Winapp2.ini

March 1, 2018

Capture software didn't seem to see the "this file has been modified by an external program" prompt in notepad++.... anyway here's a video of winapp2ool fixing up winapp2.ini..

https://streamable.com/1z3wg

March 1, 2018

5 hours ago, SMalik said:

I suggest removing the [Adobe Media Cache *] entry. If someone starts a project in Premiere Elements or Premiere Pro, save an unfinished project and if this cache is removed, the project will break. I use this when I complete the project, but a person might not know about it and remove this cache while the project is not yet completed. So I think it is dangerous.

CyberLink entries have same media cache removal. I’ll install CyberLink trial programs and will test them by removing the cache files the same way I did with Adobe Media Cache files.

Is the Media Cache worth cleaning at all?

February 25, 2018

5 hours ago, SMalik said:

There is no need to wipe WDI logs each time CCleaner is used. By having a separate entry, we can leave it unchecked and use it when needed.

I think it's fruitless to separate this entry without also including a warning that informs the user of the restart requirement

February 23, 2018

On 2/20/2018 at 19:34, CSGalloway said:

[ACDSee Photo Studio *] shows on my system, which I do not have installed....

[dvdcss *] shows on my system; What is it?

I believe the dvdcss folder is generated by applications that use libdvdcss

https://www.wikiwand.com/en/Libdvdcss

February 22, 2018

8 hours ago, Tr3bg0D said:

@ Winapp2.ini - Been playing around with the Winapp2ool, coming along very nicely. Suggestion, why not have the DIFF module output to a TXT file vs CONSOLE?

Look forward to this in the next release when it comes

7 hours ago, PICPro said:

I was just curious why in Winapp2.ini that LangSecRef=3001 or 3005 isn't used by Winapp2.ini for [Internet Explorer *] or [Microsoft Edge *] respectively. I'm not suggesting a change as 3022 is also a good choice.

6 hours ago, PICPro said:

Actually they do work in 5.40 but the entries appear as an additional section with the correct name and icon at the bottom of the applications tab. I don't know if they work in all previous versions. There are many people stuck at 5.26 since later versions of ccleaner don't work without an SSE2 processor.

Had never really considered it I guess :lol: I'm fairly sure this was always an option though.

February 15, 2018

I also prefer the alphabetical sorting. It's straightforward, immediately understandable, and requires no foreknowledge of windows directory/registry hive hierarchy to format.

February 14, 2018

Since the forums formatting appears to be breaking the diff formatting, a more readable version can be found here: https://paste2.org/DGfHNUzy

February 14, 2018

I fixed a small bug in winapp2ool that was causing the diff module to print exceptions under some circumstances. Here is the changeset between my previous post (2018-01-25) and the current master file at the time of this post


 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                               Changes made between Version: 180125 and Version: 180213                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Extensions State * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Extensions State *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\7Star
Detect2=HKCU\Software\Chromium
Detect3=HKCU\Software\Coowon
Detect4=HKCU\Software\SuperBird
Detect5=HKCU\Software\Torch
Detect6=HKCU\Software\Vivaldi
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Extension State|*.*|RECURSE
FileKey2=%LocalAppData%\Amigo\User Data\*\Extension State|*.*|RECURSE
FileKey3=%LocalAppData%\Chrome Plus\User Data\*\Extension State|*.*|RECURSE
FileKey4=%LocalAppData%\Chromium\User Data\*\Extension State|*.*|RECURSE
FileKey5=%LocalAppData%\Coowon\Coowon\User Data\*\Extension State|*.*|RECURSE
FileKey6=%LocalAppData%\Flock\User Data\*\Extension State|*.*|RECURSE
FileKey7=%LocalAppData%\Google\Chrome*\User Data\*\Extension State|*.*|RECURSE
FileKey8=%LocalAppData%\Rockmelt\User Data\*\Extension State|*.*|RECURSE
FileKey9=%LocalAppData%\SRWare Iron\User Data\*\Extension State|*.*|RECURSE
FileKey10=%LocalAppData%\SuperBird\User Data\*\Extension State|*.*|RECURSE
FileKey11=%LocalAppData%\Torch\User Data\*\Extension State|*.*|RECURSE
FileKey12=%LocalAppData%\Vivaldi\User Data\*\Extension State|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            GPU Cache * has been modified.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[GPU Cache *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\7Star
Detect2=HKCU\Software\Chromium
Detect3=HKCU\Software\Coowon
Detect4=HKCU\Software\SuperBird
Detect5=HKCU\Software\Torch
Detect6=HKCU\Software\Vivaldi
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%AppData%\Brave\*\GPUCache|*.*
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\GPUCache|*.*
FileKey3=%LocalAppData%\Amigo\User Data\*\GPUCache|*.*
FileKey4=%LocalAppData%\Chrome Plus\User Data\*\GPUCache|*.*
FileKey5=%LocalAppData%\Chromium\User Data\*\GPUCache|*.*
FileKey6=%LocalAppData%\Coowon\Coowon\User Data\*\GPUCache|*.*
FileKey7=%LocalAppData%\Flock\User Data\*\GPUCache|*.*
FileKey8=%LocalAppData%\Google\Chrome*\User Data\*\GPUCache|*.*
FileKey9=%LocalAppData%\Rockmelt\User Data\*\GPUCache|*.*
FileKey10=%LocalAppData%\SlimJet\User Data\*\GPUCache|*.*
FileKey11=%LocalAppData%\SRWare Iron\User Data\*\GPUCache|*.*
FileKey12=%LocalAppData%\SuperBird\User Data\*\GPUCache|*.*
FileKey13=%LocalAppData%\Torch\User Data\*\GPUCache|*.*
FileKey14=%LocalAppData%\Vivaldi\User Data\*\GPUCache|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             History * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[History *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\7Star
Detect2=HKCU\Software\360Browser
Detect3=HKCU\Software\Chromium
Detect4=HKCU\Software\Coowon
Detect5=HKCU\Software\SuperBird
Detect6=HKCU\Software\Torch
Detect7=HKCU\Software\Vivaldi
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|History
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey3=%LocalAppData%\360Browser\Browser\User Data\*|History
FileKey4=%LocalAppData%\360Browser\Browser\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey5=%LocalAppData%\Amigo\User Data\*|History
FileKey6=%LocalAppData%\Amigo\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey7=%LocalAppData%\Chrome Plus\User Data\*|History
FileKey8=%LocalAppData%\Chrome Plus\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey9=%LocalAppData%\Chromium\User Data\*|History
FileKey10=%LocalAppData%\Chromium\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey11=%LocalAppData%\Coowon\Coowon\User Data\*|History
FileKey12=%LocalAppData%\Coowon\Coowon\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey13=%LocalAppData%\Flock\User Data\*|History
FileKey14=%LocalAppData%\Flock\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey15=%LocalAppData%\Google\Chrome*\User Data\*|History
FileKey16=%LocalAppData%\Google\Chrome*\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey17=%LocalAppData%\Rockmelt\User Data\*|History
FileKey18=%LocalAppData%\Rockmelt\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey19=%LocalAppData%\SlimJet\User Data\*|History
FileKey20=%LocalAppData%\SlimJet\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey21=%LocalAppData%\SRWare Iron\User Data\*|History
FileKey22=%LocalAppData%\SRWare Iron\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey23=%LocalAppData%\SuperBird\User Data\*|History
FileKey24=%LocalAppData%\SuperBird\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey25=%LocalAppData%\Torch\User Data\*|History
FileKey26=%LocalAppData%\Torch\User Data\*\JumpListIcons*|*.*|RECURSE
FileKey27=%LocalAppData%\Vivaldi\User Data\*|History
FileKey28=%LocalAppData%\Vivaldi\User Data\*\JumpListIcons*|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    JumpListIconsRecentClosed * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[JumpListIconsRecentClosed *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Default=False
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default\JumpListIconsRecentClosed|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Local Storage * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Local Storage *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\7Star
Detect2=HKCU\Software\360Browser
Detect3=HKCU\Software\Chromium
Detect4=HKCU\Software\Coowon
Detect5=HKCU\Software\SuperBird
Detect6=HKCU\Software\Torch
Detect7=HKCU\Software\Vivaldi
Default=False
FileKey1=%AppData%\Brave\*\Local Storage|http*.*|RECURSE
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\Local Storage|http*.*|RECURSE
FileKey3=%LocalAppData%\360Browser\Browser\User Data\*\Local Storage|http*.*|RECURSE
FileKey4=%LocalAppData%\Amigo\User Data\*\Local Storage|http*.*|RECURSE
FileKey5=%LocalAppData%\Chrome Plus\User Data\*\Local Storage|http*.*|RECURSE
FileKey6=%LocalAppData%\Chromium\User Data\*\Local Storage|http*.*|RECURSE
FileKey7=%LocalAppData%\Coowon\Coowon\User Data\*\Local Storage|http*.*|RECURSE
FileKey8=%LocalAppData%\Flock\User Data\*\Local Storage|http*.*|RECURSE
FileKey9=%LocalAppData%\Google\Chrome*\User Data\*\Local Storage|http*.*|RECURSE
FileKey10=%LocalAppData%\Rockmelt\User Data\*\Local Storage|http*.*|RECURSE
FileKey11=%LocalAppData%\SRWare Iron\User Data\*\Local Storage|http*.*|RECURSE
FileKey12=%LocalAppData%\SuperBird\User Data\*\Local Storage|http*.*|RECURSE
FileKey13=%LocalAppData%\Torch\User Data\*\Local Storage|http*.*|RECURSE
FileKey14=%LocalAppData%\Vivaldi\User Data\*\Local Storage|http*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Logs * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Logs *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\7Star
Detect2=HKCU\Software\Chromium
Detect3=HKCU\Software\Coowon
Detect4=HKCU\Software\SuperBird
Detect5=HKCU\Software\Torch
Detect6=HKCU\Software\Vivaldi
Default=False
FileKey1=%AppData%\Brave\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey2=%LocalAppData%\7Star\7Star\Application|debug.log
FileKey3=%LocalAppData%\7Star\7Star\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey4=%LocalAppData%\Amigo\Application|debug.log
FileKey5=%LocalAppData%\Amigo\User Data\*\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey6=%LocalAppData%\Chrome Plus\Application|debug.log
FileKey7=%LocalAppData%\Chrome Plus\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey8=%LocalAppData%\Chromium\Application|debug.log
FileKey9=%LocalAppData%\Chromium\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey10=%LocalAppData%\Coowon\Coowon\Application|debug.log
FileKey11=%LocalAppData%\Coowon\Coowon\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey12=%LocalAppData%\Flock\Application|debug.log
FileKey13=%LocalAppData%\Flock\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey14=%LocalAppData%\Google\Chrome Cleanup Tool|*.log
FileKey15=%LocalAppData%\Google\Chrome*\Application|debug.log
FileKey16=%LocalAppData%\Google\Chrome*\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey17=%LocalAppData%\Google\Software Reporter Tool|*.log
FileKey18=%LocalAppData%\Rockmelt\Application|debug.log
FileKey19=%LocalAppData%\Rockmelt\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey20=%LocalAppData%\SRWare Iron\Application|debug.log
FileKey21=%LocalAppData%\SRWare Iron\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey22=%LocalAppData%\SuperBird\Application|debug.log
FileKey23=%LocalAppData%\SuperBird\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey24=%LocalAppData%\Torch\Application|debug.log
FileKey25=%LocalAppData%\Torch\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey26=%LocalAppData%\VirtualStore\Program Files*\Google\Chrome*\Application|debug.log
FileKey27=%LocalAppData%\VirtualStore\Program Files*\SRWare Iron|debug.log
FileKey28=%LocalAppData%\Vivaldi\Application|debug.log
FileKey29=%LocalAppData%\Vivaldi\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE
FileKey30=%ProgramFiles%\Google\Chrome*\Application|debug.log
FileKey31=%ProgramFiles%\SRWare Iron|debug.log
ExcludeKey1=PATH|%LocalAppData%\7Star\7Star\User Data\*\Extensions\|*.*
ExcludeKey2=PATH|%LocalAppData%\7Star\7Star\User Data\*\File System\|*.*
ExcludeKey3=PATH|%LocalAppData%\7Star\7Star\User Data\*\Local App Settings\|*.*
ExcludeKey4=PATH|%LocalAppData%\7Star\7Star\User Data\*\Local Extension Settings\|*.*
ExcludeKey5=PATH|%LocalAppData%\Amigo\User Data\*\Extensions\|*.*
ExcludeKey6=PATH|%LocalAppData%\Amigo\User Data\*\File System\|*.*
ExcludeKey7=PATH|%LocalAppData%\Amigo\User Data\*\Local App Settings\|*.*
ExcludeKey8=PATH|%LocalAppData%\Amigo\User Data\*\Local Extension Settings\|*.*
ExcludeKey9=PATH|%LocalAppData%\Chrome Plus\User Data\*\Extensions\|*.*
ExcludeKey10=PATH|%LocalAppData%\Chrome Plus\User Data\*\File System\|*.*
ExcludeKey11=PATH|%LocalAppData%\Chrome Plus\User Data\*\Local App Settings\|*.*
ExcludeKey12=PATH|%LocalAppData%\Chrome Plus\User Data\*\Local Extension Settings\|*.*
ExcludeKey13=PATH|%LocalAppData%\Chromium\User Data\*\Extensions\|*.*
ExcludeKey14=PATH|%LocalAppData%\Chromium\User Data\*\File System\|*.*
ExcludeKey15=PATH|%LocalAppData%\Chromium\User Data\*\Local App Settings\|*.*
ExcludeKey16=PATH|%LocalAppData%\Chromium\User Data\*\Local Extension Settings\|*.*
ExcludeKey17=PATH|%LocalAppData%\Coowon\Coowon\User Data\*\Extensions\|*.*
ExcludeKey18=PATH|%LocalAppData%\Coowon\Coowon\User Data\*\File System\|*.*
ExcludeKey19=PATH|%LocalAppData%\Coowon\Coowon\User Data\*\Local App Settings\|*.*
ExcludeKey20=PATH|%LocalAppData%\Coowon\Coowon\User Data\*\Local Extension Settings\|*.*
ExcludeKey21=PATH|%LocalAppData%\Flock\User Data\*\Extensions\|*.*
ExcludeKey22=PATH|%LocalAppData%\Flock\User Data\*\File System\|*.*
ExcludeKey23=PATH|%LocalAppData%\Flock\User Data\*\Local App Settings\|*.*
ExcludeKey24=PATH|%LocalAppData%\Flock\User Data\*\Local Extension Settings\|*.*
ExcludeKey25=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Extensions\|*.*
ExcludeKey26=PATH|%LocalAppData%\Google\Chrome*\User Data\*\File System\|*.*
ExcludeKey27=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Local App Settings\|*.*
ExcludeKey28=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Local Extension Settings\|*.*
ExcludeKey29=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\leveldb\|*.*
ExcludeKey30=PATH|%LocalAppData%\Rockmelt\User Data\*\Extensions\|*.*
ExcludeKey31=PATH|%LocalAppData%\Rockmelt\User Data\*\File System\|*.*
ExcludeKey32=PATH|%LocalAppData%\Rockmelt\User Data\*\Local App Settings\|*.*
ExcludeKey33=PATH|%LocalAppData%\Rockmelt\User Data\*\Local Extension Settings\|*.*
ExcludeKey34=PATH|%LocalAppData%\SRWare Iron\User Data\*\Extensions\|*.*
ExcludeKey35=PATH|%LocalAppData%\SRWare Iron\User Data\*\File System\|*.*
ExcludeKey36=PATH|%LocalAppData%\SRWare Iron\User Data\*\Local App Settings\|*.*
ExcludeKey37=PATH|%LocalAppData%\SRWare Iron\User Data\*\Local Extension Settings\|*.*
ExcludeKey38=PATH|%LocalAppData%\Superbird\User Data\*\Extensions\|*.*
ExcludeKey39=PATH|%LocalAppData%\Superbird\User Data\*\File System\|*.*
ExcludeKey40=PATH|%LocalAppData%\Superbird\User Data\*\Local App Settings\|*.*
ExcludeKey41=PATH|%LocalAppData%\Superbird\User Data\*\Local Extension Settings\|*.*
ExcludeKey42=PATH|%LocalAppData%\Torch\User Data\*\Extensions\|*.*
ExcludeKey43=PATH|%LocalAppData%\Torch\User Data\*\File System\|*.*
ExcludeKey44=PATH|%LocalAppData%\Torch\User Data\*\Local App Settings\|*.*
ExcludeKey45=PATH|%LocalAppData%\Torch\User Data\*\Local Extension Settings\|*.*
ExcludeKey46=PATH|%LocalAppData%\Vivaldi\User Data\*\Extensions\|*.*
ExcludeKey47=PATH|%LocalAppData%\Vivaldi\User Data\*\File System\|*.*
ExcludeKey48=PATH|%LocalAppData%\Vivaldi\User Data\*\Local App Settings\|*.*
ExcludeKey49=PATH|%LocalAppData%\Vivaldi\User Data\*\Local Extension Settings\|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                         Session Storage * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Session Storage *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\7Star
Detect2=HKCU\Software\Chromium
Detect3=HKCU\Software\Coowon
Detect4=HKCU\Software\SuperBird
Detect5=HKCU\Software\Torch
Detect6=HKCU\Software\Vivaldi
Default=False
FileKey1=%AppData%\Brave\*\Session Storage|*.*|RECURSE
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\Session Storage|*.*|RECURSE
FileKey3=%LocalAppData%\Amigo\User Data\*\Session Storage|*.*|RECURSE
FileKey4=%LocalAppData%\Chrome Plus\User Data\*\Session Storage|*.*|RECURSE
FileKey5=%LocalAppData%\Chromium\User Data\*\Session Storage|*.*|RECURSE
FileKey6=%LocalAppData%\Coowon\Coowon\User Data\*\Session Storage|*.*|RECURSE
FileKey7=%LocalAppData%\Flock\User Data\*\Session Storage|*.*|RECURSE
FileKey8=%LocalAppData%\Google\Chrome*\User Data\*\Session Storage|*.*|RECURSE
FileKey9=%LocalAppData%\Rockmelt\User Data\*\Session Storage|*.*|RECURSE
FileKey10=%LocalAppData%\SRWare Iron\User Data\*\Session Storage|*.*|RECURSE
FileKey11=%LocalAppData%\SuperBird\User Data\*\Session Storage|*.*|RECURSE
FileKey12=%LocalAppData%\Torch\User Data\*\Session Storage|*.*|RECURSE
FileKey13=%LocalAppData%\Vivaldi\User Data\*\Session Storage|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    SuperBird - Internet Traces * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SuperBird - Internet Traces *]
LangSecRef=3029
Detect=HKCU\Software\SuperBird
Default=False
FileKey1=%LocalAppData%\SuperBird\User Data\*|Cookies*;Current Tabs;Current session;Last Tabs;Last Session;Login Data;Archived History*;History*;visited links;Favicons*
FileKey2=%LocalAppData%\SuperBird\User Data\*\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\SuperBird\User Data\*\JumpListIcons*|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Bookmark Backups * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bookmark Backups *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\bookmarkbackups|*.json*
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*\bookmarkbackups|*.json*
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*\bookmarkbackups|*.json*
FileKey4=%AppData%\Waterfox\Profiles\*\bookmarkbackups|*.json*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                         Corrupt SQLites * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Corrupt SQLites *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles|*.corrupt|RECURSE
FileKey2=%AppData%\Mozilla\Firefox\Profiles|*.corrupt|RECURSE
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles|*.corrupt|RECURSE
FileKey4=%AppData%\Waterfox\Profiles|*.corrupt|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Crash Files * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Crash Files *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Crash Reports|*.*|RECURSE
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\minidumps|*.*
FileKey3=%AppData%\Mozilla\Firefox\Crash Reports|*.*|RECURSE
FileKey4=%AppData%\Mozilla\Firefox\Profiles\*\minidumps|*.*
FileKey5=%AppData%\Mozilla\SeaMonkey\Crash Reports|*.*|RECURSE
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\minidumps|*.*
FileKey7=%AppData%\Waterfox\Crash Reports|*.*|RECURSE
FileKey8=%AppData%\Waterfox\Profiles\*\minidumps|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Firefox HTML5 Storage * has been modified.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Firefox HTML5 Storage *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\storage|*.*|RECURSE
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*\storage|*.*|RECURSE
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*\storage|*.*|RECURSE
FileKey4=%AppData%\Waterfox\Profiles\*\storage|*.*|RECURSE
ExcludeKey1=PATH|%AppData%\Moonchild Productions\Pale Moon\Profiles\*\storage\default\moz-extension*\|*.*
ExcludeKey2=PATH|%AppData%\Mozilla\Firefox\Profiles\*\storage\default\moz-extension*\|*.*
ExcludeKey3=PATH|%AppData%\Mozilla\SeaMonkey\Profiles\*\storage\default\moz-extension*\|*.*
ExcludeKey4=PATH|%AppData%\Waterfox\Profiles\*\storage\default\moz-extension*\|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Firefox Logs * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Firefox Logs *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon|*.log|RECURSE
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Profiles|TestPilotErrorLog.*|RECURSE
FileKey3=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\weave\logs|*.*
FileKey4=%AppData%\Mozilla\Firefox|*.log|RECURSE
FileKey5=%AppData%\Mozilla\Firefox\Profiles|TestPilotErrorLog.*|RECURSE
FileKey6=%AppData%\Mozilla\Firefox\Profiles\*\weave\logs|*.*
FileKey7=%AppData%\Mozilla\SeaMonkey|*.log|RECURSE
FileKey8=%AppData%\Mozilla\SeaMonkey\Profiles|TestPilotErrorLog.*|RECURSE
FileKey9=%AppData%\Mozilla\SeaMonkey\Profiles\*\weave\logs|*.*
FileKey10=%AppData%\Waterfox|*.log|RECURSE
FileKey11=%AppData%\Waterfox\Profiles|TestPilotErrorLog.*|RECURSE
FileKey12=%AppData%\Waterfox\Profiles\*\weave\logs|*.*
FileKey13=%CommonAppData%\Mozilla*\logs|*.*
FileKey14=%LocalAppData%\Moonchild Productions\Pale Moon\*\updates|*.*|RECURSE
FileKey15=%LocalAppData%\Mozilla\Firefox\*\updates|*.*|RECURSE
FileKey16=%LocalAppData%\Mozilla\SeaMonkey\*\updates|*.*|RECURSE
FileKey17=%LocalAppData%\Mozilla\Updates|*.*|RECURSE
FileKey18=%LocalAppData%\Waterfox\*\updates|*.*|RECURSE
FileKey19=%ProgramFiles%\Mozilla Firefox|*.log
FileKey20=%ProgramFiles%\Mozilla Maintenance Service\logs|*.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Lock Files * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Lock Files *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|*.lock
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*|*.lock
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*|*.lock
FileKey4=%AppData%\Waterfox\Profiles\*|*.lock

