData%\Panda Security\Panda Devices Agent\Logs|* FileKey2=%ProgramData%\Panda Security\Panda Security Protection|*.log FileKey3=%ProgramData%\Panda Security\Panda Security Protection\Logs|* FileKey4=%ProgramData%\Panda Security\Panda Security Protection\SRFRepository|*.bak FileKey5=%ProgramData%\Panda Security\PSLogs|*.log [Pandion *] LangSecRef=3022 Detect=HKCU\Software\Pandion FileKey1=%AppData%\Pandion\Avatars|*.*|RECURSE FileKey2=%AppData%\Pandion\Message Cache|*.*|RECURSE [Pandion Chat Logs *] LangSecRef=3022 Detect=HKCU\Software\Pandion FileKey1=%AppData%\Pandion\Profiles|*.log;*.buffer|RECURSE [Paradox Interactive Launcher *] Section=Games DetectFile1=%AppData%\Launcher-main DetectFile2=%LocalAppData%\Paradox Interactive\Launcher* FileKey1=%AppData%\Launcher-main|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE FileKey2=%AppData%\Launcher-main\*Cache|* FileKey3=%AppData%\Launcher-main\blob_storage|*|RECURSE FileKey4=%AppData%\Paradox Interactive\launcher-v2\cache|* FileKey5=%AppData%\Paradox Launcher\Logs|* FileKey6=%LocalAppData%\Paradox Interactive\Launcher*|* FileKey7=%LocalAppData%\Paradox Interactive\Launcher*\Chromium-Data|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE FileKey8=%LocalAppData%\Paradox Interactive\Launcher*\Chromium-Data\*Cache|*|REMOVESELF FileKey9=%LocalAppData%\Paradox Interactive\Launcher*\Chromium-Data\blob_storage|*|RECURSE FileKey10=%LocalAppData%\Paradox Interactive\Launcher*\Logs|* FileKey11=%UserProfile%\Documents\Paradox Interactive\CrashReporter\Logs|* FileKey12=%UserProfile%\Documents\Paradox Interactive\CrashReporter\ShaderCache\dx*|*|RECURSE [Paragon Software *] LangSecRef=3024 DetectFile=%ProgramFiles%\Paragon Software FileKey1=%ProgramData%\clonehdd|*.log FileKey2=%ProgramData%\converthfs|*.log FileKey3=%ProgramData%\createpart|*.log FileKey4=%ProgramData%\deletepart|*.log FileKey5=%ProgramData%\explauncher|*.log FileKey6=%ProgramData%\formatpart|*.log FileKey7=%ProgramData%\ftw|*.log FileKey8=%ProgramData%\launcher|*.log FileKey9=%ProgramData%\logsaver|*.log FileKey10=%ProgramData%\migrateos|*.log FileKey11=%ProgramData%\redistpart|*.log FileKey12=%ProgramData%\vmadjust|*.log FileKey13=%ProgramData%\vmcreate|*.log FileKey14=%ProgramData%\wipe|*.log FileKey15=%ProgramFiles%\Paragon Software\*|*.log;*.txt|RECURSE FileKey16=%SystemDrive%\Documents and Settings\LocalService|objsrv.log [Parallel Password Recovery *] LangSecRef=3024 Detect=HKCU\Software\Parallel Password Recovery FileKey1=%ProgramFiles%\Parallel Password Recovery|*.log RegKey1=HKCU\Software\Parallel Password Recovery\Parallel recovery server\1.0|Last stored job RegKey2=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Last password definition file path RegKey3=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Last test path RegKey4=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to password definition file RegKey5=HKCU\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to test file RegKey6=HKLM\Software\Parallel Password Recovery\Parallel recovery server\1.0|Last stored job RegKey7=HKLM\Software\Parallel Password Recovery\PPR GUI manager\1.0|Last test path RegKey8=HKLM\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to password definition file RegKey9=HKLM\Software\Parallel Password Recovery\PPR GUI manager\1.0|Path to test file RegKey10=HKLM\Software\Wow6432Node\Parallel Password Recovery\Parallel recovery server\1.0|Last stored job RegKey11=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Last password definition file path RegKey12=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Last test path RegKey13=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Path to password definition file RegKey14=HKLM\Software\Wow6432Node\Parallel Password Recovery\PPR GUI manager\1.0|Path to test file [Paramount Dynamic *] LangSecRef=3023 DetectFile=%LocalAppData%\Microsoft\Windows\Themes\ParamountDynamic.theme Warning=This will cause you to redownload the Paramount Dynamic RSS file. FileKey1=%LocalAppData%\Microsoft\Feeds|http~c~f~fthemeserver~dmicrosoft~dcom~fdefault~daspx~mp*Paramount* [Paranormal Agency *] Section=Games DetectFile=%AppData%\Shape Games\Paranormal_v* FileKey1=%AppData%\Shame Games\Paranormal_v*\logs|*.* [Parsec *] LangSecRef=3022 DetectFile=%AppData%\Parsec FileKey1=%AppData%\Parsec|log.txt [Partner Application *] LangSecRef=3022 DetectFile=%ProgramData%\Partner FileKey1=%ProgramData%\Partner|*.log [Passware Encryption Analyzer *] LangSecRef=3021 DetectFile1=%AppData%\Passware\EncryptionAnalyzer DetectFile2=%ProgramFiles%\Passware\Encryption Analyzer* FileKey1=%AppData%\EncryptionAnalyzer\logs|*.* FileKey2=%AppData%\Passware\EncryptionAnalyzer\*|config.json;Network Persistent State FileKey3=%AppData%\Passware\EncryptionAnalyzer\*\*Cache|*.*|RECURSE FileKey4=%AppData%\Passware\EncryptionAnalyzer\*\blob_storage|*.*|RECURSE FileKey5=%AppData%\Passware\EncryptionAnalyzer\*\Local Storage\leveldb|*.old;LOG FileKey6=%AppData%\Passware\EncryptionAnalyzer\*\logs|*.* FileKey7=%AppData%\Passware\EncryptionAnalyzer\*\Session Storage|*.old;LOG FileKey8=%AppData%\PasswareEncryptionAnalyzer\logs|*.* [Passware Search Index Examiner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Passware\Search Index Examiner* FileKey1=%AppData%\Passware\SearchIndexExaminer|Settings.bin [Patch My PC *] LangSecRef=3024 DetectFile=%LocalAppData%\Patch_My_PC,_LLC FileKey1=%LocalAppData%\Patch_My_PC,_LLC|*.*|RECURSE [Path of Exile *] Section=Games Detect1=HKCU\Software\GrindingGearGames\Path of Exile Detect2=HKCU\Software\Valve\Steam\Apps\238960 FileKey1=%ProgramFiles%\Grinding Gear Games\Path of Exile\Logs|*.* FileKey2=%ProgramFiles%\Steam\steamapps\common\Path of Exile\logs|*.* FileKey3=%UserProfile%\Documents\My Games\Path of Exile\Minimap|*.* [PAYDAY 2 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\218620 DetectFile=%LocalAppData%\PAYDAY 2 FileKey1=%LocalAppData%\PAYDAY 2|crash*.txt [PC Doctor *] LangSecRef=3024 DetectFile=%ProgramFiles%\PC-Doctor For Windows FileKey1=%ProgramFiles%\PC-Doctor For Windows\Logs|*.* [PC Optimizer Pro *] LangSecRef=3024 DetectFile=%ProgramData%\PC optimizer pro FileKey1=%ProgramData%\PC Optimizer Pro\Logs|* [PC TechZone Merlin InstantFeedback *] LangSecRef=3024 DetectFile=%ProgramFiles%\PC TechZone\Merlin InstantFeedback FileKey1=%ProgramFiles%\PC TechZone\Merlin InstantFeedback|*Log.txt;seller.txt;*.tmp FileKey2=%ProgramFiles%\PC TechZone\Merlin InstantFeedback\Logs|*.* [PC Trek Advanced Password Recovery Suite *] LangSecRef=3021 DetectFile=%ProgramFiles%\Advanced Password Recovery Suite FileKey1=%ProgramFiles%\Advanced Password Recovery Suite|dscnt.exe [PCMark 10 *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\PCMark 10 FileKey1=%UserProfile%\Documents\PCMark 10|*.*|REMOVESELF [PCSX2 *] Section=Games DetectFile=%UserProfile%\Documents\PCSX2 FileKey1=%UserProfile%\Documents\PCSX2\logs|*.*|RECURSE FileKey2=%UserProfile%\Documents\PCSX2\snaps|*.*|RECURSE [PCWinBooster *] LangSecRef=3024 DetectFile=%AppData%\Soft4Boost\PCWinBooster* FileKey1=%AppData%\Soft4Boost\Logs|*.*|RECURSE [PDF-XChange *] LangSecRef=3021 Detect1=HKCU\Software\Tracker Software\PDFViewer Detect2=HKCU\Software\Tracker Software\PDFXEditor FileKey1=%LocalAppData%\Tracker Software\LiveUpdate\Updates|* FileKey2=%ProgramData%\Tracker Software\PDFXShellExt\Ifilter\Temp|*.tmp FileKey3=%ProgramData%\Tracker Software\TrackerUpdate|TrackerUpdate.exe.del FileKey4=%ProgramData%\Tracker Software\TrackerUpdate\Download|* RegKey1=HKCU\Software\Tracker Software\PDFViewer\Documents\LastOpened RegKey2=HKCU\Software\Tracker Software\PDFViewer\Documents\LatestView\Bars RegKey3=HKCU\Software\Tracker Software\PDFViewer\Documents\LatestView\Panes [PDF Annotator *] LangSecRef=3021 Detect=HKCU\Software\GRAHL\PDFAnnotator RegKey1=HKCU\Software\GRAHL\PDFAnnotator\3.0\Files\MRUItems RegKey2=HKCU\Software\GRAHL\PDFAnnotator\4.0\Files\MRUItems [PDF Architect *] LangSecRef=3021 DetectFile1=%AppData%\PDF Architect* DetectFile2=%AppData%\pdfforge_gmbh\PDF_Architect* FileKey1=%AppData%\PDF Architect*\Logs|*.* FileKey2=%AppData%\pdfforge_gmbh\PDF_Architect*\minidump|*.dmp|RECURSE [PDF Editor 4 *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDF Editor 4 FileKey1=%ProgramFiles%\PDF Editor 4|*.log;*.diz [PDF Explorer *] LangSecRef=3021 Detect=HKCU\Software\PDFExplorer RegKey1=HKCU\Software\PDFExplorer\Options|LastDiskTreeFolder RegKey2=HKCU\Software\PDFExplorer\Options|ScanGridStartupFolder [PDF24 Creator *] LangSecRef=3021 DetectFile=%ProgramFiles%\PDF24 FileKey1=%ProgramFiles%\PDF24|*.log [PDFCreator *] LangSecRef=3021 DetectFile=%LocalAppData%\PDFForge\PDFCreator FileKey1=%LocalAppData%\PDFForge\PDFCreator|PDFCreatorHistory.json [PDFill PDF Tools *] LangSecRef=3021 DetectFile=%ProgramFiles%\PlotSoft\PDFill_PDF_Tools FileKey1=%ProgramFiles%\PlotSoft\PDFill_PDF_Tools\download|gs.zip [PDFsam *] LangSecRef=3021 DetectFile1=%AppData%\PDFsam Enhanced* DetectFile2=%ProgramData%\PDFsam Basic FileKey1=%AppData%\PDFsam Enhanced*\logs|*.htm FileKey2=%ProgramData%\PDFsam Basic|*.msi FileKey3=%ProgramData%\PDFsam Enhanced*\Installation|*.exe;*.msi FileKey4=%ProgramData%\PDFsam Enhanced*\Installation\logs|* [PDFStreamDumper *] LangSecRef=3024 Detect=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper RegKey1=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper\Settings|LastFile RegKey2=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper\Settings|lastFind RegKey3=HKCU\Software\VB and VBA Program Settings\PDFStreamDumper\Settings|lastReplace [PE Module Explorer *] LangSecRef=3024 Detect=HKCU\Software\Woozle\PE Module Explorer RegKey1=HKCU\Software\Woozle\PE Module Explorer\Recent Files [PeaZip *] LangSecRef=3024 DetectFile=%ProgramFiles%\PeaZip FileKey1=%ProgramFiles%\PeaZip\res|note.txt|RECURSE [Peerblock *] LangSecRef=3024 DetectFile=%ProgramFiles%\Peerblock FileKey1=%ProgramFiles%\Peerblock|*.log;History.db;*.bak;cache.p2b FileKey2=%ProgramFiles%\Peerblock\lists|*.list.failed* [Pegasus Mail *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pegasus Mail FileKey1=%SystemDrive%\PMAIL\MAIL|SYSLOG.PM FileKey2=%SystemDrive%\PMAIL\Programs|*.log [Pelles C *] LangSecRef=3021 Detect=HKCU\Software\Pelle Orinius\PellesC RegKey1=HKCU\Software\Pelle Orinius\PellesC\Recent File List RegKey2=HKCU\Software\Pelle Orinius\PellesC\Recent Project List RegKey3=HKCU\Software\Pelle Orinius\PellesC\Recent Search List [Penumbra Black Plague *] Section=Games DetectFile=%UserProfile%\Documents\Penumbra* FileKey1=%UserProfile%\Documents\Penumbra*\*|*.log [PerfectDisk *] LangSecRef=3024 Detect=HKCU\Software\Raxco\PerfectDisk FileKey1=%ProgramData%\Raxco\PerfectDisk\*|*.log;*.txt;PDBootLog [PerfectKeyboard *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\PerfectKeyboardFiles FileKey1=%UserProfile%\Documents\PerfectKeyboardFiles\Temp|log.txt [PerfectRegistry *] LangSecRef=3024 Detect=HKCU\Software\Raxco\PerfectRegistry DetectFile=%ProgramFiles%\Raxco\PerfectRegistry FileKey1=%AppData%\Raxco\PerfectRegistry|*.log;TempHLList.rcp [PerfectUpdater *] LangSecRef=3024 Detect=HKCU\Software\Raxco\PerfectUpdater FileKey1=%AppData%\Raxco\PerfectUpdater|*.log FileKey2=%AppData%\Raxco\PerfectUpdater\Backup|*.* FileKey3=%AppData%\Raxco\PerfectUpdater\Download|*.* [Performance Maintainer *] LangSecRef=3024 DetectFile=%ProgramFiles%\PC Starters\Performance Maintainer FileKey1=%ProgramFiles%\PC Starters\Performance Maintainer\Backups|*|RECURSE FileKey2=%ProgramFiles%\PC Starters\Performance Maintainer\log*|*|RECURSE [Pet Pals: Animal Doctor *] Section=Games Detect=HKLM\Software\Legacy Interactive\Pet Pals FileKey1=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor|*.log FileKey2=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre|*.* FileKey3=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\temp|*.*|REMOVESELF ExcludeKey1=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\bin\|*.* ExcludeKey2=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\lib\|*.* [pgAdmin *] LangSecRef=3024 DetectFile=%AppData%\pgAdmin FileKey1=%AppData%\pgAdmin|pgadmin*.log [phase-6 *] LangSecRef=3021 DetectFile=%UserProfile%\.phase-6 FileKey1=%UserProfile%\.phase-6|window-position.txt FileKey2=%UserProfile%\.phase-6\logs|phase-6.log [Phorest *] LangSecRef=3024 Detect=HKCU\Software\FutureFog\Phorest\Options RegKey1=HKCU\Software\FutureFog\Phorest\Layout|SelectionHeight RegKey2=HKCU\Software\FutureFog\Phorest\Layout|SelectionLeft RegKey3=HKCU\Software\FutureFog\Phorest\Layout|SelectionTop RegKey4=HKCU\Software\FutureFog\Phorest\Layout|SelectionWidth RegKey5=HKCU\Software\FutureFog\Phorest\Options|LastUsedFolder [Photo DVD Slideshow *] LangSecRef=3023 DetectFile=%AppData%\Photo DVD Slideshow FileKey1=%AppData%\Photo DVD Slideshow|*.log FileKey2=%AppData%\Photo DVD Slideshow\PhotosCache|*.* [Photo Print Calendar 3.00E Beta *] LangSecRef=3021 Detect=HKLM\Software\Computer Institute of Japan, Ltd.\Photo Print Calendar from YOKOHAMA Ver.3.00E beta\3.00E beta FileKey1=%ProgramFiles%\Photo Print Calendar|update.bmp [Photo Stamp Remover *] LangSecRef=3023 Detect=HKCU\Software\softorbits\PhotoStampRemover RegKey1=HKCU\Software\softorbits\PhotoStampRemover|currentFile [Photo! Editor *] LangSecRef=3024 Detect=HKCU\Software\VicMan Software\Photo! Editor FileKey1=%ProgramFiles%\Photo!\Photo! Editor|*.log RegKey1=HKCU\Software\VicMan Software\Photo! Editor|LastFolder [PhotoFlare *] LangSecRef=3023 Detect=HKCU\Software\photoflare.io\PhotoFlare RegKey1=HKCU\Software\photoflare.io\PhotoFlare|OpenFolder RegKey2=HKCU\Software\photoflare.io\PhotoFlare|RecentFiles RegKey3=HKCU\Software\photoflare.io\PhotoFlare|SaveFolder RegKey4=HKCU\Software\photoflare.io\PhotoFlare|SaveFormat [PhotoPad Photo Editor *] LangSecRef=3023 Detect=HKCU\Software\NCH Software\PhotoPad FileKey1=%ProgramFiles%\NCH Software\PhotoPad|photopadsetup_*.exe RegKey1=HKCU\Software\NCH Software\PhotoPad\RecentFileList RegKey2=HKCU\Software\NCH Software\PhotoPad\Settings|DefaultExt RegKey3=HKCU\Software\NCH Software\PhotoPad\Settings|MinutesRunSinceLastInstall RegKey4=HKCU\Software\NCH Software\PhotoPad\Settings|ProjectFolder RegKey5=HKCU\Software\NCH Software\PhotoPad\UsageStats [PhotoScissors *] LangSecRef=3021 Detect=HKCU\Software\Teorex\PhotoScissors RegKey1=HKCU\Software\Teorex\PhotoScissors\Recent File List RegKey2=HKCU\Software\Teorex\PhotoScissors\RecentFileList [PhotoToFilm *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\PhotoToFilm FileKey1=%AppData%\KC Softwares\PhotoToFilm|*.log [PhotoZoom Pro *] LangSecRef=3023 Detect1=HKCU\Software\BenVista\PhotoZoom Pro 6 Detect2=HKCU\Software\BenVista\PhotoZoom Pro 7 Detect3=HKCU\Software\BenVista\PhotoZoom Pro 8 RegKey1=HKCU\Software\BenVista\PhotoZoom Pro 6|FileDir RegKey2=HKCU\Software\BenVista\PhotoZoom Pro 6\Recent Images RegKey3=HKCU\Software\BenVista\PhotoZoom Pro 7|FileDir RegKey4=HKCU\Software\BenVista\PhotoZoom Pro 7\Recent Images RegKey5=HKCU\Software\BenVista\PhotoZoom Pro 8|FileDir RegKey6=HKCU\Software\BenVista\PhotoZoom Pro 8\Recent Images [PHPStorm *] LangSecRef=3024 DetectFile=%UserProfile%\.WebIde40 FileKey1=%UserProfile%\.WebIde40\LocalHistory|*.*|RECURSE FileKey2=%UserProfile%\.WebIde40\Log|*.*|RECURSE FileKey3=%UserProfile%\.WebIde40\system\caches|*.*|RECURSE FileKey4=%UserProfile%\.WebIde40\tmp|*.*|RECURSE [PhraseExpress *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\PhraseExpress FileKey1=%UserProfile%\Documents\PhraseExpress|*.bak [PhrozenSoft *] LangSecRef=3024 DetectFile=%AppData%\PhrozenSoft FileKey1=%AppData%\PhrozenSoft\PVTUploader|phrzvtu.db [Phyxion.net Driver Sweeper *] LangSecRef=3024 DetectFile=%ProgramFiles%\Phyxion.net\Driver Sweeper\Logs FileKey1=%ProgramFiles%\Phyxion.net\Driver Sweeper\Backup|*.*|RECURSE FileKey2=%ProgramFiles%\Phyxion.net\Driver Sweeper\Logs|*.*|RECURSE [Pi Network *] LangSecRef=3021 DetectFile=%LocalAppData%\programs\pi-network-desktop FileKey1=%AppData%\Pi Network|*-journal;*.old;*.tmp;LOG;Network Persistent State;QuotaManager|RECURSE FileKey2=%AppData%\Pi Network\*Cache|*.*|RECURSE FileKey3=%AppData%\Pi Network\blob_storage|*.*|RECURSE FileKey4=%AppData%\Pi Network\Crashpad\reports|*.dmp FileKey5=%AppData%\Pi Network\Logs|*.* FileKey6=%AppData%\Pi Network\Pi Network\Logs|*.* FileKey7=%AppData%\Pi Network\VideoDecodeStats|*.* FileKey8=%LocalAppData%\pi-network-desktop-updater|installer.exe FileKey9=%LocalAppData%\pi-network-desktop-updater\pending|*Setup*.exe [PicoPDF PDF Editor *] LangSecRef=3021 Detect=HKCU\Software\NCH Software\PicoPDF FileKey1=%ProgramFiles%\NCH Software\PicoPDF|picopdfsetup_*.exe RegKey1=HKCU\Software\NCH Software\PicoPDF\General|lastfile RegKey2=HKCU\Software\NCH Software\PicoPDF\General|lastimagefolder RegKey3=HKCU\Software\NCH Software\PicoPDF\RecentFileList RegKey4=HKLM\Software\NCH Software\PicoPDF\Settings|InstallerName RegKey5=HKLM\Software\NCH Software\PicoPDF\Software|Installer [PictoQuest *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\NanoPiko\PictoQuest FileKey1=%UserProfile%\AppData\LocalLow\NanoPiko\PictoQuest|*txt [PictureTrail Photo Editor *] LangSecRef=3023 Detect=HKCU\Software\PictureTrail Photo Editor\PictureTrail Photo Editor RegKey1=HKCU\Software\Local AppWizard-Generated Applications\PictureTrail Photo Editor\Recent File List RegKey2=HKCU\Software\PictureTrail Photo Editor\PictureTrail Photo Editor\Recent File List [Pictus *] LangSecRef=3023 Detect=HKLM\Software\Poppeman\Pictus DetectFile=%AppData%\Poppeman\Pictus FileKey1=%AppData%\Poppeman\Pictus|runlog.txt;setup.txt [PicView *] LangSecRef=3023 DetectFile=%ProgramFiles%\PicView FileKey1=%LocalAppData%\Ruben2776\PicView_StrongName_*\*|Recent.txt [Pidgin *] LangSecRef=3022 Detect=HKCU\Software\Pidgin FileKey1=%AppData%\.purple|*.xml~ FileKey2=%UserProfile%|Recently-Used.xbel [Pidgin Chat Logs *] LangSecRef=3022 Detect=HKCU\Software\Pidgin FileKey1=%AppData%\.purple\logs|*.*|REMOVESELF [Pinnacle Studio *] LangSecRef=3023 DetectFile=%ProgramFiles%\Pinnacle\Studio* FileKey1=%ProgramFiles%\Pinnacle\Studio*|*.log FileKey2=%ProgramFiles%\Pinnacle\Studio*\Programs|*.log [Pioneer Rekordbox *] LangSecRef=3023 DetectFile=%AppData%\Pioneer\Rekordbox FileKey1=%AppData%\Pioneer\Rekordbox\Crashes|*.dmp FileKey2=%AppData%\PioneerLog|*Log.txt FileKey3=%UserProfile%\Documents\Rekordbox|*log*.txt [Pipy *] LangSecRef=3021 DetectFile=%AppData%\Pipy FileKey1=%AppData%\Pipy\Logs|*.* [Pixillion Image Converter *] LangSecRef=3023 Detect=HKCU\Software\NCH Software\Pixillion FileKey1=%ProgramFiles%\NCH Software\Pixillion|pixsetup_*.exe RegKey1=HKCU\Software\NCH Software\Pixillion\Options|Image path RegKey2=HKCU\Software\NCH Software\Pixillion\Options|Input folder RegKey3=HKCU\Software\NCH Software\Pixillion\Options|Output folder RegKey4=HKCU\Software\NCH Software\Pixillion\Options|Output format [PKZip *] LangSecRef=3024 DetectFile=%ProgramFiles%\PKWARE\PKZIPW FileKey1=%ProgramFiles%\PKWARE\PKZIPW|*.log [Plague Inc: Evolved *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Ndemic Creations\Plague Inc Evolved FileKey1=%UserProfile%\AppData\LocalLow\Ndemic Creations\Plague Inc Evolved|Player.log [Planet Horse *] Section=Games DetectFile=%ProgramFiles%\Planet Horse FileKey1=%ProgramFiles%\Planet Horse|output_log.txt|RECURSE [Planets Under Attack *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\218510 FileKey1=%UserProfile%\Documents\My Games\Planets Under Attack|*.log [Plantronics Spokes *] LangSecRef=3023 DetectFile=%LocalAppData%\Plantronics\Spokes3G FileKey1=%LocalAppData%\Plantronics\Logs|*.* FileKey2=%LocalAppData%\Plantronics\Spokes3G\cefcache\*Cache|*.* [Plants vs. Zombies *] Section=Games DetectFile=%ProgramFiles%\Popcap Games\Plants vs Zombies FileKey1=%LocalAppData%\PVZCache|* FileKey2=%ProgramFiles%\Popcap Games\Plants vs Zombies|Install.log [Plarium Play *] Section=Games DetectFile=%LocalAppData%\PlariumPlay.log FileKey1=%LocalAppData%|PlariumPlay.log [PlayFirst Games *] Section=Games DetectFile=%AppData%\PlayFirst FileKey1=%AppData%\PlayFirst|logfile.txt|RECURSE [Plex Media Server *] LangSecRef=3023 Detect=HKCU\Software\Plex, Inc.\Plex Media Server FileKey1=%LocalAppData%\Plex Media Server\Cache\PhotoTranscoder|*.*|RECURSE FileKey2=%LocalAppData%\Plex Media Server\Crash Reports|*.*|RECURSE FileKey3=%LocalAppData%\Plex Media Server\Logs|*.*|RECURSE FileKey4=%LocalAppData%\Plex Media Server\Plug-in Support\Caches|*.*|RECURSE FileKey5=%LocalAppData%\Plex Media Server\Plug-in Support\Databases|*.db-shm;*.db-wal FileKey6=%LocalAppData%\Plex Media Server\Updates|*.*|RECURSE FileKey7=%LocalAppData%\Plex\Cache\qmlcache|*.* FileKey8=%LocalAppData%\Plex\Cache\qtwebengine\Default\Cache|*.* FileKey9=%LocalAppData%\Plex\logs|*.* FileKey10=%ProgramFiles%\Plex\Plex Media Server|*.txt;*.log|RECURSE FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Plex Media Server\Logs|*.*|RECURSE FileKey12=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Plex Media Server\Logs|*.*|RECURSE [PlumChoice Quick Connect *] LangSecRef=3021 DetectFile=%LocalAppData%\Tific FileKey1=%LocalAppData%\Tific|*.log|RECURSE [Plus500 *] LangSecRef=3021 Detect=HKCU\Software\Plus500 DetectFile=%ProgramFiles%\Plus500 FileKey1=%LocalAppData%\Plus500\Main|*.log* [Pocket Killbox *] LangSecRef=3024 Detect=HKCU\Software\KillBox DetectFile=%SystemDrive%\!Killbox FileKey1=%SystemDrive%\!Killbox\Logs|*.* RegKey1=HKCU\Software\KillBox|LastPath [Pogo Games *] Section=Games DetectFile=%AppData%\Pogo Games FileKey1=%AppData%\Pogo Games\*\Cache|*.*|REMOVESELF [Pointstone Registry Cleaner *] LangSecRef=3024 DetectFile=%AppData%\Pointstone\Registry Cleaner FileKey1=%AppData%\Pointstone\Registry Cleaner|*.bak;Statistics.xml FileKey2=%AppData%\Pointstone\Registry Cleaner\Logs|*.txt [Pointstone Total Privacy *] LangSecRef=3024 Detect=HKCU\Software\Pointstone\Total Privacy FileKey1=%ProgramFiles%\Pointstone\Total Privacy*|*.txt [Pok3D *] LangSecRef=3021 DetectFile=%ProgramFiles%\Pok3d FileKey1=%AppData%\Pok3d|*.log;*.dmp [PokerStars *] Section=Games DetectFile=%LocalAppData%\PokerStars FileKey1=%LocalAppData%\PokerStars|*.log.* FileKey2=%LocalAppData%\PokerStars\ImgCache|*.* FileKey3=%ProgramFiles%\PokerStars*|*.log.* [Pokki *] LangSecRef=3022 Detect=HKCU\Software\Pokki FileKey1=%LocalAppData%\Pokki|*.log|RECURSE FileKey2=%LocalAppData%\Pokki\PokkiIconCache|*.*|RECURSE FileKey3=%LocalAppData%\Pokki\UserData\*|*.bak;Cookies*;Favicons*;*History*;Top Sites*;Visited Links;Web Data*|RECURSE FileKey4=%LocalAppData%\Pokki\UserData\*\Cache|*.*|RECURSE FileKey5=%LocalAppData%\Pokki\UserData\*\LocalStorage|*.* [Polarity *] LangSecRef=3022 DetectFile=%ProgramFiles%\Polarity FileKey1=%AppData%\Stanley Lim\Polarity\Cache|*.*|RECURSE FileKey2=%AppData%\Stanley Lim\Polarity\Favicon|*.* FileKey3=%ProgramFiles%\Polarity|*.log FileKey4=%UserProfile%\Polarity_Config|downloads_names.ini;downloads_times.ini;downloads_urls.ini;history.ini;history_names.ini;history_times.ini;savedTabs.ini [Polyball *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\368180 FileKey1=%ProgramFiles%\SteamLibrary\steamapps\common\Polyball\Polyball_Data|output_log.txt [PolyView *] LangSecRef=3021 Detect=HKCU\Software\Polybytes\PolyView RegKey1=HKCU\Software\Polybytes\PolyView\Recent File List [Popcorn Time *] LangSecRef=3022 DetectFile=%LocalAppData%\Popcorn*Time* FileKey1=%LocalAppData%\Popcorn*Time*\*Cache|*|RECURSE FileKey2=%LocalAppData%\Popcorn*Time*\node_modules\peerflix\node_modules\torrent-stream\node_modules\parse-torrent\node_modules\magnet-uri|*log.txt FileKey3=%LocalAppData%\Popcorn*Time*\PopcornTime\Cache\QTWebEngine\Default\Cache|* FileKey4=%LocalAppData%\Popcorn*Time*\QTWebEngine\Default\GPUCache|* FileKey5=%LocalAppData%\Popcorn*Time*\User Data\*\*Cache|* FileKey6=%ProgramFiles%\Popcorn*Time*\plugins|plugins.dat.* [Portfolio Performance *] LangSecRef=3021 DetectFile=%LocalAppData%\PortfolioPerformance FileKey1=%LocalAppData%\PortfolioPerformance\workspace\.metadata|*.lock;*.log [PortForward.com PortChecker *] LangSecRef=3024 Detect=HKCU\Software\VB and VBA Program Settings\PFPortChecker RegKey1=HKCU\Software\VB and VBA Program Settings\PFPortChecker\Settings|Port [PortScan & Stuff *] LangSecRef=3022 Detect=HKCU\Software\CompSoft\PortScan RegKey1=HKCU\Software\CompSoft\PortScan|ScanEnd RegKey2=HKCU\Software\CompSoft\PortScan|ScanStart RegKey3=HKCU\Software\CompSoft\PortScan\MRUDNSQuery RegKey4=HKCU\Software\CompSoft\PortScan\MRUDNSServer RegKey5=HKCU\Software\CompSoft\PortScan\MRUPing RegKey6=HKCU\Software\CompSoft\PortScan\MRUTraceroute RegKey7=HKCU\Software\CompSoft\PortScan\MRUWhoIs [PostBox *] LangSecRef=3021 DetectFile=%LocalAppData%\PostBox FileKey1=%AppData%\PostBox|*.log|RECURSE FileKey2=%AppData%\PostBox\Crash Reports|*.*|REMOVESELF FileKey3=%LocalAppData%\PostBox\Profiles\*\Cache|*.*|REMOVESELF [Postman *] LangSecRef=3022 DetectFile=%LocalAppData%\Postman FileKey1=%AppData%\Postman\*Cache|*.* FileKey2=%AppData%\Postman\Logs|*.log FileKey3=%AppData%\Postman\partitions\postman_shell\GPUCache|*.* FileKey4=%AppData%\Postman\partitions\postman_shell\webrtc_event_logs|*.* FileKey5=%AppData%\Postman\partitions\postman_user_cookies\webrtc_event_logs|*.* FileKey6=%AppData%\Postman\webrtc_event_logs|*.* FileKey7=%LocalAppData%\Postman|*.log|RECURSE [PotPlayer *] LangSecRef=3023 Detect1=HKCU\Software\Daum\PotPlayerMini Detect2=HKCU\Software\Daum\PotPlayerMini64 FileKey1=%AppData%\Daum\PotPlayer\Log|*.* FileKey2=%LocalAppData%\Daum\PotPlayer\Log|*.xml FileKey3=%ProgramFiles%\PotPlayer\History|*.txt|REMOVESELF RegKey1=HKCU\Software\Daum\PotPlayerMini\RememberFiles RegKey2=HKCU\Software\Daum\PotPlayerMini64\RememberFiles [PowerENGAGE *] LangSecRef=3021 DetectFile=%AppData%\PowerENGAGE FileKey1=%AppData%\PowerENGAGE|*-journal;*.old;LOG FileKey2=%AppData%\PowerENGAGE\*Cache|*.* FileKey3=%AppData%\PowerENGAGE\Logs|*.* [PowerISO *] LangSecRef=3024 Detect=HKCU\Software\PowerISO FileKey1=%AppData%\PowerISO\Upgrade|*.*|REMOVESELF FileKey2=%ProgramFiles%\PowerISO|*.tmp RegKey1=HKCU\Software\PowerISO\SCDEmu|ImageName0 RegKey2=HKCU\Software\PowerISO\SCDEmu|ImageName1 RegKey3=HKCU\Software\PowerISO\SCDEmu|ImageName2 RegKey4=HKCU\Software\PowerISO\SCDEmu|ImageName3 RegKey5=HKCU\Software\PowerISO\SCDEmu|ImageName4 RegKey6=HKCU\Software\PowerISO\SCDEmu|ImageName5 RegKey7=HKCU\Software\PowerISO\SCDEmu|ImageName6 RegKey8=HKCU\Software\PowerISO\SCDEmu|ImageName7 RegKey9=HKCU\Software\PowerISO\SCDEmu|ImageName8 RegKey10=HKCU\Software\PowerISO\SCDEmu|ImageName9 RegKey11=HKCU\Software\PowerISO\SCDEmu|ImageName10 RegKey12=HKCU\Software\PowerISO\SCDEmu|ImageName11 RegKey13=HKCU\Software\PowerISO\SCDEmu|ImageName12 RegKey14=HKCU\Software\PowerISO\SCDEmu|ImageName13 RegKey15=HKCU\Software\PowerISO\SCDEmu|ImageName14 RegKey16=HKCU\Software\PowerISO\SCDEmu|ImageName15 RegKey17=HKCU\Software\PowerISO\SCDEmu|ImageName16 RegKey18=HKCU\Software\PowerISO\SCDEmu|ImageName17 RegKey19=HKCU\Software\PowerISO\SCDEmu|ImageName18 RegKey20=HKCU\Software\PowerISO\SCDEmu|ImageName19 RegKey21=HKCU\Software\PowerISO\SCDEmu|ImageName20 RegKey22=HKCU\Software\PowerISO\SCDEmu|ImageName21 RegKey23=HKCU\Software\PowerISO\SCDEmu|ImageName22 RegKey24=HKU\S-1-5-18\Software\PowerISO|ExtractPath0 RegKey25=HKU\S-1-5-18\Software\PowerISO|ExtractPath1 RegKey26=HKU\S-1-5-18\Software\PowerISO|ExtractPath2 RegKey27=HKU\S-1-5-18\Software\PowerISO|ExtractPath3 RegKey28=HKU\S-1-5-18\Software\PowerISO|ExtractPath4 RegKey29=HKU\S-1-5-18\Software\PowerISO|ExtractPath5 RegKey30=HKU\S-1-5-18\Software\PowerISO|ExtractPath6 RegKey31=HKU\S-1-5-18\Software\PowerISO|ExtractPath7 RegKey32=HKU\S-1-5-18\Software\PowerISO|Reopen0 RegKey33=HKU\S-1-5-18\Software\PowerISO|Reopen1 RegKey34=HKU\S-1-5-18\Software\PowerISO|Reopen2 RegKey35=HKU\S-1-5-18\Software\PowerISO|Reopen3 RegKey36=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName0 RegKey37=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName1 RegKey38=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName2 RegKey39=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName3 RegKey40=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName4 RegKey41=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName5 RegKey42=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName6 RegKey43=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName7 RegKey44=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName8 RegKey45=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName9 RegKey46=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName10 RegKey47=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName11 RegKey48=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName12 RegKey49=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName13 RegKey50=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName14 RegKey51=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName15 RegKey52=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName16 RegKey53=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName17 RegKey54=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName18 RegKey55=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName19 RegKey56=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName20 RegKey57=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName21 RegKey58=HKU\S-1-5-18\Software\PowerISO\SCDEmu|ImageName22 [PowerPoint Repair Toolbox *] LangSecRef=3021 DetectFile=%ProgramFiles%\PowerPoint Repair Toolbox FileKey1=%LocalAppData%\PowerPoint Repair Toolbox|*.log FileKey2=%LocalAppData%\PowerPoint Repair Toolbox\temp|*.*|RECURSE FileKey3=%ProgramFiles%\PowerPoint Repair Toolbox|history.txt [PowerTerm WebConnect DeskView *] LangSecRef=3023 DetectFile=%LocalAppData%\Ericom FileKey1=%LocalAppData%\Ericom\Ptagent|*.* FileKey2=%LocalAppData%\Ericom\PtRdp|*.* [PowerZip *] LangSecRef=3024 Detect=HKCU\Software\Trident Software\PowerZip RegKey1=HKCU\Software\Trident Software\PowerZip\Doc RegKey2=HKCU\Software\Trident Software\PowerZip\Recent File List [PPTX Repair Kit *] LangSecRef=3021 DetectFile=%ProgramFiles%\PPTX Repair Kit FileKey1=%LocalAppData%\PPTX Repair Kit|*.log FileKey2=%LocalAppData%\PPTX Repair Kit\temp|*.*|RECURSE FileKey3=%ProgramFiles%\PPTX Repair Kit|history.txt [Predator *] LangSecRef=3021 Detect=HKLM\Software\Predator-Usb FileKey1=%ProgramData%\Predator-Usb\PredatorACE\data|*.log [Presto Transfer Ultimate *] LangSecRef=3024 Detect=HKCU\Software\Perception\Presto Transfer Ultimate FileKey1=%AppData%\Presto Transfer Ultimate|lastlog.html [Prevent Restore *] LangSecRef=3024 DetectFile=%AppData%\Prevent Restore FileKey1=%AppData%\Prevent Restore|rreport.txt [PriceGong *] LangSecRef=3022 DetectFile=%AppData%\PriceGong FileKey1=%AppData%\PriceGong\tmp|*|RECURSE FileKey2=%UserProfile%\AppData\LocalLow\PriceGong\data|*.txt [Prince of Persia *] Section=Games Detect1=HKLM\Software\Ubisoft\Prince of Persia The Sands of Time Detect2=HKLM\Software\Ubisoft\Prince of Persia Warrior Within DetectFile=%ProgramFiles%\Ubisoft\Prince of Persia* FileKey1=%LocalAppData%\Ubisoft\Prince of Persia*|*.log FileKey2=%ProgramFiles%\Ubisoft\Prince of Persia*|*.log;POPError.DAT [priPrinter *] LangSecRef=3021 Detect=HKLM\Software\Pelikan Software KFT\priPrinter FileKey1=%AppData%\Pelikan Software KFT\priPrinter|cache_*.dat FileKey2=%ProgramData%\priPrinter\dumps|* RegKey1=HKCU\Software\Pelikan Software KFT\priPrinter|lastCleanUp [Prison Architect *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\233450 FileKey1=%LocalAppData%\Introversion\Prison Architect|debug.txt [privacy.sexy *] LangSecRef=3024 DetectFile=%AppData%\privacy.sexy FileKey1=%AppData%\privacy.sexy|Network Persistent State FileKey2=%AppData%\privacy.sexy\*Cache|*.*|RECURSE FileKey3=%AppData%\privacy.sexy\*Storage|*.old;LOG|RECURSE FileKey4=%AppData%\privacy.sexy\blob_storage|*.*|RECURSE FileKey5=%AppData%\privacy.sexy\logs|*.log FileKey6=%AppData%\privacy.sexy\privacy.sexy\logs|*.* FileKey7=%LocalAppData%\privacy.sexy-updater\pending|privacy.sexy-Setup-*.exe [Private Internet Access VPN *] LangSecRef=3022 DetectFile=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn FileKey1=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn|*.log FileKey2=%ProgramFiles%\pia_manager\log|*.* FileKey3=%ProgramFiles%\pia_manager\tmp|*.* FileKey4=%UserProfile%|.pia_manager_crash.log [PrivaZer *] LangSecRef=3024 Detect=HKCU\Software\PrivaZer FileKey1=%LocalAppData%\PrivaZer|*.txt [Privoxy *] LangSecRef=3022 Detect=HKCU\Software\Privoxy FileKey1=%ProgramFiles%\Vidalia Bundle\Privoxy|privoxy.log [Pro PC Cleaner *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\ProPCCleaner FileKey1=%UserProfile%\Documents\ProPCCleaner|log*.txt [Procaster *] LangSecRef=3023 DetectFile=%LocalAppData%\Procaster FileKey1=%LocalAppData%\Procaster|*.log|RECURSE [Process Hacker *] LangSecRef=3024 DetectFile=%ProgramFiles%\Process Hacker FileKey1=%AppData%\Process Hacker\Cache|*.*|RECURSE FileKey2=%ProgramFiles%\Process Hacker|processhacker-setup.exe [Processing *] LangSecRef=3024 DetectFile=%AppData%\Processing FileKey1=%AppData%\Processing|recent.txts FileKey2=%AppData%\Processing\Console|*.* FileKey3=%AppData%\Processing\Debug|*.* [ProcessLasso *] LangSecRef=3024 Detect=HKCU\Software\ProcessLasso FileKey1=%AppData%\ProcessLasso|prolasso.log FileKey2=%LocalAppData%\ProcessLasso\Logs|*.