# # Sandboxie Official Configuration Templates # # PLEASE DO NOT EDIT # # You may place local (custom) templates in your Sandboxie.ini # file. Use the examples here to create your own templates, but # do not copy the [TemplateSettings] section. # # Please name your own local templates in such a way that # it will not introduce conflicts with the official templates. # # For example, if you design a local template to resolve # a conflict with the utility ExampleSoft: # # [Template_Local_ExampleSoft] # Tmpl.Title=ExampleSoft # Tmpl.Class=Local # OpenWinClass=ExampleSoft_WindowClass # OpenIpcPath=*\BaseNamedObjects*\ExampleSoft_* # # Note the use of the word "local" to prevent a conflict, # should this official template file later be revised to # include a template for ExampleSoft. # # Local templates that appear in your Sandboxie.ini are # treated the same way as any official template in this file, # and can be activated in the Sandboxie user interface. # [DefaultTemplates] Template=RpcPortBindings Template=SpecialImages Template=COM Template=WindowsExplorer Template=ThirdPartyIsolation Template=BlockSoftwareUpdaters Template=BlockWinRM Template=OpenWinInetCache Template=CredentialUIBroker Template=MSI_Lite [TemplateSettings] Tmpl.Version=1 # Firefox-based profile paths Tmpl.Firefox=%AppData%\Mozilla\Firefox\Profiles\* Tmpl.Waterfox=%AppData%\Waterfox\Profiles\* Tmpl.PaleMoon=%AppData%\Moonchild Productions\Pale Moon\Profiles\* Tmpl.SeaMonkey=%AppData%\Mozilla\SeaMonkey\Profiles\* Tmpl.LibreWolf=%AppData%\LibreWolf\Profiles\* # Firefox-based addon path Tmpl.Zotero=%Tmpl.Firefox%\zotero # Chromium-based profile paths Tmpl.Chrome=%Local AppData%\Google\Chrome\User Data\Default Tmpl.Edge=%Local AppData%\Microsoft\Edge\User Data\Default Tmpl.Vivaldi=%Local AppData%\Vivaldi\User Data\Default Tmpl.Brave=%Local AppData%\BraveSoftware\Brave-Browser\User Data\Default Tmpl.Opera=%AppData%\Opera Software\Opera Stable\Default Tmpl.Yandex=%Local AppData%\Yandex\YandexBrowser\User Data\Default Tmpl.Ungoogled=%Local AppData%\Chromium\User Data\Default Tmpl.Iron=%Local AppData%\Chromium\User Data\Default Tmpl.Maxthon_6=%Local AppData%\Maxthon\Application\User Data\Default Tmpl.Dragon=%Local AppData%\Comodo\Dragon\User Data\Default Tmpl.Osiris=%Local AppData%\Osiris\Osiris-Browser\User Data\Default Tmpl.Slimjet=%Local AppData%\Slimjet\User Data\Default # Email Readers profile paths Tmpl.Office_Outlook=%Local AppData%\Microsoft\Outlook Tmpl.Windows_Vista_Mail=%Local AppData%\Microsoft\Windows Mail Tmpl.Windows_Live_Mail=%Local AppData%\Microsoft\Windows Live Mail Tmpl.Thunderbird=%Local AppData%\Thunderbird Tmpl.Thunderbird:ExpectFile=xulstore.json Tmpl.Opera_Mail=%Local AppData%\Opera\*\mail Tmpl.Opera_Mail:ExpectFile=accounts.ini Tmpl.Incredimail=%Local AppData%\IM Tmpl.TheBat=%AppData%\The Bat! Tmpl.eM_Client=%AppData%\eM Client # Miscellaneous paths Tmpl.eDocPrinter=%ProgramFiles%\ITEKSOFT\eDocPrinter* Tmpl.FinePrint=%Personal%\FinePrint files Tmpl.RoboForm=%Personal%\My RoboForm Data Tmpl.KasperskyDataRoot=%AllUsersProfile%\Kaspersky Lab # # Default access rules # [TemplateDefaultPaths] # Key # Application Hives OpenKeyPath=\REGISTRY\A\* # File # named pipe root OpenFilePath=\Device\NamedPipe\ # mail slot root OpenFilePath=\Device\MailSlot\ # Windows 7 fault-tolerant heap OpenFilePath=\Device\NamedPipe\ProtectedPrefix\LocalService\FTHPIPE # printer OpenFilePath=\Device\NamedPipe\spoolss OpenFilePath=\Device\NamedPipe\spooler* OpenFilePath=%DefaultSpoolDirectory%\* OpenFilePath=%DefaultSpoolDirectory2%\* # doPDF OpenFilePath=\Device\NamedPipe\*_doPDF* # multimedia OpenFilePath=\Device\NamedPipe\AudioSrv # third-party software OpenFilePath=\Device\NamedPipe\Adobe LM Service* # Novell NetIdentity OpenFilePath=\Device\NamedPipe\XTIERRPCPIPE # # the LanmanRedirector/Mup devices (when accessed without extra paths) # is a security attack, and must be closed ClosedFilePath=\Device\LanmanRedirector ClosedFilePath=\Device\Mup # # Block access to imdisk, force terminated proxy processes can result in a BSOD ClosedFilePath=\Device\ImDiskCtl # IPC OpenIpcPath=\Windows\ApiPort OpenIpcPath=\Sessions\*\Windows\ApiPort OpenIpcPath=\Sessions\*\Windows\SharedSection # bSession0 OpenIpcPath=\Windows\SharedSection # now required by Chromium browsers OpenIpcPath=\Sessions\*\BaseNamedObjects\CrSharedMem_* OpenIpcPath=\ThemeApiPort OpenIpcPath=\KnownDlls\* # _WIN64 OpenIpcPath=\KnownDlls32\* # _M_ARM64 OpenIpcPath=\KnownDllsChpe32\* OpenIpcPath=\NLS\* OpenIpcPath=*\BaseNamedObjects*\ShimCacheMutex OpenIpcPath=*\BaseNamedObjects*\ShimSharedMemory OpenIpcPath=*\BaseNamedObjects*\SHIMLIB_LOG_MUTEX OpenIpcPath=*\BaseNamedObjects*\msgina: ReturnToWelcome OpenIpcPath=\Security\LSA_AUTHENTICATION_INITIALIZED OpenIpcPath=\LsaAuthenticationPort OpenIpcPath=\NlsCacheMutant OpenIpcPath=\KernelObjects\* # miscellaneous services OpenIpcPath=\NLAPublicPort OpenIpcPath=\RPC Control\nlaapi OpenIpcPath=\RPC Control\tapsrvlpc OpenIpcPath=\RPC Control\senssvc OpenIpcPath=\RPC Control\samss lpc OpenIpcPath=*\BaseNamedObjects*\SENS Information Cache OpenIpcPath=*\BaseNamedObjects*\TabletHardwarePresent OpenIpcPath=*\BaseNamedObjects*\userenv: * Group Policy has been applied OpenIpcPath=*\BaseNamedObjects*\TermSrvReadyEvent # network OpenIpcPath=\RPC Control\dhcpcsvc OpenIpcPath=\RPC Control\dhcpcsvc6 OpenIpcPath=\RPC Control\DNSResolver OpenIpcPath=\RPC Control\RasmanRpc OpenIpcPath=*\BaseNamedObjects*\WininetStartupMutex OpenIpcPath=*\BaseNamedObjects*\WininetConnectionMutex OpenIpcPath=*\BaseNamedObjects*\WininetProxyRegistryMutex OpenIpcPath=*\BaseNamedObjects*\RasPbFile # cicero multi-language subsystem OpenIpcPath=*\BaseNamedObjects*\CTF.* OpenIpcPath=*\BaseNamedObjects*\MSCTF.* OpenIpcPath=*\BaseNamedObjects*\MSUIM.* OpenIpcPath=*\BaseNamedObjects*\CtfmonInstMutex* OpenIpcPath=*\BaseNamedObjects*\CiceroSharedMemDefault* OpenIpcPath=*\BaseNamedObjects*\CicLoadWinStaWinSta* # Sysinternals DebugView (dbgview) OpenIpcPath=*\BaseNamedObjects*\DBWinMutex OpenIpcPath=*\BaseNamedObjects*\DBWIN_BUFFER OpenIpcPath=*\BaseNamedObjects*\DBWIN_BUFFER_READY OpenIpcPath=*\BaseNamedObjects*\DBWIN_DATA_READY # multimedia OpenIpcPath=\RPC Control\AudioSrv OpenIpcPath=*\BaseNamedObjects*\mmGlobalPnpInfo OpenIpcPath=*\BaseNamedObjects*\Guard*mmGlobalPnpInfoGuard OpenIpcPath=*\BaseNamedObjects*\MidiMapper_modLongMessage_RefCnt OpenIpcPath=*\BaseNamedObjects*\MidiMapper_Configure OpenIpcPath=*\BaseNamedObjects*\SsiMidiDllCs OpenIpcPath=*\BaseNamedObjects*\StaccatoSynthCore11Mutex OpenIpcPath=*\BaseNamedObjects*\WDMAUD_Callbacks OpenIpcPath=*\BaseNamedObjects*\DirectSound* OpenIpcPath=*\BaseNamedObjects*\AMResourceMutex* OpenIpcPath=*\BaseNamedObjects*\AMResourceMapping* OpenIpcPath=*\BaseNamedObjects*\VideoRenderer OpenIpcPath=*\BaseNamedObjects*\VIDEOMEMORY OpenIpcPath=*\BaseNamedObjects*\mxrapi OpenIpcPath=*\BaseNamedObjects*\mixercallback OpenIpcPath=*\BaseNamedObjects*\hardwaremixercallback OpenIpcPath=*\BaseNamedObjects*\DINPUTWINMM OpenIpcPath=*\BaseNamedObjects*\DDrawDriverObjectListMutex OpenIpcPath=*\BaseNamedObjects*\__DDrawExclMode__ OpenIpcPath=*\BaseNamedObjects*\__DDrawCheckExclMode__ OpenIpcPath=*\BaseNamedObjects*\DDrawWindowListMutex OpenIpcPath=*\BaseNamedObjects*\DDrawCheckFullscreenSemaphore OpenIpcPath=*\BaseNamedObjects*\D3D9CheckFullscreenSemaphore OpenIpcPath=*\BaseNamedObjects*\WinMMConsoleAudioEvent # multimedia (Vista) OpenIpcPath=\MmcssApiPort OpenIpcPath=\RPC Control\AudioClientRpc # AudioDg OpenIpcPath=*\BaseNamedObjects*\SYSTEM_AUDIO_STREAM_* # Windows Aero OpenIpcPath=\UxSmsApiPort OpenIpcPath=*\BaseNamedObjects*\Dwm-*-ApiPort-* OpenIpcPath=*\BaseNamedObjects*\DwmDxBltEvent* # following resource is needed on Windows Vista and later, # but also provided by the SRS Audio Sandbox program OpenIpcPath=*\BaseNamedObjects*\AudioEngineDuplicateHandleApiPort* # NComputing audio server/driver ? OpenIpcPath=\RPC Control\NCWTSAudioServer # printer OpenIpcPath=\RPC Control\spoolss OpenIpcPath=*\BaseNamedObjects*\EPSON-PrgMtr-* OpenIpcPath=*\BaseNamedObjects*\RouterPreInitEvent # Sandboxie service OpenIpcPath=\RPC Control\SbieSvcPort OpenIpcPath=*\BaseNamedObjects*\Sandboxie_StartMenu_WorkArea_* # objects in an unnamed directory OpenIpcPath=\...\* # miscellaneous services (Vista) # licensing OpenIpcPath=\RPC Control\SLCTransportEndpoint-* # parental controls OpenIpcPath=\RPC Control\wpcsvc # Windows Firewall OpenIpcPath=*\BaseNamedObjects*\BFE_Notify_Event_* # _WIN64 # 64-bit spooler for 32-bit programs OpenIpcPath=*\BaseNamedObjects*\WinSpl64To32Mutex*_0 OpenIpcPath=\RPC Control\splwow64_*_0 OpenIpcPath=\RPC Control\umpdproxy_*_0 # OpenIpcPath=\ConsoleEvent-0x* OpenIpcPath=*\BaseNamedObjects*\ConsoleEvent-0x* OpenIpcPath=\RPC Control\console-0x*-lpc-handle OpenIpcPath=\RPC Control\ConsoleEvent-0x* OpenIpcPath=\RPC Control\ConsoleLPC-0x* OpenIpcPath=\RPC Control\lsapolicylookup OpenIpcPath=\RPC Control\lsasspirpc OpenIpcPath=\RPC Control\LSARPC_ENDPOINT OpenIpcPath=\RPC Control\umpo OpenIpcPath=*\BaseNamedObjects*\FlipEx* OpenIpcPath=*\BaseNamedObjects*\FontCachePort OpenIpcPath=*\BaseNamedObjects*\FntCache-* # Windows 8 OpenIpcPath=\Windows\Theme* OpenIpcPath=\Sessions\*\Windows\Theme* OpenIpcPath=\Sessions\*\Windows\DwmApiPort OpenIpcPath=*\BaseNamedObjects*\DWM_DX_FULLSCREEN_TRANSITION_EVENT # _WIN64 # 64-bit spooler for 32-bit programs OpenIpcPath=*\BaseNamedObjects*\WinSpl64To32Mutex*_2000 OpenIpcPath=\RPC Control\splwow64_*_2000 OpenIpcPath=\RPC Control\umpdproxy_*_2000 # # Windows 10 OpenIpcPath=*\BaseNamedObjects*\CoreMessagingRegistrar OpenIpcPath=*\BaseNamedObjects\[CoreUI]-* # open paths Windows 11 # 22449.1000 accesses this before sbiedll load OpenIpcPath=*\BaseNamedObjects\SM*:WilStaging_* # _M_ARM64 22621.819 used by emulated processes OpenIpcPath=\{BEC19D6F-D7B2-41A8-860C-8787BB964F2D} # ReadIpcPath=\??