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Startup Cache * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Startup Cache *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*\startupCache|*.*
FileKey2=%LocalAppData%\Mozilla\Firefox\Profiles\*\startupCache|*.*
FileKey3=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*\startupCache|*.*
FileKey4=%LocalAppData%\Waterfox\Profiles\*\startupCache|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Telemetry * has been modified.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Telemetry *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|Telemetry*.*
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey3=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\saved-telemetry-pings|*.*
FileKey4=%AppData%\Mozilla\Firefox\Profiles\*|Telemetry*.*
FileKey5=%AppData%\Mozilla\Firefox\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey6=%AppData%\Mozilla\Firefox\Profiles\*\saved-telemetry-pings|*.*
FileKey7=%AppData%\Mozilla\SeaMonkey\Profiles\*|Telemetry*.*
FileKey8=%AppData%\Mozilla\SeaMonkey\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey9=%AppData%\Mozilla\SeaMonkey\Profiles\*\saved-telemetry-pings|*.*
FileKey10=%AppData%\Waterfox\Profiles\*|Telemetry*.*
FileKey11=%AppData%\Waterfox\Profiles\*\datareporting\archived|*.jsonlz4|RECURSE
FileKey12=%AppData%\Waterfox\Profiles\*\saved-telemetry-pings|*.*
FileKey13=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*|ShutdownDuration.*
FileKey14=%LocalAppData%\Mozilla\Firefox\Profiles\*|ShutdownDuration.*
FileKey15=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*|ShutdownDuration.*
FileKey16=%LocalAppData%\Waterfox\Profiles\*|ShutdownDuration.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Temps * has been modified.                                            ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Temps *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
Default=False
FileKey1=%ProgramFiles%\Mozilla*|*.tmp|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      urlclassifier3.sqlite * has been modified.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[urlclassifier3.sqlite *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
Warning=This will delete urlclassifier3.sqlite. If you just want to reduce its size, select Compact Databases instead.
FileKey1=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*|urlclassifier3.sqlite
FileKey2=%LocalAppData%\Mozilla\Firefox\Profiles\*|urlclassifier3.sqlite
FileKey3=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*|urlclassifier3.sqlite
FileKey4=%LocalAppData%\Waterfox\Profiles\*|urlclassifier3.sqlite

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       webappsstore.sqlite * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[webappsstore.sqlite *]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
DetectFile1=%AppData%\Moonchild Productions\Pale Moon
DetectFile2=%AppData%\Mozilla\SeaMonkey
DetectFile3=%AppData%\Waterfox
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|webappsstore.sqlite
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*|webappsstore.sqlite
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*|webappsstore.sqlite
FileKey4=%AppData%\Waterfox\Profiles\*|webappsstore.sqlite

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Email Index * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Email Index *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
Warning=This will cause your message index to be deleted, searching emails may be slow until it is rebuilt.
FileKey1=%AppData%\FossaMail\Profiles|global-messages-db.sqlite|RECURSE
FileKey2=%AppData%\Thunderbird\Profiles|global-messages-db.sqlite|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Filter Logs * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Filter Logs *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles\*|filterlog.html|RECURSE
FileKey2=%AppData%\Thunderbird\Profiles\*|filterlog.html|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                   Thunderbird Corrupt SQLites * has been modified.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Thunderbird Corrupt SQLites *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles|*.corrupt|RECURSE
FileKey2=%AppData%\Thunderbird\Profiles|*.corrupt|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Thunderbird Crash Files * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Thunderbird Crash Files *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Crash Reports|*.*|RECURSE
FileKey2=%AppData%\FossaMail\Profiles\*\Minidumps|*.*
FileKey3=%AppData%\Thunderbird\Crash Reports|*.*|RECURSE
FileKey4=%AppData%\Thunderbird\Profiles\*\Minidumps|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Thunderbird Logs * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Thunderbird Logs *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles\*|extensions.log;TestPilotErrorLog.*|RECURSE
FileKey2=%AppData%\Thunderbird\Profiles\*|extensions.log;TestPilotErrorLog.*|RECURSE
FileKey3=%CommonAppData%\Mozilla*\logs|*.*|RECURSE
FileKey4=%LocalAppData%\FossaMail\Mozilla\*\Updates|*.log|RECURSE
FileKey5=%LocalAppData%\Thunderbird\Mozilla\*\Updates|*.log|RECURSE
FileKey6=%ProgramFiles%\FossaMail|*.log
FileKey7=%ProgramFiles%\Mozilla Thunderbird|*.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Thunderbird Startup Cache * has been modified.                                  ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Thunderbird Startup Cache *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%LocalAppData%\FossaMail\Profiles\*\startupCache|*.*
FileKey2=%LocalAppData%\Thunderbird\Profiles\*\startupCache|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                 Thunderbird webappsstore.sqlite * has been modified.                               ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Thunderbird webappsstore.sqlite *]
LangSecRef=3030
SpecialDetect=DET_THUNDERBIRD
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles\*|webappsstore.sqlite
FileKey2=%AppData%\Thunderbird\Profiles\*|webappsstore.sqlite

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       .NET Framework Temps * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[.NET Framework Temps *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
Default=False
FileKey1=%WinDir%\assembly\NativeImages_*\Temp|*.*|RECURSE
FileKey2=%WinDir%\assembly\t*mp|*.*|REMOVESELF
FileKey3=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*.*|RECURSE
FileKey4=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*.*|REMOVESELF
FileKey5=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*.*|RECURSE
FileKey6=%WinDir%\System32\URTTemp|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            3D Builder * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[3D Builder *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.3DBuilder_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.3DBuilder_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.3DBuilder_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.3DBuilder_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.3DBuilder_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.3DBuilder_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.3DBuilder_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      7Star Browser - Cookies * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Cookies *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default|Cookies;Cookies-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    7Star Browser - GPU Cache * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - GPU Cache *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default\GPUCache|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  7Star Browser - Internet Cache * has been removed.                                ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Internet Cache *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default|Favicons;Favicons-journal
FileKey2=%LocalAppData%\7Star\7Star\User Data\Default\Cache|*.*|REMOVESELF

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                 7Star Browser - Internet History * has been removed.                               ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Internet History *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Archived History;Archived History-journal;History;History Provider Cache;History-journal;Visited Links;Top Sites;Top Sites-journal
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\JumpListIcons*|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  7Star Browser - Local Storage * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Local Storage *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Local Storage|http*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    7Star Browser - Login Data * has been removed.                                  ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Login Data *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default|Login Data;Login Data-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       7Star Browser - Logs * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Logs *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\Application|debug.log
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\Extension State|LOG.*;*.log;Log
FileKey3=%LocalAppData%\7Star\7Star\User Data\*\Session Storage|LOG.*;*.log;Log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      7Star Browser - Session * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[7Star Browser - Session *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Current Tabs;Current session;Last Tabs;Last Session

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        360 Browser - Cache * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[360 Browser - Cache *]
LangSecRef=3029
Detect=HKCU\Software\360Browser\Browser
Default=False
FileKey1=%LocalAppData%\360Browser\Browser\User Data\Default|*-journal*
FileKey2=%LocalAppData%\360Browser\Browser\User Data\Default\Cache|*.*
FileKey3=%LocalAppData%\360Browser\Browser\User Data\Default\Local Storage|*.*
ExcludeKey1=FILE|%LocalAppData%\360Browser\Browser\User Data\Default\|Login data-journal
ExcludeKey2=FILE|%LocalAppData%\360Browser\Browser\User Data\Default\|switcher-journal
ExcludeKey3=FILE|%LocalAppData%\360Browser\Browser\User Data\Default\|Web data-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      360 Browser - Cookies * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[360 Browser - Cookies *]
LangSecRef=3029
Detect=HKCU\Software\360Browser\Browser
Default=False
FileKey1=%LocalAppData%\360Browser\Browser\User Data\Default|Cookies

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      360 Browser - History * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[360 Browser - History *]
LangSecRef=3029
Detect=HKCU\Software\360Browser\Browser
Default=False
FileKey1=%LocalAppData%\360Browser\Browser\User Data\Default|Archived History;Current Tabs;History Provider Cache;Network Action Predictor;Top Sites;Visited Links

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      360 Browser - Session * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[360 Browser - Session *]
LangSecRef=3029
Detect=HKCU\Software\360Browser\Browser
Default=False
FileKey1=%LocalAppData%\360Browser\Browser\User Data\Default|Current*
FileKey2=%LocalAppData%\360Browser\Browser\User Data\Default|Last*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Accounts Control * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Accounts Control *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AccountsControl_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.AccountsControl_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.AccountsControl_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.AccountsControl_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.AccountsControl_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           AccuWeather * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[AccuWeather *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
DetectFile=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
Default=False
FileKey1=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\LocalState|*.tmp
FileKey5=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\TempState\Bing.Maps\Cache|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Adobe CC * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe CC *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\CreativeCloud
Default=False
FileKey1=%AppData%\Adobe\Adobe Media Encoder\12.0\logs|*.*|RECURSE
FileKey2=%AppData%\Adobe\Adobe Photoshop CC 2018\Adobe Photoshop CC 2018 Settings\CrashLogs|*.*|RECURSE
FileKey3=%AppData%\Adobe\Adobe Photoshop CC 2018\Adobe Photoshop CC 2018 Settings\web-cache-temp|*.*|RECURSE
FileKey4=%AppData%\Adobe\Adobe Photoshop CC 2018\Logs|*.*|RECURSE
FileKey5=%AppData%\Adobe\CRLogs|*.*|RECURSE
FileKey6=%AppData%\Adobe\dynamiclinkmanager\12.0\logs|*.*|RECURSE
FileKey7=%AppData%\Adobe\Extension Manager CC\Log|*.*|RECURSE
FileKey8=%AppData%\Adobe\Extension Manager CC\Temp|*.*|RECURSE
FileKey9=%AppData%\Adobe\LogTransport2CC\Logs|*.*|RECURSE
FileKey10=%AppData%\Adobe\Lumetri\9.0\logs|*.*|RECURSE
FileKey11=%AppData%\Adobe\Premiere Pro\12.0|Plugin Loading.log
FileKey12=%AppData%\Adobe\Premiere Pro\12.0\logs|*.*|RECURSE
FileKey13=%CommonProgramFiles%\Adobe\Installers|CoreSyncInstall.log;Install.log
FileKey14=%Documents%\Adobe|*.log
FileKey15=%Documents%\Adobe\Adobe Media Encoder\12.0\logs|*.*|RECURSE
FileKey16=%Documents%\Adobe\Premiere Pro\12.0|Plugin Loading.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             Adobe CS * has been removed.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe CS *]
LangSecRef=3021
DetectFile=%AppData%\Adobe\CS*ServiceManager
Default=False
FileKey1=%AppData%\Adobe\CS*ServiceManager\Cache|*.*|RECURSE
FileKey2=%AppData%\Adobe\CS*ServiceManager\Logs|*.*|RECURSE
FileKey3=%AppData%\com.adobe.downloadassistant.AdobeDownloadAssistant|*.log|RECURSE
FileKey4=%Documents%\Adobe\Adobe Media Encoder\6.0.0|*.log
FileKey5=%LocalAppData%\Akamai\Cache|*.*
FileKey6=%LocalAppData%\Akamai\Logs|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Adobe Dreamweaver * has been removed.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Dreamweaver *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\MediaBrowser\MRU\Dreamweaver
Default=False
FileKey1=%AppData%\Adobe\Dreamweaver CS*\*\Configuration\logs|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Adobe Elements Organizer * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Elements Organizer *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Elements Organizer
Default=False
FileKey1=%AppData%\Adobe\amecommand\6.0|Plugin Loading.log
FileKey2=%AppData%\Adobe\Elements Organizer\*\Organizer|*.txt;status.dat
FileKey3=%AppData%\Adobe\Elements Smart Tag Agent\*\Logs|*.log
FileKey4=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey5=%CommonAppData%|StreamingMediaTechnologyLog.txt
FileKey6=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog|face.thumb.9.cache;thumb.5.cache
FileKey7=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\WaldoData|waldo.cache
FileKey8=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\Watch Folder|*.txt;*.xml
RegKey1=HKCU\Software\Adobe\Elements Organizer\11.0\CurrentMediaFilePath
RegKey2=HKCU\Software\Adobe\Elements Organizer\12.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Elements Organizer\13.0\CurrentMediaFilePath
RegKey4=HKCU\Software\Adobe\Elements Organizer\14.0\CurrentMediaFilePath
RegKey5=HKCU\Software\Adobe\Elements Organizer\15.0\CurrentMediaFilePath

