[FonePaw Data Recovery *]LangSecRef=3024DetectFile=%LocalAppData%\FonePaw\FonePaw Data RecoveryFileKey1=%LocalAppData%\FonePaw\FonePaw Data Recovery|*.log
[FonePaw iPhone Data Recovery *]LangSecRef=3024DetectFile=%LocalAppData%\FonePaw\FonePaw iPhone Data RecoveryFileKey1=%LocalAppData%\FonePaw\FonePaw iPhone Data Recovery\Log|*.*
[Windows Media Player *]
...
RegKey7=HKCU\Software\Microsoft\MediaPlayer\Player\Settings|OpenDirRegKey8=HKCU\Software\Microsoft\MediaPlayer\Preferences|CDRecordPathRegKey9=HKU\.DEFAULT\Software\Microsoft\MediaPlayer\Player\RecentFileList
[WinHTTrack *]
...
RegKey1=HKCU\Software\WinHTTrack Website Copier\WinHTTrack Website Copier\Recent File List
[7-Zip *]
LangSecRef=3024
Detect=HKU\.DEFAULT\Software\7-Zip
RegKey1=HKU\.DEFAULT\Software\7-Zip\Compression\ArcHistory
RegKey2=HKU\.DEFAULT\Software\7-Zip\Extraction\PathHistory
RegKey3=HKU\.DEFAULT\Software\7-Zip\FM|CopyHistory
RegKey4=HKU\.DEFAULT\Software\7-Zip\FM|FolderHistory
RegKey5=HKU\.DEFAULT\Software\7-Zip\FM|PanelPath0
RegKey6=HKU\.DEFAULT\Software\7-Zip\Compression|ArcHistory
RegKey7=HKU\.DEFAULT\Software\7-Zip\Extraction|PathHistory
[AMD/ATI *]
...FileKey30=%LocalAppData%\RadeonSettings\Cache\qmlcache|*.*
[Atheros Driver *]
...FileKey6=%LocalAppData%\Atheros\DirectConnect|*.log
[Encryption Xpert *]
LangSecRef=3024
Detect=HKCU\Software\Enplase Research\Encryption Xpert
RegKey1=HKCU\Software\Enplase Research\Encryption Xpert\Settings|LastFile
[Flashpoint Launcher *]
Section=Games
DetectFile=%AppData%\Flashpoint-Launcher
FileKey1=%AppData%\Flashpoint-Launcher|*.old;LOG|RECURSE
FileKey2=%AppData%\Flashpoint-Launcher|Network Persistent State
FileKey3=%AppData%\Flashpoint-Launcher\*Cache|*.*|RECURSE
FileKey4=%AppData%\Flashpoint-Launcher\blob_storage|*.*|RECURSE
[FonePaw Data Recovery *]
LangSecRef=3024
DetectFile=%LocalAppData%\FonePaw\FonePaw Data Recovery
FileKey1=%LocalAppData%\FonePaw\FonePaw Data Recovery|*.log
[FonePaw iPhone Data Recovery *]
LangSecRef=3024
DetectFile=%LocalAppData%\FonePaw\FonePaw iPhone Data Recovery
FileKey1=%LocalAppData%\FonePaw\FonePaw iPhone Data Recovery\Log|*.*
[Fotoboeken *]
LangSecRef=3023
DetectFile=%LocalAppData%\Albelli.be Fotoboeken
FileKey1=%LocalAppData%\Albelli.be Fotoboeken\Config|List.mru
[Fotoworks XL *]
LangSecRef=3023
DetectFile=%ProgramFiles%\FotoWorksXL*
FileKey1=%ProgramFiles%\FotoWorksXL*|*.log
[GIGABYTE *]
LangSecRef=3024
DetectFile1=%ProgramFiles%\GIGABYTE\EasyTuneEngineService\EasyTuneEngineService.exe
DetectFile2=%ProgramFiles%\GIGABYTE\RGBFusion\RGBFusion.exe
FileKey1=%ProgramFiles%\GIGABYTE\EasyTuneEngineService|logFile.txt
FileKey2=%ProgramFiles%\GIGABYTE\RGBFusion\AtiTool|*.log
[GoldenCheetah *]
LangSecRef=3021
DetectFile=%LocalAppData%\GoldenCheetah
FileKey1=%LocalAppData%\GoldenCheetah\*\Logs|*.*
[HP Logs *]
...DetectFile6=%LocalAppData%\Hewlett-Packard
FileKey11=%LocalAppData%\Hewlett-Packard\HP Support Framework\Profile\Upload|*.log
[iTunes *]
...FileKey11=%AppData%\Apple Computer\Logs-old|*.*|RECURSE
[Jasc Animation Shop *]
...Detect2=HKCU\Software\Jasc\Animation Shop 2
RegKey2=HKCU\Software\Jasc\Animation Shop 2\Recent File List
[Kazaa (Search History) *]
LangSecRef=3022
Detect=HKU\.Default\Software\Kazaa
RegKey1=HKU\.Default\Software\Kazaa\Search
[Microsoft Teams *]