* FileKey3=%ProgramFiles%\Process Lasso|.logtype5 [ProDiscover *] LangSecRef=3024 Detect=HKLM\Software\Technology Pathways\ProDiscover RegKey1=HKLM\Software\Technology Pathways\ProDiscover\Recent File List [ProFantasy Software CC3 View *] LangSecRef=3023 Detect=HKCU\Software\EvolutionComputing RegKey1=HKCU\Software\EvolutionComputing\CC3View|1 RegKey2=HKCU\Software\EvolutionComputing\CC3View|2 RegKey3=HKCU\Software\EvolutionComputing\CC3View|3 RegKey4=HKCU\Software\EvolutionComputing\CC3View|4 RegKey5=HKCU\Software\EvolutionComputing\CC3View|WorkingDrawing [ProgDVB *] LangSecRef=3023 DetectFile=%ProgramFiles%\ProgDVB FileKey1=%ProgramFiles%\ProgDVB\Logs|*.*|RECURSE [Programmer's Notepad *] LangSecRef=3024 Detect=HKCU\Software\Echo Software\PN2 FileKey1=%AppData%\Echo Software\PN2|User*.xml RegKey1=HKCU\Software\Echo Software\PN2\Find|FindText RegKey2=HKCU\Software\Echo Software\PN2\Find|ReplaceText RegKey3=HKCU\Software\Echo Software\PN2\MRU RegKey4=HKCU\Software\Echo Software\PN2\MRUProjects [Project64 *] Section=Games Detect=HKCU\Software\N64 Emulation DetectFile=%ProgramFiles%\Project64* FileKey1=%ProgramFiles%\Project64 2.*\Logs|*.* RegKey1=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile1 RegKey2=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile2 RegKey3=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile3 RegKey4=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile4 RegKey5=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile5 RegKey6=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile6 RegKey7=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile7 RegKey8=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile8 RegKey9=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile9 RegKey10=HKCU\Software\N64 Emulation\Project64 Version 1.6|RecentFile10 [PropertyList Editor *] LangSecRef=3024 Detect=HKCU\Software\pledit\PropertyList Editor RegKey1=HKCU\Software\pledit\PropertyList Editor\Recent File List [Proteus *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219680 FileKey1=%UserProfile%\Documents\Proteus\logs|*.* ExcludeKey1=FILE|%UserProfile%\Documents\Proteus\logs\|rng.txt [Proton VPN *] LangSecRef=3024 DetectFile=%ProgramFiles%\Proton Technologies\ProtonVPN FileKey1=%ProgramData%\ProtonVPN\Logs|*|REMOVESELF FileKey2=%ProgramData%\ProtonVPN\UpdaterLogs|*|REMOVESELF [PS3 Media Server *] LangSecRef=3023 Detect=HKCU\Software\PS3 Media Server FileKey1=%ProgramFiles%\PS3 Media Server|*log;*.md|RECURSE [Psi *] LangSecRef=3022 Detect=HKCU\Software\psi-im.org\Psi DetectFile=%LocalAppData%\Psi+ FileKey1=%LocalAppData%\Psi+\Avatars|*.*|RECURSE FileKey2=%UserProfile%\PsiData\avatars|*.* [Psi Chat Logs *] LangSecRef=3022 Detect=HKCU\Software\psi-im.org\Psi DetectFile=%LocalAppData%\Psi+ FileKey1=%AppData%\Psi+\profiles\*\history|*.*|RECURSE FileKey2=%UserProfile%\PsiData\profiles\*\history|*.* [PSoC Designer 5.4 *] LangSecRef=3021 DetectFile=%AppData%\Cypress_Semiconductor\PSoC_Designer_54 FileKey1=%AppData%\Cypress_Semiconductor\PSoC_Designer_54|debug.log* [PSPad *] LangSecRef=3024 DetectFile=%AppData%\PSpad FileKey1=%AppData%\PSpad|Recent.ini [PUBG Lite *] Section=Games DetectFile=%ProgramFiles%\PUBGLite FileKey1=%ProgramFiles%\PUBGLite|*.log [PunkBuster *] Section=Games DetectFile=%LocalAppData%\PunkBuster FileKey1=%LocalAppData%\PunkBuster|pbcl.log|RECURSE FileKey2=%WinDir%\System32\LogFiles\PunkBuster|*.* [Puran Defrag *] LangSecRef=3024 Detect=HKLM\Software\Puran Software\Puran Defrag FileKey1=%ProgramFiles%\Puran Defrag|PuranDefrag.html [Puran Delete Empty Folders *] LangSecRef=3024 Detect=HKLM\Software\Puran Software\Delete Empty Folders RegKey1=HKLM\Software\Puran Software\Delete Empty Folders|Drives RegKey2=HKLM\Software\Wow6432Node\Puran Software\Delete Empty Folders|Drives [Puran Fix Shortcuts *] LangSecRef=3024 Detect=HKLM\Software\Puran Software\Fix Shortcuts RegKey1=HKLM\Software\Puran Software\Fix Shortcuts|Drives RegKey2=HKLM\Software\Wow6432Node\Puran Software\Fix Shortcuts|Drives [Pure Networks *] LangSecRef=3022 Detect=HKCU\Software\Pure Networks FileKey1=%ProgramData%\Pure Networks\Log|* FileKey2=%ProgramData%\Pure Networks\Platform|*.bak FileKey3=%ProgramData%\Pure Networks\Platform\minidumps|* [PureRa *] LangSecRef=3024 DetectFile=%SystemDrive%\PureRa.txt FileKey1=%SystemDrive%|PureRa.txt [Puritan File Destroyer Elite *] LangSecRef=3023 Detect=HKCU\Software\Puritan\File Destroyer Elite FileKey1=%ProgramData%\Puritan\File Destroyer Elite|*.log|RECURSE [Pushbullet *] LangSecRef=3022 DetectFile=%AppData%\Pushbullet FileKey1=%AppData%\Pushbullet\pushbullet|*.log [PuTTY *] LangSecRef=3022 DetectFile=%LocalAppData%\NETworkManager\PuTTY* FileKey1=%LocalAppData%\NETworkManager\PuTTY_Log|*.log [PySol Fan Club edition *] Section=Games DetectFile=%AppData%\PySolFC FileKey1=%AppData%\PySolFC|comments.dat;statistics.dat FileKey2=%ProgramFiles%\PySol Fan Club Edition|*.log [Python *] LangSecRef=3024 Detect=HKCU\Software\Python FileKey1=%LocalAppData%\Pip\cache|*.*|RECURSE FileKey2=%ProgramFiles%\Python*|*.icns|RECURSE FileKey3=%SystemDrive%\Python*|*.icns|RECURSE [qBittorrent *] LangSecRef=3022 DetectFile=%LocalAppData%\qBittorrent FileKey1=%LocalAppData%\qBittorrent\cache|*.* FileKey2=%LocalAppData%\qBittorrent\logs|*.* [QIP 2012 *] LangSecRef=3022 Detect=HKCU\Software\QIP DetectFile=%AppData%\QIP FileKey1=%AppData%\QIP\Profiles\*\*Avatars|*.* FileKey2=%AppData%\QIP\Profiles\*\Jabber|*.* FileKey3=%AppData%\QIP\Profiles\*\Logs|*.* FileKey4=%AppData%\QIP\Profiles\*\PicHashes|*.* [QIP 2012 Chat History *] LangSecRef=3022 Detect=HKCU\Software\QIP DetectFile=%AppData%\QIP FileKey1=%AppData%\QIP\Profiles\*\BackupCL|*.* FileKey2=%AppData%\QIP\Profiles\*\History|*.*|RECURSE FileKey3=%AppData%\QIP\Profiles\*\ICQ|*.*|RECURSE FileKey4=%AppData%\QIP\Profiles\*\RcvdFiles|*.*|RECURSE [QIP Infium *] LangSecRef=3022 DetectFile=%ProgramFiles%\QIP Infium FileKey1=%ProgramFiles%\QIP Infium\Profiles\*\Logs|*.* [Qiqqa *] LangSecRef=3021 DetectFile=%LocalAppData%\Quantisle\Qiqqa FileKey1=%LocalAppData%\Quantisle\Qiqqa\Logs|*.* FileKey2=%SystemDrive%\Temp|Qiqqa.log [Qmmp *] LangSecRef=3023 DetectFile=%UserProfile%\.qmmp FileKey1=%UserProfile%\.qmmp\cache|*.*|RECURSE [Qt Framework *] LangSecRef=3021 Detect1=HKCU\Software\QtProject Detect2=HKCU\Software\Trolltech DetectFile=%LocalAppData%\cache\qtshadercache* FileKey1=%LocalAppData%\cache\qtshadercache*|*.* RegKey1=HKCU\Software\QtProject\OrganizationDefaults\FileDialog|history RegKey2=HKCU\Software\QtProject\OrganizationDefaults\FileDialog|lastVisited RegKey3=HKCU\Software\Trolltech\OrganizationDefaults [QTranslate *] LangSecRef=3021 DetectFile=%AppData%\QTranslate FileKey1=%AppData%\QTranslate|History.json [QTTabBar *] LangSecRef=3024 Detect=HKCU\Software\Quizo\QTTabBar FileKey1=%AppData%\QTTabBar|*.log RegKey1=HKCU\Software\Quizo\QTTabBar|TabsOnLastClosedWindow RegKey2=HKCU\Software\Quizo\QTTabBar\Cache RegKey3=HKCU\Software\Quizo\QTTabBar\RecentFiles RegKey4=HKCU\Software\Quizo\QTTabBar\RecentlyClosed [Quest3D *] LangSecRef=3021 DetectFile=%AppData%\Quest3D FileKey1=%AppData%\Quest3D\Lumion*|WriteErrorLog [QuickDic *] LangSecRef=3021 DetectFile=%ProgramFiles%\QuickDic FileKey1=%ProgramFiles%\QuickDic|QuickDic.ini [Quicken WillMaker Plus *] LangSecRef=3021 DetectFile=%LocalAppData%\Quicken WillMaker Plus* FileKey1=%LocalAppData%\Quicken WillMaker Plus *|web update log.txt [QuickFind Autoplay Repair *] LangSecRef=3024 Detect=HKCU\Software\APR DetectFile=%ProgramFiles%\Autoplay Repair RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED RegKey3=HKLM\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED RegKey4=HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED [QuickPAR *] LangSecRef=3024 Detect=HKCU\Software\QuickPar FileKey1=%LocalAppData%\QuickPar|*.* [QuickTime Player *] LangSecRef=3023 Detect=HKLM\Software\Apple Computer, Inc.\QuickTime RegKey1=HKLM\Software\Apple Computer, Inc.\QuickTime\Favorite Movies RegKey2=HKLM\Software\Apple Computer, Inc.\QuickTime\Recent Movies RegKey3=HKLM\Software\Wow6432Node\Apple Computer, Inc.\QuickTime\Favorite Movies RegKey4=HKLM\Software\Wow6432Node\Apple Computer, Inc.\QuickTime\Recent Movies [Qurb4 *] LangSecRef=3021 DetectFile=%LocalAppData%\Qurb4 FileKey1=%LocalAppData%\Qurb4|*.log|RECURSE [qutIM *] LangSecRef=3022 Detect=HKCU\Software\qutIM FileKey1=%AppData%\qutIM\avatars\*|*.*|RECURSE [qutIM Chat History *] LangSecRef=3022 Detect=HKCU\Software\qutIM FileKey1=%AppData%\qutIM\history|*.*|RECURSE [QwertyLab RunAsSystem *] LangSecRef=3024 Detect=HKCU\Software\QwertyLab\RunAsSystem RegKey1=HKCU\Software\QwertyLab\RunAsSystem\mru [Qwest QuickCare *] LangSecRef=3022 Detect=HKLM\Software\QuickCare FileKey1=%LocalAppData%\SupportSoft|*.tmp|RECURSE FileKey2=%ProgramData%\Support.com|*.tmp|RECURSE [R-Wipe & Clean *] LangSecRef=3024 Detect=HKLM\Software\R-TT\RWC FileKey1=%AppData%\R-TT|*.*|RECURSE FileKey2=%SystemDrive%|*.sys.rwc FileKey3=%WinDir%\SoftwareDistribution|*.log.rwc ExcludeKey1=PATH|%AppData%\R-TT\RWC\WL\|*.* [RadeonPro *] LangSecRef=3024 DetectFile=%AppData%\RadeonPro FileKey1=%AppData%\RadeonPro|*.old;*.bak*;*.bkp FileKey2=%AppData%\RadeonPro\Cache|*.*|RECURSE FileKey3=%AppData%\RadeonPro\Temp|*.*|RECURSE [Radialix 2 *] LangSecRef=3021 Detect=HKCU\Software\Radialix FileKey1=%ProgramFiles%\Radialix 2|*diz;*.txt;*.url [RadioBOSS *] LangSecRef=3022 DetectFile=%AppData%\djsoft.net\RadioBOSS* FileKey1=%AppData%\djsoft.net\RadioBOSS*|~tmp;*.bak;*log.txt;nowplaying.txt FileKey2=%AppData%\djsoft.net\RadioBOSS*\log|*log.txt FileKey3=%AppData%\djsoft.net\RadioBOSS*\profile|*.bak FileKey4=%AppData%\djsoft.net\RadioBOSS*\report|*.csv FileKey5=%AppData%\djsoft.net\RadioBOSS*\temp|*.* [Rage *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\9200 FileKey1=%AppData%\id software\rage|*.*|RECURSE [Rainlendar 2 *] LangSecRef=3021 DetectFile=%UserProfile%\.rainlendar2 FileKey1=%UserProfile%\.rainlendar2|rainlendar2.log FileKey2=%UserProfile%\.rainlendar2\backups|*.*|RECURSE [Rainmeter *] LangSecRef=3024 Detect=HKLM\Software\Rainmeter FileKey1=%AppData%\Rainmeter\Updates|*.* [RAMExpert *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\RAMExpert FileKey1=%AppData%\KC Softwares\RAMExpert|*.log [Ranch Rush *] Section=Games Detect1=HKLM\Software\Big Fish Games\Persistence\Install\F2580T1L1 Detect2=HKLM\Software\Big Fish Games\Persistence\Install\F5659T1L1 Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ranch Rush1.0 DetectFile=%ProgramFiles%\Ranch Rush* FileKey1=%ProgramData%\FreshGames\RanchRush\*|*.log;temp_data.ssp FileKey2=%ProgramFiles%\Ranch Rush*|*.html;*.nfo [Raspberry Pi Imager *] LangSecRef=3024 DetectFile=%LocalAppData%\Raspberry Pi\Imager FileKey1=%LocalAppData%\Raspberry Pi\Imager\cache|*.cache FileKey2=%LocalAppData%\Raspberry Pi\Imager\cache\*|*.* [RAV Antivirus *] LangSecRef=3021 DetectFile=%AppData%\rav-antivirus-client FileKey1=%AppData%\rav-antivirus-client|*.old;LOG;Network Persistent State|RECURSE FileKey2=%AppData%\rav-antivirus-client\*Cache|*.* FileKey3=%AppData%\rav-antivirus-client\blob_storage|*.*|RECURSE FileKey4=%AppData%\rav-antivirus-client\Partitions\*|Network Persistent State FileKey5=%AppData%\rav-antivirus-client\Partitions\*\*Cache|*.* FileKey6=%AppData%\rav-antivirus-client\Partitions\*\blob_storage|*.*|RECURSE [Rayman Legends *] Section=Games DetectFile=%ProgramFiles%\Rayman Legends FileKey1=%ProgramFiles%\Rayman Legends\_CommonRedist|*.*|REMOVESELF [Razer *] LangSecRef=3024 DetectFile=%ProgramData%\Razer FileKey1=%LocalAppData%\Razer\*\*Cache|* FileKey2=%LocalAppData%\Razer\*\Log*|*|RECURSE FileKey3=%LocalAppData%\Razer\*\Settings|GACache.bin FileKey4=%ProgramData%\Razer\*|DiagnoseReport*.txt FileKey5=%ProgramData%\Razer\*\*Cache|* FileKey6=%ProgramData%\Razer\*\Accounts\*\DataSync|SyncDate.txt FileKey7=%ProgramData%\Razer\*\Log*|*|RECURSE FileKey8=%ProgramData%\Razer\*\ProductUpdates\Downloads|* FileKey9=%ProgramFiles%\Razer\*|*.log [RCleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\RCleaner FileKey1=%ProgramFiles%\RCleaner|log.txt [Real Network Monitor *] LangSecRef=3022 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Real Network Monitor FileKey1=%ProgramFiles%\Real Network Monitor|*.xml [Realms of Arkania: Blade of Destiny *] Section=Games DetectFile=%UserProfile%\Documents\BladeofDestiny FileKey1=%UserProfile%\Documents\BladeofDestiny\Consolelog|*.*|RECURSE [Realore Whiterra Roads of Rome NG *] Section=Games DetectFile=%AppData%\Realore Whiterra Roads of Rome NG FileKey1=%AppData%\Realore Whiterra Roads of Rome NG|log.txt [RealPlayer *] LangSecRef=3023 DetectFile=%AppData%\Real\RealPlayer FileKey1=%AppData%\Real\Real*Player|cookies.txt;ctd.dat;realplayer.ste;RealPlayer-log.txt FileKey2=%AppData%\Real\Real*Player\History|* FileKey3=%AppData%\Real\RealPlayer\db|*|RECURSE FileKey4=%AppData%\Real\RealPlayer\ErrorLogs|* FileKey5=%AppData%\Real\RealPlayer\Temp|* FileKey6=%AppData%\Real\RealPlayer\ThumbsCache|*|RECURSE FileKey7=%AppData%\Real\RealPlayer\WatchFolders|*_scan*;*.log|RECURSE FileKey8=%AppData%\Real\RPDS\Cache|*|RECURSE FileKey9=%AppData%\Real\Update|Update-log.txt FileKey10=%AppData%\Real\Update\Temp|*|RECURSE FileKey11=%LocalAppData%\Real\RealPlayer|*.db-shm;*.db-wal FileKey12=%LocalAppData%\Real\RealPlayer\Content\images|*.jpg FileKey13=%LocalAppData%\Real\RealPlayer\EBWebview|* FileKey14=%LocalAppData%\Real\RealPlayer\EBWebview\Default\Cache\Cache_Data|* FileKey15=%LocalAppData%\Real\RealPlayer\EBWebview\Default\Code Cache\js|* FileKey16=%ProgramData%\Real\RealPlayer|*-log.txt;S-* FileKey17=%ProgramData%\Real\RPDS\Content\images|*.jpg FileKey18=%ProgramData%\Real\RPDS\Logs|*.log* FileKey19=%ProgramData%\Real\Update_OB|RealPlayer-log.txt FileKey20=%ProgramData%\RPDS\Content\images|*.jpg FileKey21=%ProgramFiles%\Real\RealPlayer\common|cookies.txt FileKey22=%ProgramFiles%\Real\RealPlayer\RPDS|install.log FileKey23=%WinDir%|cdplayer.ini RegKey1=HKCU\Software\RealNetworks\RealJukebox\1.0\Preferences\WatchFolders ExcludeKey1=PATH|%AppData%\Real\RealPlayer\WatchFolders\|*scan.out [Realtek *] LangSecRef=3024 Detect=HKLM\Software\Realtek FileKey1=%ProgramData%\Realtek|*.log FileKey2=%ProgramFiles%\Realtek*|*.*log;*.txt|RECURSE FileKey3=%ProgramFiles%\Temp|*|REMOVESELF FileKey4=%SystemDrive%|RHDSetup.log ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\|InstCtrl.txt ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\|setupctrl.txt [Recent Files Scanner *] LangSecRef=3024 Detect=HKCU\Software\Groupwyse Software\Recent Files Scanner RegKey1=HKCU\Software\Groupwyse Software\Recent Files Scanner\Paths [Reckless Racing *] Section=Games DetectFile=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_* FileKey1=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_*\AC|*|RECURSE [RecordPad Sound Recorder *] LangSecRef=3023 DetectFile1=%ProgramFiles%\NCH Software\Recordpad DetectFile2=%ProgramFiles%\NCH Swift Sound\Recordpad FileKey1=%AppData%\NCH Software\RecordPad\logs|*.txt [Recovery Toolbox for Word *] LangSecRef=3024 DetectFile=%LocalAppData%\Recovery Toolbox for Word FileKey1=%LocalAppData%\Recovery Toolbox for Word|*.log [Recuva *] LangSecRef=3024 Detect=HKCU\Software\Piriform\Recuva FileKey1=%ProgramData%\Recuva\BurgerData|ActivityData_*.json FileKey2=%ProgramFiles%\Recuva|*.log;Recuva_log*.txt FileKey3=%UserProfile%|Recuva_log*.txt [Red Button *] LangSecRef=3024 Detect=HKCU\Software\Pothos\Red Button RegKey1=HKCU\Software\Pothos\Red Button|LastUpdateCheck [Reflector *] LangSecRef=3021 DetectFile=%AppData%\Reflector FileKey1=%AppData%\Reflector|*.log;*.dmp [Reg Organizer *] LangSecRef=3024 Detect=HKCU\Software\ChemTable Software\Reg Organizer FileKey1=%LocalAppData%\ChemTable Software\Reg Organizer|*.log|RECURSE FileKey2=%ProgramFiles%\Reg Organizer|*.txt [RegAlyzer *] LangSecRef=3024 Detect1=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer Detect2=HKCU\Software\Safer Networking Limited\RegAlyzer Detect3=HKLM\Software\Safer Networking Limited\HiveManager FileKey1=%AppData%\Safer Networking\RegAlyzer|history.sqlite RegKey1=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|LastKey RegKey2=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|RemoteListHistory RegKey3=HKCU\Software\PepiMK Software\Analysis tools\RegAlyzer|SearchTerm RegKey4=HKCU\Software\Safer Networking Limited\RegAlyzer|LastKey RegKey5=HKCU\Software\Safer Networking Limited\RegAlyzer|RemoteListHistory RegKey6=HKCU\Software\Safer Networking Limited\RegAlyzer|SearchTerm [RegCure Pro *] LangSecRef=3024 DetectFile=%ProgramFiles%\ParetoLogic\RegCure Pro FileKey1=%ProgramFiles%\ParetoLogic\RegCure Pro\html|*.htm [RegDoctor *] LangSecRef=3024 DetectFile=%ProgramFiles%\RegDoctor FileKey1=%ProgramFiles%\RegDoctor\Backup|log.txt [ReGet Deluxe *] LangSecRef=3022 Detect=HKCU\Software\ReGet Software\ReGetDx FileKey1=%ProgramFiles%\ReGet Deluxe\history|*.* RegKey1=HKCU\Software\ReGet Software\ReGetDx\FtpExplorer\Hist RegKey2=HKCU\Software\ReGet Software\ReGetDx\History RegKey3=HKCU\Software\ReGet Software\ReGetDx\Search\HistFind [RegHance *] LangSecRef=3024 Detect=HKCU\Software\Lavasoft\Reghance RegKey1=HKCU\Software\Lavasoft\Reghance|Last key RegKey2=HKCU\Software\Lavasoft\Reghance|LastBkmfile RegKey3=HKCU\Software\Lavasoft\Reghance|Recentkeys RegKey4=HKCU\Software\Lavasoft\Reghance|Repltext [RegHunter *] LangSecRef=3024 DetectFile=%ProgramFiles%\Enigma Software Group\RegHunter FileKey1=%ProgramFiles%\Enigma Software Group\RegHunter\Log|*.* [Registrar Registry Manager *] LangSecRef=3024 Detect=HKCU\Software\Resplendence Sp\Registrar Registry Manager RegKey1=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|ExportForm.saveDialogExportFilename RegKey2=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|ExportForm.saveDialogExportInitialDir RegKey3=HKCU\Software\Resplendence Sp\Registrar Registry Manager\Settings|LastOpenedKey [Registry Corrector *] LangSecRef=3024 DetectFile=%AppData%\RegCorrector FileKey1=%AppData%\RegCorrector|RegCorrector_Undo_*.reg [Registry Crawler *] LangSecRef=3024 Detect=HKLM\Software\4Developers\RCrawler RegKey1=HKLM\Software\4Developers\RCrawler\History RegKey2=HKLM\Software\4Developers\RCrawler\Settings|LastSearch [Registry Drill *] LangSecRef=3024 DetectFile=%ProgramFiles%\Easy Desk Utilities\Registry Drill FileKey1=%ProgramFiles%\Easy Desk Utilities\Registry Drill|*.log FileKey2=%WinDir%\System32\config|Regdrill Compact.txt [Registry Finder *] LangSecRef=3024 DetectFile=%AppData%\RegistryFinder FileKey1=%AppData%\RegistryFinder|RegCountCache.json FileKey2=%AppData%\RegistryFinder\UndoHistory|*.* FileKey3=%AppData%\RegistryFinder\UnsentCrashReports\Logs|*.* FileKey4=%ProgramFiles%\Registry Finder|RegistryFinder.log [Registry First Aid *] LangSecRef=3024 Detect=HKCU\Software\KsL Software\RFA FileKey1=%LocalAppData%\Microsoft\Windows|NTUSER.tmp;UsrClass.tmp FileKey2=%UserProfile%|NTUSER.tmp;UsrClass.tmp FileKey3=%WinDir%\ServiceProfiles\*Service|*.tmp* FileKey4=%WinDir%\System32\config|*.tmp* FileKey5=%WinDir%\System32\config\systemprofile|*.tmp* FileKey6=%WinDir%\SysWOW64\config\systemprofile|*.tmp* [Registry Help Pro *] LangSecRef=3024 DetectFile=%AppData%\Registry Help Pro FileKey1=%AppData%\Registry Help Pro|*Log.txt [Registry Life *] LangSecRef=3024 Detect=HKCU\Software\ChemTable Software\Registry Life DetectFile=%ProgramFiles%\Registry Life FileKey1=%ProgramFiles%\Registry Life|*.txt FileKey2=%ProgramFiles%\Registry Life\Setup|*.exe RegKey1=HKCU\Software\ChemTable Software\Registry Life\ExploredKeysEx [Registry Mechanic *] LangSecRef=3024 Detect=HKLM\Software\PCTools\Registry Mechanic FileKey1=%AppData%\Registry Mechanic\log|*.html FileKey2=%ProgramFiles%\Registry Mechanic\log*|*.* [Registry Mighty *] LangSecRef=3024 DetectFile=%ProgramFiles%\Registry Mighty FileKey1=%ProgramFiles%\Registry Mighty|errorlist.txt;ScanResult [Registry Recon *] LangSecRef=3024 DetectFile=%ProgramFiles%\Arsenal Recon\Registry Recon FileKey1=%ProgramFiles%\Arsenal Recon\Registry Recon|RegistryRecon.db FileKey2=%ProgramFiles%\Arsenal Recon\Registry Recon\Log|*.log FileKey3=%ProgramFiles%\Arsenal Recon\Registry Recon\OutputData|*.log|RECURSE [Registry Recovery Toolbox *] LangSecRef=3024 Detect=HKCU\Software\Registry Recovery Toolbox FileKey1=%LocalAppData%\Recovery Toolbox for Registry|*.log FileKey2=%LocalAppData%\Registry Recovery Toolbox|*.log RegKey1=HKCU\Software\Registry Recovery Toolbox\List Source Registry Files Ext [Registry Winner *] LangSecRef=3024 DetectFile=%ProgramFiles%\Registry Winner FileKey1=%ProgramFiles%\Registry Winner|*.bak [RegistryFix *] LangSecRef=3024 DetectFile=%ProgramFiles%\RegistryFix FileKey1=%ProgramFiles%\RegistryFix\logs|*.* [RegScrubVistaXP *] LangSecRef=3024 DetectFile=%ProgramFiles%\RegScrubVistaXP FileKey1=%ProgramFiles%\RegScrubVistaXP|*.reg;*.rsf;RegEditX.sav [RegServo *] LangSecRef=3024 DetectFile=%ProgramData%\regservo FileKey1=%ProgramData%\regservo\Logs|*|RECURSE [RegToBat *] LangSecRef=3024 Detect=HKLM\Software\BlueLife\RegToBat RegKey1=HKLM\Software\BlueLife\RegToBat|LastRegFile [RegVac Registry Cleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\RegVac Registry Cleaner FileKey1=%ProgramFiles%\RegVac Registry Cleaner|*.xml;cantremove.txt;Undo*.reg FileKey2=%WinDir%\System32\RegVac|*.*|REMOVESELF [RegWork *] LangSecRef=3021 DetectFile=%ProgramFiles%\RegWork FileKey1=%ProgramFiles%\RegWork\Logs|*.* FileKey2=%ProgramFiles%\RegWork\Tmp|*.* [Reign: Conflict of Nations *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\46380 FileKey1=%LocalAppData%\1C\Reign Conflict of Nations|PSPLog.log [Remo Repair PowerPoint *] LangSecRef=3021 DetectFile=%ProgramFiles%\Remo Repair PowerPoint* FileKey1=%ProgramFiles%\Remo Repair PowerPoint*|*.LOG [Rename Expert *] LangSecRef=3024 DetectFile=%AppData%\Rename Expert FileKey1=%AppData%\Rename Expert\*\Logs|*.* FileKey2=%AppData%\Rename Expert\*\Restore|*.xml [Rename Us *] LangSecRef=3024 Detect=HKCU\Software\Vitaliy Levchenko\Renamus RegKey1=HKCU\Software\Vitaliy Levchenko\Renamus\Recent Projects RegKey2=HKCU\Software\Vitaliy Levchenko\Renamus\Settings|LastFolder [Renault Media Nav Evolution Toolbox *] LangSecRef=3021 DetectFile=%AppData%\RenaultAutomotive FileKey1=%AppData%\RenaultAutomotive\log|*.* FileKey2=%AppData%\RenaultAutomotive\tmp|*.*|RECURSE [Replay Media Catcher *] LangSecRef=3022 Detect=HKLM\Software\Applian Technologies\Replay Media Catcher 5 DetectFile=%AppData%\Replay Media Catcher 4 FileKey1=%AppData%\Replay Media Catcher 4|*.log FileKey2=%AppData%\Replay Media Catcher 4\History|*.*|REMOVESELF FileKey3=%LocalAppData%\Replay Media Catcher 5\History|*.*|REMOVESELF FileKey4=%LocalAppData%\Replay Media Catcher 5\Temp|*.*|REMOVESELF FileKey5=%LocalAppData%\Replay Media Catcher 5\UrlCache|*.*|REMOVESELF FileKey6=%ProgramFiles%\Applian Technologies\Replay Media Catcher*|*.html;*.txt;*.rtf [Resilio Sync *] LangSecRef=3024 DetectFile1=%AppData%\BitTorrent Sync DetectFile2=%AppData%\Resilio Sync FileKey1=%AppData%\BitTorrent Sync|*.log;*.old FileKey2=%AppData%\Resilio Sync|*.journal;*.journal.zip;*.log;*.old;history.dat [Resource Hacker *] LangSecRef=3024 DetectFile=%ProgramFiles%\Resource Hacker FileKey1=%ProgramFiles%\Resource Hacker|ResHacker.ini;reshacker.GID [Respondus *] LangSecRef=3021 DetectFile=%LocalAppData%\Respondus FileKey1=%LocalAppData%\Respondus\Cache|LOG;LOG.old;Network Persistent State;Visited Links|RECURSE FileKey2=%LocalAppData%\Respondus\Cache\*Cache|*.*|RECURSE FileKey3=%LocalAppData%\Respondus\Cache\blob_storage|*.*|RECURSE [Restorator 2007 *] LangSecRef=3021 Detect=HKCU\Software\Bomers\Restorator RegKey1=HKCU\Software\Bomers\Restorator\Restorator\Current|LastSearchString RegKey2=HKCU\Software\Bomers\Restorator\Restorator\FindDialog RegKey3=HKCU\Software\Bomers\Restorator\Restorator\GrabDialog RegKey4=HKCU\Software\Bomers\Restorator\Restorator\LastFoundFiles RegKey5=HKCU\Software\Bomers\Restorator\Restorator\MRUList [Restore Point Creator *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{CC48DE1C-8EC2-43BC-9201-29701CD9AE13}_is1 FileKey1=%ProgramData%|Restore Point Creator.log FileKey2=%ProgramFiles%\Restore Point Creator|*.log;*.txt [ResumeMaker *] LangSecRef=3021 DetectFile=%ProgramData%\Individual Software\ResumeMaker FileKey1=%ProgramData%\Individual Software\ResumeMaker\R12|*.log [Reus *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\222730 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Reus|errorReport*.txt [Revenge of the Titans *] Section=Games DetectFile=%UserProfile%\.revenge_of_the_titans_1.80 FileKey1=%UserProfile%\.revenge_of_the_titans_1.80|*.log [Revo Uninstaller Backups *] LangSecRef=3024 DetectFile=%LocalAppData%\VS Revo Group\Revo Uninstaller* FileKey1=%LocalAppData%\VS Revo Group\Revo Uninstaller*|RUPBackUpData.ini FileKey2=%LocalAppData%\VS Revo Group\Revo Uninstaller*\BackupsData|*.*|RECURSE FileKey3=%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro|*.bak [Ride! *] Section=Games DetectFile=%ProgramFiles%\Ride! FileKey1=%ProgramFiles%\Ride!|*.log;*.txt|RECURSE FileKey2=%ProgramFiles%\Ride!\DirectX9|*.*|REMOVESELF [Riding Academy 3D *] Section=Games Detect=HKCU\Software\Program-Ace\RidingAcademy3D FileKey1=%LocalAppData%\Riding Academy 3D\logs|*.* [Riding Star 3 *] Section=Games Detect=HKLM\Software\DTP\Riding Star 3 FileKey1=%ProgramFiles%\Riding Star 3|INSTALL.LOG;log.txt [RIFT *] Section=Games DetectFile=%UserProfile%\Documents\RIFT FileKey1=%AppData%\RIFT|*.log FileKey2=%ProgramFiles%\RIFT|*.log FileKey3=%Public%\Games\RIFT|*.log FileKey4=%SystemDrive%\RIFT|*.log FileKey5=%UserProfile%\Documents\RIFT|*.log [RimWorld *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\294100 FileKey1=%UserProfile%\AppData\LocalLow\Ludeon Studios\RimWorld by Ludeon Studios|player.log [Ring Central *] LangSecRef=3022 DetectFile=%ProgramData%\RingCentral FileKey1=%ProgramData%\RingCentral\LogFiles|* [Riot Client *] Section=Games DetectFile=%LocalAppData%\Riot Games\Riot Client FileKey1=%LocalAppData%\Riot Games\Riot Client\Crashes\*\reports|*.*|RECURSE FileKey2=%LocalAppData%\Riot Games\Riot Client\Data\Cookies|*.* FileKey3=%LocalAppData%\Riot Games\Riot Client\Logs|*.*|RECURSE [Riot Vanguard *] Section=Games DetectFile=%ProgramFiles%\Riot Vanguard FileKey1=%ProgramFiles%\Riot Vanguard\Logs|*.log [Rise Of Legends *] Section=Games DetectFile=%AppData%\Microsoft\Rise Of Legends FileKey1=%AppData%\Microsoft\Rise Of Legends\Logs|*.* FileKey2=%AppData%\Microsoft\Rise Of Legends\temp|*.*|RECURSE [Rise of Nations *] Section=Games Detect1=HKCU\Software\Microsoft\Microsoft Games\Rise of Nations Detect2=HKCU\Software\Microsoft\Microsoft Games\RiseofNationsExpansion FileKey1=%AppData%\Microsoft Games\Rise of Nations\Logs|*.* FileKey2=%ProgramFiles%\Microsoft Games\Rise of Nations\Logs|*.* [Rise of the Tomb Raider *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\391220 FileKey1=%UserProfile%\Documents\Rise of the Tomb Raider|*.log [Rising Hell *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Tahoe Games\Rising Hell FileKey1=%UserProfile%\AppData\LocalLow\Tahoe Games\Rising Hell|*txt [Rkill *] LangSecRef=3024 DetectFile1=%UserProfile%\Desktop\Rkill DetectFile2=%UserProfile%\Desktop\Rkill.txt FileKey1=%UserProfile%\Desktop|*rkill*.* FileKey2=%UserProfile%\Desktop\Rkill|*.*|REMOVESELF [Roadkil's Unstoppable Copier *] LangSecRef=3024 Detect=HKCU\Software\Roadkil RegKey1=HKCU\Software\Roadkil|Source_Unstp RegKey2=HKCU\Software\Roadkil|Target_Unstp [Roblox *] Section=Games DetectFile=%LocalAppData%\Roblox FileKey1=%LocalAppData%\Roblox\Downloads|*|RECURSE FileKey2=%LocalAppData%\Roblox\Logs|*|RECURSE FileKey3=%ProgramData%\Roblox\Downloads|*|RECURSE FileKey4=%UserProfile%\AppData\LocalLow\RbxLogs|*|RECURSE [RoboBasket3 *] LangSecRef=3024 DetectFile=%AppData%\RoboBasket3 FileKey1=%AppData%\RoboBasket3|log.database [Roccat Swarm *] LangSecRef=3024 DetectFile=%AppData%\ROCCAT\SWARM FileKey1=%AppData%\ROCCAT\SWARM\change_log|*.*|REMOVESELF FileKey2=%AppData%\ROCCAT\SWARM\log|*.*|RECURSE FileKey3=%ProgramFiles%\ROCCAT\ROCCAT Swarm|log.txt [Rochard *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\107800 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Rochard\Rochard_Data|Output_log.txt FileKey2=%UserProfile%\AppData\LocalLow\Recoil Games\Rochard|journal.txt [Rock of Ages *] Section=Games Detect1=HKCU\Software\Valve\Steam\Apps\22230 Detect2=HKLM\Software\ACE Team\Rock of Ages FileKey1=%ProgramFiles%\ATLUS\Rock of Ages\Prerequisites|*.*|REMOVESELF FileKey2=%ProgramFiles%\Steam\steamapps\common\Rock of Ages\Prerequisites|*.*|REMOVESELF [Rocket League *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\252950 FileKey1=%UserProfile%\Documents\My Games\Rocket League\TAGame\Cache\WebCache|*.* FileKey2=%UserProfile%\Documents\My Games\Rocket League\TAGame\Logs|*.* [Rockstar Games Launcher *] Section=Games DetectFile=%UserProfile%\Documents\Rockstar Games FileKey1=%UserProfile%\Documents\Rockstar Games\Launcher|*.log FileKey2=%UserProfile%\Documents\Rockstar Games\Social Club|*.log [Roland Cloud Manager *] LangSecRef=3023 DetectFile=%AppData%\Roland Cloud\Cloud Manager FileKey1=%AppData%\Roland Cloud\Cache\WebEngineCache|Visited Links FileKey2=%AppData%\Roland Cloud\Cache\WebEngineCache\*Cache|*.* FileKey3=%AppData%\Roland Cloud\Cache\WebEngineCache\blob_storage|*.*|RECURSE FileKey4=%AppData%\Roland Cloud\Cloud Manager|*.log FileKey5=%AppData%\Roland Cloud\concerto\breakpad\dumps|*.dmp FileKey6=%AppData%\Roland Cloud\rcmhelper|*.log FileKey7=%AppData%\Roland Cloud\rcmservice|*.log FileKey8=%AppData%\Roland Cloud\shared|*.log FileKey9=%LocalAppData%\Roland Cloud\Cloud Manager*\Cache\QtWebEngine\Default\Cache|*.* FileKey10=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default|*-journal;*.old;LOG;QuotaManager;Visited Links|RECURSE FileKey11=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default\*Cache|*.*|RECURSE FileKey12=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default\blob_storage|*.*|RECURSE FileKey13=%LocalAppData%\Roland Cloud\Cloud Manager*\QtWebEngine\Default\VideoDecodeStats|*.* [ROLI Connect *] LangSecRef=3023 DetectFile=%AppData%\ROLI Connect FileKey1=%AppData%\ROLI Connect|*-journal;log.log;Network Persistent State FileKey2=%AppData%\ROLI Connect\*Cache|*.*|RECURSE FileKey3=%AppData%\ROLI Connect\__update__|*Setup*.exe FileKey4=%AppData%\ROLI Connect\Logs|*.* [RollBack Rx *] LangSecRef=3024 DetectFile=%ProgramFiles%\Shield FileKey1=%ProgramFiles%\Shield|*.log [ROM With a View - Director's Cut *] LangSecRef=3023 Detect=HKCU\Software\Moon Valley Software RegKey1=HKCU\Software\Moon Valley Software\CD Ultra\Recent File List RegKey2=HKCU\Software\Moon Valley Software\ROM With a View - Director's Cut\Recent File List [Rosegarden *] LangSecRef=3023 Detect=HKCU\Software\Rosegardenmusic\Rosegarden DetectFile=%ProgramFiles%\Xylgo\Rosegarden RegKey1=HKCU\Software\Rosegardenmusic\Rosegarden|recent-0 RegKey2=HKCU\Software\Rosegardenmusic\Rosegarden|recent-1 RegKey3=HKCU\Software\Rosegardenmusic\Rosegarden|recent-2 RegKey4=HKCU\Software\Rosegardenmusic\Rosegarden|recent-3 RegKey5=HKCU\Software\Rosegardenmusic\Rosegarden|recent-4 RegKey6=HKCU\Software\Rosegardenmusic\Rosegarden|recent-5 RegKey7=HKCU\Software\Rosegardenmusic\Rosegarden|recent-6 RegKey8=HKCU\Software\Rosegardenmusic\Rosegarden|recent-7 RegKey9=HKCU\Software\Rosegardenmusic\Rosegarden|recent-8 RegKey10=HKCU\Software\Rosegardenmusic\Rosegarden|recent-9 [Router Port Forwarding *] LangSecRef=3024 DetectFile=%ProgramFiles%\Router Port Forwarding FileKey1=%ProgramFiles%\Router Port Forwarding\bin\log|*.log [Roxio *] LangSecRef=3021 Detect=HKCU\Software\Roxio FileKey1=%AppData%\Roxio|*.log;*Log.txt FileKey2=%AppData%\Roxio Burn\Temp|*|RECURSE FileKey3=%AppData%\Roxio Log Files|*|RECURSE FileKey4=%AppData%\Roxio\Dragon\3.x\*Logs|*.log FileKey5=%AppData%\Roxio\Dragon\3.x\DiscInfoCache|*.tmp FileKey6=%AppData%\Roxio\MediaManager*|ItemThumbnails.dat FileKey7=%LocalAppData%|rx_*.Cache FileKey8=%ProgramData%\Roxio|*.log;cardinfo.* FileKey9=%WinDir%\System32\config\systemprofile\AppData\Roaming\Roxio Log Files|*|RECURSE FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Roxio Log Files|*|RECURSE [Roxio Creator Pro *] LangSecRef=3021 Detect1=HKCU\Software\Roxio\EMC13 Detect2=HKCU\Software\Roxio\EMC14 FileKey1=%UserProfile%\Documents\Roxio\Music Disc Creator|*.* RegKey1=HKCU\Software\Roxio\EMC13\VideoUI\RecentFiles\Catalogs RegKey2=HKCU\Software\Roxio\EMC14\Label Creator\Recent File List RegKey3=HKCU\Software\Roxio\EMC14\MusicDiscCreator\Directories RegKey4=HKCU\Software\Roxio\EMC14\MusicDiscCreator\MediaSelector RegKey5=HKCU\Software\Roxio\EMC14\PhotoSuite\RoxioPhotoSuite\MRUFiles RegKey6=HKCU\Software\Roxio\EMC14\SoundEdit\Directories RegKey7=HKCU\Software\Roxio\EMC14\SoundEdit\MediaSelector RegKey8=HKCU\Software\Roxio\EMC14\SoundEdit\WaveCache RegKey9=HKCU\Software\Roxio\EMC14\VideoConvert\Directories RegKey10=HKCU\Software\Roxio\EMC14\VideoConvert\MediaSelector RegKey11=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Albums RegKey12=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Catalogs RegKey13=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\DVD Projects RegKey14=HKCU\Software\Roxio\EMC14\VideoUI\RecentFiles\Productions RegKey15=HKLM\Software\Roxio\EMC13\Common SDK\Users RegKey16=HKLM\Software\Roxio\EMC14\Common SDK\Users RegKey17=HKLM\Software\Wow6432Node\Roxio\EMC13\Common SDK\Users RegKey18=HKLM\Software\Wow6432Node\Roxio\EMC14\Common SDK\Users [RPKG *] LangSecRef=3024 DetectFile=%LocalAppData%\rpkg FileKey1=%LocalAppData%\rpkg\db|*.old;LOG [RssBandit *] LangSecRef=3022 DetectFile=%AppData%\RssBandit FileKey1=%AppData%\RssBandit|*.bak;*.log [rtmpGUI *] LangSecRef=3024 DetectFile=%UserProfile%\.swfinfo FileKey1=%UserProfile%|.swfinfo [Rust *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\252490 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Rust|debug_steamclient.txt [RuTracker Proxy *] LangSecRef=3022 DetectFile=%AppData%\rto-proxy FileKey1=%AppData%\rto-proxy|*-journal FileKey2=%AppData%\rto-proxy\*Cache|*.