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Adobe My Digital Editions * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe My Digital Editions *]
LangSecRef=3023
DetectFile=%Documents%\My Digital Editions
Default=False
FileKey1=%Documents%\My Digital Editions|import.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Adobe Photoshop * has been removed.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Photoshop *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Photoshop
Default=False
FileKey1=%AppData%\Adobe\Adobe Photoshop*\Generator\logs|*.*
FileKey2=%AppData%\Adobe\Bridge*\Cache\Thumbnails|*.*|RECURSE
FileKey3=%AppData%\Adobe\CameraRaw\Cache|*.*|RECURSE
FileKey4=%AppData%\Adobe\FileBrowser\PhotoshopCS|*.*
FileKey5=%AppData%\Adobe\Photoshop Album\*.*|Logse*.txt
FileKey6=%Pictures%|.BridgeSort|RECURSE
RegKey1=HKCU\Software\Adobe\Photoshop\5.5\VisitedDirs
RegKey2=HKCU\Software\Adobe\Photoshop\90.0\VisitedDirs

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Adobe Photoshop Elements * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Photoshop Elements *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Photoshop Elements
Default=False
FileKey1=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey2=%AppData%\Adobe\Photoshop Elements\*\Editor|*.txt
FileKey3=%CommonAppData%\Adobe\Photoshop Elements\File Agent|WatchFolder.3.cache
RegKey1=HKCU\Software\Adobe\Photoshop Elements\11.0\common\settings\Elements MRU
RegKey2=HKCU\Software\Adobe\Photoshop Elements\11.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Photoshop Elements\11.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey4=HKCU\Software\Adobe\Photoshop Elements\12.0\common\settings\Elements MRU
RegKey5=HKCU\Software\Adobe\Photoshop Elements\12.0\CurrentMediaFilePath
RegKey6=HKCU\Software\Adobe\Photoshop Elements\12.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey7=HKCU\Software\Adobe\Photoshop Elements\13.0\common\settings\Elements MRU
RegKey8=HKCU\Software\Adobe\Photoshop Elements\13.0\CurrentMediaFilePath
RegKey9=HKCU\Software\Adobe\Photoshop Elements\13.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey10=HKCU\Software\Adobe\Photoshop Elements\14.0\common\settings\Elements MRU
RegKey11=HKCU\Software\Adobe\Photoshop Elements\14.0\CurrentMediaFilePath
RegKey12=HKCU\Software\Adobe\Photoshop Elements\14.0\VisitedDirs|STARTUPIMAGEDIRECTORY
RegKey13=HKCU\Software\Adobe\Photoshop Elements\15.0\common\settings\Elements MRU
RegKey14=HKCU\Software\Adobe\Photoshop Elements\15.0\CurrentMediaFilePath
RegKey15=HKCU\Software\Adobe\Photoshop Elements\15.0\VisitedDirs|STARTUPIMAGEDIRECTORY

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Adobe Premiere Elements * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Premiere Elements *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Premiere Elements
Default=False
FileKey1=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey2=%AppData%\Adobe\Premiere Elements\*|Plugin Loading.log
FileKey3=%AppData%\Adobe\Premiere Elements\*\logs|*.*|RECURSE
FileKey4=%Documents%\Adobe\Premiere Elements\*|*.log
FileKey5=%Documents%\NewBlueFX\Logs|*.txt
RegKey1=HKCU\Software\Adobe\Premiere Elements\11.0\MRUDocuments
RegKey2=HKCU\Software\Adobe\Premiere Elements\12.0\MRUDocuments
RegKey3=HKCU\Software\Adobe\Premiere Elements\13.0\MRUDocuments
RegKey4=HKCU\Software\Adobe\Premiere Elements\14.0\MRUDocuments
RegKey5=HKCU\Software\Adobe\Premiere Elements\15.0\MRUDocuments

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Adobe Premiere Pro * has been removed.                                      ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Premiere Pro *]
LangSecRef=3021
Detect1=HKCU\Software\Adobe\Premiere Pro\2.0
Detect2=HKCU\Software\Adobe\Premiere Pro\7.0
Detect3=HKLM\Software\Adobe\Premiere Pro\7.0
Default=False
FileKey1=%Documents%\Adobe\Premiere Pro\2.0|*.prproj
FileKey2=%Documents%\Adobe\Premiere Pro\2.0\Adobe Premiere Pro Auto-Save|*.prproj
FileKey3=%Documents%\Adobe\Premiere Pro\2.0\Adobe Premiere Pro Preview Files|*.*|RECURSE
FileKey4=%Documents%\Adobe\Premiere Pro\2.0\Encoded Files|*.*
FileKey5=%Documents%\Adobe\Premiere Pro\2.0\Media Cache Files|*.*
FileKey6=%LocalAppData%\VirtualStore\Program Files*\Adobe\Adobe Premiere Pro CC\cache|*-*-*.cache
FileKey7=%LocalAppData%\VirtualStore\Program Files*\Adobe\Adobe Premiere Pro CC\Required\data\cache|*.pcache

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Adobe Updater * has been removed.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Updater *]
LangSecRef=3021
Detect=HKCU\Software\Adobe
Default=False
FileKey1=%AppData%\Adobe\Acrobat\*\Updater|*.log
FileKey2=%AppData%\Adobe\LogTransport*\Logs|ulog_*.tmp
FileKey3=%CommonAppData%\Adobe\ARM|*.*|RECURSE
FileKey4=%LocalAppData%\Adobe\AAMUpdater|*.Log|RECURSE
FileKey5=%LocalAppData%\Adobe\Acrobat\*\Updater|*.log
FileKey6=%LocalAppData%\Adobe\Updater*|*.log|RECURSE
FileKey7=%ProgramFiles%\Common Files\Adobe\Installers|*.log.gz|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Angry Birds Space * has been modified.                                      ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Angry Birds Space *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\1ED5AEA5.AngryBirdsSpace_p2gbknwb5d8r2
DetectFile=%LocalAppData%\Packages\1ED5AEA5.AngryBirdsSpace_p2gbknwb5d8r2
Default=False
FileKey1=%LocalAppData%\Packages\*.AngryBirdsSpace_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.AngryBirdsSpace_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\*.AngryBirdsSpace_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Angry Birds Star Wars * has been modified.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Angry Birds Star Wars *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\1ED5AEA5.AngryBirdsBlack_p2gbknwb5d8r2
DetectFile=%LocalAppData%\Packages\1ED5AEA5.AngryBirdsBlack_p2gbknwb5d8r2
Default=False
FileKey1=%LocalAppData%\Packages\*.AngryBirdsBlack_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.AngryBirdsBlack_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\*.AngryBirdsBlack_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                               AOL * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[AOL *]
LangSecRef=3022
Detect=HKCU\Software\America Online
Default=False
FileKey1=%AppData%\AOL\C_AOL*|*.tmp|RECURSE
FileKey2=%CommonAppData%\AOL Downloads|*.*|RECURSE
FileKey3=%CommonAppData%\AOL\C_AOL*|*.tmp|RECURSE
FileKey4=%CommonAppData%\AOL\C_AOL*\bart|*.*|RECURSE
FileKey5=%CommonAppData%\AOL\C_AOL*\spool|*.*|RECURSE
FileKey6=%LocalAppData%\VirtualStore\ProgramData\AOL Downloads|*.*|RECURSE
FileKey7=%LocalAppData%\VirtualStore\ProgramData\AOL\C_AOL*|*.tmp|RECURSE
FileKey8=%LocalAppData%\VirtualStore\ProgramData\AOL\C_AOL*\bart|*.*|RECURSE
FileKey9=%LocalAppData%\VirtualStore\ProgramData\AOL\C_AOL*\spool|*.*|RECURSE
RegKey1=HKCU\Software\America Online\AOL Instant Messenger T\CurrentVersion\recent IM ScreenNames
RegKey2=HKCU\Software\America Online\AOL Instant Messenger T\CurrentVersion\recent ScreenNames
RegKey3=HKCU\Software\America Online\AOL Instant Messenger T\CurrentVersion\Users

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Ashampoo Burning Studio * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Ashampoo Burning Studio *]
LangSecRef=3021
Detect1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5
Detect2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6
Detect3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7
Detect4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8
Detect5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 12
Detect6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14
Detect7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15
Detect8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16
Detect9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18
Detect10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19
Detect11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007
Detect12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016
Detect13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017
Detect14=HKLM\Software\Ashampoo\Ashampoo Burning Studio 2009
Default=False
FileKey1=%AppData%\Ashampoo|*.xml;*.txt|RECURSE
FileKey2=%LocalAppData%\ashampoo\BaNT|*.*|RECURSE
RegKey1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Burn Image Project\SelectImage
RegKey2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\AddDialog
RegKey3=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Data Disc Project\DumpImage
RegKey4=HKCU\Software\Ashampoo\Ashampoo Burning Studio 5\Unknown Project\AddDialog
RegKey5=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Burn Image Project\SelectImage
RegKey6=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Data Disc Project\AddDialog
RegKey7=HKCU\Software\Ashampoo\Ashampoo Burning Studio 6\Unknown Project\AddDialog
RegKey8=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Burn Image Project\SelectImage
RegKey9=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Data Disc Project\AddDialog
RegKey10=HKCU\Software\Ashampoo\Ashampoo Burning Studio 7\Unknown Project\AddDialog
RegKey11=HKCU\Software\Ashampoo\Ashampoo Burning Studio 8\Data Disc Project\AddDialog
RegKey12=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey13=HKCU\Software\Ashampoo\Ashampoo Burning Studio 14\tempFiles
RegKey14=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey15=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\tempFiles
RegKey16=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey17=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Backup Project\BackupOptions|CustomLocation
RegKey18=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey19=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\BrowseImageFile|ImagePath
RegKey20=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey21=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey22=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Burn Image Project\SelectImage|ImagePath
RegKey23=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\DumpImage|ImagePath
RegKey24=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey25=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\MoviesPage|Path
RegKey26=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey27=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Logs
RegKey28=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\tempFiles
RegKey29=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\Unknown Project
RegKey30=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey31=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey32=HKCU\Software\Ashampoo\Ashampoo Burning Studio 16\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey33=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey34=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Backup Project\BackupOptions|CustomLocation
RegKey35=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey36=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\BrowseImageFile|ImagePath
RegKey37=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey38=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey39=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Burn Image Project\SelectImage|ImagePath
RegKey40=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\DumpImage|ImagePath
RegKey41=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey42=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\MoviesPage|Path
RegKey43=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey44=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Logs
RegKey45=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\tempFiles
RegKey46=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\Unknown Project
RegKey47=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey48=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey49=HKCU\Software\Ashampoo\Ashampoo Burning Studio 18\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey50=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey51=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Backup Project\BackupOptions|CustomLocation
RegKey52=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\BDMV Disc Project\SelectBDMVFolder|BdmvPath
RegKey53=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\BrowseImageFile|ImagePath
RegKey54=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey55=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey56=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Burn Image Project\SelectImage|ImagePath
RegKey57=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\DumpImage|ImagePath
RegKey58=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey59=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\MoviesPage|Path
RegKey60=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\DVD-Video Disc Project\SaveDialog_authed.CMoviesPage.Movies|InitialDirectory
RegKey61=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Logs
RegKey62=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\tempFiles
RegKey63=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\Unknown Project
RegKey64=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey65=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey66=HKCU\Software\Ashampoo\Ashampoo Burning Studio 19\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey67=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Burn Image Project\AddDialog
RegKey68=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Data Disc Project\AddDialog
RegKey69=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Dump Image Project\DumpImage
RegKey70=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2007\Unknown Project\AddDialog
RegKey71=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey72=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Backup Project\BackupOptions|CustomLocation
RegKey73=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\BrowseImageFile|ImagePath
RegKey74=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey75=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey76=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Burn Image Project\SelectImage|ImagePath
RegKey77=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\DumpImage|ImagePath
RegKey78=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey79=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Logs
RegKey80=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\tempFiles
RegKey81=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\Unknown Project
RegKey82=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey83=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey84=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2016\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath
RegKey85=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Audio Disc Project\SaveDialog_CPlaylistDlgEx|InitialDirectory
RegKey86=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Backup Project\BackupOptions|CustomLocation
RegKey87=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\BrowseImageFile|ImagePath
RegKey88=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Browse Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey89=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SaveDialog_SelectImageBrowse|InitialDirectory
RegKey90=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Burn Image Project\SelectImage|ImagePath
RegKey91=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\DumpImage|ImagePath
RegKey92=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory
RegKey93=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Logs
RegKey94=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\tempFiles
RegKey95=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\Unknown Project
RegKey96=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VCD Project\SaveDialog_OnAddMovies|InitialDirectory
RegKey97=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\DumpImage|ImagePath
RegKey98=HKCU\Software\Ashampoo\Ashampoo Burning Studio 2017\VIDEO_TS Disc Project\SelectVideoTSFolder|VideoTSPath