\pipe\* ReadIpcPath=$:explorer.exe OpenWinClass=Shell_TrayWnd OpenWinClass=TrayNotifyWnd # Power Meter dialog box: OpenWinClass=SystemTray_Main OpenWinClass=Connections Tray OpenWinClass=MS_WebcheckMonitor OpenWinClass=PrintTray_Notify_WndClass OpenWinClass=CicLoaderWndClass OpenWinClass=CicMarshalWndClass OpenWinClass=Credential Dialog Xaml Host # Windows 7 OpenWinClass=Sandbox:*:ConsoleWindowClass OpenWinClass=MSTaskSwWClass # Windows 11 OpenWinClass=MicrosoftWindowsTooltip # # third party # OpenIpcPath=*\BaseNamedObjects*\ATITRAY_SMEM OpenIpcPath=*\BaseNamedObjects*\ATITRAY_OSDM OpenIpcPath=*\BaseNamedObjects*\AMCreateListenSock* # Ad Muncher OpenIpcPath=*\BaseNamedObjects*\AMIPC_* # DevLdr32 sound card driver OpenIpcPath=*\BaseNamedObjects*\devldr32 # ThreatFire OpenIpcPath=*\BaseNamedObjects*\ThreatfireApiHookIpc2Map # third party - key-logger-related OpenIpcPath=*\BaseNamedObjects*\00MemoryShareKeyloggerHunter # hardware - wacom tablet OpenIpcPath=*\BaseNamedObjects*\WacomNewFrontAppEventName OpenIpcPath=*\BaseNamedObjects*\WacomTouchingAppNameMutexName OpenWinClass=CTouchPadSynchronizer OpenWinClass=Type32_Main_Window OpenWinClass=TForm_AshampooFirewall # Tight VNC OpenWinClass=WinVNC desktop sink # Download Accelerator Plus OpenWinClass=Afx:400000:0 # nVidia nView OpenWinClass=NVIDIA TwinView Window OpenWinClass=SWFlash_PlaceHolderX # PowerPoint OpenWinClass=MdiClass # joystick OpenWinClass=Logitech Wingman Internal Message Router # devldr32 sound card driver OpenWinClass=devldr # # Network access rules # depending on the preset, either the "Open" or the "Close" directives are applied # [TemplateNetworkPaths] OpenFilePath=\Device\NamedPipe\ROUTER OpenFilePath=\Device\NamedPipe\ShimViewer OpenFilePath=\Device\Afd OpenFilePath=\Device\Afd\Endpoint OpenFilePath=\Device\Afd\AsyncConnectHlp OpenFilePath=\Device\Afd\AsyncSelectHlp OpenFilePath=\Device\Afd\ROUTER OpenFilePath=\Device\Afd\Mio OpenFilePath=\Device\WS2IFSL OpenFilePath=\Device\WS2IFSL\NifsPvd OpenFilePath=\Device\WS2IFSL\NifsSct OpenFilePath=\Device\Tcp OpenFilePath=\Device\Tcp6 OpenFilePath=\Device\Ip OpenFilePath=\Device\Ip6 OpenFilePath=\Device\Udp OpenFilePath=\Device\Udp6 OpenFilePath=\Device\RawIp OpenFilePath=\Device\RawIp6 OpenFilePath=\Device\NetBT_Tcpip_* OpenFilePath=\Device\Http\* OpenFilePath=\Device\Nsi ClosedFilePath=\Device\afd* ClosedFilePath=\Device\ip ClosedFilePath=\Device\ip6 ClosedFilePath=\Device\udp ClosedFilePath=\Device\udp6 ClosedFilePath=\Device\tcp ClosedFilePath=\Device\tcp6 ClosedFilePath=\Device\http\* ClosedFilePath=\Device\rawip ClosedFilePath=\Device\rawip6 ClosedFilePath=\Device\nsi # # Access rules for device restricted boxes # [TemplateSModPaths] ClosedFilePath=\Device\* NormalFilePath=\Device\NamedPipe\* NormalFilePath=\Device\CNG NormalFilePath=\Device\ConDrv\* NormalFilePath=\Device\DeviceApi* NormalFilePath=\Device\DfsClient NormalFilePath=\Device\KsecDD NormalFilePath=\Device\MountPointManager NormalFilePath=\Device\Ndis NormalFilePath=\Device\PcwDrv NormalFilePath=\Device\Null NormalFilePath=\Device\BootDevice\Windows\* NormalFilePath=\Device\BootPartition\Windows\* # Smart App Control NormalFilePath=\Device\SrpDevice # Multimedia Class Scheduler Service NormalFilePath=\Device\MMCSS\MmThread # Nvidia NormalFilePath=\Device\NvAdminDevice # # Access rules for privacy enhanced boxes # [TemplatePModPaths] #NormalKeyPath=HKEY_LOCAL_MACHINE\* #NormalKeyPath=HKEY_CURRENT_USER\software\Microsoft\* #NormalKeyPath=HKEY_CURRENT_USER\software\WOW6432Node\Microsoft\* #NormalKeyPath=\REGISTRY\USER\*_Classes\* WriteKeyPath=\REGISTRY\USER\* # NormalFilePath=%SystemRoot%\* NormalFilePath=%SbieHome%\* NormalFilePath=%ProgramFiles%\* NormalFilePath=%ProgramFiles% (x86)\* NormalFilePath=%ProgramData%\Microsoft\* # recycle bin NormalFilePath=?:\$Recycle.Bin\* WriteFilePath=?:\$Recycle.Bin\**\* # shell & ui NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Classes\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\FileAssociations\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\* NormalKeyPath=HKEY_CURRENT_USER\AppEvents\* NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences\* NormalKeyPath=HKEY_CURRENT_USER\Environment\* # # Default folders to be created in privacy enhanced boxes # [TemplateDefaultFolders] DefaultFolder=%SystemRoot% DefaultFolder=%TEMP% DefaultFolder=%ProgramFiles% DefaultFolder=%ProgramFiles(x86)% DefaultFolder=%CommonProgramFiles% DefaultFolder=%CommonProgramFiles(x86)% DefaultFolder=%USERPROFILE% #HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders #HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders #DefaultFolder=%USERPROFILE%\Desktop DefaultFolder=%Desktop% #DefaultFolder=%USERPROFILE%\Documents DefaultFolder=%Personal% #DefaultFolder=%USERPROFILE%\Downloads DefaultFolder=%{374DE290-123F-4565-9164-39C4925E467B}% #DefaultFolder=%USERPROFILE%\Favorites DefaultFolder=%Favorites% #DefaultFolder=%USERPROFILE%\Links DefaultFolder=%{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}% #DefaultFolder=%USERPROFILE%\Music DefaultFolder=%My Music% #DefaultFolder=%USERPROFILE%\Pictures DefaultFolder=%My Pictures% #DefaultFolder=%USERPROFILE%\Saved Games DefaultFolder=%{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}% #DefaultFolder=%USERPROFILE%\Videos DefaultFolder=%My Video% DefaultFolder=%PUBLIC% #HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders #HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders DefaultFolder=%PUBLIC%\Desktop #DefaultFolder=%Common Desktop% DefaultFolder=%PUBLIC%\Documents #DefaultFolder=%Common Documents% DefaultFolder=%PUBLIC%\Downloads #DefaultFolder=%{3D644C9B-1FB8-4f30-9B45-F670235F79C0}% DefaultFolder=%PUBLIC%\Music #DefaultFolder=%CommonMusic% DefaultFolder=%PUBLIC%\Pictures #DefaultFolder=%CommonPictures% DefaultFolder=%PUBLIC%\Videos #DefaultFolder=%CommonVideo% DefaultFolder=%LOCALAPPDATA% DefaultFolder=%LOCALAPPDATA%\Microsoft DefaultFolder=%LOCALAPPDATA%\Microsoft\InputPersonalization DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows Sidebar DefaultFolder=%LOCALAPPDATA%\Microsoft\WindowsApps DefaultFolder=%LOCALAPPDATA%\Microsoft\InputPersonalization\TrainedDataStore DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows Sidebar\Gadgets DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\CloudStore DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\GameExplorer DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\History DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\INetCache DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\INetCookies DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\Shell DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\WinX DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\WinX\Group1 DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\WinX\Group2 DefaultFolder=%LOCALAPPDATA%\Microsoft\Windows\WinX\Group3 DefaultFolder=%LOCALAPPDATA%\Temp DefaultFolder=%APPDATA% DefaultFolder=%APPDATA%\Microsoft DefaultFolder=%APPDATA%\Microsoft\Internet Explorer\Quick Launch DefaultFolder=%APPDATA%\Microsoft\Windows DefaultFolder=%APPDATA%\Microsoft\Windows\CloudStore DefaultFolder=%APPDATA%\Microsoft\Windows\Network Shortcuts DefaultFolder=%APPDATA%\Microsoft\Windows\Printer Shortcuts DefaultFolder=%APPDATA%\Microsoft\Windows\Recent DefaultFolder=%APPDATA%\Microsoft\Windows\SendTo #DefaultFolder=%Common Start Menu% DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu #DefaultFolder=%Common Startup% DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup #DefaultFolder=%Common Templates% DefaultFolder=%APPDATA%\Microsoft\Windows\Templates #DefaultFolder=%Common Programs% DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessibility DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Maintenance DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools DefaultFolder=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell #DefaultFolder=%ALLUSERSPROFILE% #DefaultFolder=%Common AppData% DefaultFolder=%ProgramData% # based on fresh installation IM image DefaultFolder=%ProgramData%\Microsoft DefaultFolder=%ProgramData%\Microsoft\Windows DefaultFolder=%ProgramData%\Microsoft\Windows\GameExplorer DefaultFolder=%ProgramData%\Microsoft\Windows\LfSvc DefaultFolder=%ProgramData%\Microsoft\Windows\Models DefaultFolder=%ProgramData%\Microsoft\Windows\OneSettings DefaultFolder=%ProgramData%\Microsoft\Windows\PackagedEventProviders DefaultFolder=%ProgramData%\Microsoft\Windows\Power Efficiency Diagnostics DefaultFolder=%ProgramData%\Microsoft\Windows\Ringtones DefaultFolder=%ProgramData%\Microsoft\Windows\Templates DefaultFolder=%ProgramData%\Microsoft\Windows\wfp DefaultFolder=%ProgramData%\Microsoft\Windows\AppRepository DefaultFolder=%ProgramData%\Microsoft\Windows\AppRepository\Families DefaultFolder=%ProgramData%\Microsoft\Windows\AppRepository\Packages DefaultFolder=%ProgramData%\Microsoft\Windows\ClipSVC DefaultFolder=%ProgramData%\Microsoft\Windows\ClipSVC\Archive DefaultFolder=%ProgramData%\Microsoft\Windows\ClipSVC\GenuineTicket DefaultFolder=%ProgramData%\Microsoft\Windows\ClipSVC\Import DefaultFolder=%ProgramData%\Microsoft\Windows\ClipSVC\Install DefaultFolder=%ProgramData%\Microsoft\Windows\DeviceMetadataStore DefaultFolder=%ProgramData%\Microsoft\Windows\DeviceMetadataStore\en-US DefaultFolder=%ProgramData%\Microsoft\Windows\Parental Controls DefaultFolder=%ProgramData%\Microsoft\Windows\Parental Controls\settings DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessibility DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories #DefaultFolder=%Common Administrative Tools% DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Administrative Tools DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Maintenance DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\StartUp DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\System Tools DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell DefaultFolder=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools DefaultFolder=%ProgramData%\Microsoft\Windows\WER DefaultFolder=%ProgramData%\Microsoft\Windows\WER\ReportArchive DefaultFolder=%ProgramData%\Microsoft\Windows\WER\ReportQueue DefaultFolder=%ProgramData%\Microsoft\Windows\WER\Temp DefaultFolder=%ProgramData%\Microsoft\Windows NT DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSScan DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\ActivityLog DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\Common Coverpages DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\Inbox DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\Queue DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\SentItems DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\VirtualInbox DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US DefaultFolder=%ProgramData%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US DefaultFolder=%ProgramData%\Microsoft\DeviceSync DefaultFolder=%ProgramData%\Microsoft\MapData DefaultFolder=%ProgramData%\Microsoft\MF DefaultFolder=%ProgramData%\Microsoft\SmsRouter DefaultFolder=%ProgramData%\Microsoft\Spectrum DefaultFolder=%ProgramData%\Microsoft\Speech_OneCore