*|RECURSE [SABnzbd *] LangSecRef=3021 DetectFile=%LocalAppData%\sabnzbd FileKey1=%LocalAppData%\SABnzbd|*.bak FileKey2=%LocalAppData%\sabnzbd\admin|history1.db;totals9.sab FileKey3=%LocalAppData%\sabnzbd\logs|* [Safe Watch *] LangSecRef=3022 DetectFile=%UserProfile%\AppData\LocalLow\Safe-Watch-Updater FileKey1=%UserProfile%\AppData\LocalLow\Safe-Watch-Updater|*.exe [Sage ACT! *] LangSecRef=3021 Detect=HKLM\Software\ACT FileKey1=%ProgramData%\Sage Software, Inc\ACT! by Sage\ActUpdate|*|RECURSE [Sage Simply Accounting *] LangSecRef=3021 Detect=HKLM\Software\Sage Software\Simply Accounting FileKey1=%ProgramData%\Sage Software\Simply Accounting\Download|*|RECURSE [SageThumbs *] LangSecRef=3021 DetectFile=%ProgramFiles%\SageThumbs\64\SageThumbs.dll FileKey1=%LocalAppData%|SageThumbs.* [SAM Broadcaster *] LangSecRef=3023 Detect=HKCU\Software\SAMBC FileKey1=%LocalAppData%\SpacialAudio\SAMBC|*.log|RECURSE FileKey2=%LocalAppData%\SpacialAudio\SAMBC\backup|*.*|RECURSE [Samsung Kies *] LangSecRef=3023 Detect1=HKCU\Software\Samsung\Kies2.0 Detect2=HKCU\Software\Samsung\Kies3.0 Detect3=HKLM\Software\SAMSUNG\USB_DRIVER FileKey1=%AppData%\Samsung\Kies|*.mlca;*.mlme;*.mlpb;*.mlpgb|RECURSE FileKey2=%AppData%\Samsung\Kies*\BackupHistory|BackupHistory.xml FileKey3=%ProgramData%\Samsung\Device Error Recovery|* FileKey4=%ProgramData%\Samsung\Kies|Kiesairmessage.log FileKey5=%UserProfile%\Documents\Samsung\Kies*\Backup|*|RECURSE FileKey6=%UserProfile%\Documents\SelfMV|*.log [Samsung Magician *] LangSecRef=3024 Detect=HKLM\Software\Samsung Magician FileKey1=%AppData%\Samsung Magician\GPUCache|*|REMOVESELF FileKey2=%AppData%\Samsung Magician\Local Storage\leveldb|*.old FileKey3=%AppData%\Samsung Magician\Session Storage|*.old FileKey4=%ProgramData%\Samsung\Backup|*.exe FileKey5=%ProgramData%\Samsung\Samsung Magician|*.exe;*.mdmp|RECURSE FileKey6=%ProgramData%\Samsung\Samsung Magician\PB|*.txt FileKey7=%ProgramFiles%\Samsung Magician\Logs|* FileKey8=%ProgramFiles%\Samsung\Samsung Magician\Log*|* FileKey9=%ProgramFiles%\Samsung\Samsung Magician\MigrationService|*.log FileKey10=%ProgramFiles%\Samsung\Samsung Magician\MigrationService\Logs|* FileKey11=%SystemDrive%\MagicianPerf*|*|REMOVESELF RegKey1=HKCU\Software\Local AppWizard-Generated Applications\SamsungMagician [Samsung MSSCS *] LangSecRef=3024 Detect=HKLM\SOFTWARE\SAMSUNG FileKey1=%ProgramData%\Samsung\MSSCS|*.log [Samsung Software Upgrade Assistant *] LangSecRef=3024 DetectFile=%LocalAppData%\MSU FileKey1=%LocalAppData%\MSU|*.log;*-logs.txt [Sanctum *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\91600 FileKey1=%UserProfile%\Documents\My Games\Sanctum\SanctumGame\Logs|*.* [Sandisk Installer *] LangSecRef=3024 DetectFile=%AppData%\com.sandisk.softwareInstaller FileKey1=%AppData%\com.sandisk.softwareInstaller\Logs|*|REMOVESELF [Santa Ride! 2 *] Section=Games DetectFile=%ProgramFiles%\Invictus Games\Santa Ride! 2 FileKey1=%ProgramFiles%\Invictus Games\Santa Ride! 2|*.log [Santa's Rampage *] Section=Games DetectFile=%ProgramFiles%\*Santa* Rampage FileKey1=%ProgramFiles%\*Santa* Rampage|*.diz;*.nfo;*.txt;*.url;dotNetFx40_Full_setup.exe|RECURSE FileKey2=%ProgramFiles%\*Santa* Rampage\Redist|*.*|REMOVESELF FileKey3=%ProgramFiles%\*Santa* Rampage\UDKGame\Logs|*.*|REMOVESELF ExcludeKey1=FILE|%ProgramFiles%\*Santa* Rampage\UDKGame\CookedPC\|Manifest.txt ExcludeKey2=PATH|%ProgramFiles%\*Santa* Rampage\Binaries\Win32\|*.* ExcludeKey3=PATH|%ProgramFiles%\*Santa* Rampage\Binaries\Win64\|*.* ExcludeKey4=PATH|%ProgramFiles%\*Santa* Rampage\UDKGame\Script\|*.* [Sauerbraten *] Section=Games DetectFile=%ProgramFiles%\Sauerbraten FileKey1=%ProgramFiles%\Sauerbraten\packages\base|*.bak|RECURSE FileKey2=%UserProfile%\Documents\My Games\Crash|*.log FileKey3=%UserProfile%\Documents\My Games\Sauerbraten|log.txt [SavingsBull *] LangSecRef=3022 DetectFile=%ProgramFiles%\SavingsBullFilter FileKey1=%WinDir%\System32|SavingsBullFilterService.log [SBCleaner *] LangSecRef=3024 DetectFile=%ProgramData%\CzechMex LLC\SBCleaner* FileKey1=%ProgramData%\CzechMex LLC\SBCleaner\Logs|*.LOG FileKey2=%ProgramData%\CzechMex LLC\SBCleanerFree\Logs|*.LOG [SBMAV Disk Cleaner *] LangSecRef=3024 Detect=HKCU\Software\SBMAV Software\Disk Cleaner FileKey1=%AppData%\SBMAV Disk Cleaner|dcleaner.log FileKey2=%ProgramFiles%\SBMAV Disk Cleaner|*.rtf [ScanDefrag *] LangSecRef=3024 Detect=HKLM\Software\ScanDefrag FileKey1=%SystemDrive%\ScanDefrag|*.log FileKey2=%SystemDrive%\ScanDefrag\logs|*.txt [ScanSnap *] LangSecRef=3021 Detect=HKCU\Software\PFU\ScanToOffice DetectFile1=%CommonProgramFiles%\PFU\ScanSnap\ScanToOffice DetectFile2=%ProgramFiles%\PFU\ScanSnap FileKey1=%CommonProgramFiles%\PFU\ScanSnap\ScanToOffice|*.log|RECURSE FileKey2=%LocalAppData%\PFU|*.log|RECURSE FileKey3=%LocalAppData%\PFU\SSFolderTemp|*.*|RECURSE FileKey4=%ProgramFiles%\PFU|*.log|RECURSE FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\PFU|*.log|RECURSE FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\PFU\SSFolderTemp|*.*|RECURSE FileKey7=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\PFU|*.log|RECURSE FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\PFU\SSFolderTemp|*.*|RECURSE RegKey1=HKCU\Software\PFU\ScanToOffice\History [Screenpresso *] LangSecRef=3024 DetectFile=%AppData%\Learnpulse\Screenpresso FileKey1=%AppData%\Learnpulse\Screenpresso|settings.copy.xml FileKey2=%UserProfile%\Pictures\Screenpresso\Thumbnails|*.*|RECURSE [Scribe Finished Jobs *] LangSecRef=3021 Detect=HKCU\Software\NCH Software\Scribe FileKey1=%AppData%\NCH Software\Scribe\Done|*.* [Scribus *] LangSecRef=3023 DetectFile=%AppData%\Scribus FileKey1=%AppData%\Scribus\scrapbook\tmp|*.*|RECURSE [Scrivener *] LangSecRef=3021 DetectFile=%LocalAppData%\LiteratureandLatte\Scrivener FileKey1=%LocalAppData%\LiteratureandLatte\Scrivener\Cache|*.*|RECURSE FileKey2=%LocalAppData%\LiteratureandLatte\Scrivener\QtWebEngine\Default|*.old;LOG|RECURSE FileKey3=%LocalAppData%\LiteratureandLatte\Scrivener\QtWebEngine\Default\GPUCache|*.* [ScummVM *] Section=Games DetectFile=%AppData%\ScummVM FileKey1=%AppData%\ScummVM\Logs|*.* [SdfBrowser *] LangSecRef=3024 DetectFile=%AppData%\BokorBéla\SdfBrowser FileKey1=%AppData%\BokorBéla\SdfBrowser|*.log [Seagate Dashboard *] LangSecRef=3024 Detect=HKLM\Software\Seagate\Seagate Dashboard\CurrentVersion FileKey1=%AppData%\Seagate\Seagate Dashboard\logs|*.log* FileKey2=%WinDir%\System32\config\systemprofile\AppData\Roaming\Seagate\Seagate Dashboard\logs|SeagateDashboardService* FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Seagate\Seagate Dashboard\logs|SeagateDashboardService* [Seagate Premium Recovery Suite *] LangSecRef=3021 Detect=HKCU\Software\Pixel8\Premium Recovery Suite FileKey1=%ProgramFiles%\Premium Recovery Suite\Logs|*.* [Seagate SeaTools for Windows *] LangSecRef=3024 Detect=HKLM\Software\SeaToolsforWindows FileKey1=%ProgramFiles%\Seagate\SeaTools for Windows|*.log [Second Copy *] LangSecRef=3024 Detect=HKCU\Software\Centered Systems\Second Copy 2000 DetectFile=%LocalAppData%\Centered Systems\Second Copy FileKey1=%LocalAppData%\Centered Systems\Second Copy|log*.* FileKey2=%ProgramFiles%\SecCopy|log*.rtf RegKey1=HKCU\Software\Centered Systems\Second Copy 2000\MRU [SecondLife *] Section=Games DetectFile=%AppData%\SecondLife FileKey1=%AppData%\SecondLife\*|*.log;*.txt;screen_last.bmp;url_history.xml|RECURSE FileKey2=%AppData%\SecondLife\*\Browser_Profile\Cache|*.*|RECURSE FileKey3=%AppData%\SecondLife\*\cache|*.*|RECURSE FileKey4=%AppData%\SecondLife\cache|*.*|RECURSE FileKey5=%AppData%\SecondLife\Logs|*.* [SecuKitNXS *] LangSecRef=3021 DetectFile=%UserProfile%\AppData\LocalLow\KICA\nxClient FileKey1=%UserProfile%\AppData\LocalLow\KICA\nxClient\Log|* [SecureCRT *] LangSecRef=3021 Detect=HKCU\Software\VanDyke\SecureCRT FileKey1=%AppData%\VanDyke\SecureCRT\Config|Recent File List.ini;Recent Script List.ini [SecureDownloadManager *] LangSecRef=3022 Detect=HKCU\Software\e-academy Inc.\SecureDownloadManager FileKey1=%LocalAppData%\e-academy Inc\SecureDownloadManager|*.log RegKey1=HKCU\Software\e-academy Inc.\SecureDownloadManager\Recent File list [Security Task Manager *] LangSecRef=3024 Detect=HKCU\Software\Neuber GbR\Security Task Manager RegKey1=HKCU\Software\Neuber GbR\Security Task Manager\Options|HistoryExe RegKey2=HKCU\Software\Neuber GbR\Security Task Manager\Options|HostKnown [SecurityXploded Directory Scanner *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\DirectoryScanner RegKey1=HKCU\Software\SecurityXploded\DirectoryScanner|EndHostAddress RegKey2=HKCU\Software\SecurityXploded\DirectoryScanner|StartHostAddress [SecurityXploded FTP Password Kracker *] LangSecRef=3024 Detect=HKCU\Software\FTP Password Kracker RegKey1=HKCU\Software\FTP Password Kracker|File RegKey2=HKCU\Software\FTP Password Kracker|Port RegKey3=HKCU\Software\FTP Password Kracker|ServerAddress RegKey4=HKCU\Software\FTP Password Kracker|Username [SecurityXploded Hash Kracker *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\HashKracker RegKey1=HKCU\Software\SecurityXploded\HashKracker|File RegKey2=HKCU\Software\SecurityXploded\HashKracker|Hash RegKey3=HKCU\Software\SecurityXploded\HashKracker|Type [SecurityXploded LDAP Password Kracker *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\LDAPPasswordKracker RegKey1=HKCU\Software\SecurityXploded\LDAPPasswordKracker|File RegKey2=HKCU\Software\SecurityXploded\LDAPPasswordKracker|Port RegKey3=HKCU\Software\SecurityXploded\LDAPPasswordKracker|ServerAddress RegKey4=HKCU\Software\SecurityXploded\LDAPPasswordKracker|Username [SecurityXploded LDAP Search *] LangSecRef=3024 Detect=HKCU\Software\LDAPSearch_Nag RegKey1=HKCU\Software\LDAPSearch_Nag|BaseDN RegKey2=HKCU\Software\LDAPSearch_Nag|CertPath RegKey3=HKCU\Software\LDAPSearch_Nag|IPAddress RegKey4=HKCU\Software\LDAPSearch_Nag|LoginDN RegKey5=HKCU\Software\LDAPSearch_Nag|Port [SecurityXploded Mysql Password Auditor *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\MysqlPasswordAuditor RegKey1=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|File RegKey2=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|Port RegKey3=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|ServerAddress RegKey4=HKCU\Software\SecurityXploded\MysqlPasswordAuditor|Username [SecurityXploded Net Database Scanner *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\NetDatabaseScanner RegKey1=HKCU\Software\SecurityXploded\NetDatabaseScanner|DatabaseType RegKey2=HKCU\Software\SecurityXploded\NetDatabaseScanner|EndHostAddress RegKey3=HKCU\Software\SecurityXploded\NetDatabaseScanner|StartHostAddress [SecurityXploded Router Password Kracker *] LangSecRef=3024 Detect1=HKCU\Software\RouterPasswordKracker Detect2=HKCU\Software\SecurityXploded\RouterPasswordDecryptor RegKey1=HKCU\Software\RouterPasswordKracker|File RegKey2=HKCU\Software\RouterPasswordKracker|ServerAddress RegKey3=HKCU\Software\RouterPasswordKracker|Username RegKey4=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|File RegKey5=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|ServerAddress RegKey6=HKCU\Software\SecurityXploded\RouterPasswordDecryptor|Username [SecurityXploded Salted Hash Kracker *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\SaltedHashKracker RegKey1=HKCU\Software\SecurityXploded\SaltedHashKracker|File RegKey2=HKCU\Software\SecurityXploded\SaltedHashKracker|Hash RegKey3=HKCU\Software\SecurityXploded\SaltedHashKracker|Salt RegKey4=HKCU\Software\SecurityXploded\SaltedHashKracker|Type [SecurityXploded SSL Certificate Scanner *] LangSecRef=3024 Detect1=HKCU\Software\SecurityXploded\SSLCertScanner Detect2=HKCU\Software\SSLCertScanner RegKey1=HKCU\Software\SecurityXploded\SSLCertScanner|Port RegKey2=HKCU\Software\SecurityXploded\SSLCertScanner|ServerAddress RegKey3=HKCU\Software\SSLCertScanner|Port RegKey4=HKCU\Software\SSLCertScanner|ServerAddress [SecurityXploded Virus Total Scanner *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\VirusTotalScanner RegKey1=HKCU\Software\SecurityXploded\VirusTotalScanner|File [SecurityXploded Wi-Fi Network Monitor *] LangSecRef=3024 Detect1=HKCU\Software\SecurityXploded\WiFiNetworkMonitor Detect2=HKCU\Software\WiFi Network Monitor RegKey1=HKCU\Software\SecurityXploded\WiFiNetworkMonitor|EndHostAddress RegKey2=HKCU\Software\SecurityXploded\WiFiNetworkMonitor|StartHostAddress RegKey3=HKCU\Software\WiFi Network Monitor|EndHostAddress RegKey4=HKCU\Software\WiFi Network Monitor|StartHostAddress [SecurityXploded Windows Password Kracker *] LangSecRef=3024 Detect=HKCU\Software\SecurityXploded\WindowsPasswordKracker RegKey1=HKCU\Software\SecurityXploded\WindowsPasswordKracker|File RegKey2=HKCU\Software\SecurityXploded\WindowsPasswordKracker|Hash [SecurityXploded Windows Spy Keylogger *] LangSecRef=3024 Detect=HKCU\Software\WinSKApp RegKey1=HKCU\Software\WinSKApp [SecuROM Diagnostics Tool *] Section=Games Detect=HKCU\Software\SecuROM DetectFile1=%SystemDrive%\AnalysisLog.sr0 DetectFile2=%UserProfile%\Desktop\AnalysisLog.sr0 FileKey1=%AppData%\SecuROM\UserData|*.bak;*.tmp FileKey2=%SystemDrive%|AnalysisLog.sr0 FileKey3=%UserProfile%\Desktop|AnalysisLog.sr0 [Send To Toys *] LangSecRef=3024 Detect=HKCU\Software\Gabriele Ponti\Send To Toys RegKey1=HKCU\Software\Gabriele Ponti\Send To Toys|LastFolder RegKey2=HKCU\Software\Gabriele Ponti\Send To Toys|RecentFolders [Serato DJ *] LangSecRef=3023 DetectFile=%UserProfile%\Music\_Serato_ FileKey1=%UserProfile%\Music\_Serato_|*.log|RECURSE [Serious Sam *] Section=Games DetectFile1=%ProgramFiles%\Serious Sam* DetectFile2=%ProgramFiles%\Steam\steamApps\Common\Serious Sam* FileKey1=%ProgramFiles%\Serious Sam*|*.log FileKey2=%ProgramFiles%\Serious Sam*\Temp|*.* FileKey3=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*|*.log FileKey4=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*\Log|*.*|RECURSE FileKey5=%ProgramFiles%\Steam\steamApps\Common\Serious Sam*\Temp|*.* [ServeToMe *] LangSecRef=3023 DetectFile=%AppData%\ProjectsWithLove\ServeToMe FileKey1=%AppData%\ProjectsWithLove\ServeToMe\Fontcache|*.* [Serviio *] LangSecRef=3024 Detect=HKLM\Software\Serviio FileKey1=%ProgramFiles%\Serviio\log|*.* [Shareaza *] LangSecRef=3022 Detect=HKCU\Software\BHO Shareaza FileKey1=%LocalAppData%\Shareaza\Incomplete|*.* [ShareX *] LangSecRef=3021 DetectFile1=%LocalAppData%\Packages\19568ShareX.ShareX_* DetectFile2=%ProgramFiles%\ShareX FileKey1=%LocalAppData%\Packages\19568ShareX.ShareX_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\19568ShareX.ShareX_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\19568ShareX.ShareX_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\19568ShareX.ShareX_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\19568ShareX.ShareX_*\TempState|*|RECURSE FileKey6=%UserProfile%\Documents\ShareX|History.xml FileKey7=%UserProfile%\Documents\ShareX\Backup|*Config-*.json FileKey8=%UserProfile%\Documents\ShareX\Logs|*|RECURSE [Shatter *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\20820 FileKey1=%ProgramFiles%\Steam\steamapps\common\Shatter|log.txt [Shattered Horizon *] Section=Games DetectFile=%LocalAppData%\Futuremark\Shattered Horizon FileKey1=%LocalAppData%\Futuremark\Shattered Horizon\cache|*|REMOVESELF FileKey2=%LocalAppData%\Futuremark\Shattered Horizon\crash_dumps|* [She and the Light Bearer *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\658590 FileKey1=%UserProfile%\AppData\LocalLow\Mojiken\She and the Light Bearer|output_log.txt [ShellLess *] LangSecRef=3021 Detect=HKCU\Software\ShellLess1.10b RegKey1=HKCU\Software\ShellLess1.10b\ShellLess\Recent File List [Shogun2 *] Section=Games DetectFile=%AppData%\The Creative Assembly\Shogun2 FileKey1=%AppData%\The Creative Assembly\Shogun2\*_cache|*.* FileKey2=%AppData%\The Creative Assembly\Shogun2\Logs|*.* FileKey3=%AppData%\The Creative Assembly\Shogun2\Temp|*.* [ShooterGame *] Section=Games DetectFile=%LocalAppData%\ShooterGame FileKey1=%LocalAppData%\ShooterGame\Saved\Logs|*.*|REMOVESELF FileKey2=%LocalAppData%\ShooterGame\Saved\WebCache*|*.*|REMOVESELF [ShortKeys *] LangSecRef=3021 Detect=HKCU\Software\Insight Software Solutions\ShortKeys RegKey1=HKCU\Software\Insight Software Solutions\ShortKeys\MRU [Should I Remove It? *] LangSecRef=3024 Detect=HKCU\Software\Reason FileKey1=%ProgramFiles%\Reason\Should I Remove It|programdata.dat RegKey1=HKCU\Software\Reason\ShouldIRemoveIt\Cache [ShrewSoft VPN Client *] LangSecRef=3022 DetectFile=%ProgramFiles%\ShrewSoft\VPN Client FileKey1=%ProgramFiles%\ShrewSoft\VPN Client\debug|*.log [Shuffle Party *] Section=Games DetectFile=%LocalAppData%\Packages\Microsoft.ShuffleParty_* FileKey1=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\Settings|*.log* FileKey3=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\TempState|*|RECURSE [SideQuest *] Section=Games DetectFile=%AppData%\SideQuest FileKey1=%AppData%\SideQuest|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE FileKey2=%AppData%\SideQuest\*Cache|*.*|RECURSE FileKey3=%AppData%\SideQuest\blob_storage|*.*|RECURSE FileKey4=%AppData%\SideQuest\tmp|*.* FileKey5=%AppData%\SideQuest\VideoDecodeStats|*.*|RECURSE FileKey6=%LocalAppData%\sidequest-updater|installer.exe [Signal Messenger *] LangSecRef=3022 DetectFile=%AppData%\Signal FileKey1=%AppData%\Signal|*-journal;*.old;LOG;Network Persistent State;QuotaManager|RECURSE FileKey2=%AppData%\Signal\*Cache|*.*|RECURSE FileKey3=%AppData%\Signal\blob_storage|*.*|RECURSE FileKey4=%AppData%\Signal\Crashpad|*.*|RECURSE FileKey5=%AppData%\Signal\Logs|*.* FileKey6=%AppData%\Signal\Temp|*.* FileKey7=%LocalAppData%\Signal-Desktop-Updater|installer.exe [SignKorea *] LangSecRef=3021 DetectFile=%UserProfile%\AppData\LocalLow\SignKorea\SKCert* FileKey1=%UserProfile%\AppData\LocalLow\SignKorea\*\Log|*|RECURSE [SigParser *] LangSecRef=3024 DetectFile=%ProgramFiles%\UpdateStar\SigParser FileKey1=%AppData%\UpdateStar GmbH\SigParser\3.0.4898.22300|*.log [Silent Hunter III *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\15210 DetectFile=%ProgramFiles%\Ubisoft\SilentHunterIII FileKey1=%ProgramFiles%\Steam\SteamApps\Common\SilentHunterIII|*.log|RECURSE FileKey2=%ProgramFiles%\Ubisoft\SilentHunterIII|*.log|RECURSE [Silhouette Studio *] LangSecRef=3021 DetectFile=%AppData%\com.aspexsoftware.s* FileKey1=%AppData%\com.aspexsoftware.Silhouette_Studio\installers|*.* FileKey2=%AppData%\com.aspexsoftware.ss_bluetooth|*.bluetooth.txt FileKey3=%AppData%\com.aspexsoftware.studio_helper|log [SimCity 4 *] Section=Games Detect=HKLM\Software\Maxis\SimCity 4 FileKey1=%ProgramFiles%\Maxis\Exception Reports|*.mdmp;*.txt FileKey2=%ProgramFiles%\Maxis\HTTPCache|*.* FileKey3=%ProgramFiles%\Maxis\SimCity 4 Deluxe|*-log.txt FileKey4=%ProgramFiles%\Maxis\SimCity 4 Deluxe\Apps|*.txt FileKey5=%UserProfile%\Documents\SimCity 4\Exception Reports|*.mdmp;*.txt FileKey6=%UserProfile%\Documents\SimCity 4\HTTPCache|*.* [SimCity Societies *] Section=Games DetectFile=%UserProfile%\Documents\SimCity Societies FileKey1=%UserProfile%\Documents\SimCity Societies\Logs|* [Similarity *] LangSecRef=3023 DetectFile=%AppData%\Similarity FileKey1=%AppData%\Similarity|cache.dat FileKey2=%AppData%\Similarity\logs|*.*|RECURSE [SIMS RACER *] Section=Games DetectFile1=%ProgramData%\SIMS\RACER DetectFile2=%ProgramFiles%\SIMS\RACER DetectFile3=%SystemDrive%\SIMS\RACER FileKey1=%ProgramData%\SIMS\RACER|QLOG.txt FileKey2=%ProgramFiles%\SIMS\RACER|QLOG.txt FileKey3=%SystemDrive%\SIMS\RACER|QLOG.txt [Sins of a Solar Empire Rebellion *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Ironclad Games\Sins of a Solar Empire Rebellion FileKey1=%UserProfile%\Documents\My Games\Ironclad Games\Sins of a Solar Empire Rebellion\Cache|*.* [SIP Workbench VoIP Protocol Analyzer *] LangSecRef=3024 Detect=HKCU\Software\BreakPoint\SIP Workbench RegKey1=HKCU\Software\BreakPoint\SIP Workbench|file1 RegKey2=HKCU\Software\BreakPoint\SIP Workbench|file2 RegKey3=HKCU\Software\BreakPoint\SIP Workbench|file3 RegKey4=HKCU\Software\BreakPoint\SIP Workbench|file4 RegKey5=HKCU\Software\BreakPoint\SIP Workbench|file5 RegKey6=HKCU\Software\BreakPoint\SIP Workbench|file6 RegKey7=HKCU\Software\BreakPoint\SIP Workbench|file7 RegKey8=HKCU\Software\BreakPoint\SIP Workbench|file8 RegKey9=HKCU\Software\BreakPoint\SIP Workbench|file9 [SiSense *] LangSecRef=3021 DetectFile=%AppData%\SiSense FileKey1=%AppData%\SiSense\Prism\logs|* FileKey2=%ProgramData%\SiSense|*log|RECURSE FileKey3=%ProgramData%\SiSense\Logs|*|RECURSE [SketchUp Make *] LangSecRef=3021 Detect=HKCU\Software\SketchUp DetectFile1=%AppData%\SketchUp\SketchUp* DetectFile2=%AppData%\Trimble Connect for Sketchup FileKey1=%AppData%\SketchUp\SketchUp*\SketchUp|~*.tmp FileKey2=%AppData%\SketchUp\SketchUp*\WebCache|*-journal;*.old;LOG;data_*;debug.log;f_*;index;Visited Links|RECURSE FileKey3=%AppData%\SketchUp\SketchUp*\WebCache\Cache|*.* FileKey4=%AppData%\SketchUp\SketchUp*\WebCache\GPUCache|*.* FileKey5=%AppData%\Trimble Connect for Sketchup\Logs|*.* FileKey6=%LocalAppData%\SketchUp\SketchUp*\SketchUp|*log-sketchup.txt RegKey1=HKCU\Software\SketchUp\SketchUp 2013\Recent File List RegKey2=HKCU\Software\SketchUp\SketchUp 2014\Recent File List RegKey3=HKCU\Software\SketchUp\SketchUp 2015\Recent File List RegKey4=HKCU\Software\SketchUp\SketchUp 2016\Recent File List [Sky Go *] LangSecRef=3023 DetectFile=%AppData%\Sky\Sky Go FileKey1=%AppData%\Sky Go|*-journal|RECURSE FileKey2=%AppData%\Sky Go\GPUCache|*.* [Skype *] LangSecRef=3021 DetectFile1=%AppData%\Microsoft\Skype for Desktop DetectFile2=%LocalAppData%\Packages\Microsoft.SkypeApp_* FileKey1=%AppData%\Microsoft\Skype for Desktop|*-journal;*.old;LOG;Network Persistent State;QuotaManager;Skype-Setup.exe|RECURSE FileKey2=%AppData%\Microsoft\Skype for Desktop\blob_storage|*|RECURSE FileKey3=%AppData%\Microsoft\Skype for Desktop\Code Cache|*|RECURSE FileKey4=%AppData%\Microsoft\Skype for Desktop\Logs|* FileKey5=%AppData%\Microsoft\Skype for Desktop\Media-stack|*.bak;*.blog;*.etl FileKey6=%AppData%\Microsoft\Skype for Desktop\skylib|*.blog FileKey7=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalCache\Roaming\Microsoft\Skype for Store|*-journal;*.old;LOG;Network Persistent State|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalCache\Roaming\Microsoft\Skype for Store\*Cache|*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalCache\Roaming\Microsoft\Skype for Store\Logs|* FileKey11=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState|*-shm;*-wal FileKey12=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState\DiagOutputDir|* FileKey13=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState\logs|*|RECURSE FileKey14=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState\tracing\wppmedia|*.bak;*.etl FileKey15=%LocalAppData%\Packages\Microsoft.SkypeApp_*\Settings|*.log* FileKey16=%LocalAppData%\Packages\Microsoft.SkypeApp_*\TempState|*|RECURSE [SkypeAlyzer *] LangSecRef=3024 Detect=HKCU\Software\Raize\CodeSite FileKey1=%LocalAppData%\Raize\CodeSite\5.0|CSDispatcherLog.txt [Skyrim Script Extender *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Skyrim\SKSE FileKey1=%UserProfile%\Documents\My Games\Skyrim\SKSE|*.log [Slack *] LangSecRef=3021 DetectFile=%AppData%\Slack FileKey1=%AppData%\Slack\*Cache|*.*|RECURSE FileKey2=%AppData%\Slack\logs|*.*|RECURSE FileKey3=%AppData%\Slack\Service Worker\*Cache*|*.*|RECURSE [Sleeping Dogs *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\202170 FileKey1=%ProgramFiles%\Steam\Steamapps\common\SleepingDogs|Log*.txt [Slender: The Arrival *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\252330 FileKey1=%ProgramFiles%\Steam\steamapps\common\Slender - The Arrival\Slender - The Arrival_Data|output_log.txt [Slim PDF Reader *] LangSecRef=3021 DetectFile=%LocalAppData%\Investintech.com Inc\SPR FileKey1=%LocalAppData%\Investintech.com Inc\SPR\*|*.log [SlimBrowser *] LangSecRef=3022 DetectFile=%ProgramFiles%\SlimBrowser FileKey1=%AppData%\SlimBrowser|freqsite.txt;RecentCloseW.ini;freqform.txt FileKey2=%AppData%\SlimBrowser\iconcache|*.*|RECURSE [SlimCleaner *] LangSecRef=3024 Detect1=HKCU\Software\SlimWare Utilities Inc\SlimCleaner Detect2=HKCU\Software\SlimWare Utilities Inc\SlimCleaner Plus FileKey1=%LocalAppData%\SlimWare Utilities Inc\SlimCleaner*\Cache|*|RECURSE FileKey2=%LocalAppData%\SlimWare Utilities Inc\SlimCleaner*\Logs|*|RECURSE FileKey3=%ProgramData%\SlimWare Utilities Inc\Services\SlimService*\Logs|*.log FileKey4=%ProgramFiles%\SlimCleaner*|*.txt [SlimComputer *] LangSecRef=3024 DetectFile=%LocalAppData%\SlimWare Utilities Inc\SlimComputer FileKey1=%LocalAppData%\SlimWare Utilities Inc\SlimComputer\Logs|*.log [Slimware DriverUpdate *] LangSecRef=3024 DetectFile=%LocalAppData%\Slimware Utilities Inc\DriverUpdate FileKey1=%LocalAppData%\Slimware Utilities Inc\DriverUpdate\Backups|*.* FileKey2=%LocalAppData%\SlimWare Utilities Inc\DriverUpdate\Downloads|*.*|RECURSE FileKey3=%LocalAppData%\SlimWare Utilities Inc\DriverUpdate\Images|*.*|RECURSE FileKey4=%LocalAppData%\SlimWare Utilities Inc\DriverUpdate\Logs|*.*|RECURSE [Smart Explorer *] LangSecRef=3021 Detect=HKCU\Software\Smartque\Smart Explorer RegKey1=HKCU\Software\Smartque\Smart Explorer\Opened Pages RegKey2=HKCU\Software\Smartque\Smart Explorer\Recent Pages [Smart Install Maker *] LangSecRef=3024 Detect=HKCU\Software\InstallBuilders\Smart Install Maker RegKey1=HKCU\Software\InstallBuilders\Smart Install Maker\Reopen [Smart PDF Creator Pro *] LangSecRef=3024 DetectFile=%AppData%\Smart PDF Creator Pro FileKey1=%AppData%\Smart PDF Creator Pro|Smart PDF Creator Pro_log*.* [Smart Privacy Protector *] LangSecRef=3024 Detect=HKCU\Software\Smart Privacy Protector RegKey1=HKCU\Software\Smart Privacy Protector|SetupName [SmartDrive-Wiz *] LangSecRef=3024 DetectFile=%ProgramFiles%\Opoku\SmartDrive-Wiz FileKey1=%ProgramFiles%\Opoku\SmartDrive-Wiz\Log|*.* [SmartSynchronize *] LangSecRef=3024 DetectFile=%AppData%\syntevo\SmartSynchronize FileKey1=%AppData%\syntevo\SmartSynchronize\*\Logs|*.* [SMPlayer *] LangSecRef=3023 DetectFile=%UserProfile%\.smplayer\smplayer.ini FileKey1=%UserProfile%\.smplayer\file_settings|*.*|RECURSE [Snagit *] LangSecRef=3021 Detect=HKCU\Software\TechSmith\Snagit FileKey1=%LocalAppData%\TechSmith\Logs|*.log FileKey2=%LocalAppData%\TechSmith\Snagit|Tray.bin FileKey3=%LocalAppData%\TechSmith\Snagit\*\NativeCrashReporting\Reports|*.dmp|RECURSE FileKey4=%LocalAppData%\TechSmith\Snagit\*\WebView2Cache\EBWebView\*\GPUCache|*|REMOVESELF FileKey5=%LocalAppData%\TechSmith\Snagit\CrashDumps|*|RECURSE FileKey6=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico FileKey7=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico FileKey8=%LocalAppData%\TechSmith\Snagit\Thumbnails|*|RECURSE FileKey9=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log* FileKey10=%ProgramData%\TechSmith\Uploader|*.log FileKey11=%Public%\TechSmith\Snagit\License|*.cache;*.log FileKey12=%UserProfile%\Documents|SnagitDebug.log FileKey13=%UserProfile%\Documents\Snagit|*.snagx FileKey14=%UserProfile%\Documents\Snagit\.metadata|*|RECURSE RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount RegKey5=HKCU\Software\TechSmith\Snagit\11|OutputDirLastUsed RegKey6=HKCU\Software\TechSmith\Snagit\11|VidOutputDirLastUsed RegKey7=HKCU\Software\TechSmith\Snagit\11\SnagItEditor\Tray|Thumbnailsize RegKey8=HKCU\Software\TechSmith\Snagit\12|CaptureCount RegKey9=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount RegKey10=HKCU\Software\TechSmith\Snagit\12|OutputDirLastUsed RegKey11=HKCU\Software\TechSmith\Snagit\12|VidOutputDirLastUsed RegKey12=HKCU\Software\TechSmith\Snagit\12\SnagItEditor\Tray|Thumbnailsize RegKey13=HKCU\Software\TechSmith\Snagit\13|CaptureCount RegKey14=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount RegKey15=HKCU\Software\TechSmith\Snagit\13|OutputDirLastUsed RegKey16=HKCU\Software\TechSmith\Snagit\13|VidOutputDirLastUsed RegKey17=HKCU\Software\TechSmith\Snagit\13\Recent Captures RegKey18=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List RegKey19=HKCU\Software\TechSmith\Snagit\13\SnagItEditor\Tray|Thumbnailsize RegKey20=HKCU\Software\TechSmith\Snagit\18|CaptureCount RegKey21=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount RegKey22=HKCU\Software\TechSmith\Snagit\18|OutputDirLastUsed RegKey23=HKCU\Software\TechSmith\Snagit\18|VidOutputDirLastUsed RegKey24=HKCU\Software\TechSmith\Snagit\18\Recent Captures RegKey25=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List RegKey26=HKCU\Software\TechSmith\Snagit\18\SnagItEditor\Tray|Thumbnailsize RegKey27=HKCU\Software\TechSmith\Snagit\19|CaptureCount RegKey28=HKCU\Software\TechSmith\Snagit\19|CaptureOpenCount RegKey29=HKCU\Software\TechSmith\Snagit\19|OutputDirLastUsed RegKey30=HKCU\Software\TechSmith\Snagit\19|VidOutputDirLastUsed RegKey31=HKCU\Software\TechSmith\Snagit\19\Recent Captures RegKey32=HKCU\Software\TechSmith\Snagit\19\SnagitEditor\Recent File List RegKey33=HKCU\Software\TechSmith\Snagit\19\SnagItEditor\Tray|Thumbnailsize RegKey34=HKCU\Software\TechSmith\Snagit\20|CaptureCount RegKey35=HKCU\Software\TechSmith\Snagit\20|CaptureOpenCount RegKey36=HKCU\Software\TechSmith\Snagit\20|OutputDirLastUsed RegKey37=HKCU\Software\TechSmith\Snagit\20|VidOutputDirLastUsed RegKey38=HKCU\Software\TechSmith\Snagit\20\Recent Captures RegKey39=HKCU\Software\TechSmith\Snagit\20\SnagitEditor\Recent File List RegKey40=HKCU\Software\TechSmith\Snagit\20\SnagItEditor\Tray|Thumbnailsize RegKey41=HKCU\Software\TechSmith\Snagit\21|CaptureCount RegKey42=HKCU\Software\TechSmith\Snagit\21|CaptureOpenCount RegKey43=HKCU\Software\TechSmith\Snagit\21|OutputDirLastUsed RegKey44=HKCU\Software\TechSmith\Snagit\21|VidOutputDirLastUsed RegKey45=HKCU\Software\TechSmith\Snagit\21\Recent Captures RegKey46=HKCU\Software\TechSmith\Snagit\21\SnagitEditor\Recent File List RegKey47=HKCU\Software\TechSmith\Snagit\21\SnagItEditor\Tray|Thumbnailsize RegKey48=HKCU\Software\TechSmith\Snagit\22|CaptureCount RegKey49=HKCU\Software\TechSmith\Snagit\22|CaptureOpenCount RegKey50=HKCU\Software\TechSmith\Snagit\22|OutputDirLastUsed RegKey51=HKCU\Software\TechSmith\Snagit\22|VidOutputDirLastUsed RegKey52=HKCU\Software\TechSmith\Snagit\22\Recent Captures RegKey53=HKCU\Software\TechSmith\Snagit\22\SnagitEditor\Recent File List RegKey54=HKCU\Software\TechSmith\Snagit\22\SnagItEditor\Tray|Thumbnailsize [Snapfish Picture Mover *] LangSecRef=3023 DetectFile=%AppData%\PictureMover FileKey1=%AppData%\PictureMover\Log|*.* [Sniper: Art of Victory *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\271500 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Sniper Art of Victory\logs|*.* [Sniper: Ghost Warrior *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\34830 FileKey1=%UserProfile%\Documents\Sniper - Ghost Warrior\out\logs|*.* [Snuggle Truck *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\111100 FileKey1=%ProgramFiles%\Steam\steamapps\common\snuggle truck\Snuggle Truck_Data|output_log.txt [Sobees *] LangSecRef=3022 DetectFile=%AppData%\sobees Ltd\Sobees FileKey1=%AppData%\sobees Ltd\Sobees\tmp\imagecache|*.*|RECURSE [Sobolsoft Remove Metadata In Multiple Files Software *] LangSecRef=3024 Detect=HKCU\Software\VB and VBA Program Settings\Sobolsoft\Remove Metadata In Multiple Files Software RegKey1=HKCU\Software\VB and VBA Program Settings\Sobolsoft\Remove Metadata In Multiple Files Software|Output Folder RegKey2=HKCU\Software\VB and VBA Program Settings\Sobolsoft\Remove Metadata In Multiple Files Software|Snapshot [SocialFolders *] LangSecRef=3022 DetectFile=%LocalAppData%\ftopia\SocialFolders FileKey1=%LocalAppData%\ftopia\SocialFolders\Cache|*.*|RECURSE FileKey2=%LocalAppData%\ftopia\SocialFolders\Dumps|*.*|RECURSE [Soda PDF *] LangSecRef=3021 DetectFile=%AppData%\Soda PDF* FileKey1=%AppData%\Soda PDF*\Logs|*.* [Soda Player *] LangSecRef=3023 DetectFile=%LocalAppData%\sodaplayer FileKey1=%AppData%\Soda Player|Cookies* FileKey2=%AppData%\Soda Player\*Cache|*.* FileKey3=%AppData%\Soda Player\acestream\engine|*.log FileKey4=%AppData%\Soda Player\Local Storage|*.* FileKey5=%LocalAppData%\sodaplayer|SquirrelSetup.log FileKey6=%SystemDrive%\_acestream_cache_|*.*|REMOVESELF [Soft Organizer *] LangSecRef=3024 DetectFile=%ProgramFiles%\Soft Organizer FileKey1=%ProgramFiles%\Soft Organizer|*.txt [SoftCafe MenuPro *] LangSecRef=3021 DetectFile=%AppData%\SoftCafe\MenuPro FileKey1=%AppData%\SoftCafe\MenuPro|*.tmp [SoftCDN YouTube Downloader *] LangSecRef=3022 DetectFile=%AppData%\SoftCDN FileKey1=%AppData%\SoftCDN|*.log [SoftEther VPN *] LangSecRef=3022 Detect=HKCU\Software\SoftEther Project\SoftEther VPN FileKey1=%ProgramFiles%\SoftEther VPN Client|installer.cache FileKey2=%ProgramFiles%\SoftEther VPN Client\backup.vpn_client.config|*.config FileKey3=%ProgramFiles%\SoftEther VPN Client\client_log|*.