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Ashampoo Snap * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Ashampoo Snap *]
LangSecRef=3024
Detect1=HKCU\Software\Ashampoo\Ashampoo Snap 7
Detect2=HKCU\Software\Ashampoo\Ashampoo Snap 8
Detect3=HKCU\Software\Ashampoo\Ashampoo Snap 9
Detect4=HKCU\Software\Ashampoo\Ashampoo Snap 10
Default=False
FileKey1=%AppData%\Ashampoo\Ashampoo Snap *|*.*|RECURSE
FileKey2=%LocalAppData%\ashampoo\BaNT|*.*|RECURSE
FileKey3=%LocalAppData%\CrashRpt\UnsentCrashReports|*.*|RECURSE
FileKey4=%LocalAppData%\VirtualStore\Program Files*\Ashampoo\Ashampoo Snap *|_NLogMsg.txt
FileKey5=%ProgramFiles%\Ashampoo\Ashampoo Snap *|_NLogMsg.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Authhost * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Authhost *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windows.authhost.sso_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\microsoft.windows.authhost.sso_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\microsoft.windows.authhost.sso_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       Aviary Photo Editor * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Aviary Photo Editor *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\57AB5DD0.PhotoEditor_6hb943tstq5q8
DetectFile=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_6hb943tstq5q8
Default=False
FileKey1=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\LocalState|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\57AB5DD0.PhotoEditor_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Bing Finance * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Finance *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingFinance_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingFinance_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.BingFinance_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingFinance_*\TempState|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       Bing Food and Drink * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Food and Drink *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingFoodAndDrink_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingFoodAndDrink_*\LocalState\Cache|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Bing Health and Fitness * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Health and Fitness *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingHealthAndFitness_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingHealthAndFitness_*\LocalState\Cache|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Bing Maps * has been modified.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Maps *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingMaps_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingMaps_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\CLR_v4.0\NativeImages\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.BingMaps*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.BingMaps*\LocalState\Bing.Maps|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.BingMaps*\LocalState\MapInstrumentation|*.*
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingMaps_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Bing News * has been removed.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing News *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\PRICache|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingNews_*\LocalState\navigationHistory|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Bing Search * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Search *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Bing_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.Bing_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Bing_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Bing_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Bing Sports * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Sports *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingSports_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingSports_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.BingSports_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingSports_*\LocalState\navigationHistory|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingSports_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingSports_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Bing Travel * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Travel *]
DetectOS=6.2|6.3
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingTravel_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingTravel_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingTravel_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingTravel_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingTravel_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.BingTravel_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingTravel_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Bing Weather * has been removed.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Bing Weather *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingWeather_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\CLR_v4.0|*.log
FileKey4=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState|*.tmp
FileKey10=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\Cache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\navigationHistory|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.BingWeather_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                               Box * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Box *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\134D4F5B.Box_2qk4zy5s3qmee
DetectFile=%LocalAppData%\Packages\134D4F5B.Box_2qk4zy5s3qmee
Default=False
FileKey1=%LocalAppData%\Packages\*Box_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*Box_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*Box_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*Box_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*Box_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey6=%LocalAppData%\Packages\*Box_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\*Box_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\*Box_*\LocalState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\*Box_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Camera * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Camera *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Camera_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsCamera_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft*Camera_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft*Camera_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft*Camera_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft*Camera_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft*Camera_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\Microsoft*Camera_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\LocalState\AppData|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\LocalState\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WindowsCamera_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Camera_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft*Camera_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                               CNN * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[CNN *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\588E6FFA.CNNAppforWindows_cs8eyncph15zy
DetectFile=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_cs8eyncph15zy
Default=False
FileKey1=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Microsoft\CLR_v4.0|*.log
FileKey3=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Comms Phone * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Comms Phone *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.CommsPhone_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.CommsPhone_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.CommsPhone_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.CommsPhone_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.CommsPhone_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Connectivity Store * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Connectivity Store *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ConnectivityStore_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                         Contact Support * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Contact Support *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Windows.ContactSupport_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey4=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Windows.ContactSupport_*\AC\Temp|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Windows.ContactSupport_*\LocalCache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Windows.ContactSupport_*\LocalState\Cache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Windows.ContactSupport_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Windows.ContactSupport_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Content Delivery Manager * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Content Delivery Manager *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\BackgroundTransferApi|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INet*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\Favicons|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\MobilityExperience\ImageCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\OneSettingsResponseCache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\TargetedContentCache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Coowon Browser - Cookies * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Cookies *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*|Cookies;Cookies-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Coowon Browser - GPU Cache * has been removed.                                  ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - GPU Cache *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*\GPUCache|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  Coowon Browser - Internet Cache * has been removed.                               ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Internet Cache *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*|Favicons;Favicons-journal
FileKey2=%LocalAppData%\Coowon\Coowon\User Data\*\Cache|*.*|REMOVESELF

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                Coowon Browser - Internet History * has been removed.                               ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Internet History *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*|Archived History;Archived History-journal;History;History Provider Cache;History-journal;Visited Links;Top Sites;Top Sites-journal
FileKey2=%LocalAppData%\Coowon\Coowon\User Data\*\JumpListIcons*|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  Coowon Browser - Local Storage * has been removed.                                ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Local Storage *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*\Local Storage|http*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Coowon Browser - Login Data * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Login Data *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*|Login Data;Login Data-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Coowon Browser - Logs * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Logs *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\Application|debug.log
FileKey2=%LocalAppData%\Coowon\Coowon\User Data\*\Extension State|LOG.*;*.log;Log
FileKey3=%LocalAppData%\Coowon\Coowon\User Data\*\Session Storage|LOG.*;*.log;Log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Coowon Browser - Session * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Coowon Browser - Session *]
LangSecRef=3029
Detect=HKCU\Software\Coowon
Default=False
FileKey1=%LocalAppData%\Coowon\Coowon\User Data\*|Current Tabs;Current session;Last Tabs;Last Session

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             Cortana * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Cortana *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Cortana_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Cortana_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft*Cortana_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft*Cortana_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft*Cortana_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft*Cortana_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft*Cortana_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft*Cortana_*\TempState|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\*Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                 Dr. Despicable?s Dastardly Deeds * has been removed.                               ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Dr. Despicable?s Dastardly Deeds *]
Section=Games
DetectFile=%AppData%\HitPoint Studios\DrD
Default=False
FileKey1=%AppData%\HitPoint Studios\DrD|logfile.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                         DxO Photo Suite * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[DxO Photo Suite *]
LangSecRef=3021
Detect1=HKCU\Software\DxO
Detect2=HKCU\Software\DxO Labs
Detect3=HKCU\Software\DxOLabs
Detect4=HKLM\Software\DxO
Detect5=HKLM\Software\DxO Labs
Detect6=HKLM\Software\DxOLabs
Default=False
FileKey1=%Documents%\DxO * crash*s|*.*
FileKey2=%Documents%\DxO * logs|*.*
FileKey3=%Documents%\DxO*\CrashReports|*.*|RECURSE
FileKey4=%Documents%\DxO*\log|*.*
FileKey5=%LocalAppData%\DxO*\DataCache|*.*|RECURSE
FileKey6=%LocalAppData%\DxO*\DxO*\*Cache|*.*|RECURSE
FileKey7=%LocalAppData%\DxO*\DxO*\CrashReports|*.*|RECURSE
FileKey8=%LocalAppData%\DxO*\DxO*\Logs|*.*
FileKey9=%LocalAppData%\DxO*\Logs|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          ESPN Cricinfo * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[ESPN Cricinfo *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma
DetectFile=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma
Default=False
FileKey1=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\Microsoft\CLR_v4.0\NativeImages\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\LocalState|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\ESPNCricinfo.ESPNCricinfo_y1atfjxm9t5ma\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             ESPN FC * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[ESPN FC *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma
DetectFile=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma
Default=False
FileKey1=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\AC\Temp|*.*
FileKey5=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\LocalState|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\ESPNCricinfo.ESPNFC_y1atfjxm9t5ma\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        FastStone Capture * has been modified.                                      ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FastStone Capture *]
LangSecRef=3024
Detect=HKCU\Software\FastStone Capture
DetectFile=%AppData%\FastStone\FSC
Default=False
FileKey1=%AppData%\FastStone\FSC|*.bak;fsc.db
FileKey2=%LocalAppData%\FastStone\FSC|fsc.db
RegKey1=HKCU\Software\FastStone|_LastClipPlayed
RegKey2=HKCU\Software\FastStone|_LastRecordingFileName
RegKey3=HKCU\Software\FastStone\APP.FSRecorder\Global|_GrbId
RegKey4=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastClipPlayed
RegKey5=HKCU\Software\FastStone\APP.FSRecorder\Global|_LastRecordingFileName

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Feedback Hub * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Feedback Hub *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              FilmOn * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FilmOn *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\FilmOnLiveTVFree.FilmOnLiveTVFree_zx03kxexxb716
DetectFile=%LocalAppData%\Packages\FilmOnLiveTVFree.FilmOnLiveTVFree_zx03kxexxb716
Default=False
FileKey1=%LocalAppData%\Packages\FilmOnLiveTVFree.FilmOnLiveTVFree_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\FilmOnLiveTVFree.FilmOnLiveTVFree_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\FilmOnLiveTVFree.FilmOnLiveTVFree_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\FilmOnLiveTVFree.FilmOnLiveTVFree_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\FilmOnLiveTVFree.FilmOnLiveTVFree_zx03kxexxb716\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\FilmOnLiveTVFree.FilmOnLiveTVFree_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            FossaMail * has been removed.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FossaMail *]
LangSecRef=3030
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Crash Reports|*.*|REMOVESELF
FileKey2=%AppData%\FossaMail\Profiles\*|TestPilotErrorLog.*;extensions.log|RECURSE
FileKey3=%CommonAppData%\Mozilla*\logs|*.*|REMOVESELF
FileKey4=%LocalAppData%\FossaMail\Mozilla\*\Updates|*.log|RECURSE
FileKey5=%LocalAppData%\VirtualStore\Program Files*\FossaMail|*.log
FileKey6=%LocalAppData%\VirtualStore\ProgramData\Mozilla*\logs|*.*|REMOVESELF
FileKey7=%ProgramFiles%\FossaMail|*.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    FossaMail Corrupt SQLites * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FossaMail Corrupt SQLites *]
LangSecRef=3030
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles|*.corrupt|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        FossaMail Minidumps * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FossaMail Minidumps *]
LangSecRef=3030
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles\*\Minidumps|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      FossaMail Startup Cache * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FossaMail Startup Cache *]
LangSecRef=3030
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%LocalAppData%\FossaMail\Profiles\*\startupCache|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  FossaMail webappsstore.sqlite * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[FossaMail webappsstore.sqlite *]
LangSecRef=3030
Detect=HKLM\Software\Mozilla\FossaMail
Default=False
FileKey1=%AppData%\FossaMail\Profiles\*|webappsstore.sqlite

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Foxit PhantomPDF * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Foxit PhantomPDF *]
LangSecRef=3021
Detect1=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0
Detect2=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0
Detect3=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0
Detect4=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0
Default=False
FileKey1=%AppData%\Foxit Software\Foxit PDF Creator\Creator-Log|*.*|RECURSE
FileKey2=%AppData%\Foxit Software\Foxit PhantomPDF\FormFiller|AutoComplete.ds
FileKey3=%AppData%\Foxit Software\RMS|FXRMS_Log.txt
FileKey4=%LocalAppData%\Foxit PhantomPDF\msilog|*.log
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Roaming\Foxit Software\Foxit PDF Creator|*__foxittemp.xml|RECURSE
RegKey1=HKCU\Software\Foxit Software Company\Foxit PDF Editor|Recent File List
RegKey2=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\History
RegKey3=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\RecentFiles
RegKey4=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\File MRU
RegKey5=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\Place MRU
RegKey6=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\plugins\JSPlugins
RegKey7=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Preferences\History
RegKey8=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Recent File List
RegKey9=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\CommentPanel\Filter
RegKey10=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey11=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\File MRU
RegKey12=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\Place MRU
RegKey13=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\plugins\JSPlugins
RegKey14=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Preferences\History
RegKey15=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Recent File List
RegKey16=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\CommentPanel\Filter
RegKey17=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey18=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\File MRU
RegKey19=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\Place MRU
RegKey20=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\plugins\JSPlugins
RegKey21=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Preferences\History
RegKey22=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Recent File List

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            GasBuddy * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[GasBuddy *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\45351D82.GasBuddy-FindCheapGasPrices_932xwky9axss4
DetectFile=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_932xwky9axss4
Default=False
FileKey1=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\Temp|*.*
FileKey5=%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\45351D82.GasBuddy-FindCheapGasPrices_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Get Office * has been removed.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Get Office *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\AppData\Local\Office\16.0\WebServiceCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\Cache|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Get Started * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Get Started *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Getstarted_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Getstarted_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Getstarted_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Getstarted_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Getstarted_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Getstarted_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Getstarted_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Gravity Guy * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Gravity Guy *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MiniclipSA.GravityGuy_gpanv85qtf6rc
DetectFile=%LocalAppData%\Packages\MiniclipSA.GravityGuy_gpanv85qtf6rc
Default=False
FileKey1=%LocalAppData%\Packages\MiniclipSA.GravityGuy_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\MiniclipSA.GravityGuy_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\MiniclipSA.GravityGuy_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Groove Music * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Groove Music *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\*Cache*|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\Database\*|*.log
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\navigationHistory|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\PlayReady|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Halo Spartan Assault * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Halo Spartan Assault *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.HaloSpartanAssault_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        HP Printer Control * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[HP Printer Control *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AD2F1837.HPPrinterControl_v10z8vjag6ke6
DetectFile=%LocalAppData%\Packages\AD2F1837.HPPrinterControl_v10z8vjag6ke6
Default=False
FileKey1=%LocalAppData%\Packages\*HPPrinterControl_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*HPPrinterControl_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*HPPrinterControl_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*HPPrinterControl_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\*HPPrinterControl_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*HPPrinterControl_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*HPPrinterControl_*\LocalState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\*HPPrinterControl_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       HP Scan and Capture * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[HP Scan and Capture *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AD2F1837.HPScanandCapture_v10z8vjag6ke6
DetectFile=%LocalAppData%\Packages\AD2F1837.HPScanandCapture_v10z8vjag6ke6
Default=False
FileKey1=%LocalAppData%\Packages\*HPScanandCapture_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*HPScanandCapture_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*HPScanandCapture_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*HPScanandCapture_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\*HPScanandCapture_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*HPScanandCapture_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*HPScanandCapture_*\LocalState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\*HPScanandCapture_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Hyper for Youtube * has been modified.                                      ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Hyper for Youtube *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\19120CensoredUser.HyperforYouTube_c0tqyanwsgfn6
DetectFile=%LocalAppData%\Packages\19120CensoredUser.HyperforYouTube_c0tqyanwsgfn6
Default=False
FileKey1=%LocalAppData%\Packages\*.HyperforYouTube_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.HyperforYouTube_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*.HyperforYouTube_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\*.HyperforYouTube_*\LocalState|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*.HyperforYouTube_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\19120CensoredUser.HyperforYouTube_c0tqyanwsgfn6\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\*.HyperforYouTube_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Icon Cache * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Icon Cache *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
Warning=You may need to restart explorer.exe for this to take effect.
FileKey1=%LocalAppData%|IconCache.db
FileKey2=%LocalAppData%\Microsoft\Windows\Explorer|iconcache_*.db

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Immersive Control Panel * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Immersive Control Panel *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy
DetectFile=%LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\windows.immersivecontrolpanel_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\windows.immersivecontrolpanel_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Internet Explorer * has been modified.                                      ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Internet Explorer *]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Internet Explorer
Default=False
FileKey1=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE
FileKey3=%LocalAppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Windows\IECompatUaCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\windows_ie_ac_*\AC\AppCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\windows_ie_ac_*\AC\INet*|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey9=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\windows_ie_ac_*\AC\PRICache|*.*
FileKey11=%LocalAppData%\Packages\windows_ie_ac_*\AC\Temp|*.*
FileKey12=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\Cache|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\navigationHistory|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\windows_ie_ac_*\TempState|*.*|RECURSE
FileKey15=%WinDir%\System32\config\Systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
RegKey1=HKCR\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage
RegKey2=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore
RegKey3=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage
RegKey4=HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl
RegKey5=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
ExcludeKey1=FILE|%LocalAppData%\Packages\windows_ie_ac_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Kaspersky Now * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Kaspersky Now *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\KasperskyLab.KasperskyNow_8jx5e25qw3tdc
Default=False
FileKey1=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Microsoft\CLR_v4.0_32|*.log
FileKey3=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\LocalCache|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\KasperskyLab.KasperskyNow_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             LifeCam * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[LifeCam *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.LifeCamDashboard_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\PRICache|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.LifeCamDashboard_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Lock App * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Lock App *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.LockApp_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.LockApp_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.LockApp_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.LockApp_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.LockApp_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.LockApp_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              MAGIX * has been removed.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[MAGIX *]
LangSecRef=3023
Detect=HKCU\Software\Magix
Default=False
FileKey1=%CommonAppData%\MAGIX\*|*.log|RECURSE
FileKey2=%LocalAppData%\VirtualStore\Program Files*\MAGIX\*|*.log|RECURSE
FileKey3=%LocalAppData%\VirtualStore\ProgramData\MAGIX\*|*.log|RECURSE
FileKey4=%ProgramFiles%\MAGIX\*|*.log|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          MAGIX Backups * has been removed.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[MAGIX Backups *]
LangSecRef=3023
Detect=HKCU\Software\Magix
Default=False
FileKey1=%CommonAppData%\MAGIX\*|*.reg|RECURSE
FileKey2=%LocalAppData%\VirtualStore\ProgramData\MAGIX\*|*.reg|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      MAGIX Driver Downloads * has been removed.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[MAGIX Driver Downloads *]
LangSecRef=3023
Detect=HKCU\Software\Magix
Default=False
FileKey1=%CommonAppData%\MAGIX\*\download|*.*|REMOVESELF
FileKey2=%LocalAppData%\VirtualStore\ProgramData\MAGIX\*\download|*.*|REMOVESELF