DefaultFolder=%ProgramData%\Microsoft\Storage Health DefaultFolder=%ProgramData%\Microsoft\User Account Pictures DefaultFolder=%ProgramData%\Microsoft\Vault DefaultFolder=%ProgramData%\Microsoft\WDF DefaultFolder=%ProgramData%\Microsoft\AppV DefaultFolder=%ProgramData%\Microsoft\AppV\Setup DefaultFolder=%ProgramData%\Microsoft\Crypto DefaultFolder=%ProgramData%\Microsoft\Crypto\DSS DefaultFolder=%ProgramData%\Microsoft\Crypto\Keys DefaultFolder=%ProgramData%\Microsoft\Crypto\PCPKSP DefaultFolder=%ProgramData%\Microsoft\Crypto\RSA DefaultFolder=%ProgramData%\Microsoft\Crypto\DSS\MachineKeys DefaultFolder=%ProgramData%\Microsoft\Crypto\PCPKSP\WindowsAIK DefaultFolder=%ProgramData%\Microsoft\Crypto\RSA\MachineKeys DefaultFolder=%ProgramData%\Microsoft\Diagnosis DefaultFolder=%ProgramData%\Microsoft\Diagnosis\Siufloc DefaultFolder=%ProgramData%\Microsoft\DRM DefaultFolder=%ProgramData%\Microsoft\DRM\Server DefaultFolder=%ProgramData%\Microsoft\NetFramework DefaultFolder=%ProgramData%\Microsoft\NetFramework\BreadcrumbStore DefaultFolder=%ProgramData%\Microsoft\Network DefaultFolder=%ProgramData%\Microsoft\Network\Connections DefaultFolder=%ProgramData%\Microsoft\Network\Downloader DefaultFolder=%ProgramData%\Microsoft\Provisioning DefaultFolder=%ProgramData%\Microsoft\Provisioning\AssetCache DefaultFolder=%ProgramData%\Microsoft\Provisioning\AssetCache\CellularUx DefaultFolder=%ProgramData%\Microsoft\Settings DefaultFolder=%ProgramData%\Microsoft\Settings\Accounts DefaultFolder=%ProgramData%\Microsoft\UEV DefaultFolder=%ProgramData%\Microsoft\UEV\InboxTemplates DefaultFolder=%ProgramData%\Microsoft\UEV\Scripts DefaultFolder=%ProgramData%\Microsoft\UEV\Templates DefaultFolder=%ProgramData%\Microsoft\WinMSIPC DefaultFolder=%ProgramData%\Microsoft\WinMSIPC\Server DefaultFolder=%ProgramData%\Microsoft\WwanSvc DefaultFolder=%ProgramData%\Microsoft\WwanSvc\DMProfiles DefaultFolder=%ProgramData%\Microsoft\WwanSvc\Profiles DefaultFolder=%ProgramData%\USOPrivate DefaultFolder=%ProgramData%\USOShared DefaultFolder=%ProgramData%\USOShared\Logs DefaultFolder=%ProgramData%\USOShared\Logs\System DefaultFolder=%ProgramData%\USOShared\Logs\User DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Cache DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Cyber DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\DataCollection DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Downloads DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Temp DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Trace DefaultFolder=%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Temp\PSScriptOutputs DefaultFolder=%ProgramData%\Microsoft\Windows Defender DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Clean Store DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Definition Updates DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Features DefaultFolder=%ProgramData%\Microsoft\Windows Defender\LocalCopy DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Network Inspection System DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Platform DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Quarantine DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Scans DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Support DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Definition Updates\Backup DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Definition Updates\Default DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Definition Updates\NisBackup DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Definition Updates\Updates DefaultFolder=%ProgramData%\Microsoft\Windows Defender\Network Inspection System\Support DefaultFolder=%ProgramData%\Microsoft\Windows Security Health DefaultFolder=%ProgramData%\Microsoft\Windows Security Health\Health Advisor DefaultFolder=%ProgramData%\Microsoft\Windows Security Health\Logs DefaultFolder=%ProgramData%\regid.1991-06.com.microsoft DefaultFolder=%ProgramData%\SoftwareDistribution DefaultFolder=%ProgramData%\ssh # # Access rules for app compartment boxes # [TemplateAppCPaths] # open those in compartment mode as do not use the de-administrator-ize proxy in File_NtCreateFilePipe OpenFilePath=\device\*pipe\lsarpc OpenFilePath=\device\*pipe\srvsvc OpenFilePath=\device\*pipe\wkssvc OpenFilePath=\device\*pipe\samr OpenFilePath=\device\*pipe\netlogon # enable AppContainer isolation support OpenIpcPath=\Sessions\*\AppContainerNamedObjects\* # # Sbie builds after 5.27-1 opens this (it breaks IE's source view and cache though) # [Template_OpenWinInetCache] OpenClsid={0358B920-0AC7-461F-98F4-58E32CD89148} OpenIpcPath=\RPC Control\webcache_* OpenIpcPath=*\BaseNamedObjects\windows_webcache_counters_* # # Windows Remote Management (WinRM) is a large security hole. # A sandboxed app running in an elevated cmd shell can send any admin command to the host. # Block the WinRS.exe and the automation dlls to make it very difficult for someone to use. # See ICD-10136 "Sandboxie security hole allows guest to run any command in host as admin" # [Template_BlockWinRM] ClosedFilePath=|%SystemRoot%\Sys*\wsmsvc.dll ClosedFilePath=|%SystemRoot%\Sys*\wsmauto.dll ClosedFilePath=|%SystemRoot%\Sys*\winrs.exe # # this template replaces OpenProtectedStorage=y # [Template_OpenProtectedStorage] Tmpl.Title=Open Protected Storage Tmpl.Class=Misc #FuncSkipHook=PStoreCreateInstance OpenFilePath=|\Device\NamedPipe\protected_storage OpenIpcPath=*\BaseNamedObjects*\PS_SERVICE_STARTED OpenIpcPath=\RPC Control\protected_storage # # useful exceptions for confidential boxes # [Template_LessConfidentialBox] Tmpl.Title=Allow some Windows processes to access processes in a confidential box Tmpl.Class=Misc DenyHostAccess=audiodg.exe,n # # Custom handling for special images # [Template_SpecialImages] #Tmpl.Title=#xxxx #Tmpl.Class=Misc SpecialImage=chrome,chrome.exe SpecialImage=chrome,msedge.exe SpecialImage=chrome,msedgewebview2.exe SpecialImage=chrome,iron.exe SpecialImage=chrome,dragon.exe SpecialImage=chrome,opera.exe SpecialImage=chrome,neon.exe SpecialImage=chrome,maxthon.exe SpecialImage=chrome,vivaldi.exe SpecialImage=chrome,brave.exe SpecialImage=chrome,browser.exe SpecialImage=chrome,osiris.exe SpecialImage=chrome,slimjet.exe SpecialImage=chrome,catsxp.exe SpecialImage=firefox,firefox.exe SpecialImage=firefox,waterfox.exe SpecialImage=firefox,palemoon.exe SpecialImage=firefox,basilisk.exe SpecialImage=firefox,seamonkey.exe SpecialImage=firefox,k-meleon.exe SpecialImage=firefox,librewolf.exe SpecialImage=firefox,thunderbird.exe #SpecialImage=thunderbird,thunderbird.exe SpecialImage=mail,winmail.exe SpecialImage=mail,IncMail.exe SpecialImage=mail,eudora.exe SpecialImage=mail,thebat32.exe SpecialImage=mail,thebat64.exe SpecialImage=mail,Foxmail.exe SpecialImage=mail,Mailbird.exe SpecialImage=mail,MailClient.exe SpecialImage=mail,postbox.exe SpecialImage=mail,Inky.exe SpecialImage=browser,PuffinSecureBrowser.exe SpecialImage=chrome,wechat.exe SpecialImage=chrome,slack.exe SpecialImage=chrome,spotify.exe SpecialImage=chrome,Amazon Music.exe SpecialImage=chrome,steam.exe SpecialImage=chrome,FreeTube.exe SpecialImage=chrome,aDrive.exe SpecialImage=chrome,Signal.exe SpecialImage=chrome,Actual.exe SpecialImage=chrome,Beeper.exe # # other image specific presets # PreferExternalManifest=spotify.exe,y CustomChromiumFlags=--disable-features=PrintCompositorLPAC # # updater blockage, usage: # SoftwareUpdater=starting_image.exe,updater_path\updater_image.exe # [Template_BlockSoftwareUpdaters] #Tmpl.Title=#xxxx #Tmpl.Class=Misc #BlockSoftwareUpdaters=y SoftwareUpdater=firefox.exe,*\mozilla firefox\updater.exe SoftwareUpdater=firefox.exe,*\Firefox Nightly\updater.exe SoftwareUpdater=firefox.exe,*\Firefox Developer Edition\updater.exe SoftwareUpdater=firefox.exe,*\mozilla*\updates\*updater.exe SoftwareUpdater=waterfox.exe,*\Waterfox\updater.exe SoftwareUpdater=palemoon.exe,*\Pale Moon\updater.exe SoftwareUpdater=seamonkey.exe,*\SeaMonkey\updater.exe SoftwareUpdater=GoogleUpdate.exe,*\google\update\*chrome_installer.exe SoftwareUpdater=msedge.exe,*\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe SoftwareUpdater=msedge.exe,*\Microsoft\EdgeUpdate\*MicrosoftEdgeUpdateBroker.exe SoftwareUpdater=vivaldi.exe,*\Vivaldi\Application\update_notifier.exe SoftwareUpdater=brave.exe,*\BraveSoftware\Update\BraveUpdate.exe SoftwareUpdater=brave.exe,*\BraveSoftware\Update\*BraveUpdateBroker.exe SoftwareUpdater=opera.exe,*\Opera\*opera_autoupdate.exe SoftwareUpdater=launcher.exe,*\Opera\*opera_autoupdate.exe SoftwareUpdater=yandex.exe,*\Yandex\YandexBrowser\Application\*service_update.exe SoftwareUpdater=maxthon.exe,*\Maxthon\Application\*mxupdater.exe SoftwareUpdater=dragon.exe,*\Comodo\Dragon\dragon_updater.exe SoftwareUpdater=osiris.exe,*\Osiris\update.exe SoftwareUpdater=app_launcher.exe,*\Osiris\update.exe SoftwareUpdater=slimjet.exe,*\Slimjet\updater.exe SoftwareUpdater=thunderbird.exe,*\mozilla*\updates\*updater.exe [Template_COM] # block BITS service (issue 1081) ClosedClsid={4991D34B-80A1-4291-83B6-3328366B9097} # block ShellWindows (issue 871 -> 5213) #ClosedClsid={9BA05972-F6A8-11CF-A442-00A0C90A8F39} ClosedClsid=setup.exe,{9BA05972-F6A8-11CF-A442-00A0C90A8F39} # since KB5062660 (26100.4770) connecting to the Task Scheduler service takes 60 seconds + # since it's not usable with a sandboxed token, we outright block it ClosedClsid={0F87369F-A4E5-4CFC-BD3E-73E6154572DD} # For HW accelerated media playback and media device access # Microsoft H264 Video Decoder MFT #OpenClsid={62CE7E72-4C71-4D20-B15D-452831A87D9D} # Microsoft AAC Audio Decoder MFT #OpenClsid={32D186A7-218F-4C75-8876-DD77273A8999} # MP3 Decoder DMO #OpenClsid={BBEEA841-0A63-4F52-A7AB-A9B3A84ED38A} # Microsoft WebM MF VP8 Decoder Transform #OpenClsid={E3AAF548-C9A4-4C6E-234D-5ADA374B0000} # MMDeviceEnumerator class #OpenClsid={BCDE0395-E52F-467C-8E3D-C4579291692E} [Template_WindowsExplorer] # make search box wait (issue 1002) ClosedClsid={C2F03A33-21F5-47FA-B4BB-156362A2F239} # prevent context menu hang ClosedClsid={470C0EBD-5D73-4D58-9CED-E91E22E23282} # never fake admin rights for explorer.exe (issue 3516) FakeAdminRights=explorer.exe,n BreakoutDocumentProcess=explorer.exe,y [Template_MSI_Lite] ClosedFilePath=msiexec.exe,*\ie4uinit.exe [Template_ThirdPartyIsolation] # block VMNet0 virtual network configuration (issue 1102) ClosedFilePath=vmnetcfg.exe,\Device\VMnetUserif [Template_HideInstalledPrograms] # hide uninstall key WriteKeyPath=*\Software*\Microsoft\Windows\CurrentVersion\Uninstall\* # # OneDrive # [Template_OneDrive] Tmpl.Title=OneDrive Tmpl.Class=Misc DefaultFolder=%OneDrive%\Desktop DefaultFolder=%OneDrive%\Documents DefaultFolder=%OneDrive%\Downloads DefaultFolder=%OneDrive%\Music DefaultFolder=%OneDrive%\Pictures DefaultFolder=%OneDrive%\Videos # # Internet Explorer # [Template_IExplore_Force] Tmpl.Title=#4323,Internet Explorer Tmpl.Class=WebBrowser ForceProcess=iexplore.exe [Template_IExplore_Favorites_DirectAccess] Tmpl.Title=#4326,Internet Explorer Tmpl.Class=WebBrowser OpenFilePath=iexplore.exe,%Favorites% #OpenFilePath=firefox.exe,%Favorites% [Template_IExplore_Favorites_RecoverFolder] Tmpl.Title=#4327 Tmpl.Class=WebBrowser RecoverFolder=%Favorites% [Template_IExplore_History_DirectAccess] Tmpl.Title=#4336,Internet Explorer Tmpl.Class=WebBrowser OpenFilePath=iexplore.exe,%Favorites% OpenFilePath=iexplore.exe,%History%\History.IE5\* OpenKeyPath=iexplore.