* FileKey4=%ProgramFiles%\SoftEther VPN Client\vpn_debug|*.* [Softonic *] LangSecRef=3021 DetectFile=%LocalAppData%\Softonic FileKey1=%LocalAppData%\Softonic\cache|*.*|RECURSE [Softros Process Blocker *] LangSecRef=3024 Detect=HKLM\Software\Policies\Softros\Process Blocker FileKey1=%ProgramFiles%\Softros Systems\Process Blocker|*Log.txt [SoftThinks CD Creator *] LangSecRef=3021 Detect=HKLM\Software\SoftThinks FileKey1=%WinDir%\CREATOR|*.log [Softube Central *] LangSecRef=3023 DetectFile=%AppData%\Softube*Central FileKey1=%AppData%\Softube*Central\Logs|*.* FileKey2=%AppData%\SoftubeCentral|*.old;LOG;*-journal;log.log;Network Persistent State|RECURSE FileKey3=%AppData%\SoftubeCentral\*Cache|*.*|RECURSE FileKey4=%AppData%\SoftubeCentral\blob_storage|*.*|RECURSE FileKey5=%AppData%\SoftubeCentral\Softube Central\Logs|*.* [Software Informer *] LangSecRef=3023 DetectFile=%AppData%\Software Informer FileKey1=%AppData%\Software Informer\cache\icons|*.tmp [Solarix *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\284990 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Solarix\UDKGame\Logs|*.* [SolarWinds Wake-On-Lan *] LangSecRef=3022 Detect=HKCU\Software\VB and VBA Program Settings\Wake-On-Lan FileKey1=%ProgramData%\SolarWinds\VB\Banners|*.bmp FileKey2=%ProgramFiles%\SolarWinds\Free Tools\Installs|Wake-On-LAN.LOG RegKey1=HKCU\Software\VB and VBA Program Settings\Wake-On-Lan\IP Broadcast RegKey2=HKCU\Software\VB and VBA Program Settings\Wake-On-Lan\MAC Address [Solid Edge *] LangSecRef=3021 Detect1=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 109 Detect2=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 110 RegKey1=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 109\MRUex RegKey2=HKCU\Software\Unigraphics Solutions\Solid Edge\Version 110\MRUex [SolidWorks *] LangSecRef=3021 Detect=HKCU\Software\Solidworks RegKey1=HKCU\Software\Solidworks\SolidWorks 2012\Recent File List RegKey2=HKCU\Software\SolidWorks\SolidWorks 2013\Recent File List RegKey3=HKCU\Software\Solidworks\SolidWorks 2014\Recent File List RegKey4=HKCU\Software\SolidWorks\Solidworks 2015\Recent File List RegKey5=HKCU\Software\SolidWorks\Solidworks 2016\Recent File List RegKey6=HKCU\Software\SolidWorks\SOLIDWORKS 2017\Recent File List RegKey7=HKCU\Software\Solidworks\SOLIDWORKS 2018\Recent File List RegKey8=HKCU\Software\Solidworks\SOLIDWORKS 2018\Recent Folder List RegKey9=HKCU\Software\Solidworks\SOLIDWORKS 2019\Recent File List RegKey10=HKCU\Software\Solidworks\SOLIDWORKS 2019\Recent Folder List RegKey11=HKCU\Software\SolidWorks\SOLIDWORKS 2020\Recent File List RegKey12=HKCU\Software\SolidWorks\SOLIDWORKS 2020\Recent Folder List [Solus *] Section=Games DetectFile=%LocalAppData%\Solus FileKey1=%LocalAppData%\Solus\Saved\Config\CrashReportClient|*.*|RECURSE FileKey2=%LocalAppData%\Solus\Saved\Logs|*.* [Solway Control3 *] LangSecRef=3024 Detect=HKCU\Software\SolwaySoftware\Control3 RegKey1=HKCU\Software\SolwaySoftware\Control3|LastUserName RegKey2=HKCU\Software\SolwaySoftware\Control3|LeftDefDir RegKey3=HKCU\Software\SolwaySoftware\Control3|MiddleDefDir RegKey4=HKCU\Software\SolwaySoftware\Control3|RightDefDir [Solway Disk Investigator *] LangSecRef=3024 Detect=HKLM\Software\SolwaySoftware\DiskInvestigator RegKey1=HKLM\Software\SolwaySoftware\DiskInvestigator|Drive [Solway Password Kernel *] LangSecRef=3021 Detect=HKCU\Software\SolwaySoftware\PasswordKernel RegKey1=HKCU\Software\SolwaySoftware\PasswordKernel|LastFile [SOMA *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\282140 FileKey1=%UserProfile%\Documents\My Games\Soma\Main|*.log [Sonata *] LangSecRef=3024 DetectFile=%ProgramFiles%\Sonata FileKey1=%LocalAppData%\Sonata\temp|*.*|RECURSE FileKey2=%ProgramFiles%\Sonata\update|*.*|RECURSE [SongKong *] LangSecRef=3023 DetectFile=%AppData%\SongKong FileKey1=%AppData%\SongKong\Logs|*.*|RECURSE [Sonic Visualiser *] LangSecRef=3023 Detect=HKCU\Software\sonic-visualiser DetectFile=%UserProfile%\.Sonic Visualiser FileKey1=%AppData%\sonic-visualiser\Sonic Visualiser\cache|*.* FileKey2=%AppData%\sonic-visualiser\Sonic Visualiser\log|*.* FileKey3=%UserProfile%\.Sonic Visualiser\cache|*.* RegKey1=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-0 RegKey2=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-1 RegKey3=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-2 RegKey4=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-3 RegKey5=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-4 RegKey6=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-5 RegKey7=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-6 RegKey8=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-7 RegKey9=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-8 RegKey10=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-9 RegKey11=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-10 RegKey12=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-11 RegKey13=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-12 RegKey14=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-13 RegKey15=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-14 RegKey16=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-15 RegKey17=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-16 RegKey18=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-17 RegKey19=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-18 RegKey20=HKCU\Software\sonic-visualiser\Sonic Visualiser\RecentFiles|recent-19 [Sonique *] LangSecRef=3023 Detect=HKCU\Software\MediaScience\Sonique RegKey1=HKCU\Software\MediaScience\Sonique\Play_History RegKey2=HKCU\Software\MediaScience\Sonique\URL_History [Sony Magic Update *] LangSecRef=3024 DetectFile=%AppData%\Sony Corporation\Auto Magic Update Client FileKey1=%AppData%\Sony Corporation\Auto Magic Update Client|*.log [Sony Media Go *] LangSecRef=3021 Detect=HKCU\Software\Sony Corporation\Media Go FileKey1=%AppData%\Sony\Media Go|*.bkd FileKey2=%AppData%\Sony\Media Go Installer|*.log FileKey3=%AppData%\Sony\Media Go\gnsdk|*.log FileKey4=%LocalAppData%\Sony\ErrorReport|*.* FileKey5=%LocalAppData%\Sony\Media Go Video Playback engine\logging|*.cflog [Sony Media Manager *] LangSecRef=3023 DetectFile=%AppData%\Sony\Media Manager FileKey1=%AppData%\Sony\Media Manager|*.log;*log.txt FileKey2=%AppData%\Sony\Media Manager\Thumbnails|*.*|RECURSE [Sony Mobile Emma *] LangSecRef=3021 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Emma FileKey1=%ProgramFiles%\Sony Mobile\Emma\log|*.* FileKey2=%ProgramFiles%\Sony Mobile\Emma\temp|*.* FileKey3=%ProgramFiles%\Sony Mobile\Emma\workspace\.metadata|.log [Sony Sound Organizer *] LangSecRef=3024 DetectFile=%AppData%\Sony Corporation\Sound Organizer FileKey1=%AppData%\Sony Corporation\Sound Organizer|*.log [Sony VAIO *] LangSecRef=3024 Detect=HKLM\Software\Sony Corporation FileKey1=%ProgramData%\Sony Corporation\VAIO *|*.log;Log.txt [Sony Xperia Companion *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\Sony\Xperia Companion FileKey1=%UserProfile%\Documents\Sony\Xperia Companion\Autoupdate|*.exe FileKey2=%UserProfile%\Documents\Sony\Xperia Companion\Cache|*.* FileKey3=%UserProfile%\Documents\Sony\Xperia Companion\Logs|*.* [Sony Xperia Flashtool *] LangSecRef=3024 Detect=HKLM\Software\Flashtool FileKey1=%SystemDrive%\Flashtool|*.log [SopCast *] LangSecRef=3022 DetectFile=%ProgramFiles%\SopCast FileKey1=%ProgramFiles%\SopCast\adv|sopadver.dat [Sorcery! Parts 1 and 2 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\411000 FileKey1=%LocalAppData%\inkle\Sorcery|*.log [Soulseek *] LangSecRef=3022 DetectFile=%ProgramFiles%\Soulseek* FileKey1=%ProgramFiles%\Soulseek*|search.cfg RegKey1=HKCU\Software\SoulSeek\SoulSeek\Recent File List RegKey2=HKCU\Software\Soulseek2\config|search [Soulseek Chat History *] LangSecRef=3022 DetectFile=%ProgramFiles%\Soulseek* FileKey1=%LocalAppData%\Soulseek Chat Logs\*|*.log FileKey2=%LocalAppData%\SoulseekQt\Soulseek Chat Logs|*.log|RECURSE FileKey3=%ProgramFiles%\Soulseek*\*Chat_Logs|*.txt FileKey4=%UserProfile%\Documents\Soulseek Chat Logs\Private|*.txt [SoundMAX *] LangSecRef=3023 DetectFile=%ProgramFiles%\Analog Devices\SoundMAX FileKey1=%ProgramFiles%\Analog Devices\SoundMAX|SMax.log* [SoundTap Streaming Audio Recorder *] LangSecRef=3023 DetectFile=%AppData%\NCH Software\SoundTap FileKey1=%AppData%\NCH Software\SoundTap\Logs|*.* [Space Engineers *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\244850 FileKey1=%AppData%\SpaceEngineers|*.log [SpeedFan *] LangSecRef=3024 Detect=HKCU\Software\SpeedFan FileKey1=%ProgramFiles%\SpeedFan|debug.nfo;SFLog*.csv FileKey2=%WinDir%\System32|initdebug.nfo FileKey3=%WinDir%\SysWOW64|initdebug.nfo [SpeedRunners *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\207140 FileKey1=%AppData%|SpeedRunnersLog.txt;TargetInvocationLog.txt [SpeedyComputer *] LangSecRef=3024 DetectFile=%AppData%\SpeedyComputer FileKey1=%AppData%\SpeedyComputer\Log|*.*|RECURSE [Spider Player *] LangSecRef=3023 DetectFile=%AppData%\Spider Player FileKey1=%AppData%\Spider Player|URLHistory.xml [SpiderOak *] LangSecRef=3024 DetectFile=%AppData%\SpiderOak FileKey1=%AppData%\SpiderOak|*.log|RECURSE FileKey2=%AppData%\SpiderOak\download_cache|*.* [Spiral Knights *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\99900 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Spiral Knights|*.log [Spitfire Audio *] LangSecRef=3023 DetectFile1=%AppData%\com.spitfireaudio DetectFile2=%AppData%\Spitfire Audio FileKey1=%AppData%\com.spitfireaudio|*.log FileKey2=%AppData%\Spitfire Audio\settings|*.log [Spitkiss *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Triple Topping Games\Spitkiss FileKey1=%UserProfile%\AppData\LocalLow\Triple Topping Games\Spitkiss|*txt [SPlayer *] LangSecRef=3023 DetectFile=%AppData%\SPlayer FileKey1=%AppData%\SPlayer|default.mpcpl;local.db [Splice *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\209790 FileKey1=%ProgramFiles%\Steam\steamapps\common\splice|output_log.txt FileKey2=%ProgramFiles%\Steam\steamapps\common\Splice\Splice_Data|output_log.txt FileKey3=%UserProfile%\Documents|GALog.txt [SpongeBob Diner Dash *] Section=Games DetectFile=%ProgramFiles%\SpongeBob Diner Dash FileKey1=%ProgramFiles%\SpongeBob Diner Dash|logfile.* [Spooky Mall *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spooky Mall1.0 FileKey1=%ProgramData%\SpookyMall|*.xml_log FileKey2=%ProgramFiles%\Foxy Games\Spooky Mall|*.log [SporTV *] LangSecRef=3021 DetectFile=%LocalAppData%\SporTV FileKey1=%LocalAppData%\SporTV\Logs|*.* [Spotflux *] LangSecRef=3021 Detect=HKLM\Software\Spotflux DetectFile=%ProgramFiles%\Spotflux FileKey1=%AppData%\.spotflux|*.log [Spotify *] LangSecRef=3036 DetectFile=%AppData%\Spotify FileKey1=%AppData%\Spotify|*.log FileKey2=%AppData%\Spotify\users\*|log [Spoutcraft *] Section=Games DetectFile=%AppData%\.spoutcraft FileKey1=%AppData%\.spoutcraft|*.log FileKey2=%AppData%\.spoutcraft\logs|*.* [Sprint Hero RUU *] LangSecRef=3023 DetectFile=%SystemDrive%\ruu_log FileKey1=%SystemDrive%\ruu_log|*.*|REMOVESELF [Spybot AntiBeacon *] LangSecRef=3024 DetectFile=%LocalAppData%\Safer-Networking Ltd\Spybot* FileKey1=%LocalAppData%\Safer-Networking Ltd\Spybot*|*.log;Spybot Lab.txt [Spybot Search and Destroy *] LangSecRef=3024 Detect1=HKCU\Software\Safer Networking Limited\Spybot - Search & Destroy 2 Detect2=HKLM\Software\Safer Networking Limited\SpybotSnD FileKey1=%ProgramData%\Spybot - Search & Destroy\Logs|*|RECURSE FileKey2=%ProgramData%\Spybot - Search & Destroy\System Configuration Snapshots|*|REMOVESELF FileKey3=%ProgramFiles%\Spybot - Search & Destroy 2\Updates|*|RECURSE FileKey4=%ProgramFiles%\Spybot - Search & Destroy\Updates|*.zip FileKey5=%UserProfile%\Documents\ProcAlyzer Dumps|*|REMOVESELF ExcludeKey1=FILE|%ProgramFiles%\Spybot - Search & Destroy 2\Updates\Downloads\|updates.uid [Spybot Search and Destroy Backups *] LangSecRef=3024 Detect=HKLM\Software\Safer Networking Limited\SpybotSnD FileKey1=%ProgramData%\Spybot - Search & Destroy\Backups|*|RECURSE FileKey2=%ProgramData%\Spybot - Search & Destroy\Recovery|*|RECURSE FileKey3=%ProgramData%\Spybot - Search & Destroy\Snapshots*|*|RECURSE FileKey4=%WinDir%\System32\drivers\etc|hosts.*.backup [SpyDefense *] LangSecRef=3024 DetectFile=%ProgramFiles%\Everest Labs\Spydefense FileKey1=%AppData%\Everest Labs\Spydefense|SpyDefense.log;History.ini;Backups.ini FileKey2=%AppData%\Everest Labs\Spydefense\Backups|BF7.tmp [SpyHunter *] LangSecRef=3024 DetectFile=%ProgramFiles%\EnigmaSoft\SpyHunter FileKey1=%ProgramFiles%\EnigmaSoft\SpyHunter\Logs|*.* [SpyShelter *] LangSecRef=3024 DetectFile=%AppData%\SpyShelter FileKey1=%AppData%\SpyShelter|shelter-log.txt [Spyware Terminator *] LangSecRef=3024 Detect=HKCU\Software\Spyware Terminator FileKey1=%ProgramFiles%\Spyware Terminator|*.err;*.old|RECURSE [SpywareBlaster Update File *] LangSecRef=3024 DetectFile=%ProgramFiles%\SpywareBlaster FileKey1=%ProgramFiles%\SpywareBlaster|spywareblasterupgrade_latest.exe [SQL Anywhere 11 *] LangSecRef=3021 DetectFile=%ProgramData%\SQL Anywhere 11 FileKey1=%ProgramData%\SQL Anywhere 11\Diagnostics|*.dmp;*.crash_log [SQLite Expert 3 *] LangSecRef=3024 Detect1=HKCU\Software\SQLite Expert\Personal\3.x Detect2=HKCU\Software\SQLite Expert\Professional\3.x RegKey1=HKCU\Software\SQLite Expert\Personal\3.x\DB RegKey2=HKCU\Software\SQLite Expert\Professional\3.x\DB [SQLiteMan *] LangSecRef=3021 Detect=HKCU\Software\yarpen.cz\sqliteman RegKey1=HKCU\Software\yarpen.cz\sqliteman|lastDatabase [Squirrel.Windows *] LangSecRef=3021 DetectFile=%LocalAppData%\SquirrelTemp FileKey1=%LocalAppData%\SquirrelTemp|*|REMOVESELF [Star Citizen *] Section=Games DetectFile1=%AppData%\rsilauncher DetectFile2=%LocalAppData%\Star Citizen FileKey1=%AppData%\RSI Launcher|*.*|RECURSE FileKey2=%AppData%\rsilauncher|*.log;*.jpg FileKey3=%AppData%\rsilauncher\*Cache|*.* FileKey4=%AppData%\rsilauncher\*update*|*.* FileKey5=%LocalAppData%\Star Citizen|*.* FileKey6=%ProgramFiles%\Roberts Space Industries\StarCitizen\LIVE|*.log|RECURSE [Star Downloader *] LangSecRef=3021 Detect=HKCU\Software\Star Downloader FileKey1=%ProgramFiles%\Star Downloader|serverstats.txt;LastURLs FileKey2=%ProgramFiles%\Star Downloader\Partial Downloads|*.*|RECURSE [Star Swarm Stress Test *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\267130 FileKey1=%UserProfile%\Documents\Star Swarm|output*.txt [Star Trek Online *] Section=Games Detect1=HKCU\Software\Cryptic\Star Trek Online Detect2=HKCU\Software\Valve\Steam\Apps\9900 FileKey1=%ProgramFiles%\Steam\Steamapps\Common\star trek online\Star Trek Online\*\cache|*.* FileKey2=%ProgramFiles%\steam\steamapps\common\star trek online\star trek online\*\logs\GameClient|*.* FileKey3=%Public%\Games\Cryptic Studios\Star Trek Online\*\Cache|*.* FileKey4=%Public%\Games\Cryptic Studios\Star Trek Online\*\Logs\GameClient|*.* [Star Wars: Battlefront II *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\6060 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Star Wars BattleFront II|update*.txt [Star Wars: The Force Unleashed *] Section=Games DetectFile=%LocalAppData%\LucasArts\Star Wars The Force Unleashed* FileKey1=%LocalAppData%\LucasArts\Star Wars The Force Unleashed*|*.* [Star Wars: The Old Republic *] Section=Games Detect=HKLM\Software\BioWare\Star Wars-The Old Republic FileKey1=%LocalAppData%\SWTOR\CrashDump\swtor|*.* FileKey2=%ProgramFiles%\EA Games\Star Wars - The Old Republic\__Installer|InstallLog.txt FileKey3=%ProgramFiles%\EA Games\Star Wars - The Old Republic\logs|*.* FileKey4=%ProgramFiles%\EA Games\Star Wars - The Old Republic\swtor\retailclient\swtor\logs|*.* FileKey5=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\betatest\retailclient\Temp|*.log FileKey6=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\logs|*.log FileKey7=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\swtor\retailclient\swtor\logs|*.log FileKey8=%UserProfile%\Documents|*Install STAR WARS The Old Republic.log [StarCraft I/II *] Section=Games Detect1=HKCU\Software\Blizzard Entertainment\Starcraft Detect2=HKLM\Software\Blizzard Entertainment\StarCraft II FileKey1=%AppData%\Blizzard\StarCraft|*Log.txt FileKey2=%LocalAppData%\Blizzard Entertainment\StarCraft II\BrowserCookies|*-journal;*.old;LOG;Visited Links|RECURSE FileKey3=%LocalAppData%\Blizzard Entertainment\StarCraft II\BrowserCookies\*Cache|*.* FileKey4=%UserProfile%\Documents\StarCraft II\*Logs|*.*|RECURSE FileKey5=%UserProfile%\Documents\StarCraft\Errors|*.* RegKey1=HKCU\Software\Blizzard Entertainment\StarCraft II Editor\Recent Files [Stardew Valley *] Section=Games DetectFile=%AppData%\StardewValley FileKey1=%AppData%\StardewValley\ErrorLogs|*.txt [Stardock Fences *] LangSecRef=3024 Detect1=HKLM\Software\Stardock\Misc\Fences Detect2=HKLM\Software\Stardock\Misc\Fences2 DetectFile=%LocalAppData%\Stardock\Fences* FileKey1=%AppData%\Stardock\Fences\TroubleshootingLog|*.dat;*.txt FileKey2=%LocalAppData%\Stardock\Fences*|*Log.txt FileKey3=%ProgramData%\Stardock\Fences*|Cache.dat FileKey4=%ProgramFiles%\Stardock\Fences|*.txt [Stardock ObjectDock Plus *] LangSecRef=3024 DetectFile=%ProgramFiles%\Stardock\ObjectDock Plus FileKey1=%AppData%\Stardock|*|REMOVESELF FileKey2=%LocalAppData%\ODUI|*|REMOVESELF FileKey3=%LocalAppData%\Stardock\ObjectDockPlus|*Backup.ini FileKey4=%ProgramData%\Stardock|*|RECURSE [Stardock Start11 *] LangSecRef=3024 DetectFile=%ProgramFiles%\Stardock\Start11 FileKey1=%LocalAppData%\StarDock\Start11|SasLog.txt FileKey2=%ProgramData%\StarDock\Start11\Update|*.exe [StarMoney *] LangSecRef=3021 DetectFile=%ProgramData%\StarMoney* FileKey1=%ProgramData%\StarMoney *|*.log|RECURSE [StarOffice *] LangSecRef=3021 DetectFile=%ProgramFiles%\Sun\StarOffice* FileKey1=%AppData%\StarOffice*\user\registry\data\org\openoffice\Office|Common.xcu [Start Menu Reviver *] LangSecRef=3024 Detect=HKLM\Software\Start Menu Reviver FileKey1=%ProgramFiles%\ReviverSoft\Start Menu Reviver\Logs|*.* [Startup Sentinel *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\Startup Sentinel FileKey1=%AppData%\KC Softwares\Startup Sentinel|*.log [Staxel *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\405710 FileKey1=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\cache|*.* FileKey2=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\cookies|*.* FileKey3=%ProgramFiles%\Steam\Steamapps\common\shared\Staxel\bin\crashlogs|*.* [STDU Explorer *] LangSecRef=3021 Detect=HKCU\Software\STDUtility\STDUExplorerApp RegKey1=HKCU\Software\STDUtility\STDUExplorerApp\PathMRUList [STDU Viewer *] LangSecRef=3021 DetectFile=%ProgramFiles%\STDU Viewer FileKey1=%LocalAppData%\STDUViewer|browse.cache;FilesViewerState.xml;STDUSessions.xml FileKey2=%ProgramFiles%\STDU Viewer|browse.cache;FilesViewerState.xml;STDUSessions.xml [Steam *] Section=Games Detect=HKCU\Software\Valve\Steam FileKey1=%AppData%\SteamVR\Logs|*|REMOVESELF FileKey2=%CommonProgramFiles%\Steam|*_log.txt FileKey3=%LocalAppData%\Steam\htmlcache|*|REMOVESELF FileKey4=%ProgramData%\Steam\RLD!\*|last.txt FileKey5=%ProgramFiles%\Steam|*.old;*.log FileKey6=%ProgramFiles%\Steam\appcache\httpcache|*|REMOVESELF FileKey7=%ProgramFiles%\Steam\bin\cef\*|debug.log FileKey8=%ProgramFiles%\Steam\config\*cache|* FileKey9=%ProgramFiles%\Steam\depotcache|* FileKey10=%ProgramFiles%\Steam\dumps|*|RECURSE FileKey11=%ProgramFiles%\Steam\logs|* FileKey12=%ProgramFiles%\Steam\music\_database|*|RECURSE FileKey13=%ProgramFiles%\Steam\tenfoot\config\httpcache|*|RECURSE FileKey14=%ProgramFiles%\Steam\tenfoot\config\images\web|*|RECURSE FileKey15=%ProgramFiles%\Steam\userdata\*\*|RemoveEmptyFoldersOnly|REMOVESELF FileKey16=%ProgramFiles%\Steam\userdata\*\*\local|socache.dt FileKey17=%ProgramFiles%\Steam\userdata\*\*msgcache|*|RECURSE FileKey18=%ProgramFiles%\Steam\userdata\*\config\*cache|*|RECURSE FileKey19=%ProgramFiles%\Steam\vr\runtime\logs|*|RECURSE [Steam Games *] Section=Games Detect=HKCU\Software\Valve\Steam FileKey1=%ProgramFiles%\Steam\steamapps|*.dmp;.DS_Store;*.icns;logfile.*;*.log;*.mdmp;*.tmp|RECURSE FileKey2=%ProgramFiles%\Steam\steamapps\common\*\*\downloads|*|RECURSE FileKey3=%ProgramFiles%\Steam\steamapps\common\*\Cache|*|RECURSE FileKey4=%ProgramFiles%\Steam\steamapps\common\*\config\html|*|RECURSE FileKey5=%ProgramFiles%\Steam\steamapps\common\*\DebugData|*|RECURSE FileKey6=%ProgramFiles%\Steam\steamapps\downloading|*|RECURSE FileKey7=%ProgramFiles%\Steam\steamapps\shadercache|*|RECURSE FileKey8=%ProgramFiles%\Steam\steamapps\temp|*|RECURSE FileKey9=%ProgramFiles%\Steam\steamapps\workshop\downloads|*|RECURSE FileKey10=%ProgramFiles%\Steam\steamapps\workshop\temp|*|RECURSE ExcludeKey1=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler 1936\Cache\|*.* ExcludeKey2=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler Cold War\Cache\|*.* ExcludeKey3=PATH|%ProgramFiles%\Steam\steamapps\common\Supreme Ruler Ultimate\Cache\|*.* [Steam Installers *] Section=Games Detect=HKCU\Software\Valve\Steam Warning=This entry should only be enabled after you have launched each of your installed Steam games at least once. Deleting these files before then may cause Steam to think the game's installation is broken. After the first launch, these files become useless. FileKey1=%ProgramFiles%\Steam\Steamapps\common|*redist.msi*;dosbox*.tar.gz;*redist*.exe;*setup*.msi;*pbsvc*.exe;*UPlay*Installer*.exe;WMF*Dist*.exe;SPInstaller.exe;python*.msi;bitmap2substance_installer.exe;perforce*.exe;p4vinst*.exe;mcpp*.*;firewallinstallhelper.dll;gameuxinstallhelper.dll;eadm-installer.exe;wmpappcompat.exe;umdf.exe;Microsoft .NET Framework*.cmd;Microsoft .NET Framework*.bat;NDP*.exe;PhysX*.msi;PhysX*.exe;*d3dx11*.cat;*d3dx11*.inf;prompt.bat;GDFInstall.exe;DSInstaller.exe;d3d*.exe;directx*.exe;*.msu;Windows*-KB*.exe;cmp.bat;PVRTexTool.exe;wmp11-windowsxp-x86-enu.exe;*.vdk;RGB9RAST*.msi;WIC*.exe;XPSEPC*.exe;msxml6.msi;AdbeRdr*.*;*inst*.vdf;*.cab;*.msp;ac3filter*.exe;GamesExplorerIntegrationTool.exe;install.ini;globdata.ini;install.exe;install.res.*.dll;eula.*.*;DSETUP*.DLL;oalinst.exe;D3D*Install.exe;D3D*Install*.dll;*vc*red*.exe;*vc*red.msi;WindowsInstaller*.exe;locdata.*.ini;setupres.*.dll;*setup*.exe;wapres.*.dll;*NetFx*.*;Microsoft Visual C++ *.cmd|RECURSE ExcludeKey1=FILE|%ProgramFiles%\Steam\Steamapps\common\SteamVR\tools\steamvr_room_setup\win64\|steamvr_room_setup.exe [Steam Packages *] Section=Games Detect=HKCU\Software\Valve\Steam FileKey1=%ProgramFiles%\Steam\package|*.zip.* [SteamWorld Dig *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\252410 FileKey1=%ProgramFiles%\Steam\Steamapps\common\SteamWorld Dig|*.mdmp [Steed *] LangSecRef=3022 DetectFile=%ProgramData%\Steed FileKey1=%ProgramData%\Steed\Logs|*|REMOVESELF [SteelSeries *] LangSecRef=3024 DetectFile=%ProgramData%\SteelSeries FileKey1=%AppData%\SteelSeries-Engine-*-Client|*.old;LOG|RECURSE FileKey2=%AppData%\SteelSeries-Engine-*-Client\*Cache|*|RECURSE FileKey3=%AppData%\SteelSeries-Engine-*-Client\blob_storage|*|RECURSE FileKey4=%ProgramData%\SteelSeries\SteelSeries Engine*\Logs|*|REMOVESELF FileKey5=%ProgramFiles%\SteelSeries\SteelSeries Engine*|*.log [Steinberg Cubase *] LangSecRef=3023 DetectFile=%ProgramFiles%\Steinberg\Cubase* FileKey1=%ProgramFiles%\Steinberg\Cubase*|*.log [Stellar Phoenix Registry Manager *] LangSecRef=3024 DetectFile=%ProgramFiles%\Stellar Phoenix Registry Manager FileKey1=%SystemDrive%|LogReport.txt [Stellaris *] Section=Games DetectFile=%UserProfile%\Documents\Paradox Interactive\Stellaris FileKey1=%UserProfile%\Documents\Paradox Interactive\Stellaris\.launcher-cache|*.* FileKey2=%UserProfile%\Documents\Paradox Interactive\Stellaris\_backup_*\ShaderCache\dx*|*.*|REMOVESELF FileKey3=%UserProfile%\Documents\Paradox Interactive\Stellaris\Cache|*.* FileKey4=%UserProfile%\Documents\Paradox Interactive\Stellaris\Crashes|*.*|REMOVESELF FileKey5=%UserProfile%\Documents\Paradox Interactive\Stellaris\Dumps|*.* FileKey6=%UserProfile%\Documents\Paradox Interactive\Stellaris\Logs|*.* FileKey7=%UserProfile%\Documents\Paradox Interactive\Stellaris\Screenshots|*.png FileKey8=%UserProfile%\Documents\Paradox Interactive\Stellaris\ShaderCache\dx*|*.*|REMOVESELF [Stellarium *] LangSecRef=3021 DetectFile=%AppData%\Stellarium FileKey1=%AppData%\Stellarium|log.txt FileKey2=%LocalAppData%\Stellarium\Cache|*.*|RECURSE FileKey3=%LocalAppData%\stellarium\stellarium\cache|*.*|RECURSE [StepMania *] Section=Games DetectFile=%AppData%\StepMania* FileKey1=%AppData%\Stepmania*\Logs|*.* [SterJo NetStalker *] LangSecRef=3022 DetectFile=%LocalAppData%\SterJo NetStalker FileKey1=%LocalAppData%\SterJo NetStalker|dscnt.exe;History.sjh FileKey2=%LocalAppData%\SterJo NetStalker\Logs|*.* [STOIK Smart Resizer *] LangSecRef=3023 Detect1=HKCU\Software\STOIK Smart Resizer 1.0\STOIK Smart Resizer Detect2=HKCU\Software\STOIK Smart Resizer 2.0\STOIK Smart Resizer Detect3=HKCU\Software\STOIK Smart Resizer 3.0\STOIK Smart Resizer RegKey1=HKCU\Software\STOIK Smart Resizer 1.0\STOIK Smart Resizer\Recent File List RegKey2=HKCU\Software\STOIK Smart Resizer 2.0\STOIK Smart Resizer\Recent File List RegKey3=HKCU\Software\STOIK Smart Resizer 3.0\STOIK Smart Resizer\Recent File List [STOIK Video Converter 2 *] LangSecRef=3023 Detect=HKCU\Software\STOIK FileKey1=%AppData%\STOIK\videopak2|*.ini [Stranded Deep *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Beam Team Games\Stranded Deep FileKey1=%UserProfile%\AppData\LocalLow\Beam Team Games\Stranded Deep|*.log [Stranglehold *] Section=Games DetectFile=%LocalAppData%\Midway\Stranglehold FileKey1=%LocalAppData%\Midway\Stranglehold|*.log|RECURSE FileKey2=%LocalAppData%\Midway\Stranglehold\Cache|*.*|REMOVESELF [Stream-Cloner *] LangSecRef=3023 Detect=HKCU\Software\Stream-Cloner FileKey1=%AppData%\Stream-Cloner|*.log;IeRecentVisit.txt FileKey2=%AppData%\Stream-Cloner\Cap_images|*.*|REMOVESELF FileKey3=%AppData%\Stream-Cloner\thumbs|*.*|REMOVESELF [Stremio *] LangSecRef=3022 DetectFile=%LocalAppData%\Smart Code LTD\Stremio FileKey1=%AppData%\Stremio\Stremio-Server\Stremio-Cache|*.*|RECURSE FileKey2=%LocalAppData%\Smart Code LTD\Stremio\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Smart Code LTD\Stremio\QtWebEngine\Default|*-journal;LOG;LOG.old;Origin Bound Certs;QuotaManager;Visited Links|RECURSE FileKey4=%LocalAppData%\Smart Code LTD\Stremio\QtWebEngine\Default\Service Worker\*Cache*|*.*|RECURSE [Stronghold Crusader *] Section=Games DetectFile=%ProgramFiles%\Firefly Studios\Stronghold Crusader FileKey1=%ProgramFiles%\Firefly Studios\Stronghold Crusader\gfx|*log.txt [StudioLine Photo Basic *] LangSecRef=3023 Detect=HKCU\Software\StudioLine\StudioLine Photo Basic DetectFile=%ProgramFiles%\StudioLine Photo Basic FileKey1=%ProgramData%\H&M System Software\StudioLine Photo Basic 3|*.bak;*.dmp;*.log RegKey1=HKCU\Software\H&&M System Software\Twain\Recent File List RegKey2=HKCU\Software\StudioLine\StudioLine Photo Basic\WindowPositions [SubiT *] LangSecRef=3023 DetectFile=%AppData%\SubiT FileKey1=%AppData%\SubiT\settings|crash.log [Sublime Text Backups *] LangSecRef=3024 DetectFile=%AppData%\Sublime Text* FileKey1=%AppData%\Sublime Text 3\Backup|*.*|REMOVESELF [Sublime Text Session *] LangSecRef=3024 DetectFile=%AppData%\Sublime Text* FileKey1=%AppData%\Sublime Text 2\Settings|*.sublime_session FileKey2=%AppData%\Sublime Text 3\Local|Session.sublime_session FileKey3=%AppData%\Sublime Text\Options|*.* [Success Story *] Section=Games DetectFile=%AppData%\Shape Games\SuccessStory FileKey1=%AppData%\Shape Games\SuccessStory\logs|*.* [SumatraPDF *] LangSecRef=3024 DetectFile1=%AppData%\SumatraPDF DetectFile2=%LocalAppData%\SumatraPDF DetectFile3=%SystemDrive%\PortableApps\SumatraPDFPortable FileKey1=%AppData%\SumatraPDF\sumatrapdfcache|* FileKey2=%LocalAppData%\SumatraPDF\sumatrapdfcache|* FileKey3=%SystemDrive%\PortableApps\SumatraPDFPortable\Data\settings\sumatrapdfcache|* [SUMo *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\SUMo FileKey1=%AppData%\KC Softwares\SUMo|*.log;db.bak;errlst.txt;SUMo.cache;SUMo.skipped;db.sumo [Sundered *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Thunder Lotus Games\Sundered FileKey1=%ProgramFiles%\Steam\Steamapps\common\sundered\sundered_data|*log.txt FileKey2=%UserProfile%\AppData\LocalLow\Thunder Lotus Games\Sundered|*txt [SuniSoft Registry Clean Expert *] LangSecRef=3024 Detect=HKCU\Software\SuniSoft\IncUpdate\Registry Clean Expert FileKey1=%ProgramFiles%\Registry Clean Expert|fixlog.ini [SUPERAntiSpyware *] LangSecRef=3024 Detect1=HKCU\Software\SUPERAntiSpyware.com\SUPERAntiSpyware Detect2=HKLM\Software\SUPERAntiSpyware.com\SUPERAntiSpyware FileKey1=%ProgramData%\!SASCORE\AppLogs|*.dmp;*.SDB FileKey2=%ProgramData%\SUPERAntiSpyware.com\SUPERAntiSpyware\Applogs|*.dmp;*.SDB;*.ZIP FileKey3=%ProgramFiles%\SUPERAntiSpyware|*.tmp [SuperEasy Software Driver Updater *] LangSecRef=3023 Detect=HKLM\Software\SuperEasy Software FileKey1=%AppData%\SuperEasy Software\Driver Updater|*.log [SuperMP3Download *] LangSecRef=3023 DetectFile=%ProgramFiles%\SuperMp3Download FileKey1=%ProgramData%\SuperMP3Download|downloadlist.sav FileKey2=%ProgramData%\SuperMP3Download\Downloading|*|RECURSE [Superstar Racing *] Section=Games DetectFile=%LocalAppData%\Chat Republic Games\Superstar Racing FileKey1=%LocalAppData%\Chat Republic Games\Superstar Racing|log*.* [SuperSync *] LangSecRef=3023 DetectFile=%AppData%\SuperSync FileKey1=%AppData%\SuperSync\logs|*.* FileKey2=%AppData%\SuperSync\tmp|*.*|RECURSE [SuperWinMenu *] LangSecRef=3024 DetectFile=%AppData%\SuperWinMenu FileKey1=%AppData%\SuperWinMenu|*.lastused [SuuntoLink *] LangSecRef=3024 DetectFile=%AppData%\SuuntoLink FileKey1=%AppData%\SuuntoLink|*.dmp;*.log FileKey2=%AppData%\SuuntoLink\*Cache|*.* FileKey3=%AppData%\SuuntoLink\Feedback|*.dmp;*.log FileKey4=%AppData%\SuuntoLink\Logs|*.* FileKey5=%AppData%\SuuntoLink\webrtc_event_logs|*.* FileKey6=%LocalAppData%\SuuntoLink|*.log|RECURSE [Swiff Player *] LangSecRef=3023 Detect=HKCU\Software\GlobFX Technologies\Swiff Player RegKey1=HKCU\Software\GlobFX Technologies\Swiff Player\Recent File List [Swift *] LangSecRef=3022 Detect=HKCU\Software\Swift FileKey1=%AppData%\Swift\Avatars|*.*|RECURSE FileKey2=%AppData%\Swift\Crashes|*.*|RECURSE [Switch Audio-Converter *] LangSecRef=3023 Detect=HKCU\Software\NCH Software\Switch FileKey1=%AppData%\NCH Software\Switch\Logs|*.*|RECURSE [Syberfix Helpdesk *] LangSecRef=3021 DetectFile=%LocalAppData%\Syberfix\UserSaved\Helpdesk* FileKey1=%LocalAppData%\SyberFix\UserSaved\Helpdesk *|*.log [Sylpheed *] LangSecRef=3022 DetectFile=%AppData%\Sylpheed FileKey1=%AppData%\Sylpheed|*.bak*;*.log [Symantec Ghost *] LangSecRef=3024 Detect=HKCU\Software\Symantec\Symantec Ghost RegKey1=HKCU\Software\Symantec\Symantec Ghost\Explorer\Ghost Explorer\Recent File List [Symantec SymSilent *] LangSecRef=3024 DetectFile=%Public%\Symantec\SymSilent FileKey1=%Public%\Symantec\SymSilent\ccLog|*.* [Synchronize It! *] LangSecRef=3021 Detect=HKCU\Software\grigsoft.com\Synchronize It! RegKey1=HKCU\Software\grigsoft.com\Synchronize It!\Combos RegKey2=HKCU\Software\grigsoft.com\Synchronize It!\Synchronize It!\Combos [Syncios Cell Phone Backup & Manage *] LangSecRef=3024 Detect1=HKCU\Software\Syncios Detect2=HKCU\Software\Syncios Data Transfer Detect3=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Syncios Data Transfer.exe FileKey1=%AppData%\app_sycnios_transfer_loader|*.*|REMOVESELF FileKey2=%AppData%\Syncios*|*.log;log.txt FileKey3=%AppData%\Syncios*\GPUCache|*.* FileKey4=%AppData%\Syncios*\Local Storage\leveldb|LOG.old FileKey5=%AppData%\Syncios*\logs|*.* FileKey6=%SystemDrive%\Temp\Syncios*|*.*|REMOVESELF FileKey7=%UserProfile%\Documents\Syncios*|preference_conf.ini.old.bak [Syncovery *] LangSecRef=3024 Detect=HKCU\Software\Syncovery FileKey1=%ProgramData%\Syncovery\Logs|*.log|RECURSE [Syncthing *] LangSecRef=3022 DetectFile=%LocalAppData%\Syncthing FileKey1=%LocalAppData%\Syncthing|*.log;*.xml.v* FileKey2=%ProgramFiles%\Syncthing|*.old [SyncTrayzor *] LangSecRef=3022 DetectFile=%AppData%\SyncTrayzor FileKey1=%AppData%\SyncTrayzor|*.old FileKey2=%AppData%\SyncTrayzor\logs|*.*|REMOVESELF [Synthesia *] Section=Games Detect=HKCU\Software\Classes\synthesia FileKey1=%AppData%\Synthesia|log*.txt;recentSongs.xml [Sysinternals DebugView *] LangSecRef=3024 Detect=HKCU\Software\Sysinternals\DbgView RegKey1=HKCU\Software\Sysinternals\DbgView|Recent [Sysinternals Process Explorer *] LangSecRef=3024 Detect1=HKCU\Software\Sysinternals\Process Explorer Detect2=HKU\.DEFAULT\Software\Sysinternals\Process Explorer Detect3=HKU\S-1-5-18\Software\Sysinternals\Process Explorer RegKey1=HKCU\Software\Sysinternals\Process Explorer|SymbolPath RegKey2=HKU\.DEFAULT\Software\Sysinternals\Process Explorer|SymbolPath RegKey3=HKU\S-1-5-18\Software\Sysinternals\Process Explorer|SymbolPath [Sysinternals Process Monitor *] LangSecRef=3024 Detect=HKCU\Software\Sysinternals\Process Monitor RegKey1=HKCU\Software\Sysinternals\Process Monitor|Logfile RegKey2=HKCU\Software\Sysinternals\Process Monitor|SourcePath [Sysinternals VMMap *] LangSecRef=3024 Detect=HKCU\Software\Sysinternals\VMMap RegKey1=HKCU\Software\Sysinternals\VMMap|SourcePath [Sysinternals ZoomIt *] LangSecRef=3024 Detect=HKCU\Software\Sysinternals\ZoomIt RegKey1=HKCU\Software\Sysinternals\ZoomIt|FilePath [System Driver Installation Files *] LangSecRef=3025 DetectFile=%SystemDrive%\Drivers FileKey1=%SystemDrive%\Drivers|*.