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Maps * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Maps *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsMaps_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsMaps_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsMaps_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     Media Play Ready Client * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Media Play Ready Client *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Media.PlayReadyClient_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Messaging * has been modified.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Messaging *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Messaging_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Messaging_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Messaging_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Messaging_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Messaging_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Messaging_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Messaging_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Messaging_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Microsoft Edge * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Microsoft Edge *]
LangSecRef=3022
Detect=HKCU\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\INetCookies|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\Microsoft\Cryptnet*Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Microsoft\Cryptnet*Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\Datastore\Data\nouser1\*\Favorites|*.ico
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Indexed\Data\nouser1\*|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\ImageStore|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Temp|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AppData\User\Default\Indexed DB|*.*|RECURSE
FileKey11=%UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Microsoft Reader * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Microsoft Reader *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.Reader_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Reader_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Reader_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.Reader_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\Microsoft.Reader_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.Reader_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Reader_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Reader_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Microsoft.VCLibs * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Microsoft.VCLibs *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.VCLibs.110.00_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.VCLibs.120.00_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.VCLibs.1*0.00_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.VCLibs.*_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.VCLibs.*_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Movies & TV * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Movies & TV *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe*
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\*Cache*|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Database\anonymous|*.log
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\navigationHistory|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\PlayReady|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              MWConn * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[MWConn *]
LangSecRef=3022
DetectFile1=%AppData%\Microsoft\Windows\Start Menu\Programs\MWconn
DetectFile2=%AppData%\Microsoft\Windows\Startmenü\Programs\MWconn
DetectFile3=%UserProfile%\Start Menu\Programs\MWconn
DetectFile4=%UserProfile%\Startmenü\Programme\MWconn
Default=False
FileKey1=%AppData%\Microsoft\Windows\Start*\Program*\MWconn|connlog.txt
FileKey2=%UserProfile%\Start*\Program*\MWconn|connlog.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            MWConn SMS * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[MWConn SMS *]
LangSecRef=3022
DetectFile1=%AppData%\Microsoft\Windows\Start Menu\Programs\MWconn
DetectFile2=%AppData%\Microsoft\Windows\Startmenü\Programs\MWconn
DetectFile3=%UserProfile%\Start Menu\Programs\MWconn
DetectFile4=%UserProfile%\Startmenü\Programme\MWconn
Default=False
Warning=This will delete all of your SMS messages.
FileKey1=%AppData%\Microsoft\Windows\Start*\Program*\MWconn\sms_*|*.*|RECURSE
FileKey2=%UserProfile%\Start*\Program*\MWconn\sms_*|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            NBC News * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[NBC News *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\msnbc.comDigitalNetwork.msnbc.com_amdjbdaxqsje6
DetectFile=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_amdjbdaxqsje6
Default=False
FileKey1=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Microsoft\CLR_v4.0|*.log
FileKey3=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             Netflix * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Netflix *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\4DF9E0F8.Netflix_mcm4njqhnhss8
DetectFile=%LocalAppData%\Packages\4DF9E0F8.Netflix_mcm4njqhnhss8
Default=False
FileKey1=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AppData\Indexed DB|*.log
FileKey7=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalState|*.tmp|RECURSE
FileKey8=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\LocalState\LiveTile|*.*
FileKey9=%LocalAppData%\Packages\4DF9E0F8.Netflix_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\4DF9E0F8.Netflix_mcm4njqhnhss8\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\4DF9E0F8.Netflix_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Network Speed Test * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Network Speed Test *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.NetworkSpeedTest_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\Temp|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.NetworkSpeedTest_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                             OneNote * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[OneNote *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.OneNote_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local|msodata*.dat
FileKey5=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\office*client.microsoft.com|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\Office\OTele|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\OneNote\16.0|*.onecache
FileKey8=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\LocalState\AppData\Local\OneNote\16.0\OneNote*Cache_Files|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.Office.OneNote_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.OneNote_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Office.OneNote_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Ookla Speed Test * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Ookla Speed Test *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Ookla.SpeedtestbyOokla_43tkc6nmykmb6
DetectFile=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_43tkc6nmykmb6
Default=False
FileKey1=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey3=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\LocalState|*.tmp|RECURSE
FileKey5=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\LocalState\Unity\Local.*\Analytics\ArchivedEvents\*|*.*|REMOVESELF
FileKey6=%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Ookla.SpeedtestbyOokla_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Pale Moon - Adblock Backups * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Adblock Backups *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblock*|patterns-backup*.ini

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                   Pale Moon - Bookmark Backups * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Bookmark Backups *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\bookmarkbackups|*.json*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Pale Moon - Cache * has been removed.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Cache *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*\cache2|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Pale Moon - Cookies * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Cookies *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|cookies.sqlite

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Pale Moon - Corrupt SQLites * has been removed.                                 ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Corrupt SQLites *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles|*.corrupt|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Pale Moon - Crash Reports * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Crash Reports *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Crash Reports|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Pale Moon - extensions.log * has been removed.                                  ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - extensions.log *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|extensions.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Pale Moon - Lock Files * has been removed.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Lock Files *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|*.lock

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Pale Moon - Minidumps * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Minidumps *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\minidumps|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    Pale Moon - Startup Cache * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Startup Cache *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*\startupCache|startupCache.8.little

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Pale Moon - Telemetry * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Telemetry *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|Telemetry*.*
FileKey2=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\saved-telemetry-pings|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Pale Moon - Updates * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - Updates *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%LocalAppData%\Moonchild Productions\Pale Moon\Pale Moon\updates|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  Pale Moon - webappsstore.sqlite * has been removed.                               ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pale Moon - webappsstore.sqlite *]
LangSecRef=3026
Detect=HKLM\Software\Mozilla\Pale Moon
DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe
Default=False
FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|webappsstore.sqlite

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              People * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[People *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.People_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.People_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.People_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.People_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.People_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.People_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.People_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.People_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.People_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Phone * has been modified.                                            ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Phone *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsPhone_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsPhone_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsPhone_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Photos * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Photos *]
DetectOS=10.0|
LangSecRef=3031
Default=False
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\LocalState|*.sqlite;*.sqlite-shm;*.sqlite-wal;*.xml
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\LocalState\PhotosAppTile|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.Photos_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedPickerData\Microsoft.Windows.Photos_8wekyb3d8bbwe!App\DefaultSaveFileSingle
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\ManagedByApp
RegKey3=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Photos_8wekyb3d8bbwe\PersistedStorageItemTable\MostRecentlyUsed
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Photos_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Pokki * has been modified.                                            ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pokki *]
LangSecRef=3022
Detect=HKCU\Software\Pokki
Default=False
FileKey1=%LocalAppData%\Pokki|*.log|RECURSE
FileKey2=%LocalAppData%\Pokki\PokkiIconCache|*.*|RECURSE
FileKey3=%LocalAppData%\Pokki\UserData\*|*.bak|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Pokki Internet Traces * has been modified.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Pokki Internet Traces *]
LangSecRef=3022
Detect=HKCU\Software\Pokki
Default=False
FileKey1=%LocalAppData%\Pokki\UserData\*|Cookies*;Favicons*;*History*;Top Sites*;Visited Links;Web Data*
FileKey2=%LocalAppData%\Pokki\UserData\*\Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Pokki\UserData\*\LocalStorage|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              QuizUp * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[QuizUp *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\QuizUp.QuizUp_n36z36qeaxk8a
Default=False
FileKey1=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Microsoft\CLR_v4.0*|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\Temp|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\QuizUp.QuizUp_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\QuizUp.QuizUp_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\QuizUp.QuizUp_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\QuizUp.QuizUp_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Realtek Logs * has been removed.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Realtek Logs *]
LangSecRef=3024
Detect=HKLM\Software\Realtek
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Realtek*|*.log;*.txt|RECURSE
FileKey2=%ProgramFiles%\Realtek*|*.*log;*.txt|RECURSE
FileKey3=%SystemDrive%|RHDSetup.log
ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\|InstCtrl.txt
ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\|setupctrl.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                         Reckless Racing * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Reckless Racing *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Studios.RecklessRacingUltimate_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Reddit To Go! * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Reddit To Go! *]
LangSecRef=3031
DetectFile=%LocalAppData%\Packages\*.RedditToGo_*
Default=False
FileKey1=%LocalAppData%\Packages\*.RedditToGo_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*.RedditToGo_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*.RedditToGo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\*.RedditToGo_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\*.RedditToGo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\*.RedditToGo_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*.RedditToGo_*\RoamingState|history.txt
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\55382ross456.RedditToGo_02dxdbb1qg9kw\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\*.RedditToGo_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Scan * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Scan *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsScan_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsScan_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsScan_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsScan_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsScan_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            SdfBrowser * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SdfBrowser *]
LangSecRef=3024
DetectFile=%AppData%\BokorBéla\SdfBrowser
Default=False
FileKey1=%AppData%\BokorBéla\SdfBrowser|*.log

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            SeaMonkey * has been removed.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SeaMonkey *]
LangSecRef=3026
DetectFile=%AppData%\Mozilla\SeaMonkey
Default=False
FileKey1=%AppData%\Mozilla\SeaMonkey\Crash Reports|*.*|REMOVESELF
FileKey2=%AppData%\Mozilla\SeaMonkey\Profiles|TestPilotErrorLog.*;*.corrupt|RECURSE
FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*|seer.sqlite;netpredictions.sqlite;sessionstore.bak;FlashGot.log;FlashGot.log.bak*;lazarus.sqlite;lazarus-backup.sqlite;Telemetry*.*;webappsstore.sqlite;*.lock
FileKey4=%AppData%\Mozilla\SeaMonkey\Profiles\*\adblock*|patterns-backup*.ini;*.tmp
FileKey5=%AppData%\Mozilla\SeaMonkey\Profiles\*\bookmarkbackups|*.json*
FileKey6=%AppData%\Mozilla\SeaMonkey\Profiles\*\chatzilla|inputHistory.txt
FileKey7=%AppData%\Mozilla\SeaMonkey\Profiles\*\datareporting\archived|*.jsonlz4|REMOVESELF
FileKey8=%AppData%\Mozilla\SeaMonkey\Profiles\*\minidumps|*.*
FileKey9=%AppData%\Mozilla\SeaMonkey\Profiles\*\saved-telemetry-pings|*.*
FileKey10=%AppData%\Mozilla\SeaMonkey\Profiles\*\sessions\Deleted Sessions|*.session
FileKey11=%AppData%\Mozilla\SeaMonkey\Profiles\*\storage|*.*|REMOVESELF
FileKey12=%AppData%\Mozilla\SeaMonkey\Profiles\*\weave\logs|*.*
FileKey13=%LocalAppData%\Mozilla\SeaMonkey\*\updates|*.*|RECURSE
FileKey14=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*|urlclassifier3.sqlite
FileKey15=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*\shortcutCache|*.*
FileKey16=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*\startupCache|*.*
ExcludeKey1=PATH|%AppData%\Mozilla\SeaMonkey\Profiles\*\storage\default\moz-extension*\|*.*

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Shark Dash * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Shark Dash *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\GAMELOFTSA.SharkDashByGameloft_0pp20fcewvvtj
DetectFile=%LocalAppData%\Packages\GAMELOFTSA.SharkDashByGameloft_0pp20fcewvvtj
Default=False
FileKey1=%LocalAppData%\Packages\GAMELOFTSA.SharkDashByGameloft_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\GAMELOFTSA.SharkDashByGameloft_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\GAMELOFTSA.SharkDashByGameloft_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Shell Experience Host * has been modified.                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Shell Experience Host *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.ShellExperienceHost_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Shuffle Party * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Shuffle Party *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ShuffleParty_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.ShuffleParty_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\Microsoft\CryptnetUrlCache\*|*.*
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.ShuffleParty_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          SkyDrive App * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SkyDrive App *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\microsoft.microsoftskydrive_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\PersistedPickerData\microsoft.microsoftskydrive_8wekyb3d8bbwe!Microsoft.MicrosoftSkyDrive\DefaultOpenFileMultiple|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           Skype Metro * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Skype Metro *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SkypeApp_kzf8qxf38zg5c
DetectFile=%LocalAppData%\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.SkypeApp_*\LocalState|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.SkypeApp_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.SkypeApp_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        SlimJet - Cookies * has been removed.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - Cookies *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default|Cookies;Cookies-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        SlimJet - Favicons * has been removed.                                      ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - Favicons *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default|Favicons;Favicons-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        SlimJet - GPU Cache * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - GPU Cache *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default\GPUCache|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     SlimJet - Internet Cache * has been removed.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - Internet Cache *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default\Cache|*.*|REMOVESELF

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                    SlimJet - Internet History * has been removed.                                  ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - Internet History *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default|Archived History;Archived History-journal;History;History Provider Cache;History-journal;Visited Links;Top Sites;Top Sites-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       SlimJet - Login Data * has been removed.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - Login Data *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default|Login Data;Login Data-journal

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        SlimJet - Session * has been removed.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[SlimJet - Session *]
LangSecRef=3029
DetectFile=%LocalAppData%\SlimJet
Default=False
FileKey1=%LocalAppData%\SlimJet\User Data\Default|Last Session;Last Tabs;Current Session;Current Tabs

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Sound Recorder * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Sound Recorder *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                Spybot Search and Destroy History * has been modified.                              ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Spybot Search and Destroy History *]
LangSecRef=3024
Detect=HKLM\Software\Safer Networking Limited\SpybotSnD
Default=False
FileKey1=%CommonAppData%\Spybot - Search & Destroy\Backups|*.*|RECURSE
FileKey2=%CommonAppData%\Spybot - Search & Destroy\Recovery|*.*|RECURSE
FileKey3=%CommonAppData%\Spybot - Search & Destroy\Snapshots*|*.*|RECURSE
FileKey4=%LocalAppData%\VirtualStore\ProgramData\Spybot - Search & Destroy\Backups|*.*|RECURSE
FileKey5=%LocalAppData%\VirtualStore\ProgramData\Spybot - Search & Destroy\Recovery|*.*|RECURSE
FileKey6=%LocalAppData%\VirtualStore\ProgramData\Spybot - Search & Destroy\Snapshots*|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Store * has been modified.                                            ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Store *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsStore_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\*Win*Store_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*Win*Store_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*Win*Store_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\*Win*Store_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\*Win*Store_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\*Win*Store_*\AC\Microsoft\Windows Store\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\*Win*Store_*\AC\Microsoft\Windows Store\Data|history.dat
FileKey8=%LocalAppData%\Packages\*Win*Store_*\AC\PRICache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\*Win*Store_*\AC\Temp|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\*Win*Store_*\LocalState\Cache|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\*Win*Store_*\LocalState\navigationHistory|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.WindowsStore_*\LocalCache\*|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\WinStore_*\LocalState\LiveTile|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsStore_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Sway * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Sway *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Office.Sway_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Office.Sway_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Office.Sway_*\LocalState\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.Office.Sway_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Office.Sway_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Team Crossword * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Team Crossword *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.TeamCrossword_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.TeamCrossword_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey4=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\PRICache|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\Microsoft.TeamCrossword_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.TeamCrossword_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            The Quran * has been modified.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[The Quran *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\57100Goheer.TheQuran_s6gg0ptmhrgye
DetectFile=%LocalAppData%\Packages\57100Goheer.TheQuran_s6gg0ptmhrgye
Default=False
FileKey1=%LocalAppData%\Packages\*TheQuran_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*TheQuran_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*TheQuran_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey4=%LocalAppData%\Packages\*TheQuran_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\*TheQuran_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\*TheQuran_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\*TheQuran_*\LocalState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\*TheQuran_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                       The Weather Channel * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[The Weather Channel *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\TheWeatherChannel_t3yemqpq4kp7p
DetectFile=%LocalAppData%\Packages\Weather.TheWeatherChannel_t3yemqpq4kp7p
Default=False
FileKey1=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.log|RECURSE
FileKey3=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\Temp|*.*
FileKey4=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\LocalState|*.tmp
FileKey5=%LocalAppData%\Packages\Weather.TheWeatherChannel_*\TempState\Bing.Maps\Cache|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Weather.TheWeatherChannel_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            Tubebox! * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Tubebox! *]
LangSecRef=3023
DetectFile1=%UserProfile%\Start Menu\Programs\TubeBox!
DetectFile2=%UserProfile%\Startmenü\Programme\TubeBox!
Default=False
FileKey1=%UserProfile%\Start*\Program*\TubeBox!|TubeBox!-Log.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Twitter Metro * has been modified.                                        ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Twitter Metro *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\9E2F88E3.Twitter_wgeqdkkx372wm
DetectFile=%LocalAppData%\Packages\9E2F88E3.Twitter_wgeqdkkx372wm
Default=False
FileKey1=%LocalAppData%\Packages\*Twitter_*\AC\INetC*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*Twitter_*\AC\Microsoft\*|*.LOG|RECURSE
FileKey3=%LocalAppData%\Packages\*Twitter_*\AC\PRICache|*.*
FileKey4=%LocalAppData%\Packages\*Twitter_*\LocalState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\*Twitter_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                            USA Today * has been modified.                                          ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[USA Today *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\USATODAY.USATODAY_wy7mw3214mat8
DetectFile=%LocalAppData%\Packages\USATODAY.USATODAY_wy7mw3214mat8
Default=False
FileKey1=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\CLR_v4.0|*.log
FileKey3=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\PRICache|*.*
FileKey6=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Temp|*.*
FileKey7=%LocalAppData%\Packages\USATODAY.USATODAY_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Waterfox Installer * has been modified.                                     ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Waterfox Installer *]
LangSecRef=3026
DetectFile=%ProgramFiles%\Waterfox
Default=False
FileKey1=%AppData%\Waterfox*\Waterfox*\install|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                        Windows Feedback * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Windows Feedback *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFeedback_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\LocalCache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\LocalState\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsFeedback_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Windows Logs * has been modified.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Windows Logs *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%CommonAppData%\Microsoft\Network\Downloader|*.*|RECURSE
FileKey2=%CommonAppData%\Microsoft\Windows Security Health\Logs|*.*|RECURSE
FileKey3=%CommonAppData%\USOShared\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\ConnectedDevicesPlatform|*.log
FileKey5=%LocalAppData%\Diagnostics|*.*|RECURSE
FileKey6=%ProgramFiles%\UNP\Logs|*.*
FileKey7=%SystemDrive%\PerfLogs\System\Diagnostics|*.*|RECURSE
FileKey8=%SystemDrive%\PerfLogs\System\Performance|*.*|RECURSE
FileKey9=%WinDir%\debug\WIA|*.log
FileKey10=%WinDir%\inf|*.log*
FileKey11=%WinDir%\Logs\CBS|*.cab
FileKey12=%WinDir%\Logs\dosvc|*.*|RECURSE
FileKey13=%WinDir%\Logs\NetSetup|*.*|RECURSE
FileKey14=%WinDir%\Logs\SIH|*.*|RECURSE
FileKey15=%WinDir%\Logs\WindowsBackup|*.etl
FileKey16=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.log
FileKey17=%WinDir%\Panther\FastCleanup|*.log
FileKey18=%WinDir%\Panther\Rollback|*.txt
FileKey19=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml
FileKey20=%WinDir%\repair|setup.log
FileKey21=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt
FileKey22=%WinDir%\System32\LogFiles\HTTPERR|*.log
FileKey23=%WinDir%\System32\LogFiles\Scm|*.*|RECURSE
FileKey24=%WinDir%\System32\LogFiles\Srt|*.*|RECURSE
FileKey25=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log
FileKey26=%WinDir%\System32\WDI\*|snapshot.etl|REMOVESELF
FileKey27=%WinDir%\System32\WDI\LogFiles\StartupInfo|*.*|RECURSE
RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey2=HKLM\Software\Microsoft\Tracing
RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Windows Photos * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Windows Photos *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowsphotos_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\microsoft.windowsphotos_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\BackgroundTransferApi|*.down_data;*.up_meta
FileKey3=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\INet*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey6=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\PRICache|*.*
FileKey8=%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\Temp|*.*
FileKey9=%LocalAppData%\Packages\microsoft.windowsphotos_*\LocalState|*.log;*.jpg
FileKey10=%LocalAppData%\Packages\microsoft.windowsphotos_*\LocalState\bici|*.sqm
FileKey11=%LocalAppData%\Packages\microsoft.windowsphotos_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowsphotos_8wekyb3d8bbwe\SearchHisto
ExcludeKey1=FILE|%LocalAppData%\Packages\microsoft.windowsphotos_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              WinJS * has been modified.                                            ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[WinJS *]
LangSecRef=3031
Detect1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WinJS.1.0_8wekyb3d8bbwe
Detect2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WinJS.2.0_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.WinJS.*.0_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\LocalState\*Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WinJS.*.*_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Xbox * has been modified.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Xbox *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxApp_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState|*.log;*.log*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\*Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\SmartGlass|*.log
FileKey8=%LocalAppData%\Packages\Microsoft.XboxApp_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Xbox Identity Provider * has been modified.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Xbox Identity Provider *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CLR_v4.0*|*.log
FileKey3=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CLR_v4.0*\NativeImages\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.XboxIdentityProvider_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                         Xbox LIVE Games * has been modified.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Xbox LIVE Games *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxLIVEGames_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Microsoft\CryptnetUrlCache\*|*.*
FileKey5=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\PRICache|*.*
FileKey7=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\Temp|*.*
FileKey8=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\LocalState\*Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\LocalState\navigationHistory|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\LocalState\PlayReady|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxLIVEGames_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.XboxLIVEGames_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              XnView * has been modified.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[XnView *]
LangSecRef=3023
Detect1=HKCU\Software\XnView
Detect2=HKCU\Software\XnView\XnViewMP
Detect3=HKLM\Software\XnView
Default=False
FileKey1=%AppData%\XnView\cache|*.db
FileKey2=%AppData%\XnViewMP|*.db;category.bak
FileKey3=%LocalAppData%\VirtualStore\Program Files*\XnViewMP|category.bak;*.db
FileKey4=%ProgramFiles%\XnViewMP|category.bak;*.db