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs # Windows Search features needed for address bar in IE 8 OpenClsid={7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} OpenClsid={9E175B6D-F52A-11D8-B9A5-505054503030} OpenPipePath=\Device\NamedPipe\MsFteWds # Internet Explorer 10 history pane OpenFilePath=|%Local AppData%\Microsoft\Windows\ [Template_IExplore_Cookies_DirectAccess] Tmpl.Title=#4328,Internet Explorer Tmpl.Class=WebBrowser OpenFilePath=iexplore.exe,%Cookies% # Internet Explorer 10 cookies OpenClsid={0358b920-0ac7-461f-98f4-58e32cd89148} OpenIpcPath=\RPC Control\webcache_* OpenIpcPath=*\BaseNamedObjects*\windows_webcache_* OpenFilePath=%Local AppData%\Microsoft\Internet Explorer\DOMStore\* [Template_IExplore_Feeds_DirectAccess] Tmpl.Title=#4325,Internet Explorer Tmpl.Class=WebBrowser OpenFilePath=iexplore.exe,%Local AppData%\Microsoft\Feeds\ OpenFilePath=iexplore.exe,%Local AppData%\Microsoft\Feeds Cache\ [Template_IExplore_ProtectedStorage] Tmpl.Title=#4329 Tmpl.Class=WebBrowser OpenProtectedStorage=y OpenKeyPath=iexplore.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms OpenKeyPath=iexplore.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs # [Template_IExplore_Credentials] # Tmpl.Title=#4330 # Tmpl.Class=WebBrowser # OpenCredentials=y # # Firefox / Waterfox / PaleMoon / SeaMonkey / LibreWolf # # # Firefox # [Template_Firefox_Force] Tmpl.Title=#4323,Mozilla Firefox Tmpl.Class=WebBrowser ForceProcess=firefox.exe [Template_Firefox_Bookmarks_DirectAccess] Tmpl.Title=#4336,Mozilla Firefox Tmpl.Class=WebBrowser OpenFilePath=firefox.exe,%Tmpl.Firefox%\bookmark* OpenFilePath=firefox.exe,%Tmpl.Firefox%\places* OpenFilePath=firefox.exe,%Tmpl.Firefox%\favicons.sqlite [Template_Firefox_Cookies_DirectAccess] Tmpl.Title=#4328,Mozilla Firefox Tmpl.Class=WebBrowser OpenFilePath=firefox.exe,%Tmpl.Firefox%\cookies* [Template_Firefox_Passwords_DirectAccess] Tmpl.Title=#4331,Mozilla Firefox Tmpl.Class=WebBrowser OpenFilePath=firefox.exe,%Tmpl.Firefox%\logins.json OpenFilePath=firefox.exe,%Tmpl.Firefox%\key*.db [Template_Firefox_Session_DirectAccess] Tmpl.Title=#4340,Mozilla Firefox Tmpl.Class=WebBrowser OpenFilePath=firefox.exe,%Tmpl.Firefox%\sessionstore.js* [Template_Firefox_Phishing_DirectAccess] Tmpl.Title=#4337,Mozilla Firefox Tmpl.Class=WebBrowser OpenFilePath=firefox.exe,%Tmpl.Firefox%\cert9.db OpenFilePath=firefox.exe,%Local AppData%\Mozilla\Firefox\Profiles\*\safebrowsing* [Template_Firefox_Profile_DirectAccess] Tmpl.Title=#4338,Mozilla Firefox Tmpl.Class=WebBrowser OpenFilePath=firefox.exe,%Tmpl.Firefox%\* [Template_Firefox_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Waterfox # [Template_Waterfox_Force] Tmpl.Title=#4323,Waterfox Tmpl.Class=WebBrowser ForceProcess=waterfox.exe [Template_Waterfox_Bookmarks_DirectAccess] Tmpl.Title=#4336,Waterfox Tmpl.Class=WebBrowser OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\bookmark* OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\places* [Template_Waterfox_Cookies_DirectAccess] Tmpl.Title=#4328,Waterfox Tmpl.Class=WebBrowser OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\cookies* [Template_Waterfox_Passwords_DirectAccess] Tmpl.Title=#4331,Waterfox Tmpl.Class=WebBrowser OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\logins.json OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\key*.db [Template_Waterfox_Session_DirectAccess] Tmpl.Title=#4340,Waterfox Tmpl.Class=WebBrowser OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\sessionstore.js* [Template_Waterfox_Phishing_DirectAccess] Tmpl.Title=#4337,Waterfox Tmpl.Class=WebBrowser OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\blocklist.xml OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\cert9.db OpenFilePath=waterfox.exe,%Local AppData%\Waterfox\Profiles\*\safebrowsing* [Template_Waterfox_Profile_DirectAccess] Tmpl.Title=#4338,Waterfox Tmpl.Class=WebBrowser OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\* [Template_Waterfox_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Pale Moon # [Template_PaleMoon_Force] Tmpl.Title=#4323,Pale Moon Tmpl.Class=WebBrowser ForceProcess=palemoon.exe [Template_PaleMoon_Bookmarks_DirectAccess] Tmpl.Title=#4336,Pale Moon Tmpl.Class=WebBrowser OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\bookmark* OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\places* [Template_PaleMoon_Cookies_DirectAccess] Tmpl.Title=#4328,Pale Moon Tmpl.Class=WebBrowser OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\cookies* [Template_PaleMoon_Passwords_DirectAccess] Tmpl.Title=#4331,Pale Moon Tmpl.Class=WebBrowser OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\logins.json OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\key*.db [Template_PaleMoon_Session_DirectAccess] Tmpl.Title=#4340,Pale Moon Tmpl.Class=WebBrowser OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\sessionstore.js [Template_PaleMoon_Phishing_DirectAccess] Tmpl.Title=#4337,Pale Moon Tmpl.Class=WebBrowser OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\blocklist.xml OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\cert9.db [Template_PaleMoon_Profile_DirectAccess] Tmpl.Title=#4338,Pale Moon Tmpl.Class=WebBrowser OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\* [Template_PaleMoon_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # SeaMonkey Browser # [Template_SeaMonkey_Force] Tmpl.Title=#4323,SeaMonkey Tmpl.Class=WebBrowser ForceProcess=seamonkey.exe [Template_SeaMonkey_Bookmarks_DirectAccess] Tmpl.Title=#4336,SeaMonkey Tmpl.Class=WebBrowser OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\bookmark* OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\places* [Template_SeaMonkey_Cookies_DirectAccess] Tmpl.Title=#4328,SeaMonkey Tmpl.Class=WebBrowser OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\cookies* [Template_SeaMonkey_Passwords_DirectAccess] Tmpl.Title=#4331,SeaMonkey Tmpl.Class=WebBrowser OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\logins.json OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\key*.db [Template_SeaMonkey_Session_DirectAccess] Tmpl.Title=#4340,SeaMonkey Tmpl.Class=WebBrowser OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\sessionstore.js [Template_SeaMonkey_Phishing_DirectAccess] Tmpl.Title=#4337,SeaMonkey Tmpl.Class=WebBrowser OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\blocklist.xml OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\cert9.db OpenFilePath=seamonkey.exe,%Local AppData%\Mozilla\SeaMonkey\Profiles\*\safebrowsing* [Template_SeaMonkey_Profile_DirectAccess] Tmpl.Title=#4338,SeaMonkey Tmpl.Class=WebBrowser OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\* [Template_SeaMonkey_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # LibreWolf # [Template_LibreWolf_Force] Tmpl.Title=#4323,LibreWolf Tmpl.Class=WebBrowser ForceProcess=librewolf.exe [Template_LibreWolf_Bookmarks_DirectAccess] Tmpl.Title=#4336,LibreWolf Tmpl.Class=WebBrowser OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\bookmark* OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\places* OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\favicons.sqlite [Template_LibreWolf_Cookies_DirectAccess] Tmpl.Title=#4328,LibreWolf Tmpl.Class=WebBrowser OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\cookies* [Template_LibreWolf_Passwords_DirectAccess] Tmpl.Title=#4331,LibreWolf Tmpl.Class=WebBrowser OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\logins.json OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\key*.db [Template_LibreWolf_Session_DirectAccess] Tmpl.Title=#4340,LibreWolf Tmpl.Class=WebBrowser OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\sessionstore.js* [Template_LibreWolf_Phishing_DirectAccess] Tmpl.Title=#4337,LibreWolf Tmpl.Class=WebBrowser OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\cert9.db OpenFilePath=librewolf.exe,%Local AppData%\LibreWolf\Profiles\*\safebrowsing* [Template_LibreWolf_Profile_DirectAccess] Tmpl.Title=#4338,LibreWolf Tmpl.Class=WebBrowser OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\* # # Firefox Add-ons # [Template_Firefox_Addon_Zotero] Tmpl.Title=Zotero (with XPDF) Tmpl.Class=WebBrowser Tmpl.Url=http://www.zotero.org/ OpenFilePath=,%Tmpl.Zotero%\* ProcessGroup=,firefox.exe,pdfinfo-Win32.exe,pdftotext-Win32.exe # # Google Chrome / Microsoft Edge (Chromium) / Vivaldi / Brave Browser / Opera / Yandex / Ungoogled Chromium / # SRWare Iron / Maxthon 6 (Chromium) / Comodo Dragon / Osiris Browser / FlashPeak Slimjet / # # # Google Chrome # [Template_Chrome_Force] Tmpl.Title=#4323,Google Chrome Tmpl.Class=WebBrowser ForceProcess=chrome.exe [Template_Chrome_Bookmarks_DirectAccess] Tmpl.Title=#4356,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\Bookmarks* OpenFilePath=chrome.exe,%Tmpl.Chrome%\Favicons* [Template_Chrome_History_DirectAccess] Tmpl.Title=#4336,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\Bookmarks* OpenFilePath=chrome.exe,%Tmpl.Chrome%\Favicons* OpenFilePath=chrome.exe,%Tmpl.Chrome%\*History* OpenFilePath=chrome.exe,%Tmpl.Chrome%\Current * OpenFilePath=chrome.exe,%Tmpl.Chrome%\Last * OpenFilePath=chrome.exe,%Tmpl.Chrome%\Visited Links* [Template_Chrome_Cookies_DirectAccess] Tmpl.Title=#4328,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\Network\Cookies* [Template_Chrome_Passwords_DirectAccess] Tmpl.Title=#4331,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\Login Data* [Template_Chrome_Preferences_DirectAccess] Tmpl.Title=#4339,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\Preferences* [Template_Chrome_Sync_DirectAccess] Tmpl.Title=#4324,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\Sync