*|REMOVESELF [System Explorer *] LangSecRef=3024 DetectFile=%ProgramFiles%\System Explorer FileKey1=%ProgramData%\SystemExplorer\snapshots|*.ses [System Mechanic *] LangSecRef=3024 Detect=HKCU\Software\iolo\System Mechanic FileKey1=%AppData%\iolo\SafetyNet\Temp|* FileKey2=%AppData%\iolo\System Snapshots Data|* FileKey3=%AppData%\ioloGovernor\logs|*|REMOVESELF FileKey4=%ProgramData%\iolo|*.xml;*.txt FileKey5=%ProgramData%\Iolo Technologies\Logs|* FileKey6=%ProgramData%\iolo\ACRSummaryFiles|*|REMOVESELF FileKey7=%ProgramData%\iolo\logs|*|REMOVESELF FileKey8=%ProgramData%\iolo\TempResources|*|REMOVESELF FileKey9=%ProgramFiles%\iolo\System Mechanic|*.txt;*.xml FileKey10=%SystemDrive%\Documents and Settings\LocalService\*\iolo|*.*|REMOVESELF FileKey11=%WinDir%\System32\config|iolo App.evt [System Tray Cleaner *] LangSecRef=3024 Detect=HKCU\Software\Innovative Solutions\System Tray Cleaner DetectFile=%ProgramFiles%\Innovative Solutions\System Tray Cleaner FileKey1=%LocalAppData%\Innovative Solutions\System Tray Cleaner\Process_information_cache|*.* FileKey2=%ProgramFiles%\Innovative Solutions\System Tray Cleaner\Process_information_database|*.iscrt RegKey1=HKCU\Software\Innovative Solutions\System Tray Cleaner\TrayApplications [SystemScheduler *] LangSecRef=3024 DetectFile=%ProgramFiles%\SystemScheduler FileKey1=%ProgramFiles%\SystemScheduler|LogFile.TXT FileKey2=%ProgramFiles%\SystemScheduler\Events|*.* [SystemTools Exporter *] LangSecRef=3024 Detect=HKCU\Software\SystemTools\Exporter RegKey1=HKCU\Software\SystemTools\Exporter\Recent File List [SysTools AD Browser *] LangSecRef=3024 DetectFile=%ProgramFiles%\SysTools AD Browser FileKey1=%ProgramFiles%\SysTools AD Browser|Setup Log*.txt [SysTools PDF Unlocker *] LangSecRef=3021 DetectFile=%ProgramFiles%\SysTools PDF Unlocker FileKey1=%ProgramFiles%\SysTools PDF Unlocker|*.log;Setup Log*.txt [SysTracer *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SysTracer FileKey1=%ProgramFiles%\SysTracer|SysTracerLog.txt FileKey2=%ProgramFiles%\SysTracer\tmp|*.*|REMOVESELF [Systweak Advanced PC Cleanup *] LangSecRef=3024 Detect=HKCU\Software\Systweak\Advanced PC Cleanup DetectFile=%ProgramFiles%\Advanced PC Cleanup FileKey1=%AppData%\Advanced PC Cleanup|*Log.txt FileKey2=%ProgramFiles%\Advanced PC Cleanup|*log.txt [Systweak Advanced System Optimizer 3 *] LangSecRef=3024 Detect=HKLM\Software\Systweak\ASO3 DetectFile=%ProgramFiles%\Advanced System Optimizer 3 FileKey1=%AppData%\Systweak\ASO3\Driver Updater|*.log FileKey2=%AppData%\Systweak\ASO3\Registry Cleaner|*.log [Systweak Advanced System Protector *] LangSecRef=3024 Detect=HKCU\Software\Systweak\Advanced System Protector DetectFile=%ProgramFiles%\Advanced System Protector FileKey1=%AppData%\Systweak\Advanced System Protector|*log.txt;*.log|RECURSE FileKey2=%AppData%\Systweak\Advanced System Protector\Logs|*.xml [Systweak RegClean Pro *] LangSecRef=3024 Detect=HKCU\Software\Systweak\RegClean Pro DetectFile=%AppData%\Systweak\RegClean Pro FileKey1=%AppData%\Systweak\RegClean Pro\Version*|*.log;backup*.bin FileKey2=%AppData%\Systweak\RegClean Pro\Version*\update|*.* FileKey3=%ProgramFiles%\RCP|*log.txt [Tag&Rename *] LangSecRef=3024 Detect1=HKCU\Software\Softpointer\Tag&Rename Detect2=HKCU\Software\Softpointer\Tag&Rename2 Detect3=HKCU\Software\Softpointer\Tag&Rename3 RegKey1=HKCU\Software\Softpointer\Tag&Rename\Config|FCurrentFolder RegKey2=HKCU\Software\Softpointer\Tag&Rename\Config|FHistoryList RegKey3=HKCU\Software\Softpointer\Tag&Rename2\Config|FCurrentFolder RegKey4=HKCU\Software\Softpointer\Tag&Rename2\Config|FHistoryList RegKey5=HKCU\Software\Softpointer\Tag&Rename3\Config|FCurrentFolder RegKey6=HKCU\Software\Softpointer\Tag&Rename3\Config|FHistoryList RegKey7=HKCU\Software\Softpointer\Tag&Rename3\Config|FileListHeader [Task ForceQuit Pro *] LangSecRef=3024 DetectFile=%ProgramData%\Softorino\Task ForceQuit Pro* FileKey1=%ProgramData%\Softorino\Task ForceQuit Pro*\Logs|* FileKey2=%ProgramData%\Softorino\Task ForceQuit Pro*\Update|* [TAudio Converter *] LangSecRef=3023 DetectFile=%AppData%\TAC FileKey1=%AppData%\TAC|log_main.txt [TDIMon *] LangSecRef=3024 Detect=HKCU\Software\Systems Internals\Tdimon RegKey1=HKCU\Software\Systems Internals\Tdimon|Recent [Team Fortress 2 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\440 FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\download\user_custom|*.*|RECURSE FileKey5=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\materials\temp|*.vtf|RECURSE [TeamLink *] LangSecRef=3022 DetectFile=%AppData%\Team*Link FileKey1=%AppData%\Team-Link|*-journal;*.old;LOG;Network Persistent State;QuotaManager;Visited Links|RECURSE FileKey2=%AppData%\Team-Link\*Cache|*.*|RECURSE FileKey3=%AppData%\Team-Link\blob_storage|*.*|RECURSE FileKey4=%AppData%\TeamLink\Logs|*.* FileKey5=%LocalAppData%\Team-Link-Updater|installer.exe [TeamSpeak 3 *] LangSecRef=3022 Detect=HKCU\Software\TeamSpeak 3 Client FileKey1=%LocalAppData%\TeamSpeak 3 Client\config\logs|*.* FileKey2=%ProgramFiles%\TeamSpeak 3 Client\config\logs|*.* [TeamSpeak 3 Chats *] LangSecRef=3022 Detect=HKCU\Software\TeamSpeak 3 Client FileKey1=%AppData%\TS3Client\chats|*.*|REMOVESELF [TeamViewer *] LangSecRef=3024 Detect=HKCU\Software\TeamViewer DetectFile1=%AppData%\TeamViewer DetectFile2=%ProgramFiles%\TeamViewer\Version* FileKey1=%AppData%\TeamViewer|*.log;*.mdmp FileKey2=%LocalAppData%\TeamViewer\*Cache|*.*|RECURSE FileKey3=%LocalAppData%\TeamViewer\Database|tvchatfilecache.db FileKey4=%ProgramFiles%\TeamViewer|*.log FileKey5=%ProgramFiles%\TeamViewer\Version*|*.log FileKey6=%WinDir%\System32|TeamViewer*_Hooks.log RegKey1=HKCU\Software\TeamViewer\Version5|Last_Machine_Connections RegKey2=HKCU\Software\TeamViewer\Version5.1|Last_Machine_Connections RegKey3=HKCU\Software\TeamViewer\Version6|Last_Machine_Connections RegKey4=HKCU\Software\TeamViewer\Version7|Last_Machine_Connections RegKey5=HKCU\Software\TeamViewer\Version8|Last_Machine_Connections RegKey6=HKCU\Software\TeamViewer\Version9|Last_Machine_Connections [Technic Launcher *] Section=Games DetectFile=%AppData%\.technic* FileKey1=%AppData%\.technic*|*.old;*.log;*.tmp|RECURSE FileKey2=%AppData%\.technic*\*\logs|*.*|RECURSE FileKey3=%AppData%\.technic*\cache|*.* FileKey4=%AppData%\.technic*\temp|*.*|RECURSE [Technic Launcher Backups *] Section=Games DetectFile=%AppData%\.technic* FileKey1=%AppData%\.technic*\*\Backups|*.*|RECURSE [TechSmith DubIt *] LangSecRef=3023 Detect=HKCU\Software\TechSmith\DubIt FileKey1=%ProgramFiles%\TechSmith\DubIt|*.gid RegKey1=HKCU\Software\TechSmith\DubIt\Recent Audio Files RegKey2=HKCU\Software\TechSmith\DubIt\Recent Video Files [TEdit *] Section=Games DetectFile=%AppData%\TEdit FileKey1=%AppData%\TEdit\undo|*.*|RECURSE [Teeworlds *] Section=Games DetectFile=%AppData%\Teeworlds FileKey1=%AppData%\Teeworlds\dumps|*.*|REMOVESELF FileKey2=%AppData%\Teeworlds\tmp|*.*|REMOVESELF [Teeworlds Downloads/Maps *] Section=Games DetectFile=%AppData%\Teeworlds FileKey1=%AppData%\Teeworlds\downloaded*|*.*|REMOVESELF FileKey2=%AppData%\Teeworlds\maps|*.*|REMOVESELF [Tele2 Mobile Partner *] LangSecRef=3022 DetectFile=%ProgramFiles%\Tele2 Mobile Partner FileKey1=%ProgramData%\Tele2 Mobile Partner\log|* FileKey2=%ProgramFiles%\Tele2 Mobile Partner\Log|*.txt [Telegram Desktop *] LangSecRef=3022 DetectFile1=%AppData%\Telegram Desktop DetectFile2=%ProgramFiles%\Telegram Desktop FileKey1=%AppData%\Telegram Desktop|log*.txt FileKey2=%AppData%\Telegram Desktop\tdata\dumps|*.dmp FileKey3=%AppData%\Telegram Desktop\tdata\User_Data\*Cache|*.*|RECURSE FileKey4=%AppData%\Telegram Desktop\tupdates\Temp|*.*|RECURSE FileKey5=%ProgramFiles%\Telegram Desktop|log*.txt FileKey6=%ProgramFiles%\Telegram Desktop\tdata\dumps|*.dmp FileKey7=%ProgramFiles%\Telegram Desktop\tdata\User_Data\*Cache|*.*|RECURSE FileKey8=%ProgramFiles%\Telegram Desktop\tupdates\Temp|*.*|RECURSE [Telerik Fiddler Everywhere *] LangSecRef=3024 DetectFile=%AppData%\Fiddler Everywhere FileKey1=%AppData%\Fiddler Everywhere\Logs|*.* [Tencent AndroidServer *] LangSecRef=3021 DetectFile=%AppData%\Tencent\AndroidServer FileKey1=%AppData%\Tencent\AndroidServer|*.log.xml [Tencent QQ *] LangSecRef=3022 DetectFile=%UserProfile%\Documents\Tencent Files FileKey1=%ProgramData%\Tencent Files\QQ\Misc|*|RECURSE FileKey2=%UserProfile%\Documents\Tencent Files|*|RECURSE [Tencent WeChat *] LangSecRef=3022 DetectFile1=%AppData%\Tencent\WeChat DetectFile2=%LocalAppData%\Tencent\BrowsingService FileKey1=%AppData%\Tencent\Logs|*.* FileKey2=%AppData%\Tencent\WeChat\bak|*.* FileKey3=%AppData%\Tencent\WeChat\Log|*.*|RECURSE FileKey4=%LocalAppData%\Tencent\BrowsingService\TGB_Market|*.log FileKey5=%LocalAppData%\Tencent\BrowsingService\unkwown|*.log FileKey6=%LocalAppData%\Tencent\BrowsingService\wechat|*.log [Tencent WeChat Work *] LangSecRef=3022 Detect=HKCU\Software\Tencent\WXWork FileKey1=%AppData%\Tencent\WXWork\Data\*\Cache\File\*|MEMORY.DMP FileKey2=%AppData%\Tencent\WXWork\Data\*\Cache\Image\*|WXWorkCapture_*.jpg FileKey3=%AppData%\Tencent\WXWork\Log|*.*|RECURSE [TeraCopy *] LangSecRef=3024 Detect=HKCU\Software\Code Sector\TeraCopy FileKey1=%AppData%\TeraCopy|FileList.dat;Transfer.log FileKey2=%AppData%\TeraCopy\History|*.* FileKey3=%ProgramFiles%\TeraCopy|FileList.dat;Transfer.log RegKey1=HKCU\Software\Code Sector\TeraCopy|LastTargetFolder [Terasology *] Section=Games DetectFile=%AppData%\.terasology FileKey1=%AppData%\.terasology|*.log FileKey2=%AppData%\.terasology\logs|*.*|REMOVESELF [Terminal Studio *] LangSecRef=3023 DetectFile=%AppData%\Terminal Studio FileKey1=%AppData%\Terminal Studio|*Log.txt [Terraria *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\105600 FileKey1=%ProgramFiles%\Steam\steamapps\common\terraria|client-crashlog.txt FileKey2=%UserProfile%\Documents\My Games\Terraria|*.bak|RECURSE [Tesla Legacy *] Section=Games DetectFile=%LocalAppData%\Astar Games\Tesla Legacy FileKey1=%LocalAppData%\Astar Games\Tesla Legacy|*.log [TeXnicCenter *] LangSecRef=3021 Detect1=HKCU\Software\ToolsCenter\TeXnicCenter Detect2=HKCU\Software\ToolsCenter\TeXnicCenterNT RegKey1=HKCU\Software\ToolsCenter\TeXnicCenter\Recent File List RegKey2=HKCU\Software\ToolsCenter\TeXnicCenter\Recent Project List RegKey3=HKCU\Software\ToolsCenter\TeXnicCenter\Session RegKey4=HKCU\Software\ToolsCenter\TeXnicCenter\Settings\Options|LastOpenedFolder RegKey5=HKCU\Software\ToolsCenter\TeXnicCenterNT\Recent File List RegKey6=HKCU\Software\ToolsCenter\TeXnicCenterNT\Recent Project List RegKey7=HKCU\Software\ToolsCenter\TeXnicCenterNT\Session RegKey8=HKCU\Software\ToolsCenter\TeXnicCenterNT\Settings\Options|LastOpenedFolder [TGCM *] LangSecRef=3023 DetectFile=%AppData%\TGCMLog FileKey1=%AppData%\TGCMLog|*log.txt [The Bat *] LangSecRef=3022 Detect=HKCU\Software\RIT\The Bat! FileKey1=%AppData%\The Bat!\cache|*.* [The Binding of Isaac *] Section=Games DetectFile=%UserProfile%\Documents\My Games\Binding of Isaac* FileKey1=%UserProfile%\Documents\My Games\Binding of Isaac*|*.dmp;isaacv*.txt;log.txt [The Cleaner *] LangSecRef=3024 Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cleaner8.exe Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cleaner9.exe FileKey1=%AppData%\thecleaner|*.log FileKey2=%ProgramFiles%\The Cleaner|*.log;*.tmp;*.bak|RECURSE [The Clumsys 2: The Butterfly Effect *] Section=Games DetectFile=%LocalAppData%\BanzaiInteractive\Clumsys2 FileKey1=%AppData%\BanzaiInteractive\Clumsys2|logfile.txt [The Creative Assembly Launcher *] Section=Games DetectFile=%AppData%\The Creative Assembly\Launcher FileKey1=%AppData%\The Creative Assembly\Launcher|*.log;*_logs.txt FileKey2=%AppData%\The Creative Assembly\Launcher\electron|*.old;LOG|RECURSE FileKey3=%AppData%\The Creative Assembly\Launcher\electron\Cache|*.* FileKey4=%AppData%\The Creative Assembly\Launcher\electron\Service Worker\*Cache*|*.*|RECURSE FileKey5=%AppData%\The Creative Assembly\Launcher\Logs|*.* [The Da Vinci Code *] Section=Games DetectFile=%ProgramFiles%\2K Games\The Da Vinci Code FileKey1=%ProgramFiles%\2K Games\The Da Vinci Code\_bin|*.log [The Dream Machine *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\94300 FileKey1=%ProgramFiles%\Steam\steamapps\common\The Dream Machine\the_dream_machine.app|*.*|REMOVESELF [The Elder Scrolls Online *] Section=Games DetectFile=%UserProfile%\Documents\Elder Scrolls Online FileKey1=%UserProfile%\Documents\Elder Scrolls Online\Errors|*.* FileKey2=%UserProfile%\Documents\Elder Scrolls Online\Logs|*.* [The Lord of the Rings Online Launcher *] Section=Games DetectFile=%LocalAppData%\Turbine\The Lord of the Rings Online\Launcher FileKey1=%LocalAppData%\The Lord Of The Rings Online|*.log FileKey2=%LocalAppData%\Turbine|*.log|RECURSE [The Mighty Quest for Epic Loot *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\239220 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\The Mighty Quest For Epic Loot\CrashReport|*.* FileKey2=%ProgramFiles%\Steam\SteamApps\Common\The Mighty Quest For Epic Loot\Log|*.* [The Mystery of the Mary Celeste *] Section=Games DetectFile=%AppData%\Merscom\The Mystery of the Mary Celeste FileKey1=%AppData%\Merscom\The Mystery of the Mary Celeste|logfile.txt [The Rise of Atlantis *] Section=Games DetectFile1=%ProgramData%\Playrix Entertainment\The Rise of Atlantis DetectFile2=%ProgramData%\TERMINAL Studio\The Rise of Atlantis FileKey1=%ProgramData%\Playrix Entertainment\The Rise of Atlantis|log.htm* FileKey2=%ProgramData%\Terminal Studio\The Rise of Atlantis|log.htm* [The SemWare Editor Professional *] LangSecRef=3024 DetectFile=%SystemDrive%\TSEPro FileKey1=%SystemDrive%\TSEPro|tsefiles.dat;tsehist.dat [The Sims 3 *] Section=Games Detect=HKCU\Software\Electronic Arts\Sims 3 FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims 3|*.log;*.mdmp;xcpt*.txt|RECURSE [The Sims 3 Cache *] Section=Games Detect=HKCU\Software\Electronic Arts\Sims 3 FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims 3|socialCache.package;CASPartCache.package;scriptCache.package;compositorCache.package;simCompositorCache.package FileKey2=%UserProfile%\Documents\Electronic Arts\The Sims 3\Thumbnails|*.* FileKey3=%UserProfile%\Documents\Electronic Arts\The Sims 3\WorldCaches|*.* [The Sims 3 DCBackup *] Section=Games Detect=HKCU\Software\Electronic Arts\Sims 3 FileKey1=%UserProfile%\Documents\Electronic arts\The sims 3\DCBackup|*.package ExcludeKey1=FILE|%UserProfile%\Documents\electronic arts\The sims 3\DCBackup\|ccmerged.package [The Sims 4 *] Section=Games DetectFile=%UserProfile%\Documents\Electronic Arts\The Sims 4 FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims 4|*.txt;*.log [The Sims Medieval *] Section=Games Detect=HKLM\Software\Electronic Arts\The Sims Medieval FileKey1=%UserProfile%\Documents\Electronic Arts\The Sims Medieval|*.log;*.xml|RECURSE [The Sims Resource Merlin *] Section=Games DetectFile=%ProgramFiles%\The Sims Resource\TSR Merlin FileKey1=%ProgramFiles%\The Sims Resource\TSR Merlin\Logs|*.* [The Surge *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\378540 FileKey1=%UserProfile%\Documents\The Surge\logs|*.txt [The Swords of Ditto *] Section=Games DetectFile=%LocalAppData%\The_Swords_of_Ditto FileKey1=%LocalAppData%\The_Swords_of_Ditto|*.log [The Talos Principle *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\257510 FileKey1=%ProgramFiles%\Steam\steamapps\common\The Talos Principle\Log|*.*|RECURSE [The Tiny Bang Story *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\96000 FileKey1=%AppData%\Colibri Games\The Tiny Bang Story|logfile.txt [The Weather Channel Desktop *] LangSecRef=3021 DetectFile=%LocalAppData%\The Weather Channel\Desktop\patch FileKey1=%LocalAppData%\The Weather Channel\Desktop\patch|*.* [The Witcher *] Section=Games DetectFile=%LocalAppData%\The Witcher* FileKey1=%LocalAppData%\The Witcher*\Logs|* FileKey2=%LocalAppData%\The Witcher*\Temp|*|RECURSE [The Witcher 3 Backups *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\292030 FileKey1=%UserProfile%\Documents\The Witcher 3|*.bak [Thinstall Database *] LangSecRef=3021 DetectFile1=%AppData%\Thinstall DetectFile2=%LocalAppData%\Thinstall FileKey1=%AppData%\Thinstall|*.*|REMOVESELF FileKey2=%LocalAppData%\Thinstall|*.*|REMOVESELF [Thomas Was Alone *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\220780 FileKey1=%ProgramFiles%\Steam\Steamapps\common\thomaswasalone\ThomasWasAlone_Data|output_log.txt [ThumbsPlus *] LangSecRef=3023 Detect=HKCU\Software\Cerious Software Inc. FileKey1=%AppData%\Thumbsplus|*.log;*.bak;*.dmp;*.7z;*.exc;*.png FileKey2=%ProgramFiles%\Thumbsplus *\Bin|*.log [TightVNC *] LangSecRef=3022 DetectFile=%AppData%\TightVNC FileKey1=%AppData%\TightVNC|*.log [TikiOne Steam Cleaner *] LangSecRef=3024 DetectFile=%UserProfile%\.tikione FileKey1=%UserProfile%\.tikione\log|*.* [Time Adjuster *] LangSecRef=3021 Detect=HKCU\Software\IrekZielinskiSoft\TimeAdjuster FileKey1=%ProgramFiles%\TimeAdjuster|*.cnt RegKey1=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR1 RegKey2=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR2 RegKey3=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR3 RegKey4=HKCU\Software\IrekZielinskiSoft\TimeAdjuster|LDIR4 [TimeRabbit *] LangSecRef=3022 DetectFile=%AppData%\TimeRabbit FileKey1=%AppData%\TimeRabbit\Cache|*.*|RECURSE [Timeslips *] LangSecRef=3021 DetectFile=%ProgramFiles%\Timeslips FileKey1=%ProgramFiles%\TimeSlips\Data01\logs|*.* FileKey2=%ProgramFiles%\Timeslips\logs|*.* [Tinder++ *] LangSecRef=3021 DetectFile=%LocalAppData%\Tinder* FileKey1=%LocalAppData%\Tinder*|*.*|RECURSE [Tinseltown Dreams *] Section=Games DetectFile=%LocalAppData%\Namco Networks\Tinseltown Dreams FileKey1=%LocalAppData%\Namco Networks\Tinseltown Dreams|errors*.*;log.txt [Tipard Total Media Converter *] LangSecRef=3023 Detect1=HKCU\Software\Tipard Studio\Tipard Total Media Converter Detect2=HKCU\Software\Tipard Studio\Tipard Total Media Converter Platinum FileKey1=%LocalAppData%\Tipard Studio\Tipard *|*.txt RegKey1=HKCU\Software\Tipard Studio\Tipard Total Media Converter Platinum\Edit|LastVideoFilePath RegKey2=HKCU\Software\Tipard Studio\Tipard Total Media Converter\Edit|LastVideoFilePath [Tipard Video Converter *] LangSecRef=3023 Detect1=HKCU\Software\Tipard Studio\Tipard Video Converter Detect2=HKCU\Software\Tipard Studio\Tipard Video Converter Ultimate FileKey1=%LocalAppData%\Tipard Studio\Tipard *|*.txt RegKey1=HKCU\Software\Tipard Studio\Tipard Video Converter Ultimate\Edit|LastVideoFilePath RegKey2=HKCU\Software\Tipard Studio\Tipard Video Converter\Edit|LastVideoFilePath [Titan Quest Anniversary Edition *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\475150 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Titan Quest Anniversary Edition\logs|*.* [Tixati *] LangSecRef=3021 DetectFile=%AppData%\tixati FileKey1=%AppData%\tixati|*.dat.lastloadok.dat;upnp_diagnostic_log.txt [Tixati Incomplete Pieces *] LangSecRef=3021 DetectFile=%AppData%\tixati FileKey1=%AppData%\tixati\incomplete-pieces|*.* [TK-Data *] LangSecRef=3021 DetectFile=%LocalAppData%\tkdata FileKey1=%LocalAppData%\tkdata|*-journal;*.old;LOG;data_*;f_*;ChromeDWriteFontCache;log.txt;QuotaManager;Visited Links|RECURSE FileKey2=%LocalAppData%\tkdata\GPUCache|*.* FileKey3=%LocalAppData%\tkdata\Logs|*.* [Tobit David *] LangSecRef=3024 Detect=HKCU\Software\Tobit FileKey1=%SystemDrive%\David\Apps\Dvgrab\Code|*.chk FileKey2=%SystemDrive%\David\Apps\Postman\Code|*.chk FileKey3=%SystemDrive%\David\Apps\Webbox\Code|*.log FileKey4=%SystemDrive%\David\Archive\SYSTEM\DAVID\Errlog|*.* FileKey5=%SystemDrive%\David\Archive\SYSTEM\pbxpense\log|*.* FileKey6=%SystemDrive%\David\Archive\USER\*\system\trash|*.* FileKey7=%SystemDrive%\David\Archive\USER\*\temp|*.* FileKey8=%SystemDrive%\David\Code|*.old;*.chk;*.log FileKey9=%SystemDrive%\David\Code\Database\MSSQL*DAVID\MSSQL\LOG|ERRORLOG*;FDLAUNCHERRORLOG*;log_*.trc;SQL*.LOG* FileKey10=%SystemDrive%\David\Code\Temp|*.* FileKey11=%SystemDrive%\David\Import\System|I*.001 FileKey12=%SystemDrive%\David\Tld\COMMON|*DAVID.LOG FileKey13=%SystemDrive%\David\Tld\Port\Extra|*.chk [Tom Clancy's Ghost Recon *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\15300 DetectFile=%ProgramFiles%\Red Storm Entertainment\Ghost Recon FileKey1=%ProgramFiles%\Red Storm Entertainment\Ghost Recon|*.log FileKey2=%ProgramFiles%\Steam\SteamApps\Ghost Recon|*.log [Tom Clancy's Rainbow Six 3: Raven Shield *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\19830 DetectFile=%ProgramFiles%\Red Storm Entertainment\RavenShield FileKey1=%ProgramFiles%\Red Storm Entertainment\RavenShield|*.log FileKey2=%ProgramFiles%\Steam\SteamApps\Common\RavenShield|*.log [Tom Clancy's Rainbow Six: Vegas 2 *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\15120 DetectFile=%ProgramFiles%\Ubisoft\Tom Clancy's Rainbow Six Vegas 2 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Tom Clancy's Rainbow Six Vegas 2|CrashReport*.*;*.log|RECURSE FileKey2=%ProgramFiles%\Ubisoft\Tom Clancy's Rainbow Six Vegas 2|CrashReport*.*;*.log|RECURSE [Tomahawk *] LangSecRef=3023 Detect=HKCU\Software\Tomahawk FileKey1=%LocalAppData%\Tomahawk|*.log FileKey2=%LocalAppData%\Tomahawk\Tomahawk\Cache|*.*|RECURSE [Tomahawk PDF+ *] LangSecRef=3021 Detect=HKCU\Software\NativeWinds\Tomahawk RegKey1=HKCU\Software\NativeWinds\Tomahawk\MRU [Tomb Raider *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\203160 FileKey1=%UserProfile%\Documents|TombRaider.log [Tomboy *] LangSecRef=3021 DetectFile=%LocalAppData%\Tomboy FileKey1=%LocalAppData%\Tomboy|*.log FileKey2=%LocalAppData%\Tomboy\Cache|*.*|RECURSE [TomTom *] LangSecRef=3021 Detect1=HKCU\Software\TomTom Detect2=HKLM\Software\Classes\tomtomhome FileKey1=%AppData%\TomTom\HOME\Profiles\*|Log.txt FileKey2=%LocalAppData%\TomTom\HOME3|Log.txt FileKey3=%LocalAppData%\TomTom\HOME3\cache|*.*|RECURSE [ToniArts EasyCleaner Duplicates *] LangSecRef=3024 Detect=HKLM\Software\ToniArts\EasyCleaner FileKey1=%ProgramFiles%\ToniArts\EasyCleaner|Duplicat.* [Toolbar Cleaner *] LangSecRef=3024 Detect=HKLM\Software\Toolbar Cleaner DetectFile=%ProgramFiles%\Toolbar Cleaner FileKey1=%ProgramFiles%\Toolbar Cleaner|*.txt [Toolwiz Care *] LangSecRef=3024 DetectFile=%LocalAppData%\ToolwizCare* FileKey1=%LocalAppData%\ToolwizCare*\RegCleanBackup|*.reg FileKey2=%LocalAppData%\ToolwizCare*\RegistryBackup|*.* [Toontown Rewritten *] Section=Games DetectFile=%ProgramFiles%\ToonTown Rewritten FileKey1=%ProgramFiles%\ToonTown ReWritten\logs|*.* [Topaz Photo AI *] LangSecRef=3023 Detect=HKCU\SOFTWARE\Topaz Labs LLC\Topaz Photo AI FileKey1=%ProgramData%\Topaz Labs LLC\Topaz Photo AI\Logs|*|REMOVESELF [Topaz Video AI *] LangSecRef=3023 DetectFile=%AppData%\Topaz Labs LLC\Topaz Video AI FileKey1=%AppData%\Topaz Labs LLC\Topaz Video AI\logs|*|REMOVESELF [TopStyle 5 *] LangSecRef=3021 Detect=HKCU\Software\Bradbury\TopStyle\5.0 RegKey1=HKCU\Software\Bradbury\TopStyle\5.0\RecentFiles [Torchlight *] Section=Games Detect1=HKCU\Software\Valve\Steam\Apps\41500 Detect2=HKCU\Software\Valve\Steam\Apps\200710 Detect3=HKLM\Software\Runic Games\Torchlight II DetectFile=%AppData%\Runic Games\Torchlight FileKey1=%AppData%\Runic Games\Torchlight|*.log FileKey2=%UserProfile%\Documents\My Games\runic games\torchlight 2|ogre.log FileKey3=%UserProfile%\Documents\My Games\Runic Games\Torchlight 2\logs|*.* [Torrent Search *] LangSecRef=3022 DetectFile=%ProgramFiles%\Torrent Search FileKey1=%ProgramFiles%\Torrent Search|*.log [TortoiseHg *] LangSecRef=3021 Detect=HKCU\Software\tortoisemerge FileKey1=%AppData%\TortoiseHg|*.log;*.old [TortoiseSVN *] LangSecRef=3024 Detect=HKCU\Software\TortoiseSVN FileKey1=%AppData%\TortoiseSVN|*.* FileKey2=%LocalAppData%\TSVNCache|*.* RegKey1=HKCU\Software\TortoiseSVN\History [Toshiba BluetoothStack *] LangSecRef=3024 Detect=HKLM\Software\Toshiba\BluetoothStack FileKey1=%LocalAppData%\Toshiba\BluetoothStack\V1.0\tosOBEX\Temp|*.* [Toshiba Book Place *] LangSecRef=3021 DetectFile=%AppData%\Book Place FileKey1=%AppData%\Book Place\Cache|*.*|RECURSE FileKey2=%AppData%\Book Place\log|*.*|RECURSE [Toshiba FlashCards *] LangSecRef=3021 DetectFile=%LocalAppData%\TOSHIBA\FlashCards FileKey1=%LocalAppData%\TOSHIBa\FlashCards|log.txt [Toshiba PC Diagnostic Tool Utility *] LangSecRef=3024 DetectFile=%AppData%\Toshiba\PCDiag FileKey1=%AppData%\Toshiba\PCDiag|*.*|RECURSE FileKey2=%ProgramFiles%\Toshiba\configfree|*.log [Total Commander *] LangSecRef=3024 DetectFile=%LocalAppData%\GHISLER FileKey1=%LocalAppData%\GHISLER|tcthumbs.*db;treeinfoC.wc [Total Recorder *] LangSecRef=3023 Detect=HKCU\Software\HighCriteria\TotalRecorder\Recent File List RegKey1=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File1 RegKey2=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File2 RegKey3=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File3 RegKey4=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File4 RegKey5=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File5 RegKey6=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File6 RegKey7=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File7 RegKey8=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File8 RegKey9=HKCU\Software\HighCriteria\TotalRecorder\Recent File list|File9 [Total Registry *] LangSecRef=3024 Detect=HKCU\Software\ScorpioSoftware\TotalRegistry RegKey1=HKCU\Software\ScorpioSoftware\TotalRegistry|LastKey [Total Uninstall *] LangSecRef=3024 DetectFile=%ProgramData%\Martau\Total Uninstall* FileKey1=%ProgramData%\Martau\Total Uninstall*|*.Folders;*.cache|RECURSE FileKey2=%ProgramFiles%\Total Uninstall*|*.rtf;*.txt;*.GID|RECURSE [Total Uninstall Backups *] LangSecRef=3024 DetectFile=%ProgramData%\Martau\Total Uninstall* FileKey1=%ProgramData%\Martau\Total Uninstall*|*.tlg;*.zsns;*.zip|RECURSE FileKey2=%ProgramData%\Martau\Total Uninstall*\Analyzed Programs|* [Touch *] LangSecRef=3024 Detect=HKCU\Software\Juan M. Aguirregabiria\Touch RegKey1=HKCU\Software\Juan M. Aguirregabiria\Touch [Towns *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\221020 FileKey1=%ProgramFiles%\Steam\Steamapps\common\towns|*.log [TP-Link *] LangSecRef=3022 DetectFile=%ProgramData%\TP-Link FileKey1=%LocalAppData%\TP-Link\nsissetup|*.log FileKey2=%ProgramData%\TP-Link|*.log [Track Folder Changes *] LangSecRef=3024 Detect=HKCU\Software\antiufo\TrackFolderChanges RegKey1=HKCU\Software\antiufo\TrackFolderChanges|LastFolder [TrackMania Forever *] Section=Games DetectFile=%ProgramData%\TrackMania FileKey1=%ProgramData%\TrackMania\Cache|* FileKey2=%ProgramData%\TrackMania\Cache\ManiaCode|* [TrackMania Forever Manialinks *] Section=Games DetectFile=%ProgramData%\TrackMania FileKey1=%ProgramData%\TrackMania\Manialinks|* [TrackMania Forever Scores *] Section=Games DetectFile=%ProgramData%\TrackMania FileKey1=%ProgramData%\TrackMania\CampaignsScores|* FileKey2=%ProgramData%\TrackMania\CampaignsScores\General|* FileKey3=%ProgramData%\TrackMania\CampaignsScores\UnitedRace|* FileKey4=%ProgramData%\TrackMania\LadderScores|* [Tracks Eraser Pro *] LangSecRef=3024 Detect=HKLM\Software\Acesoft\tracks eraser pro FileKey1=%ProgramFiles%\Acesoft\Tracks Eraser Pro|te.log [Trade Manager *] LangSecRef=3021 DetectFile=%ProgramFiles%\Trademanager FileKey1=%ProgramFiles%\Trademanager|OneClickEnd.log [Treesize *] LangSecRef=3024 DetectFile=%ProgramFiles%\JAM Software\TreeSize * FileKey1=%AppData%\JAM Software\TreeSize *|GlobalOptions.bak0.xml [Trend Micro *] LangSecRef=3023 Detect1=HKCU\Software\Trend Micro Detect2=HKLM\Software\TrendMicro DetectFile=%ProgramData%\Trend Micro FileKey1=%ProgramData%\Trend Micro|*.log FileKey2=%ProgramFiles%\Trend Micro|*.log;URLLog.dat|RECURSE [Trend Micro AntiRansomware Tool *] LangSecRef=3021 DetectFile=%ProgramFiles%\AntiRansomware2.0 FileKey1=%ProgramData%\AntiRansomware|*.log [Trend Micro HijackThis Backups *] LangSecRef=3024 Detect=HKLM\Software\TrendMicro\HijackThis FileKey1=%ProgramFiles%\Trend Micro\HijackThis\backups|*.* [Trend Micro RUBotted *] LangSecRef=3024 Detect=HKLM\Software\TrendMicro\RUBotted FileKey1=%ProgramData%\Trend Micro\RUBotted\Logs|*|REMOVESELF FileKey2=%ProgramFiles%\Trend Micro\RUBotted\DebugLogs|*|REMOVESELF [Tribes: Ascend *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\17080 FileKey1=%ProgramData%\Hi-Rez Studios\BrowserCacheTribes\Default\Cache|*|RECURSE FileKey2=%ProgramFiles%\Steam\steamapps\common\tribes\Binaries\Logs|* FileKey3=%UserProfile%\Documents\My Games\Tribes Ascend\TribesGame\Logs|* [Trillian *] LangSecRef=3022 Detect=HKLM\Software\Clients\IM\Trillian FileKey1=%AppData%\Trillian\Crash Files|*.*|RECURSE FileKey2=%AppData%\Trillian\users\*|buddies.*.xml FileKey3=%AppData%\Trillian\users\*\cache|*.* FileKey4=%AppData%\Trillian\users\*\instantlookup|*.* FileKey5=%AppData%\Trillian\users\*\logs|*.*|RECURSE FileKey6=%AppData%\Trillian\users\global\skin_cache|*.* FileKey7=%ProgramFiles%\Trillian\Crash Files|*.*|RECURSE FileKey8=%ProgramFiles%\Trillian\Users\Default\buddyicons|*.*|RECURSE FileKey9=%ProgramFiles%\Trillian\Users\Default\instantlookup|*.* [Trine *] Section=Games DetectFile=%ProgramFiles%\Steam\SteamApps\Common\Trine* FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Trine*\log*|* FileKey2=%ProgramFiles%\Steam\SteamApps\common\Trine\_enchanted_edition_\log|* [Triolan DDD++ *] LangSecRef=3022 DetectFile=%ProgramFiles%\Triolan DDD++ FileKey1=%ProgramFiles%\Triolan DDD++\Settings|ddd++_log.sqlite;Recents.xml [TrojanHunter *] LangSecRef=3024 Detect=HKCU\Software\TrojanHunter FileKey1=%ProgramFiles%\TrojanHunter*|Debug.log;DebugLog.txt FileKey2=%ProgramFiles%\TrojanHunter*\Scan Reports|*.* [Tropico *] Section=Games Detect1=HKCU\Software\Haemimont Games\Tropico 4 Detect2=HKLM\Software\Haemimont Games\Tropico3 FileKey1=%AppData%\Tropico*\Logs|*.*|REMOVESELF FileKey2=%AppData%\Tropico*\ShaderCache|*.*|REMOVESELF FileKey3=%ProgramFiles%\Kalypso Media\*|dotnetfx3*.exe FileKey4=%ProgramFiles%\Kalypso Media\*\DirectXRedist|*.*|REMOVESELF [TuneIn *] LangSecRef=3023 DetectFile=%AppData%\TuneIn FileKey1=%AppData%\TuneIn|*-journal;*.old;LOG;log.log;Network Persistent State;Origin Bound Certs|RECURSE FileKey2=%AppData%\TuneIn\*Cache|*.*|RECURSE FileKey3=%AppData%\TuneIn\blob_storage|*.*|RECURSE FileKey4=%AppData%\TuneIn\Logs|*.* FileKey5=%LocalAppData%\TuneIn-Updater|*.*|RECURSE [TuneXP *] LangSecRef=3021 DetectFile=%ProgramFiles%\TuneXP FileKey1=%ProgramFiles%\TuneXP\docs|*.bak [TunnelBear VPN *] LangSecRef=3022 DetectFile1=%AppData%\TunnelBear DetectFile2=%ProgramFiles%\TunnelBear FileKey1=%AppData%\TunnelBear\Logs|*.* FileKey2=%ProgramFiles%\TunnelBear|*.log [Turbo VPN *] LangSecRef=3022 DetectFile=%LocalAppData%\TurboVPN FileKey1=%LocalAppData%\TurboVPN\TVDump|*.dmp [Turnip Boy Commits Tax Evasion *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\1205450 FileKey1=%UserProfile%\AppData\LocalLow\Snoozy Kazoo\Turnip Boy Commits Tax Evasion|*.log [TV-Browser *] LangSecRef=3021 DetectFile=%ProgramFiles%\TV-Browser FileKey1=%AppData%\TV-Browser\*|java.searchplugin.SearchPlugin.dat* [TV_Net *] LangSecRef=3023 DetectFile=%UserProfile%\AppData\LocalLow\TV_Net FileKey1=%UserProfile%\AppData\LocalLow\TV_Net\CacheIcons|*|RECURSE FileKey2=%UserProfile%\AppData\LocalLow\TV_Net\Logs|*|RECURSE [TVersity *] LangSecRef=3023 Detect=HKLM\Software\TVersity\Media Server FileKey1=%ProgramFiles%\TVersity Codec Pack|*.exe;*.url FileKey2=%ProgramFiles%\TVersity\Media Server|*.rtf;*.url;*TVersityCodecPackSetup* FileKey3=%ProgramFiles%\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE FileKey4=%WinDir%\System32|tversity.cookies;TVersityMediaServer.log;*.1;*.2;*.3 FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\TVersity Media Server|*.*|REMOVESELF FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Temp\TVersity Media Server|*.*|REMOVESELF ExcludeKey1=FILE|%ProgramFiles%\TVersity Codec Pack\|uninst.exe ExcludeKey2=FILE|%ProgramFiles%\TVersity\Media Server\|HOWTO Share Media.txt ExcludeKey3=FILE|%ProgramFiles%\TVersity\Media Server\|version.txt [TVUPlayer *] LangSecRef=3023 Detect=HKCU\Software\TVU networks FileKey1=%ProgramFiles%\TVUPlayer|log.txt [TweakBit Internet Optimizer *] LangSecRef=3024 DetectFile=%ProgramFiles%\TweakBit\Internet Optimizer FileKey1=%ProgramFiles%\TweakBit\Internet Optimizer|GASender.exe;GoogleAnalyticsHelper.dll [Tweaking.com Windows Repair *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Tweaking.com - Windows Repair (All in One) DetectFile1=%ProgramFiles%\Tweaking.com DetectFile2=%SystemDrive%\Tweaking.com_Windows_Repair_Logs FileKey1=%ProgramFiles%\Tweaking.com\Windows Repair (All in One)\Logs|*.*|REMOVESELF FileKey2=%SystemDrive%\Tweaking.com_Windows_Repair_Logs|*.*|REMOVESELF [TweakNow PowerPack Backups *] LangSecRef=3024 Detect=HKCU\Software\TweakNow PowerPack FileKey1=%ProgramFiles%\TweakNow PowerPack\Backup|*.* [Twitch *] Section=Games DetectFile=%AppData%\Twitch FileKey1=%AppData%\Twitch|updater.log FileKey2=%AppData%\Twitch\Electron|cookies* FileKey3=%AppData%\Twitch\Electron\*cache|*.*|REMOVESELF FileKey4=%AppData%\Twitch\Electron\local storage|*.* FileKey5=%AppData%\Twitch\Games\Dumps|*.