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                           .NET Framework * has been added.                                         ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[.NET Framework *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
Default=False
FileKey1=%WinDir%\assembly\NativeImages_*\Temp|*.*|RECURSE
FileKey2=%WinDir%\assembly\t*mp|*.*|REMOVESELF
FileKey3=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*.*|RECURSE
FileKey4=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*.*|REMOVESELF
FileKey5=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*.*|RECURSE
FileKey6=%WinDir%\System32\URTTemp|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                      Adobe Application Manager * has been added.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Application Manager *]
LangSecRef=3021
Detect=HKCU\Software\Adobe
Default=False
FileKey1=%AppData%\Adobe\Acrobat\*\Updater|*.log
FileKey2=%CommonAppData%\Adobe\ARM|*.*|RECURSE
FileKey3=%LocalAppData%\Adobe\AAMUpdater|*.Log|RECURSE
FileKey4=%LocalAppData%\Adobe\Acrobat\*\Updater|*.log
FileKey5=%LocalAppData%\Adobe\Updater*|*.log|RECURSE
FileKey6=%ProgramFiles%\Common Files\Adobe\Installers|*.log.gz|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                          Adobe Media Cache * has been added.                                       ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Adobe Media Cache *]
LangSecRef=3021
DetectFile=%AppData%\Adobe\Common\Media Cache
Default=False
FileKey1=%AppData%\Adobe\Common\* Cache*|*.*|RECURSE
FileKey2=%AppData%\Adobe\Common\Peak Files|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                  Dr. Despicable's Dastardly Deeds * has been added.                                ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Dr. Despicable's Dastardly Deeds *]
Section=Games
DetectFile=%AppData%\HitPoint Studios\DrD
Default=False
FileKey1=%AppData%\HitPoint Studios\DrD|logfile.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                     MAGIX Installation Manager * has been added.                                   ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[MAGIX Installation Manager *]
LangSecRef=3023
Detect=HKCU\Software\Magix\MAGIX Installation manager
Default=False
FileKey1=%CommonAppData%\MAGIX\*|*.log;*.reg
FileKey2=%CommonAppData%\MAGIX\*\download|*.*|RECURSE
FileKey3=%LocalAppData%\VirtualStore\ProgramData\MAGIX\*|*.log;*.reg
FileKey4=%LocalAppData%\VirtualStore\ProgramData\MAGIX\*\download|*.*|RECURSE

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              My Office * has been added.                                           ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[My Office *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\AppData\Local\Office\16.0\WebServiceCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\Cache|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                                News * has been added.                                              ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[News *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingNews_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Microsoft\CLR_v4.0|*.log|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\PRICache|*.*
FileKey3=%LocalAppData%\Packages\Microsoft.BingNews_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.BingNews_*\LocalState\navigationHistory|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingNews_8wekyb3d8bbwe\SearchHistory

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Realtek * has been added.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Realtek *]
LangSecRef=3024
Detect=HKLM\Software\Realtek
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Realtek*|*.log;*.txt|RECURSE
FileKey2=%ProgramFiles%\Realtek*|*.*log;*.txt|RECURSE
FileKey3=%ProgramFiles%\Temp|*.*|REMOVESELF
FileKey4=%SystemDrive%|RHDSetup.log
ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\|InstCtrl.txt
ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\|setupctrl.txt

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                              Weather * has been added.                                             ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

[Weather *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.BingWeather_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\CLR_v4.0|*.log
FileKey4=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState|*.tmp
FileKey9=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.BingWeather_*\LocalState\navigationHistory|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.BingWeather_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.BingWeather_8wekyb3d8bbwe\SearchHistory
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.BingWeather_*\AC\INetCache\|container.dat

 ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
 ║                                                    Diff complete.                                                  ║
 ╠════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣
 ║ Added entries: 9                                                                                                   ║
 ║ Modified entries: 122                                                                                              ║
 ║ Removed entries: 63                                                                                                ║
 ║                                                                                                                    ║
 ║ Press any key to return to the winapp2ool menu.                                                                    ║
 ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

February 13, 2018

1 minute ago, siliconman01 said:

I assume that the sorting function is still in the works for sorting and alphabetizing winapp2.ini + user custom additions during the TRIM process, eh?

Yes. They're on my radar (and indeed some of the scaffolding is completed for WinappDebug's upcoming autocorrect functionality). Most of this release's front end changes were concerned with setting up a consistent menu system and exception handling.

February 13, 2018

There is a new version of winapp2ool (v0.6) available for testing.

Most of the changes are under-the-hood but you should see a little more prevention against loading files that don't exist or contain no content (eg. loading an empty file will present an error that the file is empty instead of just attempting to do whatever module work with an empty file under some circumstances.)

There's also a new menu/output design that's fit to the size of the console window and consistent throughout the modules.

The WinappDebug module's alphabetization checking has been tweaked a bit to organize entries that belong in the browser sections differently (via langsecref instead of specialdetect)

Known issues:

There may be some places where entering 0 to return to the menu fails to properly do so. I think I've caught all these but let me know if you find one.

There may be some inconsistent grammar throughout menus. Again, if anything jumps out, do let me know.

Diff might throw some exceptions under some circumstances, I'm currently looking into the cause of this.

Bug reports are best left through GitHub but comments here are fine too.

On 2/7/2018 at 19:18, PICPro said:

I'd like to be able to use WinApp2ool.exe however it crashes on startup when used on a Windows 7 computer that has no internet connection. Hopefully Robert can make a note to adjust this behavior the next time he is able to work on this program.

This should be fixed now. Opening winapp2ool.exe without an internet connection should produce an error against the update checker before printing the menu instead of simply crashing.

February 8, 2018

6 hours ago, PICPro said:

I'd like to be able to use WinApp2ool.exe however it crashes on startup when used on a Windows 7 computer that has no internet connection. Hopefully Robert can make a note to adjust this behavior the next time he is able to work on this program.

I have this fixed on my side, I'm hoping to have some time within the next week to clean up and push the next update

February 3, 2018

9 minutes ago, SMalik said:

There should be a seperate entry for bam service traces. Initially it was added in the [Cryptographic Services Traces*] now it is in the [Windows Logs *] entry.

https://forum.piriform.com/topic/32310-winapp2ini-additions/?do=findComment&comment=288748

Background Activity Moderator Driver (bam) Service

http://servicedefaults.com/10/bam/

[BAM Service Traces *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
RegKey1=HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings

Would this be better suited to the Windows Subsystems * entry?

January 29, 2018

WebRender newsletter #13:

https://mozillagfx.wordpress.com/2018/01/29/webrender-newsletter-13/

January 29, 2018

3 hours ago, SMalik said:

I will not recommend shortening paths like "Cryptnet*Cache". Something like "\nouser1\*\" is fine, where the name is different each time the program is installed. I suggest that we should implement this rule for all entries.

Is there a folder called CryptnetCache simultaneously alongside the CryptnetUrlCache folders I see on my machine? or some other folder name that matches this pattern? If not, I agree. The only sense in parameterizing filekeys with wildcards is to multiple clean locations with identical parameters, but it doesn't make sense to include paths that don't necessarily exist in such a parameterization.

INet* comes to mind. In all the entries in which is evoked, it took the place of 3 filekeys cleaning the respective inet/cache/cookies/history folders and makes sense (to me) as a parameterization in a way that it wouldn't if there were no expectations of multiple different INet/.../ folders.

January 28, 2018

32 minutes ago, kr37 said:

Hi, just for fun, I bumped into this error using Firefox and a Firefox knockoff, K-Meleon. Still 11 exabytes, 8 years later.

CCleaner 5.27.5976 64-bit.

It's not a problem.

Hi! And welcome to the forum

Your CCleaner version appears to be about a year out-of-date. Does the problem persist on v5.39?

January 28, 2018

1 hour ago, Nergal said:

Yeah, we went down that road with him, CL didn't seem to work in his case, so another moderator suggested to post this request.

Ooh. Didn't have thread context, whoops!

While it's not an official fix, these entries exist in winapp2.ini and may help! Based on the other thread, the paths seem accurate.

	[7Star Browser - Cookies *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default|Cookies;Cookies-journal
	[7Star Browser - GPU Cache *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default\GPUCache|*.*|RECURSE
	[7Star Browser - Internet Cache *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default|Favicons;Favicons-journal
FileKey2=%LocalAppData%\7Star\7Star\User Data\Default\Cache|*.*|REMOVESELF
	[7Star Browser - Internet History *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Archived History;Archived History-journal;History;History Provider Cache;History-journal;Visited Links;Top Sites;Top Sites-journal
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\JumpListIcons*|*.*|RECURSE
	[7Star Browser - Local Storage *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*\Local Storage|http*.*|RECURSE
	[7Star Browser - Login Data *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\Default|Login Data;Login Data-journal
	[7Star Browser - Logs *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\Application|debug.log
FileKey2=%LocalAppData%\7Star\7Star\User Data\*\Extension State|LOG.*;*.log;Log
FileKey3=%LocalAppData%\7Star\7Star\User Data\*\Session Storage|LOG.*;*.log;Log
	[7Star Browser - Session *]
LangSecRef=3029
Detect=HKCU\Software\7Star
Default=False
FileKey1=%LocalAppData%\7Star\7Star\User Data\*|Current Tabs;Current session;Last Tabs;Last Session

January 27, 2018

59.0beta release notes:
https://www.mozilla.org/en-US/firefox/59.0beta/releasenotes/

60.0 nightly release notes:

https://www.mozilla.org/en-US/firefox/60.0a1/releasenotes/

Making WebAssembly even faster: Firefox’s new streaming and tiering compiler:
https://hacks.mozilla.org/2018/01/making-webassembly-even-faster-firefoxs-new-streaming-and-tiering-compiler/

Firefox 58: The Quantum Era Continues:
https://hacks.mozilla.org/2018/01/firefox-58-the-quantum-era-continues/

WebRender newsletter:
11: https://mozillagfx.wordpress.com/2018/01/03/webrender-newsletter-11/
12:https://mozillagfx.wordpress.com/2018/01/16/webrender-newsletter-12/

Retained Display Lists:
https://mozillagfx.wordpress.com/2018/01/09/retained-display-lists/

TWIF 30:
https://blog.nightly.mozilla.org/2018/01/18/these-weeks-in-firefox-issue-30/

Latest Firefox Quantum release available with faster, always-on privacy with opt-in Tracking Protection and new features:
https://blog.mozilla.org/blog/2018/01/23/latest-firefox-quantum-release-now-available-with-new-features/

Mozilla Files Suit Against FCC to Protect Net Neutrality:
https://blog.mozilla.org/blog/2018/01/16/mozilla-files-suit-fcc-protect-net-neutrality/

City of Barcelona Kicks Out Microsoft in Favor of Linux and Open Source:
https://itsfoss.com/barcelona-open-source/

Secure Contexts Everywhere:
https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/

January 27, 2018

CCleaner has the ability to set custom profile locations for Firefox and Chrome-based browsers.

https://www.ccleaner.com/docs/ccleaner/advanced-usage/ccleaner-ini-files/how-to-clean-user-data-from-non-standard-mozilla-browsers

January 25, 2018

21 minutes ago, ROCKNROLL said:

Updates: https://github.com/MoscaDotTo/Winapp2/commit/602af668ab2addce2dab580c819f8e69120bf12c

https://github.com/MoscaDotTo/Winapp2/commit/2b435d2c383fe3d699075706bf44315d5c4c601b

The below (revised) changelog should accurately reflect the changes between my last changelog post on Jan 11th and the above commit

The previous post was removed due to a bug in the compareTo method of the iniFile class that would output the old state of entries who were modified instead of the new state.

Changes made between Version: 180111 and Version: 180125

Browser Exit Codes * has been modified.

[Browser Exit Codes *]
LangSecRef=3029
SpecialDetect=DET_CHROME
Default=False
RegKey1=HKCU\Software\Chromium\BrowserExitCodes
RegKey2=HKCU\Software\Google\Chrome\BrowserExitCodes

*--------------------------------------------------------------------------------------------------*

.NET Framework * has been removed.

[.NET Framework *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
Default=False
FileKey1=%LocalAppData%\IsolatedStorage|*.*|RECURSE
FileKey2=%WinDir%\assembly\NativeImages_*\Temp|*.*|RECURSE
FileKey3=%WinDir%\assembly\t*mp|*.*|REMOVESELF
FileKey4=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*.*|RECURSE
FileKey5=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*.*|REMOVESELF
FileKey6=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*.*|RECURSE
FileKey7=%WinDir%\System32\URTTemp|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps

*--------------------------------------------------------------------------------------------------*

1Click DVD Copy Pro * has been modified.

[1Click DVD Copy Pro *]
LangSecRef=3023
DetectFile=%CommonAppData%\1click dvd copy pro
Default=False
FileKey1=%CommonAppData%\1click dvd copy pro|*.log
FileKey2=%LocalAppData%\VirtualStore\ProgramData\1click dvd copy pro|*.log

*--------------------------------------------------------------------------------------------------*

AbsoluteFTP * has been modified.