Data\* OpenFilePath=chrome.exe,%Tmpl.Chrome%\Sync Extension Settings\* [Template_Chrome_Phishing_DirectAccess] Tmpl.Title=#4337,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Local AppData%\Google\Chrome\User Data\Safe Browsing* OpenFilePath=chrome.exe,%Local AppData%\Google\Chrome\User Data\CertificateRevocation [Template_Chrome_Profile_DirectAccess] Tmpl.Title=#4338,Google Chrome Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Chrome%\* # # Microsoft Edge (Chromium) # [Template_Edge_Force] Tmpl.Title=#4323,Microsoft Edge Tmpl.Class=WebBrowser ForceProcess=msedge.exe [Template_Edge_Bookmarks_DirectAccess] Tmpl.Title=#4356,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\Bookmarks* OpenFilePath=msedge.exe,%Tmpl.Edge%\Favicons* [Template_Edge_History_DirectAccess] Tmpl.Title=#4336,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\Bookmarks* OpenFilePath=msedge.exe,%Tmpl.Edge%\Favicons* OpenFilePath=msedge.exe,%Tmpl.Edge%\*History* OpenFilePath=msedge.exe,%Tmpl.Edge%\Current * OpenFilePath=msedge.exe,%Tmpl.Edge%\Last * OpenFilePath=msedge.exe,%Tmpl.Edge%\Visited Links* [Template_Edge_Cookies_DirectAccess] Tmpl.Title=#4328,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\Network\Cookies* [Template_Edge_Passwords_DirectAccess] Tmpl.Title=#4331,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\Login Data* [Template_Edge_Preferences_DirectAccess] Tmpl.Title=#4339,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\Preferences* [Template_Edge_Sync_DirectAccess] Tmpl.Title=#4324,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\Sync Data\* OpenFilePath=msedge.exe,%Tmpl.Edge%\Sync Extension Settings\* [Template_Edge_Phishing_DirectAccess] Tmpl.Title=#4337,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\Safe Browsing* OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\CertificateRevocation OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\SmartScreen OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\Ad Blocking [Template_Edge_Profile_DirectAccess] Tmpl.Title=#4338,Microsoft Edge Tmpl.Class=WebBrowser OpenFilePath=msedge.exe,%Tmpl.Edge%\* [Template_Edge_Fix] Tmpl.Title=#4342,Microsoft Edge Tmpl.Class=WebBrowser Tmpl.Url=https://www.microsoft.com/en-us/edge Tmpl.Scan=s Tmpl.ScanProduct=Microsoft Edge Tmpl.ScanService=edgeupdate # SBIE fix for Windows 11 KB5014019 update (May 2022) # ExternalManifest breaks MSEdge 111.0.1633.0 #ExternalManifestHack=msedge.exe,y # SBIE fix for MS Edge 106.x also for Windows 10 #OpenIpcPath=msedge.exe,\Sessions\*\AppContainerNamedObjects\* #OpenFilePath=msedge.exe,\Device\NamedPipe\Sessions\*\AppContainerNamedObjects\* # SBIE fix for MS Edge WebView2 #ExternalManifestHack=msedgewebview2.exe,y NormalFilePath=msedge.exe,%LocalAppData%\Microsoft\Edge\User Data\Default\Secure Preferences FakeAdminRights=msedge.exe,n [Template_W10_Arm64_Fix] Tmpl.Title=#4342,Windows 10 on ARM64 Tmpl.Class=Misc Tmpl.Scan=s Tmpl.ScanFile=C:\Program Files (Arm)\desktop.ini DisableBoxedWinSxS=explorer.exe,y DisableBoxedWinSxS=msedge.exe,y # # Vivaldi # [Template_Vivaldi_Force] Tmpl.Title=#4323,Vivaldi Tmpl.Class=WebBrowser ForceProcess=vivaldi.exe [Template_Vivaldi_Bookmarks_DirectAccess] Tmpl.Title=#4356,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Bookmarks* OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Favicons* [Template_Vivaldi_History_DirectAccess] Tmpl.Title=#4336,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Bookmarks* OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Favicons* OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\*History* OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Current * OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Last * OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Visited Links* [Template_Vivaldi_Cookies_DirectAccess] Tmpl.Title=#4328,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Network\Cookies* [Template_Vivaldi_Notes_DirectAccess] Tmpl.Title=#4341,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Notes* [Template_Vivaldi_Passwords_DirectAccess] Tmpl.Title=#4331,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Login Data* [Template_Vivaldi_Preferences_DirectAccess] Tmpl.Title=#4339,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Preferences* [Template_Vivaldi_Sync_DirectAccess] Tmpl.Title=#4324,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Sync Data\* OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Sync Extension Settings\* [Template_Vivaldi_Phishing_DirectAccess] Tmpl.Title=#4337,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Local AppData%\Vivaldi\User Data\Safe Browsing* OpenFilePath=vivaldi.exe,%Local AppData%\Vivaldi\User Data\CertificateRevocation [Template_Vivaldi_Profile_DirectAccess] Tmpl.Title=#4338,Vivaldi Tmpl.Class=WebBrowser OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\* [Template_Vivaldi_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Brave Browser # [Template_Brave_Force] Tmpl.Title=#4323,Brave Browser Tmpl.Class=WebBrowser ForceProcess=brave.exe [Template_Brave_Bookmarks_DirectAccess] Tmpl.Title=#4356,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\Bookmarks* OpenFilePath=brave.exe,%Tmpl.Brave%\Favicons* [Template_Brave_History_DirectAccess] Tmpl.Title=#4336,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\Bookmarks* OpenFilePath=brave.exe,%Tmpl.Brave%\Favicons* OpenFilePath=brave.exe,%Tmpl.Brave%\*History* OpenFilePath=brave.exe,%Tmpl.Brave%\Current * OpenFilePath=brave.exe,%Tmpl.Brave%\Last * OpenFilePath=brave.exe,%Tmpl.Brave%\Visited Links* [Template_Brave_Cookies_DirectAccess] Tmpl.Title=#4328,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\Network\Cookies* [Template_Brave_Passwords_DirectAccess] Tmpl.Title=#4331,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\Login Data* [Template_Brave_Preferences_DirectAccess] Tmpl.Title=#4339,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\Preferences* [Template_Brave_Sync_DirectAccess] Tmpl.Title=#4324,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\Sync Data\* [Template_Brave_Phishing_DirectAccess] Tmpl.Title=#4337,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Local AppData%\BraveSoftware\Brave-Browser\User Data\Safe Browsing* OpenFilePath=brave.exe,%Local AppData%\BraveSoftware\Brave-Browser\User Data\CertificateRevocation [Template_Brave_Profile_DirectAccess] Tmpl.Title=#4338,Brave Browser Tmpl.Class=WebBrowser OpenFilePath=brave.exe,%Tmpl.Brave%\* [Template_Brave_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Opera # [Template_Opera_Force] Tmpl.Title=#4323,Opera Tmpl.Class=WebBrowser ForceProcess=opera.exe [Template_Opera_Bookmarks_DirectAccess] Tmpl.Title=#4356,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\Bookmarks* OpenFilePath=opera.exe,%Tmpl.Opera%\Favicons* [Template_Opera_History_DirectAccess] Tmpl.Title=#4336,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\Bookmarks* OpenFilePath=opera.exe,%Tmpl.Opera%\Favicons* OpenFilePath=opera.exe,%Tmpl.Opera%\*History* OpenFilePath=opera.exe,%Tmpl.Opera%\Current * OpenFilePath=opera.exe,%Tmpl.Opera%\Last * OpenFilePath=opera.exe,%Tmpl.Opera%\Visited Links* [Template_Opera_Cookies_DirectAccess] Tmpl.Title=#4328,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\Network\Cookies* [Template_Opera_Passwords_DirectAccess] Tmpl.Title=#4331,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\Login Data* [Template_Opera_Preferences_DirectAccess] Tmpl.Title=#4339,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\Preferences* [Template_Opera_Sync_DirectAccess] Tmpl.Title=#4324,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\Sync Data\* [Template_Opera_Phishing_DirectAccess] Tmpl.Title=#4337,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\CertificateRevocation [Template_Opera_Profile_DirectAccess] Tmpl.Title=#4338,Opera Tmpl.Class=WebBrowser OpenFilePath=opera.exe,%Tmpl.Opera%\* OpenFilePath=launcher.exe,%Local AppData%\*\Opera\* OpenFilePath=opera.exe,%Local AppData%\*\Opera\*\* [Template_Opera_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Yandex # [Template_Yandex_Force] Tmpl.Title=#4323,Yandex Browser Tmpl.Class=WebBrowser ForceProcess=browser.exe [Template_Yandex_Bookmarks_DirectAccess] Tmpl.Title=#4356,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\Bookmarks* OpenFilePath=browser.exe,%Tmpl.Yandex%\Favicons* [Template_Yandex_History_DirectAccess] Tmpl.Title=#4336,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\Bookmarks* OpenFilePath=browser.exe,%Tmpl.Yandex%\Favicons* OpenFilePath=browser.exe,%Tmpl.Yandex%\*History* OpenFilePath=browser.exe,%Tmpl.Yandex%\Current * OpenFilePath=browser.exe,%Tmpl.Yandex%\Last * OpenFilePath=browser.exe,%Tmpl.Yandex%\Visited Links* [Template_Yandex_Cookies_DirectAccess] Tmpl.Title=#4328,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\Network\Cookies* [Template_Yandex_Passwords_DirectAccess] Tmpl.Title=#4331,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\Ya Passman Data* [Template_Yandex_Preferences_DirectAccess] Tmpl.Title=#4339,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\Preferences* [Template_Yandex_Sync_DirectAccess] Tmpl.Title=#4324,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\Sync Data\* [Template_Yandex_Phishing_DirectAccess] Tmpl.Title=#4337,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Local AppData%\Yandex\YandexBrowser\User Data\Safe Browsing* OpenFilePath=browser.exe,%Local AppData%\Yandex\YandexBrowser\User Data\CertificateRevocation [Template_Yandex_Profile_DirectAccess] Tmpl.Title=#4338,Yandex Browser Tmpl.Class=WebBrowser OpenFilePath=browser.exe,%Tmpl.Yandex%\* [Template_Yandex_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Ungoogled Chromium # [Template_Ungoogled_Force] Tmpl.Title=#4323,Ungoogled Chromium Tmpl.Class=WebBrowser ForceProcess=chrome.exe [Template_Ungoogled_Bookmarks_DirectAccess] Tmpl.Title=#4356,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Bookmarks* OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Favicons* [Template_Ungoogled_History_DirectAccess] Tmpl.Title=#4336,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Bookmarks* OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Favicons* OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\*History* OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Current * OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Last * OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Visited