*|REMOVESELF FileKey6=%AppData%\Twitch\logs\*|*.json;*.log|REMOVESELF [Twitter *] LangSecRef=3022 DetectFile=%LocalAppData%\Packages\9E2F88E3.Twitter_* FileKey1=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\9E2F88E3.Twitter_*\AppData\Indexed DB|*.log FileKey3=%LocalAppData%\Packages\9E2F88E3.Twitter_*\LocalState|*|RECURSE FileKey4=%LocalAppData%\Packages\9E2F88E3.Twitter_*\Settings|*.log* [Two Worlds Epic Edition *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\1930 FileKey1=%UserProfile%\Documents\TwoWorlds Files\FontsCache|*.tmp [Tzip *] LangSecRef=3022 DetectFile=%ProgramFiles%\Tzip FileKey1=%ProgramFiles%\Tzip|*.temp [Ubisoft Connect *] Section=Games DetectFile=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher FileKey1=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher|*.log;*log.txt;Installed_files.txt;version.txt FileKey2=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\assets|*.* FileKey3=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\http*|*.*|RECURSE FileKey4=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Logs|*.* [Ubisoft Connect Installers *] Section=Games DetectFile=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher Warning=Make sure to launch all of your installed UPlay games at least once before running this, or they may not launch properly. FileKey1=%ProgramFiles%\Ubisoft\Ubisoft Game Launcher\Cache\Installers|*.*|REMOVESELF [Ulead GIF Animator 5.05 *] LangSecRef=3024 Detect=HKCU\Software\Ulead Systems\Ulead GIF Animator\5.05 RegKey1=HKCU\Software\Ulead Systems\Ulead GIF Animator\5.05\Recent File List [Ultimate Defrag *] LangSecRef=3024 DetectFile=%ProgramFiles%\Disktrix\UltimateDefrag FileKey1=%ProgramFiles%\Disktrix\UltimateDefrag|*.db;*Crash.dmp [UltraDefrag *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraDefrag DetectFile1=%SystemDrive%\PortableApps\UltraDefragPortable DetectFile2=%WinDir%\UltraDefrag FileKey1=%ProgramFiles%\UltraDefrag\logs|*.* FileKey2=%SystemDrive%|fraglist.luar FileKey3=%SystemDrive%\PortableApps\UltraDefragPortable\Data|UltraDefragPortable.log FileKey4=%WinDir%\UltraDefrag\logs|*.log [UltraEdit *] LangSecRef=3021 Detect=HKCU\Software\IDM Computer Solutions\UltraEdit FileKey1=%AppData%\IDMComp\UltraEdit\autorec|*.*|RECURSE FileKey2=%ProgramFiles%\IDM Computer Solutions\UltraEdit|*.txt [UltraISO *] LangSecRef=3024 Detect=HKCU\Software\EasyBoot Systems FileKey1=%ProgramFiles%\UltraISO\backup|*.*|REMOVESELF RegKey1=HKCU\Software\EasyBoot Systems\UltraISO\5.0|LogFile RegKey2=HKCU\Software\EasyBoot Systems\UltraISO\5.0|OpenFolder [Ultratron *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\219190 FileKey1=%UserProfile%\.ultratron*|*.log [UMPlayer *] LangSecRef=3023 DetectFile=%UserProfile%\.umplayer FileKey1=%SystemDrive%\MININT|*.log|RECURSE FileKey2=%UserProfile%\.umplayer\file_settings|*.*|RECURSE [Unchecky *] LangSecRef=3024 Detect=HKCU\Software\Unchecky FileKey1=%ProgramData%\Unchecky|*.log;uclogfile*.bin [UnHackMe *] LangSecRef=3024 Detect=HKLM\Software\Greatis FileKey1=%ProgramFiles%\UnHackMe|*.err;*.txt;*.log|RECURSE FileKey2=%UserProfile%\Documents\RegRun2|*.txt [Unicenta Open POS *] LangSecRef=3021 DetectFile=%ProgramFiles%\Unicentaopos* FileKey1=%ProgramFiles%\Unicentaopos*|*.log [Unified Remote *] LangSecRef=3023 Detect=HKCU\Software\Unified Remote FileKey1=%AppData%\Unified Remote\Logs|*.* [Unigine Heaven DX11 Benchmark *] LangSecRef=3021 DetectFile=%UserProfile%\Unigine Heaven FileKey1=%UserProfile%\Unigine Heaven|log.html;*.cache FileKey2=%UserProfile%\Unigine Heaven\save|*.*|REMOVESELF [Uninstall Tool *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool_is1 FileKey1=%ProgramFiles%\Uninstall Tool|*.dmp [Universal Share Downloader *] LangSecRef=3022 DetectFile=%ProgramFiles%\USDownloader FileKey1=%ProgramFiles%\USDownloader|USDownloader.log;*.bak;*.bmp;*.jpg;*.png [Universal Viewer *] LangSecRef=3024 DetectFile=%AppData%\ATViewer FileKey1=%AppData%\ATViewer|ViewerHistory.ini [Universal Windows Platform *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_* FileKey1=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalState|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\TempState|*|RECURSE FileKey6=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\LocalState\Cache|*|RECURSE FileKey8=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\LocalState\navigationHistory|*|RECURSE FileKey9=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\Settings|*.log* FileKey10=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\TempState|*|RECURSE RegKey1=HKCU\Software\Microsoft\Phone\ShellUI\WindowSizing RegKey2=HKCU\Software\Microsoft\UserData\UninstallTimes ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalState\|settings.json [Universe Sandbox *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Giant Army\Universe Sandbox* FileKey1=%UserProfile%\AppData\LocalLow\Giant Army\Universe Sandbox*|*log.txt;history.json [Unlocker *] LangSecRef=3024 DetectFile=%ProgramFiles%\Unlocker FileKey1=%ProgramFiles%\Unlocker|Unlocker-List.txt [Unlockroot *] LangSecRef=3024 DetectFile=%ProgramFiles%\Unlockroot* FileKey1=%ProgramFiles%\Unlockroot*|*.txt FileKey2=%ProgramFiles%\Unlockroot*\tools|*.zip [Unreal Tournament: Game of the Year *] Section=Games DetectFile=%ProgramFiles%\GOG.com\Unreal Tournament GOTY FileKey1=%ProgramFiles%\GOG.com\Unreal Tournament GOTY\Logs|*.* FileKey2=%ProgramFiles%\GOG.com\Unreal Tournament GOTY\System|*.log [UPnP Wizard *] LangSecRef=3024 DetectFile=%AppData%\Neos Eureka S.r.l\EurekaLog FileKey1=%AppData%\Neos Eureka S.r.l\EurekaLog|*.*|RECURSE RegKey1=HKCU\Software\EurekaLab\EurekaLog [UPX Shell *] LangSecRef=3024 Detect=HKCU\Software\ION Tek\UPX Shell RegKey1=HKCU\Software\ION Tek\UPX Shell\3.x|History [USB Disk Security *] LangSecRef=3024 DetectFile=%ProgramFiles%\USB Disk Security FileKey1=%AppData%\Zbshareware Lab|*.*|REMOVESELF [USB Redirector *] LangSecRef=3022 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{FB9376AC-5253-42a5-AC0A-D306F32FFAD2} FileKey1=%ProgramFiles%\USB Redirector|*.log;*.txt [USB Safely Remove *] LangSecRef=3024 Detect=HKCU\Software\SafelyRemove FileKey1=%AppData%\USBSafelyRemove|*.txt FileKey2=%AppData%\USBSRService|*.txt FileKey3=%ProgramData%\USBSRService|*.txt FileKey4=%ProgramFiles%\USB Safely Remove|*.DIZ;*.rtf;*.url [UsbFix *] LangSecRef=3023 Detect=HKCU\Software\UsbFix FileKey1=%SystemDrive%\UsbFix\Log|*.*|REMOVESELF FileKey2=%SystemDrive%\UsbFix\Quarantine|*.*|REMOVESELF FileKey3=%UserProfile%\Desktop|UsbFix_Report.txt RegKey1=HKCU\Software\UsbFix\LastReport [UserBenchmark *] LangSecRef=3024 DetectFile1=%AppData%\UserBenchmark DetectFile2=%ProgramFiles%\User Benchmark FileKey1=%AppData%\UserBenchmark\User|*.log* FileKey2=%SystemDrive%\UserBenchmark|*|REMOVESELF [USPS Shipping Assistant *] LangSecRef=3021 DetectFile=%LocalAppData%\ShippingAssistant FileKey1=%LocalAppData%\ShippingAssistant\Logs|*|RECURSE [uTorrent *] LangSecRef=3022 Detect=HKCU\Software\BitTorrent\uTorrent FileKey1=%AppData%\utorrent|*.log;*.dmp;*.bad;*.older;*.benc;updates.dat;*ipfilter.bak FileKey2=%AppData%\utorrent\updates|*.exe FileKey3=%LocalAppData%\BitTorrentHelper|*.log FileKey4=%LocalAppData%\BitTorrentHelper\crashdumps|*.*|RECURSE FileKey5=%ProgramFiles%\uTorrent|*.tmp;*.old FileKey6=%UserProfile%\AppData\LocalLow\uTorrent|uTorrent_* FileKey7=%UserProfile%\AppData\LocalLow\uTorrentBar\Logs|* RegKey1=HKCU\Software\BitTorrent|computerID [uTorrent Web *] LangSecRef=3022 DetectFile=%AppData%\uTorrent Web FileKey1=%AppData%\uTorrent Web|*.bak;*.log* FileKey2=%AppData%\uTorrent Web\crashdumps|*.*|RECURSE [UVI Portal *] LangSecRef=3023 DetectFile=%AppData%\UVI Portal* FileKey1=%AppData%\UVI Portal|*.log FileKey2=%AppData%\UVIPortalCache|UVI Portal.bin [V - The File Viewer *] LangSecRef=3024 Detect=HKCU\Software\Prineas\FileViewer FileKey1=%AppData%\V|*.log RegKey1=HKCU\Software\Prineas\FileViewer\History RegKey2=HKCU\Software\Prineas\FileViewer\PathC RegKey3=HKCU\Software\Prineas\FileViewer\QathH RegKey4=HKCU\Software\Prineas\FileViewer\VCurrentPath RegKey5=HKCU\Software\Prineas\FileViewer\VCurrentPath1 [V-Ray *] LangSecRef=3021 DetectFile=%AppData%\ChaosGroup\V-Ray For * FileKey1=%AppData%\ChaosGroup\Cloud\Client|*.log FileKey2=%AppData%\ChaosGroup\V-Ray For Revit*\Logs|*.* FileKey3=%AppData%\ChaosGroup\V-Ray For Revit*\neui4fevit|*-journal;*.old;LOG;*.log;Network Persistent State|RECURSE FileKey4=%AppData%\ChaosGroup\V-Ray For Revit*\neui4fevit\*Cache|*.*|RECURSE FileKey5=%AppData%\ChaosGroup\V-Ray For Revit*\neui4fevit\blob_storage|*.*|RECURSE FileKey6=%AppData%\ChaosGroup\V-Ray For SketchUp|*.log;telemetry.json FileKey7=%LocalAppData%\ChaosGroup\Telemetry|*.log [V&V Messenger Chat History *] LangSecRef=3022 DetectFile=%AppData%\AJabber FileKey1=%AppData%\AJabber\*\Contacts|*.*|RECURSE [Valfaris *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Steel Mantis\Valfaris FileKey1=%UserProfile%\AppData\LocalLow\Steel Mantis\Valfaris|*txt [Valorant *] Section=Games DetectFile=%LocalAppData%\VALORANT FileKey1=%LocalAppData%\VALORANT\Saved\Crashes|* FileKey2=%LocalAppData%\VALORANT\Saved\Logs|*.log [Vampire Survivors *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\1794680 FileKey1=%AppData%\Vampire_Survivors|Network Persistent State FileKey2=%AppData%\Vampire_Survivors\*Cache|*.*|RECURSE FileKey3=%AppData%\Vampire_Survivors\*Storage|*.old;LOG|RECURSE FileKey4=%AppData%\Vampire_Survivors\blob_storage|*.*|RECURSE FileKey5=%AppData%\Vampire_Survivors\logs|*.log [Vampix *] LangSecRef=3023 Detect=HKCU\Software\KC Softwares\Vampix FileKey1=%AppData%\KC Softwares\Vampix|*.jpg;*.log [Vbs2Exe *] LangSecRef=3024 Detect=HKCU\Software\enkeladress\vbs2exe DetectFile=%ProgramFiles%\Vbs2Exe FileKey1=%ProgramFiles%\Vbs2Exe|recentlist.rlt [VCast *] LangSecRef=3023 DetectFile=%LocalAppData%\V Cast Media Manager FileKey1=%LocalAppData%\V Cast Media Manager|*.log;*log*.txt;*.tmp|RECURSE [VCW VicMan's Photo Editor *] LangSecRef=3023 DetectFile=%ProgramFiles%\VCW VicMan's Photo Editor FileKey1=%ProgramFiles%\VCW VicMan's Photo Editor|recent.ini [VDownloader *] LangSecRef=3023 DetectFile=%AppData%\VDownloader FileKey1=%AppData%\VDownloader|completedTasks.xml [Venis IX *] LangSecRef=3021 Detect=HKCU\Software\Spaceblue\Venis IX RegKey1=HKCU\Software\Spaceblue\Venis IX\FileHistory [Ventrilo Chat Logs *] LangSecRef=3022 Detect=HKCU\Software\Ventrilo FileKey1=%AppData%\ventrilo\chatlogs|*.*|REMOVESELF [Verizon Download Manager *] LangSecRef=3022 DetectFile=%LocalAppData%\SupportSoft\Verizondm FileKey1=%LocalAppData%\SupportSoft\verizondm\*\*\logs|*.* [Verizon In-Home Assistant *] LangSecRef=3021 DetectFile=%ProgramFiles%\Verizon\IHA_MessageCenter FileKey1=%ProgramFiles%\Verizon\IHA_MessageCenter\Log|mc-log* [VeryPDF OCR to Any Converter *] LangSecRef=3021 Detect=HKCU\Software\VietUnicode\VeryPDF OCR to Any Converter3 RegKey1=HKCU\Software\VietUnicode\VeryPDF OCR to Any Converter3|MruList [VeryPDF PDF Manual Splitter *] LangSecRef=3021 Detect=HKCU\Software\VeryPDF PDF Manual Splitter RegKey1=HKCU\Software\VeryPDF PDF Manual Splitter\pdfms\Recent File List [VHD Attach *] LangSecRef=3024 Detect=HKCU\Software\Josip Medved\VHD Attach FileKey1=%ProgramFiles%\Josip Medved\VHD Attach|*.InstallLog RegKey1=HKCU\Software\Josip Medved\VHD Attach|LastSize RegKey2=HKCU\Software\Josip Medved\VHD Attach\RecentFiles [VIA/S3G UniChrome Pro IGP *] LangSecRef=3024 Detect=HKLM\Software\S3 FileKey1=%ProgramFiles%\S3\UChromeP|s3iscfg.log [VicMan Web Photo Album *] LangSecRef=3023 Detect=HKCU\Software\VicMan Software\Web Photo Album DetectFile=%ProgramFiles%\Web Photo Album FileKey1=%ProgramFiles%\Web Photo Album|*.log RegKey1=HKCU\Software\VicMan Software\Web Photo Album|RecentFile0 RegKey2=HKCU\Software\VicMan Software\Web Photo Album|RecentFile1 RegKey3=HKCU\Software\VicMan Software\Web Photo Album|RecentFile2 RegKey4=HKCU\Software\VicMan Software\Web Photo Album|RecentFile3 RegKey5=HKCU\Software\VicMan Software\Web Photo Album|RecentFile4 [Viddly YouTube Downloader *] LangSecRef=3022 DetectFile=%AppData%\Viddly Inc\Viddly YouTube Downloader FileKey1=%AppData%\Viddly Inc\Viddly YouTube Downloader|log.txt FileKey2=%LocalAppData%\Viddly YouTube Downloader|*.log [Video Thumbnails Maker *] LangSecRef=3023 DetectFile=%ProgramFiles%\Video Thumbnails Maker FileKey1=%ProgramFiles%\Video Thumbnails Maker|*_bkp.exe;*.log FileKey2=%ProgramFiles%\Video Thumbnails Maker\Logs|*.* [Videoder *] LangSecRef=3023 DetectFile=%AppData%\Videoder FileKey1=%AppData%\Videoder|*.log FileKey2=%AppData%\Videoder\*Cache|*.* [VideoGet *] LangSecRef=3022 Detect=HKCU\Software\Nuclear Coffee\VideoGet FileKey1=%ProgramFiles%\VideoGet\Temp|*.* [VideoInspector *] LangSecRef=3023 Detect=HKCU\Software\KC Softwares\VideoInspector FileKey1=%AppData%\KC Softwares\VideoInspector|*.log [VideoMach *] LangSecRef=3023 Detect=HKCU\Software\Gromada\VideoMach FileKey1=%UserProfile%\Documents|VideoMach_Log.txt [VideoPad Video Editor *] LangSecRef=3023 DetectFile=%ProgramFiles%\NCH Software\VideoPad FileKey1=%ProgramFiles%\NCH Software\VideoPad|videopadsetup_*.exe [Vidmore Screen Recorder *] LangSecRef=3023 DetectFile=%LocalAppData%\Vidmore\Vidmore Screen Recorder FileKey1=%LocalAppData%\Vidmore\Vidmore Screen Recorder\Logs|*.* [Vim *] LangSecRef=3021 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vim FileKey1=%UserProfile%|_viminfo [Vindictus *] Section=Games Detect=HKLM\Software\Nexon\Vindictus DetectFile=%SystemDrive%\Nexon\Vindictus EU\en-EU FileKey1=%ProgramData%\NexonEU\601|*.log FileKey2=%SystemDrive%\Nexon\Vindictus EU\en-EU|*.log;*.tmp FileKey3=%SystemDrive%\Nexon\Vindictus EU\en-EU\HShield|*.log FileKey4=%UserProfile%\Documents\Vindictus EU\Report Error|*.log;*.mdmp [Violett *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\257830 FileKey1=%ProgramFiles%\Steam\SteamApps\Common\Violett|crash.dmp;error.log;output_log.txt;report.ini|RECURSE [Virtual Clone Drive *] LangSecRef=3021 Detect=HKLM\Software\Elaborate Bytes\VirtualCloneDrive RegKey1=HKLM\Software\Elaborate Bytes\VirtualCloneDrive\0 [VirtualBox *] LangSecRef=3024 DetectFile=%UserProfile%\.VirtualBox FileKey1=%ProgramData%\VirtualBox|*.log* FileKey2=%UserProfile%\.VirtualBox|*.log* FileKey3=%UserProfile%\VirtualBox VMs\*\Logs|*.log* [VirtualDJ *] LangSecRef=3023 Detect=HKCU\Software\VirtualDJ FileKey1=%UserProfile%\Documents\VirtualDJ|Crashguard report.txt FileKey2=%UserProfile%\Documents\VirtualDJ\Cache|*.*|RECURSE FileKey3=%UserProfile%\Documents\VirtualDJ\History|*.* [VirtualDJ Tracklist *] LangSecRef=3023 Detect=HKCU\Software\VirtualDJ FileKey1=%UserProfile%\Documents\VirtualDJ\TrackListing|*.* [VirtualDub *] LangSecRef=3023 Detect=HKCU\Software\VirtualDub.org\VirtualDub RegKey1=HKCU\Software\VirtualDub.org\VirtualDub\MRU List RegKey2=HKCU\Software\VirtualDub.org\VirtualDub\Saved filespecs [VirtualDubMod *] LangSecRef=3023 Detect=HKCU\Software\Freeware\VirtualDubMod RegKey1=HKCU\Software\Freeware\VirtualDubMod\MRU List [VirtualFDD *] LangSecRef=3024 Detect=HKCU\Software\Korbos\VirtualFDD RegKey1=HKCU\Software\Korbos\VirtualFDD\Recent File List [VirtuaWin *] LangSecRef=3021 DetectFile=%AppData%\VirtuaWin FileKey1=%AppData%\VirtuaWin|virtuawin.log [Visual Watermark *] LangSecRef=3023 DetectFile=%LocalAppData%\Visual Watermark* FileKey1=%LocalAppData%\Visual Watermark Common\Temp|*.* [Vit Registry Fix *] LangSecRef=3024 Detect=HKCU\Software\VITSOFT\Vit Registry Fix FileKey1=%ProgramFiles%\VITSOFT\Vit Registry Fix\Backup|BackupREG_*.Vreg [Vizzed Retro Game Room *] LangSecRef=3023 DetectFile=%UserProfile%\AppData\LocalLow\VizzedRgr FileKey1=%UserProfile%\AppData\LocalLow\VizzedRgr\Downloads|*|RECURSE FileKey2=%UserProfile%\AppData\LocalLow\VizzedRgr\Roms|*|RECURSE [VLC Media Player *] LangSecRef=3023 Detect=HKLM\Software\VideoLAN\VLC FileKey1=%AppData%\vlc|*.cache-3;ml.xspf.tmp*;vlc-qt-interface.ini.* FileKey2=%AppData%\vlc\art|*.*|RECURSE FileKey3=%AppData%\vlc\crashdump*|*.* FileKey4=%ProgramFiles%\Videolan\VLC\plugins|plugins.dat.* [VMware Personal Desktop Virtualization *] LangSecRef=3024 Detect1=HKLM\Software\VMware, Inc.\VMware Player Detect2=HKLM\Software\VMware, Inc.\VMware Workstation DetectFile=%UserProfile%\Documents\Virtual Machines FileKey1=%LocalAppData%\VMware|*.log FileKey2=%LocalAppData%\VMware\VMware vCenter Converter Standalone Client\Logs|*.log;*.gz FileKey3=%LocalAppData%\VMware\wdm\Logs|*.* FileKey4=%ProgramData%\VMware\hostd|*.log;*.gz|RECURSE FileKey5=%ProgramData%\VMware\Installer|*|REMOVESELF FileKey6=%ProgramData%\VMware\logs|*.log|RECURSE FileKey7=%ProgramData%\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE FileKey8=%UserProfile%\Documents\*Virtual Machines|*.log|RECURSE [VNCViewer *] LangSecRef=3024 Detect=HKU\.DEFAULT\Software\ORL\VNCviewer RegKey1=HKU\.DEFAULT\Software\ORL\VNCviewer\MRU [Vodafone *] LangSecRef=3022 Detect=HKCU\Software\Vodafone FileKey1=%AppData%\Vodafone\Vodafone Mobile*\Log|* FileKey2=%AppData%\Vodafone\Vodafone Mobile*\Temp|* FileKey3=%ProgramData%\Vodafone\Log|* FileKey4=%ProgramFiles%\Vodafone\Vodafone Mobile Broadband\Bin|SwiHpAux.log FileKey5=%WinDir%|ModemLog_*.txt [VoiCenter *] LangSecRef=3022 DetectFile=%LocalAppData%\VoiCenter FileKey1=%LocalAppData%\VoiCenter\Logs|*.* [VoipBuster *] LangSecRef=3022 DetectFile=%AppData%\VoipBuster FileKey1=%AppData%\VoipBuster|*.log FileKey2=%WinDir%\System32|VoipBuster*.log FileKey3=%WinDir%\SysWOW64|VoipBuster*.log [Volkswagen DiscoverCare *] LangSecRef=3021 DetectFile=%UserProfile%\DiscoverCare FileKey1=%UserProfile%\DiscoverCare\Data|DiscoverCare.log [Vopt 9 *] LangSecRef=3024 Detect=HKCU\Software\Golden Bow Systems\Vopt FileKey1=%ProgramFiles%\Golden Bow\Vopt 9|Vopt.log [Vortex *] Section=Games DetectFile=%AppData%\Vortex FileKey1=%AppData%\Vortex|Network Persistent State;*.log FileKey2=%AppData%\Vortex\*Cache|*|REMOVESELF FileKey3=%AppData%\Vortex\*Storage|*.old;LOG|RECURSE FileKey4=%AppData%\Vortex\blob_storage|*|RECURSE FileKey5=%AppData%\Vortex\Crashpad\reports|*|REMOVESELF FileKey6=%AppData%\Vortex\logs|*.log FileKey7=%AppData%\Vortex\temp|*|REMOVESELF FileKey8=%LocalAppData%\Vortex-Updater\pending|* [VS Logon Screen Customizer *] LangSecRef=3024 Detect=HKCU\Software\LOKIBIT.COM\VSLogonScreenCustomizer RegKey1=HKCU\Software\LOKIBIT.COM\VSLogonScreenCustomizer|LastInputDir [VSO *] LangSecRef=3023 Detect=HKCU\Software\VSO FileKey1=%AppData%|pcouffin.log;ezplay.log FileKey2=%AppData%\VSO|*.log|REMOVESELF FileKey3=%ProgramData%\VSO|*.cache;*.crashlist;*.log;*.vsothumb|RECURSE FileKey4=%ProgramData%\VSO\vsothumbs|*|REMOVESELF FileKey5=%UserProfile%|timestamp.txt FileKey6=%UserProfile%\Documents\PcSetup|*.log|REMOVESELF [VSO Batcher *] LangSecRef=3023 Detect=HKCU\Software\VSO\VSO Batcher FileKey1=%AppData%\Vso\VSO Batcher\1|*.*|RECURSE RegKey1=HKCU\Software\VSO\VSO Batcher\1|VideoFilesLastFlder [VSO Blindwrite *] LangSecRef=3021 Detect=HKCU\Software\VSO\Blindwrite FileKey1=%ProgramData%\VSO\Blindwrite\*|*.log|REMOVESELF [VSO Converter *] LangSecRef=3023 Detect1=HKCU\Software\VSO\Blu-ray Converter Ultimate Detect2=HKCU\Software\VSO\DVD Converter Ultimate Detect3=HKCU\Software\VSO\VSO Video Converter FileKey1=%ProgramData%\VSO\*Converter*\*\Log|*.log;*.crashlist|REMOVESELF FileKey2=%ProgramFiles%\VSO\*Converter*\*|*.txt RegKey1=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|BDMVInputFolders RegKey2=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|ISOInputFolders RegKey3=HKCU\Software\VSO\Blu-ray Converter Ultimate\2|MediaLabel RegKey4=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_audio RegKey5=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_bluray RegKey6=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_dvd RegKey7=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_iso RegKey8=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_subtitle RegKey9=HKCU\Software\VSO\Blu-ray Converter Ultimate\3|input_MRUfiles_video RegKey10=HKCU\Software\VSO\DVD Converter Ultimate\2|BDMVInputFolders RegKey11=HKCU\Software\VSO\DVD Converter Ultimate\2|ISOInputFolders RegKey12=HKCU\Software\VSO\DVD Converter Ultimate\2|MediaLabel RegKey13=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_audio RegKey14=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_bluray RegKey15=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_dvd RegKey16=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_iso RegKey17=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_subtitle RegKey18=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_video RegKey19=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_audio RegKey20=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_bluray RegKey21=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_dvd RegKey22=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_iso RegKey23=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_subtitle RegKey24=HKCU\Software\VSO\VSO Video Converter\1|input_MRUfiles_video [VSO ConvertXToDVD 5 *] LangSecRef=3023 Detect=HKCU\Software\VSO\ConvertXtoDVD\5 FileKey1=%ProgramFiles%\VSO\ConvertX\5|*.log;*.rtf [VSO Downloader *] LangSecRef=3023 Detect=HKCU\Software\VSO\VSO Downloader FileKey1=%AppData%\VSO\VSO Downloader\*\items|*.item|RECURSE FileKey2=%ProgramData%\VSO\VSO Downloader\*\items|*.item|RECURSE FileKey3=%ProgramData%\VSO\VSO Downloader\*\log|*.log [VSO Media Player 1 *] LangSecRef=3023 Detect=HKCU\Software\VSO\VSO Media Player\1 FileKey1=%AppData%\VSO\VSO Media Player\1|autoresume.xml FileKey2=%ProgramData%\VSO\VSO Media Player\1\log|*.log;*.crashlist RegKey1=HKCU\Software\VSO\VSO Media Player\1\RecentlyOpenedFiles [VueScan *] LangSecRef=3024 DetectFile1=%ProgramFiles%\VueScan DetectFile2=%SystemDrive%\VueScan FileKey1=%ProgramFiles%\VueScan|*.log|RECURSE FileKey2=%SystemDrive%\VueScan|*.log|RECURSE [Vuze *] LangSecRef=3022 Detect=HKCU\Software\Azureus FileKey1=%AppData%\Azureus|ipfilter.cache FileKey2=%AppData%\Azureus\plugins\advancedstatistics|*.txt FileKey3=%AppData%\Azureus\plugins\dasu\reports|*.* FileKey4=%AppData%\Azureus\plugins\progressbar|*.txt FileKey5=%AppData%\Azureus\torrents|*.tmp FileKey6=%ProgramFiles%\Vuze|*.log|RECURSE [W3i *] LangSecRef=3022 DetectFile=%ProgramData%\W3i FileKey1=%ProgramData%\W3i\InstallQUpdater|*.log [Wacom *] LangSecRef=3023 Detect=HKCU\Software\Wacom FileKey1=%AppData%\WTablet|*.bak FileKey2=%SystemDrive%\Wacom\Logs|* [Walgreens PhotoShow Express CD *] LangSecRef=3021 DetectFile=%AppData%\Walgreens\PhotoShow Express CD FileKey1=%AppData%\Walgreens\Photoshow Express CD\Cache|*.*|RECURSE [WallWatcher *] LangSecRef=3024 DetectFile=%ProgramFiles%\Wall Watcher FileKey1=%ProgramFiles%\Wall Watcher\Logs|*.* [Wanted Weapons of Fate *] Section=Games DetectFile=%LocalAppData%\wanted FileKey1=%LocalAppData%\wanted|crash*.txt [War Thunder *] Section=Games Detect1=HKCU\Software\Gaijin\WarThunder Detect2=HKCU\Software\Valve\Steam\Apps\236390 FileKey1=%ProgramFiles%\Steam\SteamApps\common\War Thunder\.launcher_log|*.txt FileKey2=%ProgramFiles%\Steam\SteamApps\common\War Thunder\_debuginfo|*.clog FileKey3=%ProgramFiles%\War Thunder\.launcher_log|*.txt FileKey4=%ProgramFiles%\War Thunder\_debuginfo|*.clog [Warcraft III *] Section=Games DetectFile=%ProgramFiles%\Warcraft III FileKey1=%ProgramFiles%\Warcraft III|*.log;*.html FileKey2=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt ExcludeKey1=PATH|%ProgramFiles%\Warcraft III\|CustomKey*.txt [Warcraft III Backups *] Section=Games Detect=HKLM\Software\Blizzard Entertainment\Warcraft III FileKey1=%ProgramFiles%\Warcraft III|*.bak;*.old|RECURSE [Warframe *] Section=Games Detect=HKCU\Software\Digital Extremes\Warframe FileKey1=%LocalAppData%\Warframe|*.log [Wargaming.net GameCenter *] Section=Games DetectFile=%ProgramFiles%\Wargaming.net\GameCenter FileKey1=%ProgramFiles%\Wargaming.net\GameCenter|*.bak FileKey2=%ProgramFiles%\Wargaming.net\GameCenter\Cache|*.*|RECURSE FileKey3=%ProgramFiles%\Wargaming.net\GameCenter\Logs|*.* [Wargaming.net World of Tanks *] Section=Games DetectFile=%AppData%\Wargaming.net\WorldofTanks FileKey1=%AppData%\Wargaming.net\WorldofTanks\*_Cache|*.*|RECURSE FileKey2=%AppData%\Wargaming.net\WorldofTanks\Profile\Cef_Cache|Visited Links FileKey3=%AppData%\Wargaming.net\WorldofTanks\Profile\Cef_Cache\blob_storage|*.*|RECURSE FileKey4=%AppData%\Wargaming.net\WorldofTanks\Profile\Cef_Cache\Code Cache|*.*|RECURSE [Warhammer *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\4570 DetectFile=%AppData%\The Creative Assembly\Warhammer* FileKey1=%AppData%\The Creative Assembly\Warhammer*\Logs|*.* FileKey2=%AppData%\The Creative Assembly\Warhammer*\Temp|*.temp FileKey3=%ProgramFiles%\Steam\steamapps\common\Dawn of War Gold\Logfiles|*.* [Warp Registry Cleaner *] LangSecRef=3024 DetectFile=%ProgramFiles%\NCH Software\Warp FileKey1=%AppData%\NCH Software\Warp\Logs|*.csv [Watto Studios Game Extractor *] LangSecRef=3021 DetectFile=%ProgramFiles%\Game Extractor FileKey1=%ProgramFiles%\Game Extractor\extract|*.* FileKey2=%ProgramFiles%\Game Extractor\logs|*.* FileKey3=%ProgramFiles%\Game Extractor\previews|*.* FileKey4=%ProgramFiles%\Game Extractor\temp|*.* [Wave Systems Corp *] LangSecRef=3021 DetectFile=%AppData%\Wave Systems Corp FileKey1=%AppData%\Wave Systems Corp|DSM_AM.* FileKey2=%LocalAppData%\Wave Systems Corp\WCLIENTDLL|errors.txt FileKey3=%ProgramData%\Wave Systems Corp|*.log|RECURSE [WavePad Sound Editor *] LangSecRef=3023 Detect=HKCU\Software\NCH Software\WavePad DetectFile=%AppData%\NCH Software\WavePad FileKey1=%AppData%\NCH Software\WavePad\Logs|*.* FileKey2=%AppData%\NCH Software\WavePad\SoundCache|*.* FileKey3=%ProgramFiles%\NCH Software\WavePad|wavepadsetup_*.exe RegKey1=HKCU\Software\NCH Software\WavePad\Recent [Waves Audio *] LangSecRef=3023 DetectFile=%AppData%\Waves Audio FileKey1=%AppData%\Waves Audio\Caches|*.*|RECURSE FileKey2=%AppData%\Waves Audio\Waves Central\logs|*.*|RECURSE FileKey3=%LocalAppData%\Waves Audio\logs|*.log* FileKey4=%LocalAppData%\Waves Audio\Waves Central\Cache\QtWebEngine\Default\Cache|*.* [Wavosaur *] LangSecRef=3023 DetectFile=%ProgramFiles%\Wavosaur FileKey1=%ProgramFiles%\Wavosaur|wavosaur.log [Weather It Up *] LangSecRef=3024 Detect=HKLM\Software\Weather It Up FileKey1=%ProgramFiles%\Weather It Up|*.log [Weather Watcher Live *] LangSecRef=3021 Detect=HKCU\Software\VB and VBA Program Settings\Weather Watcher Live FileKey1=%AppData%\WeatherWatcherLive|WeatherWatcherLive.log FileKey2=%AppData%\WeatherWatcherLive\LatestChanges|*.* FileKey3=%AppData%\WeatherWatcherLive\Temp|*.* [Web Sling Player *] LangSecRef=3023 DetectFile=%AppData%\Sling Media\WebSlingPlayer FileKey1=%AppData%\Sling Media\WebSlingPlayer|*.txt;*.log FileKey2=%AppData%\Sling Media\WebSlingPlayer\*_cache|*.*|RECURSE FileKey3=%AppData%\Sling Media\WebSlingPlayer\temp|*.*|RECURSE [WebMon *] LangSecRef=3022 Detect=HKCU\Software\CM\WebMon FileKey1=%ProgramFiles%\WebMon|UpdateLog.* [WebP Codec *] LangSecRef=3023 DetectFile=%ProgramFiles%\WebP Codec FileKey1=%ProgramFiles%\WebP Codec\Example Files|*.*|REMOVESELF [WebPictures Downloader *] LangSecRef=3022 DetectFile=%ProgramFiles%\WebPictures Downloader FileKey1=%ProgramFiles%\WebPictures Downloader\Projects|*.*|RECURSE [WebReaper *] LangSecRef=3022 Detect=HKCU\Software\BlueBeam\WebReaper RegKey1=HKCU\Software\BlueBeam\WebReaper\URL History [Webroot SecureAnywhere *] LangSecRef=3024 DetectFile1=%ProgramFiles%\Webroot DetectFile2=%UserProfile%\AppData\LocalLow\Webroot FileKey1=%AppData%\Local\Temp\lptmp*|*|REMOVESELF FileKey2=%LocalAppData%\lptmp*|*.*|REMOVESELF FileKey3=%ProgramData%\WRData|WRLog.log [Webroot Window Washer Backups *] LangSecRef=3024 Detect=HKCU\Software\Webroot\Window Washer FileKey1=%AppData%\Webroot\Washer\Backup|*.*|RECURSE [WebTorrent *] LangSecRef=3022 DetectFile=%AppData%\WebTorrent FileKey1=%AppData%\WebTorrent\*Cache|*.* FileKey2=%LocalAppData%\WebTorrent|*.log [WeFi *] LangSecRef=3024 DetectFile=%ProgramFiles%\WeFi FileKey1=%ProgramData%\WeFi\LogFiles|*|REMOVESELF [West of Loathing *] Section=Games Detect=HKCU\Software\Valve\Steam\Apps\597220 FileKey1=%UserProfile%\AppData\LocalLow\Asymmetric Software\West of Loathing|*output_log.txt FileKey2=%UserProfile%\AppData\LocalLow\Asymmetric Software\West of Loathing\Crashes|* [Western Digital SmartWare *] LangSecRef=3024 DetectFile=%ProgramData%\Western Digital FileKey1=%AppData%\Western Digital\WD SmartWare\Logs|* FileKey2=%LocalAppData%\Western Digital\WD SmartWare|*log.txt FileKey3=%ProgramData%\Western Digital\Logs\WD *\*|*.log FileKey4=%ProgramData%\Western Digital\Logs\WD Firmware Updater|*|REMOVESELF FileKey5=%ProgramData%\Western Digital\WD SmartWare|*.log FileKey6=%ProgramData%\Western Digital\WDFME|* FileKey7=%Public%\Documents\Downloads\WD_SmartWare_Installer_*|*|REMOVESELF [WhatPulse *] LangSecRef=3021 Detect=HKCU\Software\WhatPulse FileKey1=%AppData%\WhatPulse|*.bak;*.log [WhatsApp *] LangSecRef=3022 DetectFile=%LocalAppData%\WhatsApp FileKey1=%AppData%\WhatsApp|*.log*;*_log.txt;Network Persistent State;QuotaManager FileKey2=%AppData%\WhatsApp|*-journal;*.old;LOG|RECURSE FileKey3=%AppData%\WhatsApp\*Cache|*.*|RECURSE FileKey4=%AppData%\WhatsApp\blob_storage|*.*|RECURSE FileKey5=%AppData%\WhatsApp\Crashpad\Reports|*.* FileKey6=%AppData%\WhatsApp\Logs|*.* FileKey7=%AppData%\WhatsApp\Service Worker\*Cache*|*.*|RECURSE FileKey8=%AppData%\WhatsApp\VideoDecodeStats|*.* FileKey9=%LocalAppData%\WhatsApp|*.log FileKey10=%LocalAppData%\WhatsApp\app-*|*.log FileKey11=%LocalAppData%\WhatsApp\packages\SquirrelTemp|*.*|REMOVESELF [Whoer VPN *] LangSecRef=3022 DetectFile=%ProgramFiles%\Whoer FileKey1=%ProgramFiles%\Whoer|log.txt [Who's On My WiFi *] LangSecRef=3022 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{010D45A1-093D-4534-8147-4E10E80F81CC}_is1 FileKey1=%ProgramFiles%\IO3O LLC\Who Is On My Wifi\logs|*.* [WhySoSlow *] LangSecRef=3024 Detect=HKCU\Software\Resplendence Sp\WhySoSlow FileKey1=%LocalAppData%\Resplendence|WhySoSlowLog.txt [WildTangent *] LangSecRef=3021 DetectFile=%AppData%\WildTangent FileKey1=%AppData%\WildTangent\Logs|*.* [Win Movie Maker *] LangSecRef=3023 DetectFile=%AppData%\VideoWinSoft FileKey1=%AppData%\VideoWinSoft|format_his.db FileKey2=%AppData%\VideoWinSoft\logs|*.*|RECURSE [WinAce *] LangSecRef=3024 Detect=HKU\.DEFAULT\Software\e-merge\WinAce\2.0 DetectFile=%ProgramFiles%\WinAce FileKey1=%ProgramFiles%\WinAce|*.cnt;*.log RegKey1=HKU\.DEFAULT\Software\e-merge\WinAce\2.0\MRU Items [Winaero Tweaker *] LangSecRef=3024 Detect=HKCU\Software\Winaero.com\Winaero Tweaker RegKey1=HKCU\Software\Winaero.com\Winaero Tweaker|SetupDir [Winamp *] LangSecRef=3023 Detect1=HKCU\Software\Streamripper Detect2=HKCU\Software\Winamp FileKey1=%AppData%\Streamripper|*.*|REMOVESELF FileKey2=%AppData%\Winamp\Plugins|*.dmp;*.log;feedback.ini;report.zip FileKey3=%AppData%\Winamp\Plugins\ml|ml_pmp_device_*.ini;recent.dat;recent.idx FileKey4=%ProgramFiles%\Winamp|*log.txt FileKey5=%ProgramFiles%\Winamp\Plugins|*.log FileKey6=%ProgramFiles%\Winamp\Plugins\ml|ml_pmp_device_*.ini;recent.dat;recent.idx [Winamp Current Playlist *] LangSecRef=3023 Detect=HKCU\Software\Winamp FileKey1=%AppData%\Winamp|Winamp.m3u;Winamp.m3u8 [Winamp Playlist Undo Plug-in *] LangSecRef=3023 DetectFile=%ProgramFiles%\Winamp\Plugins\gen_undo.dll FileKey1=%AppData%\Winamp\Plugins|undo.gul FileKey2=%AppData%\Winamp\Plugins\gen_undo|*.m3u8 [WinAVI Video Converter *] LangSecRef=3023 Detect=HKCU\Software\ZjSoft\WinAVI FileKey1=%LocalAppData%\winavi|debug.log [WinCHM *] LangSecRef=3021 Detect=HKCU\Software\Softany\WinCHM RegKey1=HKCU\Software\Softany\WinCHM|RecentFile1 RegKey2=HKCU\Software\Softany\WinCHM|RecentFile2 RegKey3=HKCU\Software\Softany\WinCHM|RecentFile3 RegKey4=HKCU\Software\Softany\WinCHM|RecentFile4 RegKey5=HKCU\Software\Softany\WinCHM|RecentFile5 RegKey6=HKCU\Software\Softany\WinCHM|RecentFile6 [WinDjView *] LangSecRef=3024 Detect=HKCU\Software\Andrew Zhezherun\WinDjView RegKey1=HKCU\Software\Andrew Zhezherun\WinDjView\Documents RegKey2=HKCU\Software\Andrew Zhezherun\WinDjView\Recent File List [Windows 7 Manager *] LangSecRef=3024 Detect=HKCU\Software\Yamicsoft\Windows 7 Manager FileKey1=%ProgramFiles%\Yamicsoft\Windows 7 Manager\DiskAnalyzerXML|*.* [Windows Activity History *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Warning=You need to run this in Windows Safe Mode. Or stop services "Connected Devices Platform Service" and "Connected Devices Platform User Service_xxxxx" prior to cleaning and restart after cleaning. FileKey1=%LocalAppData%\ConnectedDevicesPlatform\*|*.db* [Windows AutoPlay Devices *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\KnownDevices [Windows Calculator *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsCalculator_* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\TempState|*|RECURSE [Windows Camera *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.*Camera_* FileKey1=%LocalAppData%\Packages\Microsoft.*Camera_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.*Camera_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.*Camera_*\LocalState\AppData|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.*Camera_*\LocalState\Cache|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.*Camera_*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.