Note: The folders found so far are:
%CommonAppData%\Microsoft\Event Viewer\Applications and Services Logs|*.xml%CommonAppData%\Microsoft\Event Viewer\Windows Logs|*.xml
[Foxit Reader *]
...
FileKey9=%CommonAppData%\Foxit Software\Foxit PDF Reader\Foxit Service\Log|*.*
[ABBYY PDFTransformer *]
...FileKey5=%SystemDrive%\Temp\PDFT*|*.*|REMOVESELF
[ASUS *]
...FileKey2=%CommonAppData%\ASUS|*Log.txt;*.bak;*.log;*.log.lzma;Thumbs.db|RECURSE
FileKey5=%CommonAppData%\ASUS\ASUS System Control Interface\AsusSystemDiagnosis|*.txt
FileKey12=%CommonAppData%\ASUS\ARMOURY CRATE Diagnosis\ASUS Update\ACS|*.txt
FileKey13=%CommonAppData%\ASUS\ARMOURY CRATE Diagnosis\LightingService|*.*
FileKey14=%CommonAppData%\ASUS\ARMOURY CRATE Diagnosis\ROG Live Service\InstallLog|*.*|RECURSE
[Audacity *]
...FileKey1=%AppData%\Audacity|lastlog.txt
FileKey2=%LocalAppData%\Audacity\CrashReports|*.*
[AVG PC TuneUp *]
...FileKey13=%CommonAppData%\AVG\Icarus\Logs|*.*
[BlackBeltPrivacy DarkNet *]
...FileKey2=%LocalAppData%\BlackBeltPrivacy\3rdParty|*.*|REMOVESELF
[Daemon Tools *]
...FileKey3=%CommonAppData%\DAEMON Tools*\Temp|*.*|RECURSE
[Edge Update *]
...FileKey1=%CommonAppData%\Microsoft\EdgeUpdate\Log|*.*
[Event Viewer *]
...FileKey2=%CommonAppData%\Microsoft\Event Viewer\*Logs|*.xml
Note: The folders found so far are:
%CommonAppData%\Microsoft\Event Viewer\Applications and Services Logs|*.xml
%CommonAppData%\Microsoft\Event Viewer\Windows Logs|*.xml
[Foxit Reader *]
...FileKey9=%CommonAppData%\Foxit Software\Foxit PDF Reader\Foxit Service\Log|*.*
[HP Logs *]
...FileKey22=%CommonAppData%\HP\HP Audio Switch|*.log
FileKey23=%SystemDrive%\HP\Diagnostics\PSDR|logFile.txt
[HP Installation Files *]
...FileKey7=%CommonAppData%\Microsoft\Windows\DeviceMetadataCache\dmrccache.bak|*.*|REMOVESELF
[Kaspersky *]
...FileKey4=%CommonAppData%\Kaspersky Lab\*\Temp|*.*|RECURSE
...FileKey7=%CommonAppData%\Kaspersky Lab\*\Bases|hdhm_temp_drives_*
FileKey8=%CommonAppData%\Kaspersky Lab\*\Bases\*|log*;strg*|RECURSE
FileKey9=%CommonAppData%\Kaspersky Lab\*\Bases\*\Cache|*.*|RECURSE
FileKey10=%CommonAppData%\Kaspersky Lab\*\Data|*.bak*;*.db-shm;*.db-wal;*.kvdb-shm;*.kvdb-wal|RECURSE
FileKey11=%CommonAppData%\Kaspersky Lab\*\Data\KDSCRL|log*
FileKey12=%CommonAppData%\Kaspersky Lab\*\Logs|*.*|RECURSE
FileKey13=%CommonAppData%\Kaspersky Lab\*\Report|*.*|RECURSE
FileKey14=%CommonAppData%\Kaspersky Lab\Kaspersky Password Manager*\Logs|*.*
[Letasoft Sound Booster *]
LangSecRef=3023
DetectFile=%CommonAppData%\Letasoft\Sound Booster
FileKey1=%CommonAppData%\Letasoft\Sound Booster\Logs|*.*
[Nero *]
...FileKey26=%AppData%\Nero|*.log|RECURSE
FileKey27=%CommonAppData%\Nero|*.log|RECURSE
FileKey28=%CommonAppData%\Nero\NeroUpdate\Logs|*.*
Note:
FileKey26
andFileKey27
are taken from[Nero Extended *]
.[Nero TuneItUp *]
...FileKey10=%CommonAppData%\Nero\Nero TuneItUp|Setup Log*.log
FileKey11=%CommonAppData%\Nero\Nero TuneItUp\cache|*.*|RECURSE
[NVIDIA *]
...FileKey4=%CommonAppData%\NVIDIA Corporation|*.log*;*bak;*log.*;*.old;*.stat|RECURSE
FileKey23=%CommonAppData%\NVIDIA Corporation\CrashDumps|*.*
[PDFsam Basic *]
LangSecRef=3021
DetectFile=%CommonAppData%\PDFsam Basic
FileKey1=%CommonAppData%\PDFsam Basic|*.msi
[PDFsam Enhanced *]
...FileKey3=%CommonAppData%\PDFsam Enhanced*\Installation|*.exe;*.msi
[Recuva *]
...FileKey3=%CommonAppData%\Recuva\BurgerData|ActivityData_*.json
[Samsung Magician *]
...FileKey10=%CommonAppData%\Samsung\Samsung Magician|*.mdmp
[Steam *]
...FileKey6=%CommonAppData%\Steam\RLD!\*|last.txt
[Web Companion *]
...FileKey3=%CommonAppData%\Lavasoft\Web Companion\Options|Statistics.txt
[Wondershare Recoverit *]
LangSecRef=3024
DetectFile=%CommonAppData%\Wondershare\Recoverit*
FileKey1=%CommonAppData%\Wondershare\Recoverit*\dataSDK|tmp;*.bak;*.log
FileKey2=%CommonAppData%\Wondershare\Recoverit*\WGPSDK|*.log
[Wondershare UniConverter *]
...FileKey10=%CommonAppData%\Wondershare\UniConverter*\UpdatePackge|*.exe
Note: The mistype is not a mistake.
[wufuc *]
LangSecRef=3024
DetectFile=%CommonAppData%\wufuc
FileKey1=%CommonAppData%\wufuc|*.log