Links* [Template_Ungoogled_Cookies_DirectAccess] Tmpl.Title=#4328,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Network\Cookies* [Template_Ungoogled_Passwords_DirectAccess] Tmpl.Title=#4331,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Login Data* [Template_Ungoogled_Preferences_DirectAccess] Tmpl.Title=#4339,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Preferences* [Template_Ungoogled_Sync_DirectAccess] Tmpl.Title=#4324,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Sync Data\* [Template_Ungoogled_Profile_DirectAccess] Tmpl.Title=#4338,Ungoogled Chromium Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\* [Template_Ungoogled_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # SRWare Iron # [Template_Iron_Force] Tmpl.Title=#4323,SRWare Iron Tmpl.Class=WebBrowser ForceFolder=C:\Program Files\SRWare Iron (64-Bit) [Template_Iron_Bookmarks_DirectAccess] Tmpl.Title=#4356,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\Bookmarks* OpenFilePath=chrome.exe,%Tmpl.Iron%\Favicons* [Template_Iron_History_DirectAccess] Tmpl.Title=#4336,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\Bookmarks* OpenFilePath=chrome.exe,%Tmpl.Iron%\Favicons* OpenFilePath=chrome.exe,%Tmpl.Iron%\*History* OpenFilePath=chrome.exe,%Tmpl.Iron%\Current * OpenFilePath=chrome.exe,%Tmpl.Iron%\Last * OpenFilePath=chrome.exe,%Tmpl.Iron%\Visited Links* [Template_Iron_Cookies_DirectAccess] Tmpl.Title=#4328,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\Network\Cookies* [Template_Iron_Passwords_DirectAccess] Tmpl.Title=#4331,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\Login Data* [Template_Iron_Preferences_DirectAccess] Tmpl.Title=#4339,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\Preferences* [Template_Iron_Sync_DirectAccess] Tmpl.Title=#4324,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\Sync Data\* [Template_Iron_Phishing_DirectAccess] Tmpl.Title=#4337,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Local AppData%\Chromium\User Data\Safe Browsing* OpenFilePath=chrome.exe,%Local AppData%\Chromium\User Data\CertificateRevocation [Template_Iron_Profile_DirectAccess] Tmpl.Title=#4338,SRWare Iron Tmpl.Class=WebBrowser OpenFilePath=chrome.exe,%Tmpl.Iron%\* [Template_Iron_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Maxthon 6 (Chromium) # [Template_Maxthon6_Force] Tmpl.Title=#4323,Maxthon 6 Tmpl.Class=WebBrowser ForceProcess=Maxthon.exe [Template_Maxthon6_Bookmarks_DirectAccess] Tmpl.Title=#4356,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Bookmarks* OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Favicons* [Template_Maxthon6_History_DirectAccess] Tmpl.Title=#4336,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Bookmarks* OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Favicons* OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\*History* OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Current * OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Last * OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Visited Links* [Template_Maxthon6_Cookies_DirectAccess] Tmpl.Title=#4328,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Network\Cookies* [Template_Maxthon6_Passwords_DirectAccess] Tmpl.Title=#4331,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Login Data* [Template_Maxthon6_Preferences_DirectAccess] Tmpl.Title=#4339,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Preferences* [Template_Maxthon6_Phishing_DirectAccess] Tmpl.Title=#4337,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Local AppData%\Maxthon\Application\User Data\Safe Browsing* OpenFilePath=Maxthon.exe,%Local AppData%\Maxthon\Application\User Data\CertificateRevocation [Template_Maxthon6_Profile_DirectAccess] Tmpl.Title=#4338,Maxthon 6 Tmpl.Class=WebBrowser OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\* [Template_Maxthon6_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Comodo Dragon # [Template_Dragon_Force] Tmpl.Title=#4323,Comodo Dragon Tmpl.Class=WebBrowser ForceProcess=dragon.exe [Template_Dragon_Bookmarks_DirectAccess] Tmpl.Title=#4356,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Tmpl.Dragon%\Bookmarks* OpenFilePath=dragon.exe,%Tmpl.Dragon%\Favicons* [Template_Dragon_History_DirectAccess] Tmpl.Title=#4336,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Tmpl.Dragon%\Bookmarks* OpenFilePath=dragon.exe,%Tmpl.Dragon%\Favicons* OpenFilePath=dragon.exe,%Tmpl.Dragon%\*History* OpenFilePath=dragon.exe,%Tmpl.Dragon%\Current * OpenFilePath=dragon.exe,%Tmpl.Dragon%\Last * OpenFilePath=dragon.exe,%Tmpl.Dragon%\Visited Links* [Template_Dragon_Cookies_DirectAccess] Tmpl.Title=#4328,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Tmpl.Dragon%\Network\Cookies* [Template_Dragon_Passwords_DirectAccess] Tmpl.Title=#4331,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Tmpl.Dragon%\Login Data* [Template_Dragon_Preferences_DirectAccess] Tmpl.Title=#4339,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Tmpl.Dragon%\Preferences* [Template_Dragon_Phishing_DirectAccess] Tmpl.Title=#4337,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Local AppData%\Comodo\Dragon\User Data\Safe Browsing* OpenFilePath=dragon.exe,%Local AppData%\Comodo\Dragon\User Data\CertificateRevocation [Template_Dragon_Profile_DirectAccess] Tmpl.Title=#4338,Comodo Dragon Tmpl.Class=WebBrowser OpenFilePath=dragon.exe,%Tmpl.Dragon%\* [Template_Dragon_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # Osiris Browser # [Template_Osiris_Force] Tmpl.Title=#4323,Osiris Browser Tmpl.Class=WebBrowser ForceProcess=osiris.exe [Template_Osiris_Bookmarks_DirectAccess] Tmpl.Title=#4356,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\Bookmarks* OpenFilePath=osiris.exe,%Tmpl.Osiris%\Favicons* [Template_Osiris_History_DirectAccess] Tmpl.Title=#4336,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\Bookmarks* OpenFilePath=osiris.exe,%Tmpl.Osiris%\Favicons* OpenFilePath=osiris.exe,%Tmpl.Osiris%\*History* OpenFilePath=osiris.exe,%Tmpl.Osiris%\Current * OpenFilePath=osiris.exe,%Tmpl.Osiris%\Last * OpenFilePath=osiris.exe,%Tmpl.Osiris%\Visited Links* [Template_Osiris_Cookies_DirectAccess] Tmpl.Title=#4328,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\Cookies* [Template_Osiris_Passwords_DirectAccess] Tmpl.Title=#4331,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\Login Data* [Template_Osiris_Preferences_DirectAccess] Tmpl.Title=#4339,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\Preferences* [Template_Osiris_Sync_DirectAccess] Tmpl.Title=#4324,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\Sync Data\* [Template_Osiris_Phishing_DirectAccess] Tmpl.Title=#4337,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\User Data\Safe Browsing* OpenFilePath=osiris.exe,%Tmpl.Osiris%\User Data\CertificateRevocation [Template_Osiris_Profile_DirectAccess] Tmpl.Title=#4338,Osiris Browser Tmpl.Class=WebBrowser OpenFilePath=osiris.exe,%Tmpl.Osiris%\* [Template_Osiris_Separator] Tmpl.Title=- Tmpl.Class=WebBrowser # # FlashPeak Slimjet # [Template_Slimjet_Force] Tmpl.Title=#4323,Slimjet Tmpl.Class=WebBrowser ForceProcess=slimjet.exe [Template_Slimjet_Bookmarks_DirectAccess] Tmpl.Title=#4356,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Bookmarks* OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Favicons* [Template_Slimjet_History_DirectAccess] Tmpl.Title=#4336,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Bookmarks* OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Favicons* OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\*History* OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Current * OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Last * OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Visited Links* [Template_Slimjet_Cookies_DirectAccess] Tmpl.Title=#4328,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Network\Cookies* [Template_Slimjet_Passwords_DirectAccess] Tmpl.Title=#4331,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Login Data* [Template_Slimjet_Preferences_DirectAccess] Tmpl.Title=#4339,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Preferences* [Template_Slimjet_Sync_DirectAccess] Tmpl.Title=#4324,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Sync Data\* OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Sync Extension Settings\* [Template_Slimjet_Phishing_DirectAccess] Tmpl.Title=#4337,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Local AppData%\Slimjet\User Data\Safe Browsing* OpenFilePath=slimjet.exe,%Local AppData%\Slimjet\User Data\CertificateRevocation [Template_Slimjet_Profile_DirectAccess] Tmpl.Title=#4338,Slimjet Tmpl.Class=WebBrowser OpenFilePath=slimjet.exe,%Local AppData%\Slimjet* # # Email Readers # [Template_Office_Outlook] Tmpl.Title=Office Outlook Tmpl.Class=EmailReader ProcessGroup=,outlook.exe OpenFilePath=,%Tmpl.Office_Outlook% OpenFilePath=,%AppData%\Microsoft\Outlook OpenFilePath=,%Local AppData%\Microsoft\Outlook OpenFilePath=outlook.exe,*.eml OpenKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Office OpenKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager OpenKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook # Outlook pst locks OpenIpcPath=,*\BaseNamedObjects*\OLKCRPC.OBJ=* OpenIpcPath=,*\BaseNamedObjects*\MAPI-HP* OpenIpcPath=,*\BaseNamedObjects*\*_WCIDXPACKED OpenIpcPath=,*\BaseNamedObjects*\*_WCEMPTY OpenIpcPath=,*\BaseNamedObjects*\*_WCWRITE OpenIpcPath=,*\BaseNamedObjects*\*_WCINFO OpenIpcPath=,*\BaseNamedObjects*\*_CACHEMUTEX OpenIpcPath=,*\BaseNamedObjects*\*_NDB_ZOMBIE OpenIpcPath=,*\BaseNamedObjects*\NDB_ROOT_MUTEX OpenIpcPath=,*\BaseNamedObjects*\Shared-NDB-FE OpenIpcPath=,*\BaseNamedObjects*\Optex_*_LogOptex OpenIpcPath=,*\BaseNamedObjects*\OfficeSharedLocks_* OpenIpcPath=,*\BaseNamedObjects\WMS Notif Engine* OpenWinClass=,WMS ST Notif Class # Integration with Windows Desktop Search OpenClsid={7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} OpenClsid={9E175B6D-F52A-11D8-B9A5-505054503030} OpenPipePath=\Device\NamedPipe\MsFteWds [Template_Office_Outlook_NEO_Pro] Tmpl.Title=Office Outlook + NEO Pro Tmpl.Class=EmailReader Tmpl.Url=http://www.caelo.com/ ProcessGroup=,neopro.exe OpenFilePath=,%Local AppData%\Caelo\NEO Pro\* OpenKeyPath=,HKEY_CURRENT_USER\Software\Caelo Software\ LingerProcess=w32mkde.exe [Template_Office_Outlook_Copernic_Desktop_Search] Tmpl.Title=Office Outlook + Copernic Desktop Search Tmpl.Class=EmailReader Tmpl.Url=http://www.copernic.com/index.html Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{728F7B17-0053-4543-B232-EC3F19A97985} OpenIpcPath=,$:DesktopSearchService.exe OpenIpcPath=,*\BaseNamedObjects*\*DDCS [Template_Office_Outlook_Avast_Mail_Scanner] Tmpl.Title=Office Outlook + avast! Mail Scanner Tmpl.Class=EmailReader Tmpl.Url=http://www.avast.com Tmpl.Scan=s Tmpl.ScanService=avast! Mail Scanner OpenIpcPath=,\RPC Control\[Aavm] OpenIpcPath=,*\BaseNamedObjects*\*Aavm* OpenIpcPath=,*\BaseNamedObjects*\AvOut* OpenIpcPath=,*\BaseNamedObjects*\AvSPM* OpenIpcPath=,*\BaseNamedObjects*\AvRes* ProcessGroup=,outlook.exe [Template_Office_Outlook_Rainlendar] Tmpl.Title=Office Outlook + Rainlendar Tmpl.Class=EmailReader Tmpl.Url=http://www.rainlendar.net Tmpl.Scan=s Tmpl.ScanProduct=Rainlendar2 OpenIpcPath=,*\BaseNamedObjects*\Mutex_MSOSharedMem OpenIpcPath=,*\BaseNamedObjects*\MSOutlook97_ANCTinuse OpenIpcPath=,$:Rainlendar2.exe ProcessGroup=,outlook.exe [Template_Windows_Vista_Mail] Tmpl.Title=Windows Vista Mail Tmpl.Class=EmailReader OpenFilePath=winmail.exe,%Tmpl.Windows_Vista_Mail% OpenFilePath=winmail.exe,%AppData%\Microsoft\Windows Mail OpenFilePath=winmail.exe,%Local AppData%\Microsoft\Windows Mail OpenFilePath=winmail.exe,*.eml OpenKeyPath=winmail.exe,HKEY_CURRENT_USER\Software\Microsoft\Windows Mail OpenKeyPath=winmail.