...FileKey2=%AppData%\Microsoft\Teams|*.log;logs.txt;old_logs_*.txt;watchdog.txt;watchdog_*.json
[MyNextbase Player *]
LangSecRef=3023
DetectFile=%AppData%\MyNextbase Player
FileKey1=%AppData%\MyNextbase Player|*-journal;*.old;LOG|RECURSE
FileKey2=%AppData%\MyNextbase Player|QuotaManager
FileKey3=%AppData%\MyNextbase Player\*Cache|*.*|RECURSE
FileKey4=%AppData%\MyNextbase Player\Logs|*.*
[MyWinLocker *]
...DetectFile=%ProgramFiles%\EgisTec\MyWinLocker*
FileKey1=%LocalAppData%|MyWinLockerInstaller.*
FileKey2=%ProgramFiles%\EgisTec\MyWinLocker*\log|*.*
[Nero Burning ROM *]
LangSecRef=3021
Detect=HKU\.Default\Software\Ahead\Nero - Burning Rom
RegKey1=HKU\.Default\Software\Ahead\Cover Designer\Recent File List
RegKey2=HKU\.Default\Software\Ahead\Nero - Burning Rom\Recent File List
RegKey3=HKU\.Default\Software\Ahead\Nero Wave Editor\Recent File List
[Paint Shop Pro *]
LangSecRef=3023
Detect=HKCU\Software\Jasc\Paint Shop Pro 6
RegKey1=HKCU\Software\Jasc\Paint Shop Pro 6\Recent File List
[Plantronics Spokes *]
LangSecRef=3023
DetectFile=%LocalAppData%\Plantronics\Spokes3G
FileKey1=%LocalAppData%\Plantronics\Logs|*.dmp;*.log
FileKey2=%LocalAppData%\Plantronics\Spokes3G\cefcache\*Cache|*.*
[PowerZip *]
...RegKey2=HKCU\Software\Trident Software\PowerZip\Doc
[Recently Typed URLs *]
LangSecRef=3001
Detect=HKU\.Default\Software\Microsoft\Internet Explorer
FileKey1=HKU\.Default\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU
FileKey2=HKU\.Default\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
FileKey3=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs
[ShooterGame *]
Section=Games
DetectFile=%LocalAppData%\ShooterGame
FileKey1=%LocalAppData%\ShooterGame\Saved\Logs|*.*|REMOVESELF
FileKey2=%LocalAppData%\ShooterGame\Saved\WebCache*|*.*|REMOVESELF
[SuuntoLink *]
LangSecRef=3024
DetectFile=%AppData%\SuuntoLink
FileKey1=%AppData%\SuuntoLink|*.dmp;*.log
FileKey2=%AppData%\SuuntoLink\*Cache|*.*
FileKey3=%AppData%\SuuntoLink\Feedback|*.dmp;*.log
FileKey4=%AppData%\SuuntoLink\Logs|*.*
FileKey5=%AppData%\SuuntoLink\webrtc_event_logs|*.*
FileKey6=%LocalAppData%\SuuntoLink|*.log|RECURSE
[Temporary Files *]
...FileKey6=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Temp|*.*|RECURSE
[Toolwiz Care *]
...[VNCViewer *]
LangSecRef=3024
Detect=HKU\.DEFAULT\Software\ORL\VNCviewer
RegKey1=HKU\.DEFAULT\Software\ORL\VNCviewer\MRU
[WhatsApp *]
...FileKey1=%AppData%\WhatsApp|*.log*;*_log.txt;Network Persistent State;QuotaManager
FileKey2=%AppData%\WhatsApp|*-journal;*.old;LOG|RECURSE
...FileKey8=%AppData%\WhatsApp\blob_storage|*.*|RECURSE
FileKey9=%AppData%\WhatsApp\Crashpad\Reports|*.*
[WinAce *]
...Detect=HKU\.DEFAULT\Software\e-merge\WinAce\2.0
RegKey1=HKU\.DEFAULT\Software\e-merge\WinAce\2.0\MRU Items
[Windows Media Player *]
...RegKey7=HKCU\Software\Microsoft\MediaPlayer\Player\Settings|OpenDir
RegKey8=HKCU\Software\Microsoft\MediaPlayer\Preferences|CDRecordPath
RegKey9=HKU\.DEFAULT\Software\Microsoft\MediaPlayer\Player\RecentFileList
[WinHTTrack *]
...RegKey1=HKCU\Software\WinHTTrack Website Copier\WinHTTrack Website Copier\Recent File List
[WinInfo *]
LangSecRef=3024
Detect=HKCU\Software\jack1024\WinInfo\1.0
RegKey1=HKCU\Software\jack1024\WinInfo\1.0|FirstRun
[winLAME *]
LangSecRef=3023
DetectFile=%LocalAppData%\winLAME
FileKey1=%LocalAppData%\winLAME\CrashDumps|*.mdmp