*Camera_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Camera_8wekyb3d8bbwe\SearchHistory [Windows CD Burning Queue *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning FileKey1=%LocalAppData%\Microsoft\CD Burning|*|RECURSE FileKey2=%LocalAppData%\Microsoft\Windows\Burn|*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo [Windows Clock *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsAlarms_* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\LocalState|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\TempState|*|RECURSE [Windows Credential Manager Saved Credentials *] LangSecRef=3025 DetectFile=%LocalAppData%\Microsoft\Vault FileKey1=%LocalAppData%\Microsoft\Vault\*|*.vcrd [Windows Cryptographic Services *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%UserProfile%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE FileKey2=%UserProfile%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE FileKey3=%WinDir%\ServiceProfiles\*\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE FileKey4=%WinDir%\ServiceProfiles\*\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE FileKey5=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE FileKey6=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE FileKey7=%WinDir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content|*|RECURSE FileKey8=%WinDir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*|RECURSE FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*|RECURSE [Windows Device Manager *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows FileKey1=%WinDir%\INF|INFCACHE.1 FileKey2=%WinDir%\System32\DriverStore|INFCACHE.1 [Windows DVD Maker *] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings RegKey1=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 2 RegKey2=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 5 RegKey3=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 7 RegKey4=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\Browse 128 RegKey5=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU0 RegKey6=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU1 RegKey7=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU2 RegKey8=HKCU\Software\Microsoft\Microsoft DVD Wizard Settings\MRU3 [Windows EdgeHTML *] LangSecRef=3025 Detect=HKCU\Software\Microsoft FileKey1=%LocalAppData%\Microsoft\Internet Explorer|*.log;*.txt|RECURSE FileKey2=%LocalAppData%\Microsoft\Internet Explorer\CacheStorage|*|RECURSE FileKey3=%LocalAppData%\Microsoft\Internet Explorer\DOMStore|*|RECURSE FileKey4=%LocalAppData%\Microsoft\Internet Explorer\Recovery|*|RECURSE FileKey5=%LocalAppData%\Microsoft\Windows\INet*|*|RECURSE FileKey6=%LocalAppData%\Microsoft\Windows\PRICache|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\AC|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\Settings|*.log* FileKey9=%LocalAppData%\Packages\Microsoft.Win32WebViewHost_*\TempState|*|RECURSE FileKey10=%UserProfile%\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore|*|REMOVESELF FileKey11=%UserProfile%\AppData\LocalLow\webviewdata\2\EBWebView\Crashpad\reports|* FileKey12=%UserProfile%\AppData\LocalLow\webviewdata\2\EBWebView\Crashpad\temp|* FileKey13=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\History|*|RECURSE FileKey14=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\INet*|*|RECURSE FileKey15=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer|*.log FileKey16=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*|RECURSE FileKey17=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INet*|*|RECURSE FileKey18=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*|RECURSE FileKey19=%WinDir%\System32\config\systemprofile\Cookies|*|RECURSE FileKey20=%WinDir%\System32\config\systemprofile\History|*|RECURSE FileKey21=%WinDir%\System32\config\systemprofile\Local Settings\Temporary Internet Files|*|RECURSE FileKey22=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History|*|RECURSE FileKey23=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INet*|*|RECURSE FileKey24=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*|RECURSE RegKey1=HKCU\Software\Microsoft\Internet Explorer\DOMStorage RegKey2=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage RegKey3=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats [Windows Error Reporting *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\Windows Error Reporting FileKey1=%LocalAppData%\CrashDumps|*dmp* FileKey2=%LocalAppData%\PCHealth\ErrorRep\QSignoff|* FileKey3=%WinDir%\LiveKernelReports|*.dmp|RECURSE FileKey4=%WinDir%\pchealth\ERRORREP|*|RECURSE FileKey5=%WinDir%\pchealth\helpctr\DataColl|*.xml FileKey6=%WinDir%\pchealth\helpctr\OfflineCache|*|RECURSE FileKey7=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE FileKey8=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*dmp* FileKey9=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE FileKey11=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE RegKey1=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports|LastFullLiveReport RegKey2=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports\win32k.sys RegKey3=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports\win32k.sys RegKey4=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps RegKey5=HKU\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation [Windows Event Viewer *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows FileKey1=%LocalAppData%\Microsoft\Event Viewer|RecentViews FileKey2=%ProgramData%\Microsoft\Event Viewer\*Logs|*.xml [Windows Feedback Hub *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsFeedback* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedback*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedback*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedback*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedback*\LocalState\DiagOutputDir|*.txt FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedback*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFeedback*\TempState|*|RECURSE [Windows File Manager *] LangSecRef=3024 DetectFile1=%LocalAppData%\Packages\FileManager_* DetectFile2=%LocalAppData%\Packages\Microsoft.WindowsFileManager_* FileKey1=%LocalAppData%\Packages\FileManager_*\LocalState|*.jpg FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\AC|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\Local\*|*|REMOVESELF FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\LocalLow\Microsoft\CryptnetUrlCache\*|*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\LocalLow\Temp|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\Roaming\*|*|REMOVESELF FileKey7=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\LocalCache\Temp|*|REMOVESELF FileKey8=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\Settings|*.log* FileKey9=%LocalAppData%\Packages\Microsoft.WindowsFileManager_*\TempState|*|RECURSE [Windows Font Cache *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows FileKey1=%LocalAppData%|GDIPFONTCACHEV1.DAT FileKey2=%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data|*FontCache*.dat FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local|*FontCache*.dat FileKey4=%WinDir%\ServiceProfiles\LocalService\AppData\Local\FontCache|*FontCache*.dat [Windows Game Statistics *] LangSecRef=3025 DetectFile=%LocalAppData%\Microsoft Games FileKey1=%LocalAppData%\Microsoft Games|*.xml*|RECURSE [Windows Get Help *] LangSecRef=3025 DetectFile1=%LocalAppData%\Packages\Microsoft.GetHelp_* DetectFile2=%LocalAppData%\Packages\Windows.ContactSupport_* FileKey1=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.GetHelp_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.GetHelp_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.GetHelp_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.GetHelp_*\TempState|*|RECURSE FileKey6=%LocalAppData%\Packages\Windows.ContactSupport_*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Windows.ContactSupport_*\LocalCache|*|RECURSE FileKey8=%LocalAppData%\Packages\Windows.ContactSupport_*\LocalState\Cache|*|RECURSE FileKey9=%LocalAppData%\Packages\Windows.ContactSupport_*\Settings|*.log* FileKey10=%LocalAppData%\Packages\Windows.ContactSupport_*\TempState|*|RECURSE [Windows Grep *] LangSecRef=3024 Detect=HKCU\Software\Windows Grep\Windows Grep RegKey1=HKCU\Software\Windows Grep\Windows Grep\Current Version\Replace Options|Replace String RegKey2=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Filespecs RegKey3=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Folders RegKey4=HKCU\Software\Windows Grep\Windows Grep\Current Version\Search Dialog\Strings [Windows Image Acquisition *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\WIA FileKey1=%AppData%\Microsoft\Document Center\UserScanProfiles|* FileKey2=%LocalAppData%\Microsoft\UserScanProfiles|* FileKey3=%UserProfile%|Sti_Trace.log RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\WIA [Windows Installer *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer FileKey1=%SystemDrive%\Config.msi|*|REMOVESELF FileKey2=%WinDir%\Installer|*.tmp|RECURSE FileKey3=%WinDir%\Installer|SourceHash{*};wix{*}.SchedServiceConfig.rmi FileKey4=%WinDir%\Installer\Config.Msi|*|REMOVESELF FileKey5=%WinDir%\Installer\MSI*.tmp-|*|REMOVESELF FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local|*.tmp|RECURSE [Windows Language Libraries *] LangSecRef=3025 DetectFile1=%LocalAppData%\Packages\Microsoft.VCLibs.* DetectFile2=%LocalAppData%\Packages\Microsoft.WinJS.* FileKey1=%LocalAppData%\Packages\Microsoft.VCLibs.*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.VCLibs.*\LocalState\Cache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.VCLibs.*\LocalState\navigationHistory|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.VCLibs.*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.VCLibs.*\TempState|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.WinJS.*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.WinJS.*\LocalState\*Cache|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.WinJS.*\LocalState\navigationHistory|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.WinJS.*\Settings|*.log* FileKey10=%LocalAppData%\Packages\Microsoft.WinJS.*\TempState|*|RECURSE FileKey11=%SystemDrive%|eula.*.txt;globdata.ini;install.exe;install.ini;install.res.*.dll;VC_RED.cab;VC_RED.MSI;vcredist.bmp [Windows Live Mail *] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Live Mail FileKey1=%LocalAppData%\Microsoft\Windows*Mail|*.log;*.jrs;*.chk;*.rss;*.tmp|RECURSE FileKey2=%LocalAppData%\Microsoft\Windows*Mail\*|*.MSMessageStore|RECURSE FileKey3=%LocalAppData%\Microsoft\Windows*Mail\*.tmp|*|RECURSE FileKey4=%LocalAppData%\Microsoft\Windows*Mail\*\Backup|*|REMOVESELF FileKey5=%LocalAppData%\Microsoft\Windows*Mail\Backup|*|REMOVESELF RegKey1=HKCU\Software\Microsoft\Windows Live Mail|SearchFolderVersion [Windows Live Movie Maker *] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Live\Movie Maker FileKey1=%LocalAppData%\Microsoft\Windows Live Movie Maker|*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows Live\Movie Maker|browseformusicdirectory RegKey2=HKCU\Software\Microsoft\Windows Live\Movie Maker|browseforpicturesdirectory RegKey3=HKCU\Software\Microsoft\Windows Live\Movie Maker|browseforprojectsdirectory RegKey4=HKCU\Software\Microsoft\Windows Live\Movie Maker|rendertofiledirectory RegKey5=HKCU\Software\Microsoft\Windows Live\Movie Maker|snapshotfiledirectory RegKey6=HKCU\Software\Microsoft\Windows Live\Movie Maker\recent [Windows Live Photo Gallery *] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Live\Photo Gallery FileKey1=%LocalAppData%\Microsoft\Windows Live Photo Gallery|*.*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|FinenameTemplate RegKey2=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|RootDirectory RegKey3=HKCU\Software\Microsoft\Windows Live\Photo Gallery|galleryscopedfolders [Windows Live Setup *] LangSecRef=3022 Detect1=HKCU\Software\Microsoft\Windows Live Mail Detect2=HKLM\Software\Microsoft\Windows Live FileKey1=%CommonProgramFiles%\Windows Live\.cache|*.tmp FileKey2=%LocalAppData%\Microsoft\WLSetup\*logs|*|RECURSE FileKey3=%ProgramData%\Microsoft\WLSetup|*.tmp FileKey4=%ProgramData%\Microsoft\WLSetup\*logs|*|RECURSE FileKey5=%ProgramData%\WLInstaller|*.log [Windows Live Writer *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows Live Writer FileKey1=%LocalAppData%\Windows Live Writer|*.log [Windows Lock Screen *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.LockApp* FileKey1=%LocalAppData%\Packages\Microsoft.LockApp*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.LockApp*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.LockApp*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.LockApp*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.LockApp*\TempState|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\LocalCache|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\LocalState\Favicons|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\LocalState\MobilityExperience\ImageCache|*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\LocalState\OneSettingsResponseCache|*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\LocalState\TargetedContentCache|*|RECURSE FileKey12=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\Settings|*.log* FileKey13=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager*\TempState|*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps [Windows Logs *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows FileKey1=%LocalAppData%\ConnectedDevicesPlatform|*.log FileKey2=%LocalAppData%\Diagnostics|*|RECURSE FileKey3=%LocalAppData%\Microsoft\Dialer|*.log.txt FileKey4=%LocalAppData%\Microsoft\msipc\Logs|* FileKey5=%LocalAppData%\Microsoft\Portable Devices|wpdlog*.sqm FileKey6=%LocalAppData%\Microsoft\Windows\Explorer|*.etl FileKey7=%ProgramData%\Microsoft\Diagnosis\DownloadedSettings|*.json.bk FileKey8=%ProgramData%\Microsoft\Diagnosis\ETLLogs|*|RECURSE FileKey9=%ProgramData%\Microsoft\DiagnosticLogCSP|*|RECURSE FileKey10=%ProgramData%\Microsoft\Network\Downloader|*|RECURSE FileKey11=%ProgramData%\Microsoft\WDF|*|RECURSE FileKey12=%ProgramData%\Microsoft\Windows Security Health\Logs|*|RECURSE FileKey13=%ProgramData%\Microsoft\Windows\wfp|*.etl FileKey14=%ProgramData%\USOShared\Logs|*|RECURSE FileKey15=%ProgramFiles%\UNP\*Logs|* FileKey16=%SystemDrive%|DumpStack.log FileKey17=%SystemDrive%\PerfLogs\System\Diagnostics|*|RECURSE FileKey18=%SystemDrive%\PerfLogs\System\Performance|*|RECURSE FileKey19=%WinDir%|*.log FileKey20=%WinDir%\AppCompat\Programs|*.txt;*.xml FileKey21=%WinDir%\AppCompat\Programs\Install|*.txt;*.xml FileKey22=%WinDir%\debug|*.log|RECURSE FileKey23=%WinDir%\INF|*.etl;*.log* FileKey24=%WinDir%\Logs|*.etl;*.log|RECURSE FileKey25=%WinDir%\Logs\CBS|*.cab FileKey26=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;*GatherPnPList.log;*.tmp FileKey27=%WinDir%\Panther\FastCleanup|*.log FileKey28=%WinDir%\Panther\Rollback|*.txt FileKey29=%WinDir%\Panther\UnattendGC|diag*.xml;setup*.log FileKey30=%WinDir%\repair|setup.log FileKey31=%WinDir%\security\logs|*|RECURSE FileKey32=%WinDir%\ServiceProfiles\NetworkService\debug|*.log FileKey33=%WinDir%\System32\CatRoot|*.tmp FileKey34=%WinDir%\System32\CatRoot_bak|*|REMOVESELF FileKey35=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt FileKey36=%WinDir%\System32\LogFiles|*|RECURSE FileKey37=%WinDir%\System32\Logs|*.etl FileKey38=%WinDir%\System32\NDF|*.etl FileKey39=%WinDir%\System32\SleepStudy|*.etl|RECURSE FileKey40=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log FileKey41=%WinDir%\System32\WDI\*|*.etl*|REMOVESELF FileKey42=%WinDir%\System32\WDI\LogFiles\StartupInfo|*|RECURSE FileKey43=%WinDir%\Temp|*.log RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications RegKey2=HKLM\Software\Microsoft\Tracing RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing [Windows Mail *] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Mail FileKey1=%LocalAppData%\Microsoft\Windows Mail|*.log;*.jrs;*.chk|RECURSE FileKey2=%LocalAppData%\Microsoft\Windows Mail\Backup\Old|*.*|REMOVESELF [Windows Mail and Calendar *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_* FileKey1=%LocalAppData%\Comms\Unistore\data|AggregateCache.uca FileKey2=%LocalAppData%\Comms\UnistoreDB|*.jcp;*.jrs;*.jtx FileKey3=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC|*|RECURSE FileKey4=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalCache|*|RECURSE FileKey5=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState|*.etl;*.jpg;*.log FileKey6=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState\AppData\Local\Office\*\WebServiceCache|*|RECURSE FileKey7=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState\Livecomm\*\dbStore\LogFiles|* FileKey8=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\Settings|*.log* FileKey9=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SearchHistory [Windows Maps *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsMaps_* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\TempState|*|RECURSE FileKey6=%ProgramData%\Microsoft\MapData|events.log FileKey7=%ProgramData%\Microsoft\MapData\mapscache|*|RECURSE [Windows Media Center *] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Media Center FileKey1=%LocalAppData%\Microsoft\ehome|Image.db;Video.db;musicThumbs.db FileKey2=%LocalAppData%\Microsoft\eHome\Art Cache|*|RECURSE FileKey3=%ProgramData%\Microsoft\eHome\thmb|TVThumb.db RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Media Center\MRU\SettingsMRU [Windows Media Extensions *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.*extension* FileKey1=%LocalAppData%\Packages\Microsoft.*extension*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.*extension*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.*extension*\Settings|*.log* FileKey4=%LocalAppData%\Packages\Microsoft.*extension*\TempState|*|RECURSE [Windows Media Player *] LangSecRef=3023 Detect=HKCU\Software\Microsoft\MediaPlayer FileKey1=%LocalAppData%|DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini FileKey2=%LocalAppData%\Microsoft\Media Player\Cache*|* FileKey3=%LocalAppData%\Microsoft\Media Player\Cache*\LocalMLS|*|RECURSE RegKey1=HKCU\Software\Microsoft\MediaPlayer\Player\Settings|OpenDir RegKey2=HKCU\Software\Microsoft\MediaPlayer\Preferences|CDRecordPath RegKey3=HKCU\Software\Microsoft\MediaPlayer\Preferences|MostRecentFileAddOrRemove RegKey4=HKCU\Software\Microsoft\MediaPlayer\Preferences|ObfuscatedSyncPlaylistsPath RegKey5=HKCU\Software\Microsoft\MediaPlayer\Services\Bing|CachedIconPath RegKey6=HKCU\Software\Microsoft\MediaPlayer\Services\Bing|CachedLargeLogoPath RegKey7=HKCU\Software\Microsoft\MediaPlayer\Setup\FileMoveCache\Source RegKey8=HKU\.DEFAULT\Software\Microsoft\MediaPlayer\Player\RecentFileList RegKey9=HKU\S-1-5-18\Software\Microsoft\MediaPlayer\Preferences|ObfuscatedSyncPlaylistsPath [Windows Metafile Viewer *] LangSecRef=3023 Detect=HKCU\Software\Metafile Viewer\WMF Viewer RegKey1=HKCU\Software\Metafile Viewer\WMF Viewer\Recent File List [Windows Movie Maker *] LangSecRef=3023 Detect1=HKCU\Software\Microsoft\MM20 Detect2=HKCU\Software\Microsoft\MovieMaker FileKey1=%LocalAppData%\Microsoft\Movie Maker|MEDIATAB*.DAT RegKey1=HKCU\Software\Microsoft\MM20\ImportDirAllMedia RegKey2=HKCU\Software\Microsoft\MM20\ImportDirAudio RegKey3=HKCU\Software\Microsoft\MM20\ImportDirStills RegKey4=HKCU\Software\Microsoft\MM20\ImportDirVideo RegKey5=HKCU\Software\Microsoft\MM20\OpenProjectDir RegKey6=HKCU\Software\Microsoft\MM20\Publish Wizard\MRU List RegKey7=HKCU\Software\Microsoft\MM20\Recent Document List [Windows Notepad *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Notepad DetectFile=%LocalAppData%\Packages\Microsoft.WindowsNotepad_* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsNotepad_*\SystemAppData\Helium|User.dat RegKey1=HKCU\Software\Microsoft\Notepad|replaceString RegKey2=HKCU\Software\Microsoft\Notepad|searchString [Windows Notifications *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE FileKey2=%LocalAppData%\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE FileKey3=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog RegKey4=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm [Windows Password Reset Audit *] LangSecRef=3024 DetectFile=%ProgramFiles%\WPRAudit FileKey1=%UserProfile%\Documents|Splash.htm;WPRF.htm [Windows Photo Gallery *] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Photo Gallery RegKey1=HKCU\Software\Microsoft\Windows Photo Gallery\Library\PreviewAssignment\MRU RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|FilenameTemplate RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|RootDirectory RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\DestinationMru RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|FilenameTemplate RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|RootDirectory RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|FilenameTemplate RegKey8=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|RootDirectory [Windows Photo Viewer *] LangSecRef=3025 DetectFile=%AppData%\Microsoft\Windows Photo Viewer FileKey1=%AppData%\Microsoft\Windows Photo Viewer|*.* [Windows Photos *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\microsoft.windows*photos* FileKey1=%LocalAppData%\Packages\microsoft.windows*photos*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Windows*Photos*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Windows*Photos*\LocalState|*.etl;*.sqlite*;*.xml;*.log;*.jpg FileKey4=%LocalAppData%\Packages\microsoft.windows*photos*\LocalState\bici|*.sqm FileKey5=%LocalAppData%\Packages\Microsoft.Windows*Photos*\LocalState\PhotosAppTile|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.Windows*Photos*\Settings|*.log* FileKey7=%LocalAppData%\Packages\Microsoft.Windows*Photos*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedPickerData\Microsoft.Windows.Photos_8wekyb3d8bbwe!App\DefaultSaveFileSingle RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp RegKey3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed RegKey4=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowsphotos_8wekyb3d8bbwe\SearchHistory [Windows Power Efficiency Diagnostics *] LangSecRef=3025 DetectFile=%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics FileKey1=%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics|*.xml ExcludeKey1=FILE|%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics\|energy-report-latest.xml [Windows PowerShell *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\PowerShell FileKey1=%AppData%\Microsoft\Windows\PowerShell\PSReadline|*|RECURSE FileKey2=%LocalAppData%\Microsoft\Windows\PowerShell|ModuleAnalysisCache*;StartupProfileData* FileKey3=%LocalAppData%\Microsoft\Windows\PowerShell\CommandAnalysis|*|RECURSE FileKey4=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*|user.config FileKey5=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*\AutoSaveFiles|*|RECURSE FileKey6=%LocalAppData%\Microsoft_Corporation\PowerShell_ISE.exe_*\*\AutoSaveInformation|*|RECURSE FileKey7=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell|ModuleAnalysisCache*;StartupProfileData* [Windows Printing *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%\Packages\Windows.PrintDialog_*\AC|*|RECURSE FileKey2=%SystemDrive%\spoolerlogs|spooler.xml FileKey3=%WinDir%\System32\spool|spooler.xml FileKey4=%WinDir%\System32\Spool\Printers|* [Windows Program Compatibility Assistant *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant FileKey1=%WinDir%\appcompat\Programs|*.log* RegKey1=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted RegKey2=HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store RegKey3=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|AppCompatCache RegKey4=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|CacheMainSdb RegKey5=HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache|SdbTime RegKey6=HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store [Windows Recent Documents *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows RegKey1=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs RegKey2=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs RegKey3=HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs RegKey4=HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs [Windows Recycle Bin *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%SystemDrive%\$Recycle.Bin|*|RECURSE [Windows Registry Editor *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit RegKey1=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit|LastKey RegKey2=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit|LastKey [Windows Remote Desktop *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Terminal Server Client FileKey1=%UserProfile%\Documents|*.rdp [Windows Retail Demo *] LangSecRef=3025 DetectFile=%ProgramData%\Microsoft\Windows\RetailDemo FileKey1=%ProgramData%\Microsoft\Windows\RetailDemo|*|REMOVESELF [Windows Scan *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsScan_* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsScan_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsScan_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsScan_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.WindowsScan_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsScan_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp [Windows Search *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Search_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalState\AppIconCache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalState\DeviceSearchCache|*.tmp;*.txt FileKey5=%LocalAppData%\Packages\Microsoft.Windows.Search_*\Settings|*.log* FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Search_*\TempState|*|RECURSE FileKey7=%ProgramData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex|*|RECURSE FileKey8=%UserProfile%\Searches|*.search-ms;*.searchconnector-ms RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Bing_8wekyb3d8bbwe\SearchHistory RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Search_*\LocalState\DeviceSearchCache\|SettingsCache.txt [Windows Security *] LangSecRef=3025 Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy Detect3=HKCU\Software\Microsoft\Microsoft Antimalware Detect4=HKLM\Software\Microsoft\Microsoft Antimalware Detect5=HKLM\Software\Microsoft\Windows Defender DetectFile=%ProgramData%\Microsoft\Microsoft antimalware FileKey1=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.AccountsControl_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.AccountsControl_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.AccountsControl_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.AccountsControl_*\TempState|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Apprep.ChxApp_*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Apprep.ChxApp_*\Settings|*.log* FileKey8=%LocalAppData%\Packages\Microsoft.Windows.Apprep.ChxApp_*\TempState|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\AC|*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\LocalCache|*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\Settings|*.log* FileKey12=%LocalAppData%\Packages\Microsoft.Windows.SecHealthUI_*\TempState|*|RECURSE FileKey13=%ProgramData%\Microsoft\*\network inspection system\Support|*.txt;*.log;NisLog.txt.bak FileKey14=%ProgramData%\Microsoft\*\Scans\History\Service|*.log|RECURSE FileKey15=%ProgramData%\Microsoft\Microsoft Antimalware\LocalCopy|*|RECURSE FileKey16=%ProgramData%\Microsoft\Microsoft antimalware\scans\history\results\Quick|*|REMOVESELF FileKey17=%ProgramData%\Microsoft\Microsoft antimalware\scans\history\results\resource|*|REMOVESELF FileKey18=%ProgramData%\Microsoft\Microsoft antimalware\scans\history\results\System|*|REMOVESELF FileKey19=%ProgramData%\Microsoft\Microsoft antimalware\support|*.log;*.txt FileKey20=%ProgramData%\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log FileKey21=%ProgramData%\Microsoft\Windows Defender\Definition Updates\Backup|* FileKey22=%ProgramData%\Microsoft\Windows Defender\LocalCopy|*|RECURSE FileKey23=%ProgramData%\Microsoft\Windows Defender\Scans\BackupStore|*|RECURSE FileKey24=%ProgramData%\Microsoft\Windows Defender\Scans\History\CacheManager|*|RECURSE FileKey25=%ProgramData%\Microsoft\Windows Defender\scans\history\results\Quick|*|REMOVESELF FileKey26=%ProgramData%\Microsoft\Windows Defender\scans\history\results\resource|*|REMOVESELF FileKey27=%ProgramData%\Microsoft\Windows Defender\scans\history\results\System|*|REMOVESELF FileKey28=%ProgramData%\Microsoft\Windows Defender\Scans\History\Store|* FileKey29=%ProgramData%\Microsoft\Windows Defender\Scans\MetaStore|*|RECURSE FileKey30=%ProgramData%\Microsoft\Windows Defender\Scans\RtSigs\Data|*|RECURSE FileKey31=%ProgramData%\Microsoft\Windows Defender\Support|*|RECURSE FileKey32=%ProgramData%\Microsoft\Windows Defender\support|*.log;*.txt FileKey33=%SystemDrive%\Documents and Settings\NetworkService*\Temp|MpCmdRun.log FileKey34=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Temp|MpCmdRun.log RegKey1=HKLM\Software\Microsoft\Windows NT\CurrentVersion\SecEdit|LastUsedDatabase RegKey2=HKU\.DEFAULT\Software\Classes\Local Settings\MrtCache [Windows Settings *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\windows.immersivecontrolpanel_* FileKey1=%LocalAppData%\Packages\windows.immersivecontrolpanel_*|AC\*|RECURSE FileKey2=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\LocalState\Cache|*|RECURSE FileKey3=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\LocalState\navigationHistory|*|RECURSE FileKey4=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\TempState|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SearchHistory [Windows Shell - Folder View Settings *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags RegKey3=HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU RegKey4=HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags RegKey5=HKCU\Software\Microsoft\Windows\Shell\BagMRU RegKey6=HKCU\Software\Microsoft\Windows\Shell\Bags RegKey7=HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU RegKey8=HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags ExcludeKey1=REG|HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders ExcludeKey2=REG|HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders ExcludeKey3=REG|HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop ExcludeKey4=REG|HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\AllFolders [Windows Shell - Theme Colors History *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors [Windows Shell *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%|IconCache.db;IconCache.db.backup FileKey2=%LocalAppData%\Microsoft\Windows\Explorer|*.db FileKey3=%LocalAppData%\Microsoft\Windows\Explorer\IconCacheToDelete|*.tmp FileKey4=%LocalAppData%\Packages\InputApp_*\AC|*|RECURSE FileKey5=%LocalAppData%\Packages\InputApp_*\LocalCache|*|RECURSE FileKey6=%LocalAppData%\Packages\InputApp_*\Settings|*.log* FileKey7=%LocalAppData%\Packages\InputApp_*\TempState|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\LocalCache|*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\Settings|*.log* FileKey11=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\TempState|*|RECURSE FileKey12=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer|ExplorerStartupLog.etl RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer|ScreenshotIndex RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached RegKey5=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts RegKey6=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached [Windows Signature Verification *] LangSecRef=3025 DetectFile=%WinDir%|SIGVERIF.TXT FileKey1=%WinDir%|SIGVERIF.TXT [Windows Snip & Sketch *] LangSecRef=3025 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.