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager [Template_Windows_Live_Mail] Tmpl.Title=Windows Live Mail Tmpl.Class=EmailReader ProcessGroup=,wlmail.exe,wlcomm.exe OpenFilePath=,%Tmpl.Windows_Live_Mail% OpenFilePath=,%AppData%\Microsoft\Windows Live Mail OpenFilePath=,%AppData%\Microsoft\Windows Live Contacts OpenFilePath=,%Local AppData%\Microsoft\Windows Live Mail OpenFilePath=,%Local AppData%\Microsoft\Windows Live Contacts OpenFilePath=,%Local AppData%\Microsoft\Windows Live\Contacts OpenFilePath=wlmail.exe,*.eml OpenKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Windows Live OpenKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail OpenIpcPath=,\RPC Control\LiveIdSvc [Template_Thunderbird] Tmpl.Title=Thunderbird Tmpl.Class=EmailReader OpenFilePath=thunderbird.exe,%Tmpl.Thunderbird% OpenFilePath=thunderbird.exe,%AppData%\Thunderbird OpenFilePath=thunderbird.exe,%Local AppData%\Thunderbird OpenKeyPath=thunderbird.exe,HKEY_LOCAL_MACHINE\SOFTWARE\Clients\*\Mozilla Thunderbird* OpenKeyPath=thunderbird.exe,HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird* [Template_Thunderbird_PGP] Tmpl.Title=OpenPGP for Thunderbird Tmpl.Class=EmailReader OpenFilePath=thunderbird.exe,%AppData%\gnupg ProcessGroup=,gpg.exe,gpg2.exe,gpg-agent.exe OpenFilePath=,%Tmpl.Thunderbird% OpenFilePath=,%AppData%\Thunderbird OpenFilePath=,%Local AppData%\Thunderbird OpenFilePath=,%AppData%\gnupg\ LingerProcess=gpg-agent.exe [Template_SeaMonkey] Tmpl.Title=SeaMonkey Tmpl.Class=EmailReader OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\Mail* #OpenFilePath=seamonkey.exe,%AppData%\Mozilla\Profiles\*\Mail* #OpenFilePath=seamonkey.exe,%Local AppData%\Mozilla\Profiles\*\Mail* OpenKeyPath=seamonkey.exe,HKEY_CURRENT_USER\Software\Mozilla*\SeaMonkey* OpenKeyPath=seamonkey.exe,HKEY_LOCAL_MACHINE\Software\Mozilla\SeaMonkey* [Template_Opera_Mail] Tmpl.Title=Opera Mail Tmpl.Class=EmailReader OpenFilePath=opera.exe,%Tmpl.Opera_Mail%\* OpenFilePath=opera.exe,%AppData%\Opera\*\mail\* OpenFilePath=opera.exe,%Local AppData%\Opera\*\mail\* [Template_IncrediMail] Tmpl.Title=IncrediMail Tmpl.Class=EmailReader OpenFilePath=IncMail.exe,*\IncrediMail\Data\* OpenFilePath=IncMail.exe,%Tmpl.Incredimail%\ OpenFilePath=IncMail.exe,%Local AppData%\IM\ OpenFilePath=IncMail.exe,%AppData%\IM\ OpenFilePath=ImApp.exe,*\IncrediMail\Data\* OpenFilePath=ImApp.exe,%Tmpl.Incredimail%\ OpenFilePath=ImApp.exe,%Local AppData%\IM\ OpenFilePath=ImApp.exe,%AppData%\IM\ LingerProcess=ImApp.exe [Template_Eudora] Tmpl.Title=Eudora Tmpl.Class=EmailReader OpenFilePath=eudora.exe,%Tmpl.Eudora% OpenKeyPath=eudora.exe,HKEY_CURRENT_USER\Software\Qualcomm\Eudora [Template_TheBat] Tmpl.Title=The Bat! Tmpl.Class=EmailReader ProcessGroup=,thebat32.exe,thebat64.exe OpenFilePath=,%Tmpl.TheBat% OpenKeyPath=,HKEY_CURRENT_USER\Software\RIT\The Bat! [Template_eM_Client] Tmpl.Title=eM Client Tmpl.Class=EmailReader Tmpl.Url=http://www.emclient.com OpenFilePath=MailClient.exe,%Tmpl.em_Client%\ [Template_SpamFighter] Tmpl.Title=SPAMfighter Tmpl.Class=EmailReader Tmpl.Url=http://www.spamfighter.com/ OpenIpcPath=*\BaseNamedObjects*\SPAMfighter.* OpenIpcPath=*\BaseNamedObjects*\sfsg.update_* OpenIpcPath=*\BaseNamedObjects*\log-*_SPAMfighter_Logs_* OpenIpcPath=*\BaseNamedObjects*\*?SPAMCFG.EXE OpenKeyPath=HKEY_CURRENT_USER\Software\SPAMfighter\ [Template_GreatNews] Tmpl.Title=Great News RSS Reader Tmpl.Class=EmailReader Tmpl.Url=http://www.curiostudio.com/download.html Tmpl.Scan=s Tmpl.ScanProduct={AA381A22-834B-4b21-AB78-CAFF2B05A4C3}}_is1 OpenFilePath=GreatNews.exe,*\greatnews.ini OpenFilePath=GreatNews.exe,*\newsfeed.db # # PDF and Printing # [Template_AdobeAcrobat] Tmpl.Title=Adobe Acrobat Tmpl.Class=Print Tmpl.Url=http://www.adobe.com/ OpenPipePath=\Device\NamedPipe\FLEXnet Licensing Service* OpenIpcPath=*\BaseNamedObjects*\FLEXnet Licensing Service* OpenWinClass=AcrobatTrayIcon [Template_AdobeAcrobatReader] Tmpl.Title=Adobe Acrobat Reader Tmpl.Class=Print Tmpl.Url=http://www.adobe.com/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F9DB5320-233E-11D1-9F84-707F02C10627} Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F9DB5320-233E-11D1-9F84-707F02C10627} OpenPipePath=\Device\NamedPipe\AIPC_SRV\pdfshell_* OpenPipePath=\Device\NamedPipe\AIPC_SRV\AcroSBL_* NoRenameWinClass=AcrobatSDIWindow [Template_AdobeDistiller] Tmpl.Title=Adobe Acrobat (version 8 or 9) with Distiller Tmpl.Class=Print Tmpl.Url=http://www.adobe.com/ Tmpl.Scan=w OpenPipePath=\Device\NamedPipe\PMtoDistiller OpenWinClass=Distiller [Template_AdobeLicensing] Tmpl.Title=FlexNet Licensing for Adobe and Autodesk Tmpl.Class=Print Tmpl.Url=http://www.adobe.com/ Tmpl.Scan=i OpenPipePath=\Device\NamedPipe\FLEXnet Licensing Service* OpenIpcPath=*\BaseNamedObjects*\FLEXnet Licensing Service* [Template_eDocPrinter] Tmpl.Title=ITEKSOFT eDocPrinter PDF Tmpl.Class=Print Tmpl.Url=http://uk.iteksoft.com/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{E6718EF2-2B9F-4FFE-B783-35E2CDC6F12E} Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{621483E9-77B0-4E2E-A737-2DB9D5CD02E0} OpenIpcPath=*\BaseNamedObjects*\eDocPDF* OpenIpcPath=*\BaseNamedObjects*\Global\eDocPDF* OpenIpcPath=*\BaseNamedObjects*\EPDFEVTREGPIPE* OpenPipePath=%Tmpl.eDocPrinter%\ OpenKeyPath=HKEY_CURRENT_USER\Software\ITEKSOFT\eDocPrinter\PDF\ OpenPipePath=%Temp%\ep*\ [Template_FinePrint] Tmpl.Title=FinePrint (PDF) Tmpl.Class=Print Tmpl.Url=http://www.fineprint.com/products/fineprint/index.html Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint5 Tmpl.ScanKey=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint6 OpenIpcPath=*\BaseNamedObjects*\FP5* OpenIpcPath=*\BaseNamedObjects*\FP6* OpenPipePath=\Device\NamedPipe\FP5_Dispatcher_* OpenPipePath=\Device\NamedPipe\FP6_Dispatcher_* OpenWinClass=FP5_DispWndClass OpenWinClass=FP6_DispWndClass OpenKeyPath=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint5 OpenKeyPath=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint6 OpenFilePath=%Tmpl.FinePrint%\fp5.ini OpenFilePath=%Tmpl.FinePrint%\fp6.ini RecoverFolder=%Tmpl.FinePrint% [Template_HP_UniversalPrintDriver] Tmpl.Title=HP Universal Print Driver Tmpl.Class=Print Tmpl.Url=http://www.hp.com/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877A5D52-5F6F-4175-907D-A6AC4E8F1171} OpenClsid={877A5D52-5F6F-4175-907D-A6AC4E8F1171} #OpenPipePath=\Device\NamedPipe\wkssvc [Template_NitroPDF5] Tmpl.Title=Nitro PDF 5 Tmpl.Class=Print Tmpl.Url=http://www.nitropdf.com/index.asp Tmpl.Scan=w OpenWinClass={FAF5BE9E-BAFF-47BF-BA47-1A4B15185066} OpenWinClass={03576772-AD02-4630-BC5F-3648526FDF87} OpenWinClass={AD744029-AC6A-4C0C-A597-D0B02CDB4DE4} OpenPipePath=%Temp%\BCL Technologies [Template_NitroPDF6] Tmpl.Title=Nitro PDF 6/7 Tmpl.Class=Print Tmpl.Scan=s Tmpl.ScanService=NitroDriverReadSpool Tmpl.ScanService=NitroDriverReadSpool2 OpenPipePath=\Device\Mailslot\nlsX86ccMailslot OpenPipePath=\Device\Mailslot\nlsX86ccCtlSlot OpenPipePath=\Device\NamedPipe\nitropdfdriverspool OpenPipePath=\Device\NamedPipe\nitropdfreaderdriverspool OpenPipePath=\Device\Mailslot\AstccMailslot* OpenIpcPath=*\BaseNamedObjects*\Nitro PDF Professional* [Template_SumatraPDF] Tmpl.Title=#4323,SumatraPDF Tmpl.Class=Print ForceProcess=SumatraPDF.exe [Template_SumatraPDF_Folder] Tmpl.Title=#4338,SumatraPDF Tmpl.Class=Print OpenFilePath=%Local AppData%\SumatraPDF [Template_Evernote] Tmpl.Title=Evernote Tmpl.Class=Print Tmpl.Url=http://evernote.com/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\Evernote* OpenIpcPath=*\BaseNamedObjects*\ENClipperInstanceMutex OpenIpcPath=*\BaseNamedObjects*\ENSyncServiceAuthMutex OpenWinClass=TENTrayMainWindow OpenWinClass=ENMainFrame OpenWinClass=ENMainFrame3 OpenWinClass=HwndWrapper[Evernote.exe;* OpenWinClass=$:EvernoteClipper.exe/IgnoreUIPI LingerProcess=EvernoteClipper.exe [Template_MetaProducts_Inquiry] Tmpl.Title=MetaProducts Inquiry Tmpl.Class=Print Tmpl.Url=http://www.metaproducts.com/mp/Inquiry_Standard_Edition.htm ProcessGroup=,iqls.exe,iqserv.exe,inquiry.exe,iexplore.exe OpenFilePath=,%AppData%\MetaProducts\Inquiry\ OpenFilePath=,%Personal%\ LingerProcess=iqserv.exe [Template_Pdf995] Tmpl.Title=Pdf995 Tmpl.Class=Print Tmpl.Url=http://www.pdf995.com/index.html Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\PDF995 OpenPipePath=%Common AppData%\pdf995\ OpenPipePath=%AppData%\pdf995\ OpenPipePath=%Local AppData%\pdf995\ [Template_PretonSaver] Tmpl.Title=PretonSaver Tmpl.Class=Print Tmpl.Url=http://www.preton.com/ Tmpl.Scan=s Tmpl.ScanService=PretonClientService OpenPipePath=\Device\NamedPipe\PT32_IpcSessionQueue* [Template_SolidConverter] Tmpl.Title=Solid Converter Tmpl.Class=Print Tmpl.Url=http://www.soliddocuments.com/features.htm?product=SolidConverterPDF Tmpl.Scan=s Tmpl.ScanService=SPDFCreatorReadSpool OpenPipePath=\Device\NamedPipe\sdspool OpenIpcPath=*\BaseNamedObjects*\*.spl* OpenIpcPath=*\BaseNamedObjects*\Solid* LingerProcess=SolidConverterPDFv8.exe LingerProcess=SolidScanServiceX86.exe ClosedFilePath=SolidConverterPDFV8.exe,* [Template_UltraRecall] Tmpl.Title=UltraRecall Tmpl.Class=Print Tmpl.Url=http://www.kinook.com/UltraRecall/ Tmpl.Scan=s Tmpl.ScanProduct=Ultra Recall_is1 OpenWinClass=Afx:00400000:0 OpenWinClass=$:UltraRecall.exe/IgnoreUIPI OpenIpcPath=*\BaseNamedObjects*\UltraRecall # # Security/Privacy # [Template_a2AntiMalware] Tmpl.Title=Emsisoft A-Squared Anti-Malware Tmpl.Class=Security Tmpl.Url=http://www.emsisoft.com/en/software/free/ Tmpl.Scan=s Tmpl.ScanService=a2AntiMalware # version 5.0 OpenPipePath=\Device\NamedPipe\{A2IPC}a2_ipc OpenIpcPath=*\BaseNamedObjects*\{A2IPCMUTEX}a2_ipc # earlier versions OpenIpcPath=*\BaseNamedObjects*\mc2SWDIJ* OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API* OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap* OpenIpcPath=*\BaseNamedObjects*\mchLLEW2* OpenIpcPath=*\BaseNamedObjects*\mchMixCache* OpenIpcPath=*\BaseNamedObjects*\TestQueue* OpenIpcPath=\RPC Control\mchIpcTestQueue OpenIpcPath=$:a2service.exe [Template_Anonymizer] Tmpl.Title=Anonymizer Anonymous Surfing Tmpl.Class=Security Tmpl.Url=http://www.anonymizer.com/consumer/products/anonymous_surfing/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\AnonFrmWrk* OpenIpcPath=*\BaseNamedObjects*\AnonTCPMutex [Template_Avast_Antivirus] Tmpl.Title=avast! Antivirus Tmpl.Class=Security Tmpl.Url=http://www.avast.com Tmpl.Scan=s Tmpl.ScanService=avast! Antivirus OpenWinClass=asw_av_tray_icon_wndclass OpenIpcPath=*\BaseNamedObjects*\asw.script_blocking.conf_data* OpenIpcPath=*\BaseNamedObjects*\aavmGlob.