[AbsoluteFTP *]
LangSecRef=3022
Detect=HKCU\Software\Van Dyke Technologies\AbsoluteFTP
Default=False
RegKey1=HKCU\Software\Van Dyke Technologies\AbsoluteFTP\Recent File List

*--------------------------------------------------------------------------------------------------*

Action Center * has been modified.

[Action Center *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog

*--------------------------------------------------------------------------------------------------*

Adobe CS * has been modified.

*--------------------------------------------------------------------------------------------------*

Adobe Elements Organizer * has been modified.

[Adobe Elements Organizer *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Elements Organizer
Default=False
FileKey1=%AppData%\Adobe\amecommand\6.0|Plugin Loading.log
FileKey2=%AppData%\Adobe\Elements Organizer\*\Organizer|*.txt;status.dat
FileKey3=%AppData%\Adobe\Elements Smart Tag Agent\*\Logs|*.log
FileKey4=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey5=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog|face.thumb.9.cache;thumb.5.cache
FileKey6=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\WaldoData|waldo.cache
FileKey7=%CommonAppData%\Adobe\Elements Organizer\Catalogs\My Catalog\Watch Folder|*.txt;*.xml
RegKey1=HKCU\Software\Adobe\Elements Organizer\11.0\CurrentMediaFilePath
RegKey2=HKCU\Software\Adobe\Elements Organizer\12.0\CurrentMediaFilePath
RegKey3=HKCU\Software\Adobe\Elements Organizer\13.0\CurrentMediaFilePath
RegKey4=HKCU\Software\Adobe\Elements Organizer\14.0\CurrentMediaFilePath
RegKey5=HKCU\Software\Adobe\Elements Organizer\15.0\CurrentMediaFilePath

*--------------------------------------------------------------------------------------------------*

Adobe Flash Player * has been modified.

[Adobe Flash Player *]
LangSecRef=3023
Detect=HKCU\Software\Macromedia\FlashPlayer
DetectFile=%AppData%\Adobe\Flash Player
Default=False
FileKey1=%AppData%\Adobe\Flash Player\*Cache|*.*|RECURSE
FileKey2=%WinDir%\System32\Macromed\Flash|FlashInstall*.log;install.log
FileKey3=%WinDir%\SysWOW64\Macromed\Flash|FlashInstall*.log;install.log

*--------------------------------------------------------------------------------------------------*

Call of Atlantis * has been modified.

[Call of Atlantis *]
Section=Games
Detect=HKLM\Software\Playrix\Call of Atlantis
Default=False
FileKey1=%CommonAppData%\Playrix Entertainment\Call of Atlantis\Log|*.*
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Playrix Entertainment\Call of Atlantis\Log|*.*

*--------------------------------------------------------------------------------------------------*

CasualArts * has been modified.

*--------------------------------------------------------------------------------------------------*

ClickFree Full Imaging Backup * has been modified.

[ClickFree Full Imaging Backup *]
LangSecRef=3024
DetectFile=%CommonAppData%\ClickFree\FullImagingBackup
Default=False
FileKey1=%CommonAppData%\ClickFree\FullImagingBackup|*.log
FileKey2=%LocalAppData%\VirtualStore\ProgramData\ClickFree\FullImagingBackup|*.log

*--------------------------------------------------------------------------------------------------*

Comcast Toolbar * has been modified.

[Comcast Toolbar *]
LangSecRef=3022
Detect=HKCU\Software\ComcastToolbar
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\ComcastToolbar\Cache|*.*
FileKey2=%ProgramFiles%\ComcastToolbar\Cache|*.*

*--------------------------------------------------------------------------------------------------*

Conceiva Mezzmo * has been modified.

[Conceiva Mezzmo *]
LangSecRef=3023
Detect=HKLM\Software\Conceiva\Mezzmo
Default=False
FileKey1=%CommonAppData%\Conceiva\*|*.bat;*.exe;*.txt
FileKey2=%CommonAppData%\Conceiva\Mezzmo\CER|*.zip
FileKey3=%LocalAppData%\Conceiva\Logs|*.*|REMOVESELF
FileKey4=%LocalAppData%\Conceiva\Mezzmo|DebugCERwrite.txt
FileKey5=%LocalAppData%\Conceiva\Mezzmo\Temporary_*_Files|*.*|REMOVESELF
FileKey6=%LocalAppData%\VirtualStore\Program Files*\Conceiva\Mezzmo|*.txt
FileKey7=%LocalAppData%\VirtualStore\Program Files*\Conceiva\Mezzmo\Third\MKVToolNix|*.txt
FileKey8=%LocalAppData%\VirtualStore\Program Files*\Conceiva\Mezzmo\Third\OGMDemuxer\doc|*.*|REMOVESELF
FileKey9=%LocalAppData%\VirtualStore\ProgramData\Conceiva\Mezzmo\CER|*.zip
FileKey10=%ProgramFiles%\Conceiva\Mezzmo|*.txt
FileKey11=%ProgramFiles%\Conceiva\Mezzmo\Third\MKVToolNix|*.txt
FileKey12=%ProgramFiles%\Conceiva\Mezzmo\Third\OGMDemuxer\doc|*.*|REMOVESELF
RegKey1=HKCU\Software\Conceiva\Mezzmo\General|LastWatchFolder

*--------------------------------------------------------------------------------------------------*

Connectify Hotspot * has been modified.

[Connectify Hotspot *]
LangSecRef=3022
Detect=HKLM\Software\Connectify
Default=False
FileKey1=%CommonAppData%\Connectify\cache|*.time;*.cache;*.runtime
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Connectify\cache|*.time;*.cache;*.runtime
FileKey3=%ProgramFiles%\Connectify\Installer|*.*|REMOVESELF
FileKey4=%ProgramFiles%\Connectify\Portal|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

Connectivity Store * has been modified.

[Connectivity Store *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ConnectivityStore_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ConnectivityStore_*\TempState|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

Corel PaintShop Pro AutoPreserve * has been modified.

[Corel PaintShop Pro AutoPreserve *]
LangSecRef=3023
Detect1=HKCU\Software\Corel\PaintShop Pro\X6
Detect2=HKCU\Software\Corel\PaintShop Pro\X7
Detect3=HKCU\Software\Corel\PaintShop Pro\X10
Default=False
FileKey1=%Pictures%\Corel Auto-Preserve|*.*

*--------------------------------------------------------------------------------------------------*

Creative Installation Information * has been modified.

[Creative Installation Information *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Creative Installation Information
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Creative Installation Information|*.log|RECURSE
FileKey2=%ProgramFiles%\Creative Installation Information|*.log|RECURSE

*--------------------------------------------------------------------------------------------------*

CyberLink PowerDVD * has been modified.

[CyberLink PowerDVD *]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PowerDVD15
Detect2=HKCU\Software\CyberLink\PowerDVD16
Detect3=HKCU\Software\CyberLink\PowerDVD17
Default=False
FileKey1=%CommonAppData%\CyberLink\Boomerang\*|*.xml;*.dmp
FileKey2=%CommonAppData%\Cyberlink\Evoparser|*.xml
FileKey3=%CommonAppData%\CyberLink\PowerDVD*\Boomerang\*|*.xml;*.dmp
FileKey4=%LocalAppData%\Cyberlink\DigitalHome|*.log|RECURSE
FileKey5=%LocalAppData%\Cyberlink\PowerDVD*|*.log|RECURSE
FileKey6=%LocalAppData%\Cyberlink\PowerDVD*\cache*|*.*|RECURSE
FileKey7=%LocalAppData%\Cyberlink\PowerDVD*\CL_DMP_Browser|*.*|RECURSE
RegKey1=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey3=HKCU\Software\CyberLink\PowerDVD15\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey4=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey5=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey6=HKCU\Software\CyberLink\PowerDVD16\CLMPSvc\MediaObj\MediaCache5\Thumbnail5
RegKey7=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Data5
RegKey8=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\ProgramInfo
RegKey9=HKCU\Software\CyberLink\PowerDVD17\CLMPSvc\MediaObj\MediaCache5\Thumbnail5

*--------------------------------------------------------------------------------------------------*

Defraggler * has been modified.

[Defraggler *]
LangSecRef=3024
Detect=HKCU\Software\Piriform\Defraggler
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Defraggler|*.dmp;*statistics*;*.log;Defraggler*.txt
FileKey2=%ProgramFiles%\Defraggler|*.dmp;*statistics*;*.log;Defraggler*.txt
FileKey3=%UserProfile%|Defraggler*.txt

*--------------------------------------------------------------------------------------------------*

DriverEasy Driver Backups * has been modified.

[DriverEasy Driver Backups *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easeware\DriverEasy
Default=False
FileKey1=%Documents%\DriverEasy|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

DriverEasy Driver Installation Files * has been modified.

[DriverEasy Driver Installation Files *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Easeware\DriverEasy
Default=False
FileKey1=%AppData%\Easeware\DriverEasy\drivers|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

DVD Flick * has been modified.

[DVD Flick *]
LangSecRef=3023
DetectFile=%ProgramFiles%\DVD Flick\dvdflick.exe
Default=False
FileKey1=%AppData%\DVD Flick|dvdflick.log;report.txt

*--------------------------------------------------------------------------------------------------*

DVDFab Media Player 2 * has been removed.

[DVDFab Media Player 2 *]
LangSecRef=3023
Detect=HKCU\Software\FabPlayer
Default=False
FileKey1=%Documents%\DVDFab Media Player|*.log
RegKey1=HKCU\Software\FabPlayer|DefaultFile

*--------------------------------------------------------------------------------------------------*

DVDFab Passkey * has been removed.

[DVDFab Passkey *]
LangSecRef=3023
Detect=HKCU\Software\DVDFab Passkey
Default=False
FileKey1=%Documents%\DVDFab Passkey\Log|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

EssentialPIM Desktop * has been modified.

[EssentialPIM Desktop *]
LangSecRef=3021
Detect=HKLM\Software\clients\mail\essentialpim pro
DetectFile=%AppData%\EssentialPIM
Default=False
FileKey1=%AppData%\EssentialPIM*\Logs|*.*

*--------------------------------------------------------------------------------------------------*

Explorer MRUs * has been removed.

[Explorer MRUs *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams

*--------------------------------------------------------------------------------------------------*

Farming Simulator * has been modified.

[Farming Simulator *]
Section=Games
Detect=HKLM\Software\SCS Software
Default=False
FileKey1=%Documents%\My Games\FarmingSimulator*|*.txt
FileKey2=%Documents%\My Games\FarmingSimulator*\pdlc*|*.dlc|REMOVESELF
FileKey3=%Documents%\My Games\FarmingSimulator*\shader_cache|*.shc;*.xml|REMOVESELF

*--------------------------------------------------------------------------------------------------*

Genymobile * has been modified.

[Genymobile *]
LangSecRef=3024
Detect=HKCU\Software\Genymobile
Default=False
FileKey1=%LocalAppData%\Genymobile|*.log
FileKey2=%UserProfile%\VirtualBox VMs\*|genymotion-player*.log;logcat*.txt

*--------------------------------------------------------------------------------------------------*

Get Office * has been modified.

[Get Office *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\AppData\Local\Office\16.0\WebServiceCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftOfficeHub_*\LocalState\Cache|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

GIANT AntiSpyware * has been modified.

[GIANT AntiSpyware *]
LangSecRef=3021
Detect=HKCU\Software\GIANTCompany\AntiSpyware
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\GIANT Company Software\GIANT AntiSpyware|errors.log;cleaner.log;tracksEraser.log
FileKey2=%ProgramFiles%\GIANT Company Software\GIANT AntiSpyware|errors.log;cleaner.log;tracksEraser.log

*--------------------------------------------------------------------------------------------------*

Kaspersky * has been modified.

[Kaspersky *]
LangSecRef=3024
Detect=HKCU\Software\KasperskyLab
Default=False
Warning=Make sure to disable "Self Defense" before cleaning.
FileKey1=%CommonAppData%\Kaspersky Lab|*.dmp;*.dmp.stat;*.log
FileKey2=%CommonAppData%\Kaspersky Lab\*\Bases\Cache|*.*|RECURSE
FileKey3=%CommonAppData%\Kaspersky Lab\*\Data\Updater\Temporary Files|*.*|RECURSE
FileKey4=%CommonAppData%\Kaspersky Lab\*\Temp|*.*
FileKey5=%LocalAppData%\VirtualStore\ProgramData\Kaspersky Lab\*\Bases\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\VirtualStore\ProgramData\Kaspersky Lab\*\Data\Updater\Temporary Files|*.*|RECURSE
FileKey7=%LocalAppData%\VirtualStore\ProgramData\Kaspersky Lab\*\Temp|*.*
FileKey8=%ProgramFiles%\Kaspersky Lab\NetworkAgent\~dumps|*.*

*--------------------------------------------------------------------------------------------------*

LocalService * has been modified.

[LocalService *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%SystemDrive%\Documents and Settings\LocalService*\Cookies|*.*|RECURSE
FileKey2=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\History|*.*|RECURSE
FileKey3=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temp|*.*|RECURSE
FileKey4=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temporary Internet Files|*.*|RECURSE
FileKey5=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
FileKey6=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE
FileKey7=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Temp|*.*|RECURSE
FileKey8=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies|*.*|REMOVESELF
FileKey9=%WinDir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey10=%WinDir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

MAGIX Driver Downloads * has been modified.

[MAGIX Driver Downloads *]
LangSecRef=3023
Detect=HKCU\Software\Magix
Default=False
FileKey1=%CommonAppData%\MAGIX\*\download|*.*|REMOVESELF
FileKey2=%LocalAppData%\VirtualStore\ProgramData\MAGIX\*\download|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

MAL Updater * has been modified.

[MAL Updater *]
LangSecRef=3023
DetectFile=%ProgramFiles%\Mal Updater 2\MalUpdater.exe
Default=False
FileKey1=%AppData%\Mal Updater\*Pics|*.*
FileKey2=%AppData%\Mal Updater\SeasonData|*.*
FileKey3=%AppData%\Mal Updater\Users|*.log|RECURSE

*--------------------------------------------------------------------------------------------------*

ManiaPlanet * has been modified.

[ManiaPlanet *]
Section=Games
DetectFile=%CommonAppData%\ManiaPlanet
Default=False
FileKey1=%CommonAppData%\ManiaPlanet\Cache|*.*
FileKey2=%LocalAppData%\VirtualStore\ProgramData\ManiaPlanet\Cache|*.*

*--------------------------------------------------------------------------------------------------*

Marine Sharpshooter 3 * has been modified.

[Marine Sharpshooter 3 *]
Section=Games
DetectFile=%ProgramFiles%\Groove Games\Marine Sharpshooter 3
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Groove Games\Marine Sharpshooter 3|*.dmp;*.mdmp|RECURSE
FileKey2=%ProgramFiles%\Groove Games\Marine Sharpshooter 3|*.dmp;*.mdmp|RECURSE

*--------------------------------------------------------------------------------------------------*

Media Jukebox * has been modified.

[Media Jukebox *]
LangSecRef=3023
Detect=HKCU\Software\J. River\Music Exchange\1.0\Media Jukebox
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\J River\Media Jukebox\Data|*.jmd
FileKey2=%ProgramFiles%\J River\Media Jukebox\Data|*.jmd

*--------------------------------------------------------------------------------------------------*

Men of War Log * has been removed.

[Men of War Log *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\204860
Detect2=HKCU\Software\Valve\Steam\Apps\3130
Detect3=HKCU\Software\Valve\Steam\Apps\63940
Detect4=HKCU\Software\Valve\Steam\Apps\64000
Detect5=HKCU\Software\Valve\Steam\Apps\7830
Default=False
FileKey1=%Documents%\My Games\men of war*\log|*.*
FileKey2=%Documents%\My Games\men of war*\shader_cache|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

Men of War * has been modified.

[Men of War *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\204860
Detect2=HKCU\Software\Valve\Steam\Apps\3130
Detect3=HKCU\Software\Valve\Steam\Apps\63940
Detect4=HKCU\Software\Valve\Steam\Apps\64000
Detect5=HKCU\Software\Valve\Steam\Apps\7830
Default=False
FileKey1=%Documents%\My Games\men of war*\log|*.*
FileKey2=%Documents%\My Games\men of war*\shader_cache|*.*|RECURSE
FileKey3=%Documents%\My Games\mow *\log|*.*
FileKey4=%Documents%\My Games\mow *\shader_cache|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

MS PhotoDraw 2000 * has been modified.

[MS PhotoDraw 2000 *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\PhotoDraw\1.0
Default=False
RegKey1=HKCU\Software\Microsoft\PhotoDraw\1.0\Recent File List

*--------------------------------------------------------------------------------------------------*

NFS Hot Pursuit 2010 Saves * has been modified.