*\TempState\ScreenClip|* RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\AppSnipAndSketchFileSaveSettings|LastLocation RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\DefaultOpenFileSingle|LastLocation [Windows Start Menu *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH FileKey1=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_*\TempState|*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCache RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCacheSMP RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2|ProgramsCacheTBP RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC RegKey6=HKLM\Software\Microsoft\Windows\CurrentVersion\UFH\ARP RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache RegKey8=HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage|ProgramsCache [Windows Subsystems *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%\Microsoft\Windows Sidebar\Cache|*|RECURSE FileKey2=%LocalAppData%\Microsoft\Windows\AppCache|*|RECURSE FileKey3=%LocalAppData%\Microsoft\Windows\SettingSync\metastore|*.jrs FileKey4=%LocalAppData%\Microsoft\Windows\SettingSync\remotemetastore\*|*.jrs FileKey5=%LocalAppData%\Microsoft\Windows\WebCache|*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\LocalCache|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\LocalState\Cache|*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\Settings|*.log* FileKey10=%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_*\TempState|*|RECURSE FileKey11=%ProgramData%\Microsoft\RAC\PublishedData|*.log;*.jrs FileKey12=%ProgramData%\Microsoft\RAC\StateData|*.log;*.jrs FileKey13=%ProgramData%\Microsoft\RAC\Temp|* FileKey14=%ProgramData%\Microsoft\Windows\DeviceMetadataCache\dmrccache.bak|*|REMOVESELF FileKey15=%ProgramData%\Microsoft\Windows\Sqm\Manifest|*.bin FileKey16=%ProgramData%\Microsoft\Windows\Sqm\Sessions|*.psqm;*.sqm FileKey17=%SystemDrive%\Documents and Settings\LocalService\Application Data\PeerNetworking|*|RECURSE FileKey18=%UserProfile%\Documents\Remote Assistance Logs|*.xml FileKey19=%WinDir%\$regcmp$|*|REMOVESELF FileKey20=%WinDir%\ehome|PRDMOWrapper.log FileKey21=%WinDir%\msdownld.tmp|*|REMOVESELF FileKey22=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows|qwavecache.dat FileKey23=%WinDir%\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking|*|RECURSE FileKey24=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\PeerDist*|*.chk;*.jrs FileKey25=%WinDir%\System32|PRDMOWrapper.log;qwavecache.dat FileKey26=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads|*.tmp FileKey27=%WinDir%\System32\config\systemprofile\AppData\Local\tw-*.tmp|empty.check|REMOVESELF FileKey28=%WinDir%\System32\sru|*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache RegKey2=HKCU\Software\Classes\MIME\Database\Content Type RegKey3=HKCU\Software\Local AppWizard-Generated Applications RegKey4=HKCU\Software\Microsoft\Keyboard\Native Media Players RegKey5=HKCU\Software\Microsoft\Windows\Shell\MUICache RegKey6=HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache RegKey7=HKLM\Software\Microsoft\ESENT\Process RegKey8=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders|Folder RegKey9=HKLM\Software\Microsoft\Windows\CurrentVersion\Setup|Installation Sources RegKey10=HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders|Folder ExcludeKey1=PATH|%LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost*\AC\TokenBroker\Accounts\|*.tbacct* [Windows System Assessment Tool *] LangSecRef=3025 DetectFile=%WinDir%\Performance\WinSAT FileKey1=%WinDir%\Performance\WinSAT|*|REMOVESELF [Windows Task Scheduler *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%WinDir%\System32\Tasks_Migrated|*|REMOVESELF [Windows Taskbar *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%AppData%\Microsoft\Windows\Recent|*.URL|RECURSE FileKey2=%AppData%\Microsoft\Windows\Recent\AutomaticDestinations|*|RECURSE FileKey3=%AppData%\Microsoft\Windows\Recent\CustomDestinations|*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband|FavoritesChanges ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\|f01b4d95cf55d32a.automaticDestinations-ms [Windows Temporary Files *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows FileKey1=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temp|*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temp|*|RECURSE FileKey3=%Temp%|*|RECURSE FileKey4=%WinDir%\ServiceProfiles\*\AppData\Local\Temp|*|RECURSE FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp|*|RECURSE FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Temp|*|RECURSE FileKey7=%WinDir%\SystemTemp|*|RECURSE FileKey8=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Temp|*|RECURSE FileKey9=%WinDir%\TEMP|*|RECURSE [Windows Update *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%LocalAppData%\Microsoft\Windows\Windows Anytime Upgrade|Upgrade.log FileKey2=%LocalAppData%\MigWiz|*|REMOVESELF FileKey3=%LocalAppData%\Packages\MicrosoftWindows.Client*\AC|*|RECURSE FileKey4=%LocalAppData%\Packages\MicrosoftWindows.Client*\LocalCache|*|RECURSE FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client*\LocalState\EBWebview\Default\Service Worker\CacheStorage\*|*|RECURSE FileKey7=%LocalAppData%\Packages\MicrosoftWindows.Client*\Settings|*.log* FileKey8=%LocalAppData%\Packages\MicrosoftWindows.Client*\TempState|*|RECURSE FileKey9=%ProgramData%\USOShared\Logs|*.etl|RECURSE FileKey10=%ProgramFiles%\CUAssistant\Logs|*.etl FileKey11=%ProgramFiles%\Microsoft Update Health Tools\Logs|* FileKey12=%ProgramFiles%\rempl\Logs|*.etl FileKey13=%ProgramFiles%\WindowsInstallationAssistant\Logs|* FileKey14=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache|*|RECURSE FileKey15=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs|*|RECURSE FileKey16=%WinDir%\SoftwareDistribution\DataStore\Logs|*|RECURSE FileKey17=%WinDir%\System32\MRT\*|*.log|REMOVESELF [Windows Voice Recorder *] LangSecRef=3025 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_* FileKey1=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC|*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalCache|*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalState\Cache|*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\Settings|*.log* FileKey5=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\TempState|*|RECURSE [Windows Volume Mixer *] LangSecRef=3025 Detect=HKCU\Software\Microsoft RegKey1=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore [Windows XP Add/Remove Programs *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache [Windows XP Driver Reinstall Backups *] LangSecRef=3025 DetectFile=%WinDir%\System32\ReinstallBackups FileKey1=%WinDir%\System32\ReinstallBackups|*|RECURSE [Windows XP Help and Support Center *] LangSecRef=3025 Detect=HKCR\AppID\HelpCtr.EXE FileKey1=%LocalAppData%\Microsoft\HelpCtr|HelpSessionHistory.dat [Windscribe VPN *] LangSecRef=3022 DetectFile=%ProgramFiles%\Windscribe FileKey1=%LocalAppData%\Windscribe\Windscribe|*.log;*log.txt FileKey2=%ProgramFiles%\Windscribe|*.log FileKey3=%ProgramFiles%\Windscribe\log|*.*|RECURSE [Winemaker Extraordinaire *] Section=Games DetectFile=%AppData%\UClick\Winemaker Extraordinaire FileKey1=%AppData%\UClick\Winemaker Extraordinaire|logfile.txt [WinExt Registry Fixer *] LangSecRef=3024 DetectFile=%AppData%\TSS\WERF FileKey1=%AppData%\TSS\WERF|REG_POINT_*.reg [WinGate Proxy Server *] LangSecRef=3021 Detect=HKCU\Software\Qbik Software\GateKeeper DetectFile=%ProgramFiles%\WinGate FileKey1=%ProgramFiles%\WinGate|*Log.txt;*.log|RECURSE FileKey2=%ProgramFiles%\WinGate\Logs\Global|*.idx [WinGuides Tweak Manager *] LangSecRef=3024 Detect=HKCU\Software\WinGuides\WinGuides Tweak Manager RegKey1=HKCU\Software\WinGuides\WinGuides Tweak Manager\Settings|RecentTweaks [WinHasher *] LangSecRef=3024 Detect=HKCU\Software\GPF Comics\WinHasher RegKey1=HKCU\Software\GPF Comics\WinHasher|LastDirectory [WinHTTrack *] LangSecRef=3022 Detect=HKCU\Software\WinHTTrack Website Copier FileKey1=%ProgramFiles%\WinHTTrack|winhttrack.log RegKey1=HKCU\Software\WinHTTrack Website Copier\WinHTTrack Website Copier\Recent File List [WinImage *] LangSecRef=3024 Detect=HKCU\Software\WinImage RegKey1=HKCU\Software\WinImage|File1 RegKey2=HKCU\Software\WinImage|File2 RegKey3=HKCU\Software\WinImage|File3 RegKey4=HKCU\Software\WinImage|File4 RegKey5=HKCU\Software\WinImage|File5 RegKey6=HKCU\Software\WinImage|File6 RegKey7=HKCU\Software\WinImage|File7 RegKey8=HKCU\Software\WinImage|File8 RegKey9=HKCU\Software\WinImage|File9 RegKey10=HKCU\Software\WinImage|PathExtract [winLAME *] LangSecRef=3023 DetectFile=%LocalAppData%\winLAME FileKey1=%LocalAppData%\winLAME\CrashDumps|*.mdmp [WinMerge *] LangSecRef=3024 Detect=HKCU\Software\Thingamahoochie\WinMerge\Files RegKey1=HKCU\Software\Thingamahoochie\WinMerge\Files\Ext RegKey2=HKCU\Software\Thingamahoochie\WinMerge\Files\Left RegKey3=HKCU\Software\Thingamahoochie\WinMerge\Files\Option RegKey4=HKCU\Software\Thingamahoochie\WinMerge\Files\Right [WinMount *] LangSecRef=3024 Detect=HKCU\Software\WinMount Applications\WinMount FileKey1=%AppData%\WinMount|*.dat RegKey1=HKCU\Software\WinMount Applications\WinMount\Recent File List [WinPcap *] LangSecRef=3022 Detect=HKLM\Software\WinPcap FileKey1=%ProgramFiles%\WinPcap|*.log [WinRAR *] LangSecRef=3024 Detect=HKCU\Software\WinRAR FileKey1=%ProgramFiles%\WinRAR|*.tmp;*.diz|RECURSE RegKey1=HKCU\Software\WinRAR SFX RegKey2=HKCU\Software\WinRAR\DialogEditHistory RegKey3=HKCU\Software\WinRAR\General\Info|CommentFile [WinRemote *] LangSecRef=3021 DetectFile=%ProgramData%\Banamalon\WinRemoteService FileKey1=%ProgramData%\Banamalon\WinRemoteService\log|* [WinSetupFromUSB *] LangSecRef=3024 DetectFile1=%ProgramFiles%\WinSetupFromUSB DetectFile2=%SystemDrive%\WinSetupFromUSB FileKey1=%ProgramFiles%\WinSetupFromUSB|*.log|RECURSE FileKey2=%SystemDrive%\WinSetupFromUSB|*.log|RECURSE [WinSweeper *] LangSecRef=3024 Detect=HKCU\Software\WinSweeper2 RegKey1=HKCU\Software\WinSweeper2|LastScan [WinSysClean *] LangSecRef=3024 DetectFile=%ProgramFiles%\WinSysClean* FileKey1=%ProgramFiles%\WinSysClean *|*.log;*scanlog.dat;RegBackup.reg [WinThruster *] LangSecRef=3024 Detect=HKCU\Software\WinThruster DetectFile=%AppData%\WinThruster FileKey1=%AppData%\WinThruster\Backup|*.* FileKey2=%AppData%\WinThruster\Log|*.* FileKey3=%AppData%\WinThruster\Undo|*.* RegKey1=HKCU\Software\WinThruster|InstallerName RegKey2=HKCU\Software\WinThruster|LastScanDate RegKey3=HKCU\Software\WinThruster|SizeToClean [WinTK *] LangSecRef=3024 DetectFile=%UserProfile%\Documents\WinTK FileKey1=%UserProfile%\Documents\WinTK|ExLog.txt [WinTools.net *] LangSecRef=3024 DetectFile1=%ProgramFiles%\Godlike Developers\WinTools.net* DetectFile2=%ProgramFiles%\WinTools Software\WinTools.net* FileKey1=%ProgramFiles%\Godlike Developers\WinTools.net*|*.txt;*.url FileKey2=%ProgramFiles%\Godlike Developers\WinTools.net*\Undo|*.reg|RECURSE FileKey3=%ProgramFiles%\WinTools Software\WinTools.net*|*.txt FileKey4=%ProgramFiles%\WinTools Software\WinTools.net*\Undo|*.reg|RECURSE [WinToUSB *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinToUSB_is1 FileKey1=%ProgramFiles%\WinToUSB\bin|*.log [WinX DVD Author *] LangSecRef=3023 DetectFile=%ProgramFiles%\Digiarty\WinX DVD Author* FileKey1=%ProgramFiles%\Digiarty\WinX DVD Author*\Temp|*.* [WinX DVD Ripper Platinum *] LangSecRef=3023 DetectFile=%AppData%\Digiarty\WinX DVD Ripper Platinum FileKey1=%AppData%\Digiarty\WinX DVD Ripper Platinum|*.log;*.tmp [WinX YouTube Downloader *] LangSecRef=3023 DetectFile1=%AppData%\Digiarty\WinX YouTube Downloader DetectFile2=%AppData%\WinX YouTube Downloader FileKey1=%AppData%\Digiarty\WinX YouTube Downloader|*.jpg FileKey2=%AppData%\WinX YouTube Downloader|Error File.*;log.txt [WinZip *] LangSecRef=3024 Detect=HKCU\Software\Nico Mak Computing\WinZip DetectFile=%LocalAppData%\Nico Mak Computing\WinZip Update Notifier FileKey1=%LocalAppData%\Nico Mak Computing\WinZip Update Notifier\log|log-*.txt FileKey2=%LocalAppData%\WinZip\SyncHelper\MRU|WinZip_MRU.roaming FileKey3=%LocalAppData%\WinZip\WinZip Update Notifier\Log|*.* RegKey1=HKCU\Software\Nico Mak Computing\WinZip\Mru [WinZip Privacy Protector *] LangSecRef=3024 DetectFile=%LocalAppData%\WinZipPrivacyProtector FileKey1=%LocalAppData%\WinZipPrivacyProtector|*.log;*.tmp;log.rtf;report.txt;WebCache*.dat;WebCache*.jfm [WinZip Registry Optimizer *] LangSecRef=3024 DetectFile1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer DetectFile2=%ProgramFiles%\WinZip Registry Optimizer FileKey1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer\*|log*.* FileKey2=%ProgramFiles%\WinZip Registry Optimizer\Backups|*.* [Wipe *] LangSecRef=3024 Detect=HKLM\Software\privacyroot.com\wipe DetectFile=%AppData%\Wipe* FileKey1=%AppData%\Wipe*|found_apps.paths;apps_sorting.titles;StatsDates.txt FileKey2=%AppData%\Wipe*\AutoExclude|*.txt FileKey3=%AppData%\Wipe*\Temp\CachedImages|*.png RegKey1=HKLM\Software\privacyroot.com\wipe|SETUP-EXE [Wire *] LangSecRef=3022 DetectFile=%LocalAppData%\wire FileKey1=%AppData%\Wire\*Cache|*.* FileKey2=%AppData%\Wire\Service Worker|*.*|REMOVESELF [Wirecast *] LangSecRef=3023 DetectFile=%AppData%\Wirecast FileKey1=%AppData%\Wirecast|*.txt [Wireshark *] LangSecRef=3024 DetectFile=%ProgramFiles%\Wireshark FileKey1=%AppData%\Wireshark\plugins\cloudshark\tmp|*.* FileKey2=%ProgramFiles%\Wireshark|*Setup*.exe;npcap-*.exe [Wise Care 365 *] LangSecRef=3024 Detect=HKLM\Software\WiseCleaner\WiseCare365 FileKey1=%AppData%\Wise Care 365|Errorlog.txt;FailToRemove.dat [Wise Video/YouTube Downloader *] LangSecRef=3023 Detect1=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wise Video Downloader_is1 Detect2=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wise Youtube Downloader_is1 DetectFile1=%ProgramFiles%\Wise\Wise Video Downloader DetectFile2=%ProgramFiles%\Wise\Wise YouTube Downloader FileKey1=%AppData%\Wise * Downloader|DownloadList.ini;FileListConfig.ini FileKey2=%SystemDrive%|urlinfo.txt FileKey3=%SystemDrive%\ThumbnailCache|*.* [WiseVector StopX *] LangSecRef=3024 DetectFile=%ProgramFiles%\WiseVector FileKey1=%ProgramFiles%\WiseVector\log|*.log [Wistron Launch Manager *] LangSecRef=3024 Detect=HKLM\Software\Wistron Corp\Launch Manager FileKey1=%ProgramFiles%\Launch Manager|*.log [Wizards of the Coast *] Section=Games DetectFile=%UserProfile%\AppData\LocalLow\Wizards of the Coast FileKey1=%UserProfile%\AppData\LocalLow\Wizards of the Coast\mtga|*_log.txt [WM Recorder *] LangSecRef=3023 DetectFile=%ProgramFiles%\WM Recorder* FileKey1=%ProgramFiles%\WM Recorder*|log.txt;urls.txt [Wolfenstein: MP *] Section=Games DetectFile=%LocalAppData%\id Software\WolfMP FileKey1=%LocalAppData%\id Software\WolfMP|*.log|RECURSE [WolfQuest *] Section=Games Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9E6AD6CF-1EFF-43E4-86C4-5C00254C3D8E} FileKey1=%ProgramFiles%\WolfQuest|*.txt|RECURSE ExcludeKey1=FILE|%ProgramFiles%\WolfQuest\|Help.txt [Wondershare *] LangSecRef=3021 Detect=HKLM\Software\Wondershare FileKey1=%AppData%\se_tmp*|*|REMOVESELF FileKey2=%ProgramData%\Wondershare\*\*Log*|*|RECURSE FileKey3=%ProgramData%\Wondershare\WAF\ProductFeatures\*Logs|*|RECURSE FileKey4=%Public%\Documents\Wondershare|*|REMOVESELF [Wondershare AllMyTube *] LangSecRef=3022 Detect=HKLM\Software\Wondershare\Wondershare AllMyTube FileKey1=%AppData%\Wondershare AllMyTube|*.*|RECURSE FileKey2=%ProgramData%\Wondershare AllMyTube\ConvertedLibPic|*|RECURSE FileKey3=%ProgramData%\Wondershare Application Common Data\Download|*.bak;*.xml FileKey4=%ProgramData%\Wondershare Application Common Data\Download\MediaLibPic|*|RECURSE FileKey5=%ProgramData%\Wondershare Application Common Data\Download\SiteLogo|*|RECURSE FileKey6=%ProgramData%\Wondershare Application Common Data\Download\TempThumbDir|*|RECURSE FileKey7=%ProgramData%\Wondershare\AllMyTube|*.bak;*.xml FileKey8=%ProgramFiles%\Wondershare\AllMyTube\Log|*|RECURSE [Wondershare Dr.Fone *] LangSecRef=3021 DetectFile=%ProgramFiles%\Wondershare\Wondershare Dr.Fone FileKey1=%AppData%\DataEraser_Temp|*.*|RECURSE FileKey2=%ProgramData%\Wondershare\dr.fone\Wondershare_DataEraser_Clean|*|RECURSE FileKey3=%ProgramData%\Wondershare\DriverInstall|*.log FileKey4=%ProgramData%\Wondershare\WSRoot|*.tmp FileKey5=%ProgramData%\WsAppHelper\Dr.Fone|*.log FileKey6=%ProgramFiles%\Wondershare\dr.fone\ThumbnailCache|*|RECURSE FileKey7=%ProgramFiles%\Wondershare\MirrorGo\Log|*|RECURSE [Wondershare DVD Creator *] LangSecRef=3023 DetectFile=%UserProfile%\Documents\Wondershare DVD Creator FileKey1=%UserProfile%\Documents\Wondershare DVD Creator\log|log*.txt [Wondershare Filmora *] LangSecRef=3023 Detect1=HKLM\Software\Wondershare\Wondershare Filmora Detect2=HKLM\Software\Wondershare\Wondershare FilmoraPro FileKey1=%ProgramFiles%\Wondershare\Wondershare Filmora\log|*.*|RECURSE FileKey2=%UserProfile%\Documents\Wondershare Filmora\Temp|*.*|RECURSE [Wondershare Helper Compact *] LangSecRef=3021 Detect=HKLM\Software\Wondershare\Wondershare Helper Compact FileKey1=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact|ProductUpdateLists.xml;WSHelper*.exe_temp FileKey2=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\DATADICT|*.*|RECURSE FileKey3=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\Log|*.*|RECURSE FileKey4=%CommonProgramFiles%\Wondershare\Wondershare Helper Compact\Temp|*.*|RECURSE [Wondershare MobileGo *] LangSecRef=3021 Detect=HKCU\Software\Wondershare\MobileGo DetectFile=%AppData%\Wondershare\MobileGo for iOS FileKey1=%AppData%\Wondershare\*Go*|*.log FileKey2=%AppData%\Wondershare\DataEraser|*.log FileKey3=%AppData%\Wondershare\Dr.FoneTool\log|*.log FileKey4=%AppData%\Wondershare\DrFoneAndroidTool\log|*.log FileKey5=%AppData%\Wondershare\MirrorGo\ImageCache\ADImage|*.*|RECURSE FileKey6=%AppData%\Wondershare\MobileGo\DeviceImageCache|*.*|RECURSE FileKey7=%AppData%\Wondershare\MobileGo\iOSTemp|*.*|REMOVESELF FileKey8=%AppData%\Wondershare\MobileGo\Logs\DeviceConnection|*.*|RECURSE FileKey9=%AppData%\Wondershare\MobileTransTool|*.log FileKey10=%AppData%\Wondershare\WsRoot\Logs|*.*|RECURSE FileKey11=%ProgramData%\Wondershare\Dr.FoneTool\Log|*.txt FileKey12=%ProgramFiles%\Wondershare\MobileGo|*.log [Wondershare PDF Editor *] LangSecRef=3021 Detect=HKLM\Software\Wondershare\Wondershare PDF Editor FileKey1=%AppData%\Wondershare\PDF Editor|HistoryDatas.dat FileKey2=%AppData%\Wondershare\PDF Editor\Log|*.log [Wondershare Recoverit *] LangSecRef=3024 DetectFile=%ProgramData%\Wondershare\Recoverit* FileKey1=%ProgramData%\Wondershare\Recoverit*\dataSDK|tmp;*.bak;*.log FileKey2=%ProgramData%\Wondershare\Recoverit*\WGPSDK|*.log [Wondershare Repairit *] LangSecRef=3024 DetectFile=%ProgramFiles%\Wondershare\Repairit FileKey1=%ProgramData%\Wondershare\Repairit\*SDK|*.bak;*.log;tmp FileKey2=%ProgramFiles%\Wondershare\Repairit\log|* [Wondershare SafeEraser *] LangSecRef=3021 Detect=HKLM\Software\Wondershare\SafeEraser FileKey1=%AppData%\HMYGSetting|*.*|REMOVESELF FileKey2=%AppData%\HYXDevPsnList|*.*|REMOVESELF FileKey3=%AppData%\Wondershare\SafeEraser|*.log FileKey4=%AppData%\Wondershare\SafeEraser\Logs\DeviceConnection|*.*|RECURSE FileKey5=%AppData%\Wondershare\SafeEraser\Logs\iOSTemp|*.*|RECURSE FileKey6=%ProgramFiles%\Wondershare\SafeEraser\se_tmp_win|*.*|REMOVESELF FileKey7=%SystemDrive%\se_tmp|*.*|REMOVESELF [Wondershare UniConverter *] LangSecRef=3023 Detect1=HKLM\Software\Wondershare\Wondershare UniConverter Detect2=HKLM\Software\Wondershare\Wondershare UniConverter 13 FileKey1=%ProgramData%\Wondershare\UniConverter*\DataTrack|tmp;*.bak;*.log FileKey2=%ProgramData%\Wondershare\UniConverter*\TempThumbDir|*|RECURSE FileKey3=%ProgramData%\Wondershare\UniConverter*\UpdatePackge|*|RECURSE FileKey4=%ProgramFiles%\Wondershare\*UniConverter*\Log|*|RECURSE FileKey5=%SystemDrive%|logWSVCUUpdateHelper.log FileKey6=%SystemDrive%\Wondershare UniConverter\Downloaded\temp|*|REMOVESELF [Wondershare Video Converter *] LangSecRef=3023 DetectFile1=%ProgramFiles%\Wondershare Video Converter* DetectFile2=%ProgramFiles%\Wondershare\Video Converter* FileKey1=%ProgramData%\Wondershare MediaServer|*.txt FileKey2=%ProgramData%\Wondershare Video Converter*|*.dat.bak FileKey3=%ProgramData%\Wondershare Video Converter*\Temp*Dir|*|RECURSE FileKey4=%ProgramFiles%\Wondershare Video Converter*\Log|*|RECURSE FileKey5=%ProgramFiles%\Wondershare Video Converter*\Temp*Dir|*|RECURSE FileKey6=%ProgramFiles%\Wondershare\Video Converter*\Log|*|RECURSE FileKey7=%ProgramFiles%\Wondershare\Video Converter*\Output|Thumbnail.dat FileKey8=%ProgramFiles%\Wondershare\Video Converter*\Transfer\MultimediaLibs\Log|* FileKey9=%SystemDrive%|logWSVCUUpdateHelper.log FileKey10=%UserProfile%\Documents\Wondershare MediaServer\log|*|RECURSE [Wondershare Video Editor *] LangSecRef=3023 DetectFile=%ProgramData%\Wondershare Video Editor FileKey1=%ProgramData%\Wondershare Video Editor\Resources|Favorites.xml [Wordweb *] LangSecRef=3021 Detect=HKCU\Software\WordWeb FileKey1=%AppData%\WordWeb|History.txt [World of Warcraft *] Section=Games Detect=HKCU\Software\Blizzard Entertainment\World of Warcraft FileKey1=%ProgramFiles%\World of Warcraft|*.bak;*.old|RECURSE FileKey2=%ProgramFiles%\World of Warcraft\_*_\Logs|*.* FileKey3=%ProgramFiles%\World of Warcraft\Cache|*.*|REMOVESELF FileKey4=%ProgramFiles%\World of Warcraft\Errors|*.*|REMOVESELF FileKey5=%ProgramFiles%\World of Warcraft\Logs|*.* FileKey6=%Public%\games\World of Warcraft|*.bak;*.old|RECURSE FileKey7=%Public%\Games\World of Warcraft\Cache|*.*|REMOVESELF FileKey8=%Public%\Games\World of Warcraft\Errors|*.*|REMOVESELF FileKey9=%Public%\Games\World of Warcraft\Logs|*.* FileKey10=%SystemDrive%\World of Warcraft|*.bak;*.old|RECURSE FileKey11=%SystemDrive%\World of Warcraft\Cache|*.*|REMOVESELF FileKey12=%SystemDrive%\World of Warcraft\Errors|*.*|REMOVESELF FileKey13=%SystemDrive%\World of Warcraft\Logs|*.* [WorldWide Telescope *] LangSecRef=3021 Detect=HKCU\Software\Classes\WorldWideTelescope.wtml FileKey1=%LocalAppData%\Microsoft\WorldWideTelescope\dem|*.*|RECURSE FileKey2=%LocalAppData%\Microsoft\WorldWideTelescope\Imagery|*.*|RECURSE FileKey3=%LocalAppData%\Microsoft\WorldWideTelescope\tourcache|*.*|RECURSE [Wowhead Client *] Section=Games Detect=HKCU\Software\Wowhead\WowHead Client FileKey1=%ProgramData%\wowhead\wowhead client\cache|*|REMOVESELF FileKey2=%ProgramData%\wowhead\wowhead client\log|*|REMOVESELF RegKey1=HKCU\Software\Wowhead\WowHead Client|Statistics [WRAL Desktop Alert *] LangSecRef=3024 DetectFile=%ProgramFiles%\WRAL Desktop Alert FileKey1=%ProgramFiles%\WRAL Desktop Alert|*.log [WS FTP Pro *] LangSecRef=3022 Detect=HKCU\Software\Ipswitch\WS_FTP FileKey1=%AppData%\Ipswitch\WS_FTP\Logs|*.* [wufuc *] LangSecRef=3024 DetectFile=%ProgramData%\wufuc FileKey1=%ProgramData%\wufuc|*.log [X-NetStat *] LangSecRef=3024 DetectFile=%AppData%\X-NetStat* FileKey1=%AppData%\X-NetStat*|*.exe FileKey2=%AppData%\X-NetStat*\Logs|*.* [X-Ways WinHex *] LangSecRef=3024 DetectFile=%LocalAppData%\X-Ways\WinHex FileKey1=%LocalAppData%\X-Ways\WinHex|*log.txt [Xara Photo & Graphic Designer *] LangSecRef=3023 Detect=HKCU\Software\Xara\Xtreme_SE FileKey1=%LocalAppData%\Xara\Xtreme\9.2\Backups|*.*|RECURSE FileKey2=%LocalAppData%\Xara\Xtreme_SE\6.1\Backups|*.txt RegKey1=HKCU\Software\Xara\Xtreme\9.2\Options\Recent File List RegKey2=HKCU\Software\Xara\Xtreme_SE\6.1\Options\Recent File List RegKey3=HKCU\Software\Xara\Xtreme_SE\6.1\Workspace [Xara WebDesigner *] LangSecRef=3024 Detect=HKCU\Software\Xara\WebDesigner RegKey1=HKCU\Software\Xara\WebDesigner\8.0\Workspace\MDI [Xara WebDesigner Backups *] LangSecRef=3024 Detect=HKCU\Software\Xara\WebDesigner FileKey1=%LocalAppData%\Xara\WebDesigner\*\Backups|*.*|RECURSE [Xbox *] Section=Games DetectFile1=%LocalAppData%\Packages\Microsoft.Gaming* DetectFile2=%LocalAppData%\Packages\Microsoft.Xbox* FileKey1=%LocalAppData%\EAConnect_microsoft\Cache|*|RECURSE FileKey2=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default|Network Persistent State;Visited Links FileKey3=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default\GPUCache|* FileKey4=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default\Platform Notifications|* FileKey5=%LocalAppData%\EAConnect_microsoft\QtWebEngine\Default\Session Storage|*.old;LOG FileKey6=%LocalAppData%\Packages\Microsoft.Gaming*\AC|*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Gaming*\LocalCache|*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.Gaming*\LocalState|*log*;asyncache.db|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.Gaming*\Settings|*.log* FileKey10=%LocalAppData%\Packages\Microsoft.Gaming*\TempState|*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.Xbox*\AC|*|RECURSE FileKey12=%LocalAppData%\Packages\Microsoft.Xbox*\LocalCache|*|RECURSE FileKey13=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState|*.log*|RECURSE FileKey14=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\*Cache|*|RECURSE FileKey15=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\DiagOutputDir|*.txt FileKey16=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\navigationHistory|*|RECURSE FileKey17=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\PlayReady|*|RECURSE FileKey18=%LocalAppData%\Packages\Microsoft.Xbox*\LocalState\SmartGlass|*.log FileKey19=%LocalAppData%\Packages\Microsoft.Xbox*\Settings|*.log* FileKey20=%LocalAppData%\Packages\Microsoft.Xbox*\TempState|*|RECURSE FileKey21=%ProgramData%\Microsoft\Windows\WindowsApps\Microsoft.GamingServices*\Cache|*|REMOVESELF FileKey22=%WinDir%\System32\config\systemprofile\AppData\Local\Packages\Microsoft.GamingServices_8wekyb3d8bbwe\LocalState|*|REMOVESELF RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxLIVEGames_8wekyb3d8bbwe\SearchHistory [XCOM *] Section=Games DetectFile=%UserProfile%\Documents\My Games\XCOM* FileKey1=%UserProfile%\Documents\My Games\XCOM*\XComGame\Logs|*.* [Xenocode Sandbox *] LangSecRef=3021 Detect=HKCU\Software\Xenocode\SandboxCache FileKey1=%LocalAppData%\Xenocode\Sandbox|*.*|REMOVESELF FileKey2=%WinDir%\XSxS|*.*|REMOVESELF RegKey1=HKCU\Software\Xenocode\SandboxCache [Xerox Printer Driver *] LangSecRef=3021 DetectFile=%ProgramData%\Xerox\PrinterDriver FileKey1=%ProgramData%\Xerox\PrinterDriver|*.tmp|RECURSE [Xiaomi *] LangSecRef=3021 DetectFile=%AppData%\Xiaomi FileKey1=%AppData%\Xiaomi\account_auth\log|*.log FileKey2=%AppData%\Xiaomi\miflash_unlock\log|*.log FileKey3=%AppData%\Xiaomi\miflash_unlock\temp|*.tmp;data_*;f_* FileKey4=%AppData%\Xiaomi\miflash_unlock_en\log|*.log FileKey5=%AppData%\Xiaomi\miflash_unlock_en\temp|*.tmp;data_*;f_* FileKey6=%AppData%\Xiaomi\miphonemanager\cache|*.* FileKey7=%AppData%\Xiaomi\miphonemanager\log|*.log|RECURSE FileKey8=%AppData%\Xiaomi\miusbdriver\log|*.log [Xilisoft AVI to DVD Converter *] LangSecRef=3023 DetectFile=%LocalAppData%\Xilisoft\AVI to DVD Converter FileKey1=%LocalAppData%\Xilisoft\AVI to DVD Converter|log_testing.txt [XMind *] LangSecRef=3021 DetectFile=%AppData%\XMind FileKey1=%AppData%\XMind|*.log|RECURSE [XN Resource Editor *] LangSecRef=3024 Detect=HKCU\Software\Woozle\XN Resource Editor RegKey1=HKCU\Software\Woozle\XN Resource Editor\Recent Files [XnView *] LangSecRef=3023 Detect1=HKCU\Software\XnView Detect2=HKLM\Software\XnView FileKey1=%AppData%\XnView\cache|*.db FileKey2=%AppData%\XnViewMP|*.db;category.bak FileKey3=%ProgramFiles%\XnViewMP|category.bak;*.db RegKey1=HKCU\Software\XnView\Start|DirName_0 RegKey2=HKCU\Software\XnView\Start|DirName_1 RegKey3=HKCU\Software\XnView\Start|DirName_2 RegKey4=HKCU\Software\XnView\Start|DirName_3 RegKey5=HKCU\Software\XnView\Start|DirName_4 RegKey6=HKCU\Software\XnView\Start|DirName_5 RegKey7=HKCU\Software\XnView\Start|DirName_6 RegKey8=HKCU\Software\XnView\Start|DirName_7 RegKey9=HKCU\Software\XnView\Start|DirName_8 RegKey10=HKCU\Software\XnView\Start|DirName_9 RegKey11=HKCU\Software\XnView\Start|FileName_0 RegKey12=HKCU\Software\XnView\Start|FileName_1 RegKey13=HKCU\Software\XnView\Start|FileName_2 RegKey14=HKCU\Software\XnView\Start|FileName_3 RegKey15=HKCU\Software\XnView\Start|FileName_4 RegKey16=HKCU\Software\XnView\Start|FileName_5 RegKey17=HKCU\Software\XnView\Start|FileName_6 RegKey18=HKCU\Software\XnView\Start|FileName_7 RegKey19=HKCU\Software\XnView\Start|FileName_8 RegKey20=HKCU\Software\XnView\Start|FileName_9 RegKey21=HKCU\Software\XnView\XnViewMP\Start|customPath RegKey22=HKCU\Software\XnView\XnViewMP\Start|History RegKey23=HKCU\Software\XnView\XnViewMP\Start|PathBrowser RegKey24=HKCU\Software\XnView\XnViewMP\Start|RecentFiles RegKey25=HKCU\Software\XnView\XnViewMP\Strip|list_folder RegKey26=HKCU\Software\XnView\XnViewMP\Viewer|saveFolder [XPhone *] LangSecRef=3021 Detect=HKCU\Software\C4B\Log FileKey1=%LocalAppData%\C4B\Log|*.* [Xplorer2 *] LangSecRef=3024 Detect1=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings Detect2=HKCU\Software\ZabaraKatranemia Plc\xplorer2_UC\MainFrame Settings RegKey1=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings\Folder History RegKey2=HKCU\Software\ZabaraKatranemia Plc\xplorer2\MainFrame Settings\Recent Document List RegKey3=HKCU\Software\ZabaraKatranemia Plc\xplorer2_UC\MainFrame Settings\Folder History RegKey4=HKCU\Software\ZabaraKatranemia Plc\xplorer2_UC\MainFrame Settings\Recent Document List [XPort 360 *] LangSecRef=3021 DetectFile=%AppData%\Datel\XPort 360 FileKey1=%AppData%\Datel\XPort 360\Temp|*.*|REMOVESELF [XPressUpdate *] LangSecRef=3023 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\XPressUpdate.exe FileKey1=%CommonProgramFiles%\XpressUpdate|*.log;*old [XRayz LinkStash *] LangSecRef=3024 Detect=HKCU\Software\XRayz\LinkStash RegKey1=HKCU\Software\XRayz\LinkStash\Recent File List [Xsplit *] LangSecRef=3023 Detect=HKLM\Software\Splitmedialabs\XSplit DetectFile=%ProgramFiles%\SplitmediaLabs\XSplit Broadcaster FileKey1=%AppData%\SplitMediaLabs\XSplit*|*.log|RECURSE FileKey2=%LocalAppData%\SplitMediaLabs\XSplit\*|bwtestlogs.txt FileKey3=%ProgramData%\SplitMediaLabs\XSplit\LocalStore\Temp|* FileKey4=%ProgramData%\SplitMediaLabs\XSplit\Temp|* FileKey5=%ProgramFiles%\SplitmediaLabs\XSplit Broadcaster\x*|*Log.txt [XviD *] LangSecRef=3023 Detect=HKCU\Software\GNU\Xvid RegKey1=HKCU\Software\GNU\Xvid|stats [XWidget *] LangSecRef=3021 DetectFile=%UserProfile%\Documents\XWidget FileKey1=%UserProfile%\Documents\XWidget\Backup|*.*|RECURSE FileKey2=%UserProfile%\Documents\XWidget\Cache|*.*|RECURSE [XYplorer *] LangSecRef=3024 DetectFile=%AppData%\XYplorer FileKey1=%AppData%\XYplorer|xyerrorlog-*.txt [YACReader *] LangSecRef=3021 DetectFile=%LocalAppData%\YACReader\YACReader* FileKey1=%LocalAppData%\YACReader\YACReader*|yacreader*.log [Yahoo Autosync *] LangSecRef=3022 Detect=HKCU\Software\Yahoo!\Autosync for Yahoo! FileKey1=%ProgramFiles%\Yahoo!\Yahoo! Autosync\Logs|*.* [Yet Another Cleaner! *] LangSecRef=3024 DetectFile1=%AppData%\Elex-Tech\Yac DetectFile2=%ProgramFiles%\iSafe FileKey1=%AppData%\eCyber\sysicons|*.ico FileKey2=%AppData%\Elex-Tech\Yac\log|*.* FileKey3=%AppData%\Elex-Tech\Yac\log_bak|*.* FileKey4=%AppData%\iSafe\ico|*.ico FileKey5=%AppData%\iSafe\log|*.log FileKey6=%ProgramFiles%\iSafe\log|.log;*.zip FileKey7=%ProgramFiles%\iSafe\tws|*log.txt FileKey8=%ProgramFiles%\iSafe\tws\logs|*.log [Your Freedom VPN *] LangSecRef=3022 DetectFile=%ProgramFiles%\Your Freedom FileKey1=%LocalAppData%\Your Freedom|*.old [YouTube-DL *] LangSecRef=3024 DetectFile=%UserProfile%\.cache\youtube-dl FileKey1=%UserProfile%\.cache\youtube-dl|*.*|RECURSE [YouTubeByClick *] LangSecRef=3022 DetectFile=%AppData%\YouTubeByClick FileKey1=%AppData%\YouTubeByClick|History.ytb [YPOPs *] LangSecRef=3021 DetectFile=%ProgramFiles%\YPOPs FileKey1=%ProgramFiles%\YPOPs|ypops.log [yWriter *] LangSecRef=3021 DetectFile=%AppData%\Spacejock Software\yWriter* FileKey1=%AppData%\Spacejock Software\yWriter*|Log.txt FileKey2=%UserProfile%\Documents\Logs|*.txt FileKey3=%UserProfile%\Documents\ywriter projects\*ywriter\Logs|*.* FileKey4=%UserProfile%\Documents\ywriter projects\*ywriter\ywtemp|*.* [Z-VSScopy *] LangSecRef=3024 DetectFile=%CommonProgramFiles%\Z-Manufaktur\Z-VSScopy FileKey1=%CommonProgramFiles%\Z-Manufaktur\Z-VSScopy|LogFile.txt [Zemana AntiMalware *] LangSecRef=3024 DetectFile=%LocalAppData%\Zemana\Zemana AntiMalware FileKey1=%LocalAppData%\Zemana\Zemana AntiMalware\reports|*.txt [Zend Studio 10 *] LangSecRef=3021 Detect=HKCU\Software\Zend\ZendStudio FileKey1=%ProgramFiles%\Zend\Zend Studio 10.0.0|*.html;*.log|RECURSE FileKey2=%ProgramFiles%\Zend\Zend Studio 10.0.0\docs|*.txt|REMOVESELF FileKey3=%ProgramFiles%\Zend\Zend Studio 10.0.0\features|*.html|RECURSE [Zer0 *] LangSecRef=3024 Detect=HKCU\Software\KC Softwares\Zer0 FileKey1=%AppData%\KC Softwares\Zer0|*.log [ZipGenius *] LangSecRef=3024 Detect=HKCU\Software\M.Dev Software\ZG5 FileKey1=%AppData%\ZipGenius|mru.dat RegKey1=HKCU\Software\M.Dev Software\ZG5\MRU Items [ZoneAlarm Internet *] LangSecRef=3021 Detect=HKLM\Software\Zone Labs\ZoneAlarm FileKey1=%WinDir%\Internet Logs|*.dmp;*.log;*.tmp;*.zip [ZoneIDTrimmer *] LangSecRef=3021 Detect=HKLM\Software\Gasanov.net\ZoneIDTrimmer DetectFile=%ProgramFiles%\Gasanov.net\ZoneIDTrimmer FileKey1=%AppData%\ZoneIDTrimmer\Logs|ZoneIDTrimmer.log [Zoner Photo Studio *] LangSecRef=3022 Detect1=HKCU\Software\ZONER\Zoner Photo Studio 15 Detect2=HKCU\Software\ZONER\Zoner Photo Studio 16 Detect3=HKCU\Software\ZONER\Zoner Photo Studio 18 DetectFile=%LocalAppData%\Zoner\ZPS 14 FileKey1=%LocalAppData%\Zoner\OriginalsRepository|*.JPG.info;*.JPG.original|RECURSE FileKey2=%LocalAppData%\Zoner\ZPS *\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Zoner\ZPS *\CEF|*.log FileKey4=%LocalAppData%\Zoner\ZPS *\ZPSCache.dat|*.* FileKey5=%UserProfile%\Pictures|*.uid-zps [Zoom *] LangSecRef=3022 DetectFile=%AppData%\Zoom FileKey1=%AppData%\Zoom|*.txt FileKey2=%AppData%\Zoom Plugin\checkforupdate|*.msi FileKey3=%AppData%\Zoom\data|*.tmp*.db;*.zmdownload;zmonitorlog.bin;*-journal;*.db-shm;*.db-wal|RECURSE FileKey4=%AppData%\Zoom\data\ConfAvatar|*.* FileKey5=%AppData%\Zoom\data\WebviewCache|*.old;LOG|RECURSE FileKey6=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView|Visited Links FileKey7=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView\*Cache|*.*|RECURSE FileKey8=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView\blob_storage|*.*|RECURSE FileKey9=%AppData%\Zoom\data\WebviewCache\*\ZoomApps\*\CefWebView\Network|Network Persistent State FileKey10=%AppData%\Zoom\Logs|*.*|RECURSE FileKey11=%AppData%\Zoom\Reports|*.* FileKey12=%AppData%\Zoom\ZoomDownload|*.exe;*.msi [Zoosk *] LangSecRef=3022 DetectFile=%AppData%\com.zoosk.desktop.* FileKey1=%AppData%\com.zoosk.desktop.*\Local Store|*.log FileKey2=%AppData%\com.zoosk.desktop.*\Local Store\#SharedObjects|*.*|RECURSE [ZX32 ZX Spectrum Emulator v1.03 *] LangSecRef=3021 Detect=HKCU\Software\VK\zx32\1.03 RegKey1=HKCU\Software\VK\zx32\1.03\FileMRU [Zynga Games *] Section=Games DetectFile=%LocalAppData%\Zynga FileKey1=%LocalAppData%\Zynga\Logs|*.*|RECURSE