[NFS Hot Pursuit 2010 Saves *]
Section=Games
Detect=HKCU\Software\Electronic Arts\Need for Speed(TM) Hot Pursuit
Default=False
Warning=This will delete your saved games for NFS Hot Pursuit
FileKey1=%Documents%\Criterion Games|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

NirSoft RegistryChangesView Snapshots * has been modified.

[NirSoft RegistryChangesView Snapshots *]
LangSecRef=3024
DetectFile=%ProgramFiles%\NirSoft\RegistryChangesView.exe
Default=False
FileKey1=%ProgramFiles%\NirSoft\RegSnapshot*|*.*|REMOVESELF
FileKey2=%ProgramFiles%\NirSoft\x64\RegSnapshot*|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

Notepad++ * has been modified.

[Notepad++ *]
LangSecRef=3021
Detect=HKLM\Software\Notepad++
Default=False
FileKey1=%AppData%\Notepad++\plugins\config|PluginManagerGpup.xml;PluginManagerPlugins.xml;PluginManagerPlugins.zip
FileKey2=%AppData%\Notepad++\plugins\config\plugin_install_temp|*.*|REMOVESELF
FileKey3=%ProgramFiles%\Notepad++\plugins\disabled|*.*

*--------------------------------------------------------------------------------------------------*

Orbit Downloader * has been modified.

[Orbit Downloader *]
LangSecRef=3022
Detect=HKLM\Software\Orbit
Default=False
FileKey1=%AppData%\Orbit|history.dat;DownloadList.dat;unfinish.dat;softI.dat;updateslist.xml
FileKey2=%AppData%\Orbit\flink|*.*
FileKey3=%AppData%\Orbit\icon|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

PeerNetworking * has been modified.

[PeerNetworking *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%SystemDrive%\Documents and Settings\LocalService\Application Data\PeerNetworking|*.*|RECURSE
FileKey2=%WinDir%\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

Pet Pals Animal Doctor * has been modified.

[Pet Pals Animal Doctor *]
Section=Games
Detect=HKLM\Software\Legacy Interactive\Pet Pals
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Legacy Interactive\Pet Pals Animal Doctor|*.log
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Legacy Interactive\Pet Pals Animal Doctor\jre|*.*
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Legacy Interactive\Pet Pals Animal Doctor\temp|*.*|REMOVESELF
FileKey4=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor|*.log
FileKey5=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre|*.*
FileKey6=%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\temp|*.*|REMOVESELF
ExcludeKey1=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\bin\|*.*
ExcludeKey2=PATH|%ProgramFiles%\Legacy Interactive\Pet Pals Animal Doctor\jre\lib\|*.*

*--------------------------------------------------------------------------------------------------*

Photo! Editor * has been modified.

[Photo! Editor *]
LangSecRef=3024
Detect=HKCU\Software\VicMan Software\Photo! Editor
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Photo!\Photo! Editor|*.log
FileKey2=%ProgramFiles%\Photo!\Photo! Editor|*.log
RegKey1=HKCU\Software\VicMan Software\Photo! Editor|LastFolder

*--------------------------------------------------------------------------------------------------*

Push Notifications * has been removed.

[Push Notifications *]
DetectOS=6.2|
LangSecRef=3025
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm

*--------------------------------------------------------------------------------------------------*

QuickTime Player * has been modified.

[QuickTime Player *]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.\QuickTime
Default=False
RegKey1=HKCU\Software\Classes\VirtualStore\MACHINE\Software\Apple Computer, Inc.\QuickTime\Favorite Movies
RegKey2=HKCU\Software\Classes\VirtualStore\MACHINE\Software\Apple Computer, Inc.\QuickTime\Recent Movies
RegKey3=HKCU\Software\Classes\VirtualStore\MACHINE\Software\WOW6432Node\Apple Computer, Inc.\QuickTime\Favorite Movies
RegKey4=HKCU\Software\Classes\VirtualStore\MACHINE\Software\WOW6432Node\Apple Computer, Inc.\QuickTime\Recent Movies

*--------------------------------------------------------------------------------------------------*

SBMAV Disk Cleaner * has been modified.

[SBMAV Disk Cleaner *]
LangSecRef=3024
Detect=HKCU\Software\SBMAV Software\Disk Cleaner
Default=False
FileKey1=%AppData%\SBMAV Disk Cleaner|dcleaner.log
FileKey2=%ProgramFiles%\SBMAV Disk Cleaner|*.rtf

*--------------------------------------------------------------------------------------------------*

Shattered Horizon * has been modified.

[Shattered Horizon *]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\18110
DetectFile=%LocalAppData%\Futuremark\Shattered Horizon
Default=False
FileKey1=%LocalAppData%\Futuremark\Shattered Horizon\cache|*.*|REMOVESELF
FileKey2=%LocalAppData%\Futuremark\Shattered Horizon\crash_dumps|*.*

*--------------------------------------------------------------------------------------------------*

SoulseekQt * has been modified.

[SoulseekQt *]
LangSecRef=3022
DetectFile=%ProgramFiles%\SoulseekQt\SoulseekQt.exe
Detect=HKLM\Software\SoulseekQt
Default=False
Warning=This will delete your chat history.
FileKey1=%LocalAppData%\Soulseek Chat Logs\*|*.log

*--------------------------------------------------------------------------------------------------*

STOIK Video Converter 2 * has been modified.

[STOIK Video Converter 2 *]
LangSecRef=3023
Detect=HKCU\Software\STOIK
Default=False
FileKey1=%AppData%\STOIK\videopak2|*.ini

*--------------------------------------------------------------------------------------------------*

SuperWinMenu * has been modified.

[SuperWinMenu *]
LangSecRef=3024
DetectFile=%AppData%\SuperWinMenu
Default=False
FileKey1=%AppData%\SuperWinMenu|*.lastused

*--------------------------------------------------------------------------------------------------*

Synchronize It! * has been modified.

[Synchronize It! *]
LangSecRef=3021
Detect=HKCU\Software\grigsoft.com\Synchronize It!
Default=False
RegKey1=HKCU\Software\grigsoft.com\Synchronize It!\Combos
RegKey2=HKCU\Software\grigsoft.com\Synchronize It!\Synchronize It!\Combos

*--------------------------------------------------------------------------------------------------*

TeamSpeak 3 Chats * has been modified.

[TeamSpeak 3 Chats *]
LangSecRef=3022
Detect=HKCU\Software\TeamSpeak 3 Client
Default=False
FileKey1=%AppData%\TS3Client\chats|*.*|REMOVESELF

*--------------------------------------------------------------------------------------------------*

UMPlayer File Settings * has been modified.

[UMPlayer File Settings *]
LangSecRef=3023
DetectFile=%UserProfile%\.umplayer
Default=False
FileKey1=%UserProfile%\.umplayer\file_settings|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

VSO DVD Converter Ultimate * has been modified.

[VSO DVD Converter Ultimate *]
LangSecRef=3023
Detect=HKCU\Software\VSO\DVD Converter Ultimate
Default=False
FileKey1=%AppData%|pcouffin.log
FileKey2=%CommonAppData%\VSO|*.cache
FileKey3=%CommonAppData%\VSO\DVD Converter Ultimate\*\Log|*.log;*.crashlist|REMOVESELF
FileKey4=%CommonAppData%\VSO\vsothumbs|*.*|REMOVESELF
FileKey5=%Documents%\PcSetup|*.log|REMOVESELF
FileKey6=%LocalAppData%\VirtualStore\Program Files*\VSO\DVD Converter Ultimate\*|*.txt
FileKey7=%LocalAppData%\VirtualStore\ProgramData\VSO|*.cache
FileKey8=%LocalAppData%\VirtualStore\ProgramData\VSO\DVD Converter Ultimate\*\Log|*.log;*.crashlist|REMOVESELF
FileKey9=%LocalAppData%\VirtualStore\ProgramData\VSO\vsothumbs|*.*|REMOVESELF
FileKey10=%ProgramFiles%\VSO\DVD Converter Ultimate\*|*.txt
RegKey1=HKCU\Software\VSO\DVD Converter Ultimate\2|BDMVInputFolders
RegKey2=HKCU\Software\VSO\DVD Converter Ultimate\2|ISOInputFolders
RegKey3=HKCU\Software\VSO\DVD Converter Ultimate\2|MediaLabel
RegKey4=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_audio
RegKey5=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_bluray
RegKey6=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_dvd
RegKey7=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_iso
RegKey8=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_subtitle
RegKey9=HKCU\Software\VSO\DVD Converter Ultimate\3|input_MRUfiles_video

*--------------------------------------------------------------------------------------------------*

Windows 7 Manager * has been modified.

[Windows 7 Manager *]
LangSecRef=3024
Detect=HKCU\Software\Yamicsoft\Windows 7 Manager
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Yamicsoft\Windows 7 Manager\DiskAnalyzerXML|*.*
FileKey2=%ProgramFiles%\Yamicsoft\Windows 7 Manager\DiskAnalyzerXML|*.*

*--------------------------------------------------------------------------------------------------*

Windows Experience Index * has been modified.

[Windows Experience Index *]
LangSecRef=3025
DetectOS=10.0|
Default=False
FileKey1=%WinDir%\Performance\WinSAT|*.*
FileKey2=%WinDir%\Performance\WinSAT\DataStore|*.*

*--------------------------------------------------------------------------------------------------*

Windows Mail * has been modified.

[Windows Mail *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows Mail
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows Mail|*.log;*.jrs;*.chk|RECURSE

*--------------------------------------------------------------------------------------------------*

Windows Registry Recovery * has been modified.

[Windows Registry Recovery *]
LangSecRef=3024
Detect=HKCU\Software\MiTeC\WRR
Default=False
RegKey1=HKCU\Software\MiTeC\WRR\1.x\dlg_wrr_Find\eFind_Items
RegKey2=HKCU\Software\MiTeC\WRR\1.x\Main\MRUHistory

*--------------------------------------------------------------------------------------------------*

Windows Sidebar * has been modified.

[Windows Sidebar *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows Sidebar
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows Sidebar\Cache|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

Wondershare dr.fone toolkit for iOS * has been modified.

[Wondershare dr.fone toolkit for iOS *]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\dr.fone toolkit for iOS
Default=False
FileKey1=%CommonAppData%\Wondershare\DrFoneiOS\DBCache\NormalMode|*.*|RECURSE
FileKey2=%CommonAppData%\Wondershare\DrFoneiOS\log|*.*|RECURSE
FileKey3=%CommonAppData%\Wondershare\WAF\Log|*.*|RECURSE
FileKey4=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

Xara WebDesigner Session * has been modified.

[Xara WebDesigner Session *]
LangSecRef=3024
Detect=HKCU\Software\Xara\WebDesigner
Default=False
RegKey1=HKCU\Software\Xara\WebDesigner\8.0\Workspace\MDI

*--------------------------------------------------------------------------------------------------*

Xbox * has been modified.

[Xbox *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxApp_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState|*.log;*.log*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\*Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\SmartGlass|*.log
FileKey9=%LocalAppData%\Packages\Microsoft.XboxApp_*\TempState|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

.NET Framework Isolated Storage * has been added.

[.NET Framework Isolated Storage *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
Default=False
FileKey1=%LocalAppData%\IsolatedStorage|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

.NET Framework Temps * has been added.

[.NET Framework Temps *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\.NETFramework
Default=False
FileKey1=%WinDir%\assembly\NativeImages_*\Temp|*.*|RECURSE
FileKey2=%WinDir%\assembly\t*mp|*.*|REMOVESELF
FileKey3=%WinDir%\Microsoft.NET\Framework*\*\*\Logs|*.*|RECURSE
FileKey4=%WinDir%\Microsoft.NET\Framework*\*\Temporary ASP.NET Files|*.*|REMOVESELF
FileKey5=%WinDir%\Microsoft.NET\Framework*\v4.0.30319\SetupCache|*.*|RECURSE
FileKey6=%WinDir%\System32\URTTemp|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps

*--------------------------------------------------------------------------------------------------*

Adobe Acrobat 2017 * has been added.

[Adobe Acrobat 2017 *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Adobe Acrobat\2017
Default=False
RegKey1=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFiles
RegKey2=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFolders

*--------------------------------------------------------------------------------------------------*

Adobe Reader 2017 * has been added.

[Adobe Reader 2017 *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Acrobat Reader\2017
Default=False
RegKey1=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFiles
RegKey2=HKCU\Software\Adobe\Acrobat Reader\2017\AVGeneral\cRecentFolders

*--------------------------------------------------------------------------------------------------*

Feedback Hub * has been added.

[Feedback Hub *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\TempState|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INetCache\|container.dat

*--------------------------------------------------------------------------------------------------*

Lenovo System Update * has been added.

[Lenovo System Update *]
LangSecRef=3024
DetectFile=%CommonAppData%\Lenovo\SystemUpdate\sessionSE\Repository
Default=False
FileKey1=%CommonAppData%\Lenovo\SystemUpdate\sessionSE\Repository|*.*|RECURSE
FileKey2=%CommonAppData%\Lenovo\SystemUpdate\sessionSE\system\SSClientCommon|*.xml

*--------------------------------------------------------------------------------------------------*

Men of War * has been added.

[Men of War *]
Section=Games
Detect1=HKCU\Software\Valve\Steam\Apps\204860
Detect2=HKCU\Software\Valve\Steam\Apps\3130
Detect3=HKCU\Software\Valve\Steam\Apps\63940
Detect4=HKCU\Software\Valve\Steam\Apps\64000
Detect5=HKCU\Software\Valve\Steam\Apps\7830
Default=False
FileKey1=%Documents%\My Games\men of war*\log|*.*
FileKey2=%Documents%\My Games\men of war*\shader_cache|*.*|RECURSE
FileKey3=%Documents%\My Games\mow *\log|*.*
FileKey4=%Documents%\My Games\mow *\shader_cache|*.*|RECURSE

*--------------------------------------------------------------------------------------------------*

Finished diffing. Change counts:

Added entries: 7
Modified entries: 60
Removed entries: 6

*--------------------------------------------------------------------------------------------------*
End of diff. Press any key to return to the winapp2ool menu.

January 25, 2018

Edit: post removed for now as diff contains a bug

January 25, 2018

1 hour ago, siliconman01 said:

To be sure that it is understood what I am referring to as "out of order". I am not talking about alphabetizing the lines of code within a specific cleaning module. I am talking about the alphabetizing of the modules themselves. For example, ordering modules [Zemana Anti-Malware (Lng) *], [Bookmark Backup *], [Windows Subsystems *] as [Bookmark Backup *],[Windows Subsystems *], [Zemana Anti-Malware (Lng) *] within a Trimmed winapp2.ini.

The same function (findOutOfPlace) handles alphabetization for both entries and the individual lines within entries, so the plan is to have WinappDebug fix both.

January 25, 2018

12 hours ago, siliconman01 said:

Hmmm, I was thinking that the TRIM re-ordered and alphabetized entries, but I see that it does not. When I get a new winapp2.ini, I attach a fairly large Custom.ini on to it to cover my personal entries. Then I TRIM. The latest tool 1 (WinappDebug) shows that I have 538 errors because all my attached Custom.ini are tagged onto the bottom of Winapp2.ini. This puts a lot of entries out of order.

Any way to fix TRIM to re-alphabetize ? The old TRIM.bat did this re-alphabetization.

I have tentative plans for WinappDebug to be capable of fixing certain types of errors ( alphabetization will likely be the first) automagically after detecting them

January 25, 2018

1 hour ago, APMichael said:

I created a pull request with all corrections on GitHub today.

these invalid section pointers are probably left over from before ccleaner had langsecref=3031

windows 10 apps used to be a winapp2.ini exclusive and were listed in a custom section similar to how games currently are

January 24, 2018

a new demo of winapp2ool is available

January 19, 2018

4 hours ago, Hav0c said:

Do not get me wrong Winapp2ool has the potential to be a great tool.
But (like in all cases there is a but) let the developer get a sold base line of functions out before asking a lot of functions from the get go.

Some functions within the tool as of now is "nice to have" in my opinion. Could have left it for later versions of the application.

Allso does not help the developer is rushing things and have to release a new "bug free" version every couple of hours due to something that broke while adding new function.

Baby steps.....

Sorry about the rushed nature of the builds I had about 4 days from start-to-finish before I would (as I am currently) become busy with some school business, probably for the next week or so, so I wanted to get down what I could while the concepts were still somewhat fresh in my mind.

WRT REMOVESELF

I think this should only be used in instances like cache folders, where deleting the folders goes hand-in-hand with deleting their contents. Empty folders aren't necessarily junk or a privacy concern.

Sign In

Winapp2.ini

Posts

Joined

Last visited

Content Type

Forums

Events

Posts posted by Winapp2.ini

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

The Firefox/Mozilla Thread

Winapp2.ini additions

Impossible: 11 Exabytes Cleaned

Browser addons

The Firefox/Mozilla Thread

Browser addons

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Browse

Activity

Home

Mobile

Business

Important Information