* OpenIpcPath=*\BaseNamedObjects*\aavmSema.* OpenIpcPath=*\BaseNamedObjects*\*aavmRq.map OpenIpcPath=*\BaseNamedObjects*\*aavmSync.evt OpenIpcPath=*\BaseNamedObjects*\*avscr*.map ClosedFilePath=*\snxhk.dll ClosedFilePath=*\snxhk64.dll ClosedFilePath=*\ashShell.dll [Template_AVG_Anti_Virus] Tmpl.Title=AVG Anti-Virus / LinkScanner Tmpl.Class=Security Tmpl.Url=http://www.avg.com Tmpl.Scan=s Tmpl.ScanService=AvgLdx86 Tmpl.ScanService=AvgMfx86 Tmpl.ScanService=avgwd Tmpl.ScanService=avgsvc ProcessGroup=,avgscana.exe,avgscanx.exe,avgcsrvx.exe,avgui.exe ProcessGroup=,avgscana.exe,avgscanx.exe,avgcsrvx.exe,avgui.exe,firefox.exe,iexplore.exe ProcessGroup=,avgscana.exe OpenPipePath=,\Device\NamedPipe\*-*-*-*-*::* OpenPipePath=,\Device\NamedPipe\AVG-CHJW-* OpenPipePath=,\Device\NamedPipe\AvgScanPipeName* OpenPipePath=,\Device\NamedPipe\AvgUIPipeName* OpenPipePath=,\Device\NamedPipe\__hex8__-__hex4__-__hex4__-__hex4__-__hex12__ OpenIpcPath=,*\BaseNamedObjects*\bce5ad8b-264e-024b-81d6-f289aa672301* OpenIpcPath=*\BaseNamedObjects*\__AVG_FW_*__ OpenIpcPath=*\BaseNamedObjects*\CE6383A0-EB13-428c-A97E-92FE645B06E3 OpenFilePath=,%AllUsersProfile%\AVG*\* OpenPipePath=\Device\NamedPipe\avg-* ClosedFilePath=*avg*snxhk*.dll [Template_Avira_Antivirus] Tmpl.Title=Avira Antivirus / Internet Security Tmpl.Class=Security Tmpl.Url=http://www.avira.com Tmpl.Scan=s Tmpl.ScanService=AntiVirService OpenIpcPath=*\BaseNamedObjects*\AVSDA_KERNELOBJECT_* OpenIpcPath=*\BaseNamedObjects*\WEBGUARD_KERNEL_OBJECT_* OpenIpcPath=*\BaseNamedObjects*\AVMAILC_ISPOP3ACTIVE_* OpenIpcPath=*\BaseNamedObjects*\AVMAILC_KERNELOBJECT_* OpenIpcPath=*\BaseNamedObjects*\AVMAILC_KERNEL_OBJECT_* OpenIpcPath=*\BaseNamedObjects*\KERNELOBJECTNAME_* OpenIpcPath=*\BaseNamedObjects*\KERNELOBJECT_* OpenIpcPath=*\BaseNamedObjects*\{506A71E2-D744-4717-8689-649A16CBBA0F} [Template_BitDefenderInternetSecurity] Tmpl.Title=BitDefender Internet Security Tmpl.Class=Security Tmpl.Url=http://www.bitdefender.com Tmpl.Scan=s Tmpl.ScanProduct=BitDefender Tmpl.ScanService=vsserv Tmpl.ScanService=ProductAgentService OpenPipePath=\Device\NamedPipe\DEFAULT_BD_COMM_PIPE ClosedFilePath=*BitDefender*atcuf*.dll [Template_BitVise] Tmpl.Title=Bitvise SSH Client Tmpl.Class=Security Tmpl.Url=http://www.bitvise.com/ Tmpl.Scan=s Tmpl.ScanProduct=BvSshClient OpenIpcPath=\Device\NamedPipe\TLINETLOCKPIPE [Template_TrendMicroBrowserGuard] Tmpl.Title=Trend Micro Browser Guard Tmpl.Class=Security Tmpl.Url=http://free.antivirus.com/browser-guard/ Tmpl.Scan=s Tmpl.ScanProduct={D4ADDB2A-EE3C-41A7-88DF-99333DAE18E3} OpenPipePath=\Device\NamedPipe\bgpipe [Template_CA_InternetSecuritySuite] Tmpl.Title=CA Internet Security Suite Tmpl.Class=Security Tmpl.Url=http://shop.ca.com/ca/products/internetsecurity/internetsecurity_suite.asp Tmpl.Scan=s Tmpl.ScanService=CAISafe OpenIpcPath=*\BaseNamedObjects*\820EEE67-B517-405d-A775-8BE1879BD279 OpenIpcPath=*\BaseNamedObjects*\0F727B36-E18C-47fa-B5A4-30C2B84E2EAA OpenIpcPath=*\BaseNamedObjects*\672AF2F3-FCBE-4870-A103-E78DDCFC051C* OpenIpcPath=*\BaseNamedObjects*\2212AC6F-01F9-4107-9DD6-C75DA65A7A1F* OpenIpcPath=*\BaseNamedObjects*\CallingID.* OpenIpcPath=*\BaseNamedObjects*\*UmxSbx_* OpenClsid={1791C1B5-FFD0-4D4B-ABCD-7A7DF6EAA89C} OpenClsid={5F36DC27-B076-4D0C-BD8C-7AEE14022193} OpenClsid={E82070F7-4174-4F49-8DCF-C87F8DDF0BAA} [Template_ChildControl2011] Tmpl.Title=Salfeld.com Child Control 2011 Tmpl.Class=Security Tmpl.Url=http://www.salfeld.com/software/parentalcontrol/index.html Tmpl.Scan=s Tmpl.ScanIpc=*\BaseNamedObjects*\ChicoTaskCaller* OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap* OpenIpcPath=*\BaseNamedObjects*\mchLLEW* OpenIpcPath=*\BaseNamedObjects*\mchMixCache* OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API* OpenIpcPath=*\BaseNamedObjects*\ChicoTaskCaller* OpenIpcPath=*\BaseNamedObjects*\IPCMyLogIpc* OpenIpcPath=*\BaseNamedObjects*\IPCWebCheck* OpenIpcPath=*\BaseNamedObjects*\Salfeld-* OpenIpcPath=$:webtmr.exe [Template_CovenantEyes] Tmpl.Title=Covenant Eyes Tmpl.Class=Security Tmpl.Url=http://www.covenanteyes.com/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\CE_*Obj OpenWinClass=$:nmSvc.exe/IgnoreUIPI [Template_ComodoInternetSecurity] Tmpl.Title=Comodo Internet Security / Antivirus / Firewall Tmpl.Class=Security Tmpl.Url=http://www.comodo.com/home/internet-security/free-internet-security.php Tmpl.Scan=s Tmpl.ScanService=cmdGuard DelayLoadDll=guard32.dll DelayLoadDll=guard64.dll ClosedFilePath=*\Guard32.dll ClosedFilePath=*\Guard64.dll [Template_ComodoVerificationEngine] Tmpl.Title=Comodo Verification Engine Tmpl.Class=Security Tmpl.Url=http://www.vengine.com/ Tmpl.Scan=w OpenWinClass=Comodo_TTB_Shadow_Class OpenIpcPath=*\BaseNamedObjects*\Verification Engine Registry Mutex Object OpenIpcPath=*\BaseNamedObjects*\EE855D62-517A-420e-ADEA-9813658B0442 OpenIpcPath=*\BaseNamedObjects*\ESigilTaskTrayLoadMutex OpenIpcPath=*\BaseNamedObjects*\ESigilBho::ValidateOnEvent OpenIpcPath=*\BaseNamedObjects*\ESigilBho::ValidateOffEvent [Template_DigitalPersona] Tmpl.Title=Digital Persona U.are.U 4500 Fingerprint Reader Tmpl.Class=Security Tmpl.Url=https://web.archive.org/web/20090728034419/http://www.digitalpersona.com/index.php?id=dev_hdw_uareu_reader Tmpl.Scan=iw OpenIpcPath=*\BaseNamedObjects*\__DP_TRACE_MUTEX__ OpenIpcPath=*\BaseNamedObjects*\DP_OTS_IPC_MUTEX OpenIpcPath=*\BaseNamedObjects*\U.are.U_VerifyCriptoprovider OpenIpcPath=*\BaseNamedObjects*\DP_OTS_IPC_BUFFER OpenIpcPath=*\BaseNamedObjects*\DP_OTS_LOOKUP_CACHE OpenIpcPath=\RPC Control\DPHOST OpenWinClass=DigitalPersona Pro Agent OpenWinClass=DP_GlobalAvatarClass [Template_DrWeb_SecuritySpace] Tmpl.Title=Dr.Web Security Space Tmpl.Class=Security Tmpl.Url=http://products.drweb.com/win/security_space/?lng=en Tmpl.Scan=s Tmpl.ScanService=DrWebEngine Tmpl.ScanService=DrWebAVService OpenPipePath=\Device\SpiderG3 OpenPipePath=\Device\NamedPipe\Dr.Web OpenPipePath=\??\SPIDER OpenIpcPath=*\BaseNamedObjects*\DrWebOutlookRunningEvent OpenWinClass=SpiderAgent GUI Class [Template_EasyHideIp] Tmpl.Title=Easy Hide IP Tmpl.Class=Security Tmpl.Url=http://www.easy-hide-ip.com/ Tmpl.Scan=s Tmpl.ScanService=EasyRedirect OpenIpcPath=*\BaseNamedObjects*\Redirector_event2 OpenClsid={E8B2A82A-2B16-4DBE-BCF0-70CB49FF5022} [Template_FastAccessAnywhere] Tmpl.Title=FastAccess Anywhere Tmpl.Class=Security Tmpl.Url=http://www.sensiblevision.com/en-us/fastaccessanywhere/overview.aspx Tmpl.Scan=s Tmpl.ScanIpc=*\BaseNamedObjects*\E84B01BF-FA91-48e4-A4B3-EECD7E4DB810 OpenIpcPath=*\BaseNamedObjects*\E84B01BF-FA91-48e4-A4B3-EECD7E4DB810 OpenIpcPath=\RPC Control\Callbacks* OpenWinClass=FATrayAlert [Template_FSecure] Tmpl.Title=F-Secure Internet Protection Tmpl.Class=Security Tmpl.Url=http://www.f-secure.com/en_US/products/home-office/internet-security/index.html Tmpl.Scan=s Tmpl.ScanService=F-Secure Filter Tmpl.ScanService=F-Secure Gatekeeper Handler Starter Tmpl.ScanService=F-Secure Gatekeeper OpenIpcPath=\RPC Control\__hex12__*.*.*.*.*.*.*.* OpenIpcPath=\RPC Control\F-Secure ORSP V1 OpenIpcPath=*\BaseNamedObjects*\FSMB * OpenIpcPath=*\BaseNamedObjects*\dxk390x-* OpenIpcPath=*\BaseNamedObjects*\pipeserverhere* OpenIpcPath=*\BaseNamedObjects*\pipeserversync* OpenIpcPath=*\BaseNamedObjects*\pipeservertaken* OpenPipePath=\Device\NamedPipe\__fs*__ OpenPipePath=\Device\NamedPipe\*.*.*.*.*.*.*.*.*.* OpenPipePath=\Device\NamedPipe\rcn_* LingerProcess=fsavaui.exe # F-Secure 2012 OpenPipePath=\Device\NamedPipe\ccf_cuif* OpenPipePath=\Device\NamedPipe\fsccfSettingsServer* OpenPipePath=\Device\NamedPipe\CCFSettingsChangeNotif_* OpenPipePath=\Device\NamedPipe\PipeServerTaken* # F-Secure 2013 OpenIpcPath=*\BaseNamedObjects*\FsCcfLogging_*.log OpenIpcPath=*\BaseNamedObjects*\PipeServerTaken* OpenPipePath=\Device\NamedPipe\FS_CCF_NI_DAEMON* # change line below to OpenPipePath=\Device\NamedPipe\%EXENAME%-%PID% OpenPipePath=\Device\NamedPipe\*.exe-* [Template_GDataInternetSecurity] Tmpl.Title=G Data Anti-Virus/Internet Security Tmpl.Class=Security Tmpl.Url=http://www.gdata-software.com/home-security/ Tmpl.Scan=s Tmpl.ScanService=GDScan OpenClsid={1E0D02B2-989A-45FF-9318-F43CC56C515A} [Template_HomeGuard] Tmpl.Title=HomeGuard Activity Monitor Tmpl.Class=Security Tmpl.Url=http://veridium.net/ Tmpl.Scan=s Tmpl.ScanService=HomeGuard AMC OpenIpcPath=*\BaseNamedObjects*\*Ipc2Map* OpenIpcPath=*\BaseNamedObjects*\*Ipc2Mutex* OpenIpcPath=*\BaseNamedObjects*\mc2SWDIJ* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API* OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API* OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap* OpenIpcPath=*\BaseNamedObjects*\mchLLEW2* OpenIpcPath=*\BaseNamedObjects*\mchMixCache* OpenIpcPath=*\BaseNamedObjects*\*AnswerBuf*Event* OpenIpcPath=*\BaseNamedObjects*\*AnswerBuf*Map* OpenIpcPath=$:vglset.exe [Template_IoloSystemMechanic] Tmpl.Title=iolo System Mechanic Tmpl.Class=Security Tmpl.Url=http://www.iolo.com/system-mechanic/standard/ Tmpl.Scan=s Tmpl.ScanService=ioloSystemService OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap* OpenIpcPath=*\BaseNamedObjects*\Mutex*mAH*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mAH*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mix*Process*API* OpenIpcPath=*\BaseNamedObjects*\mchLLEW2* OpenIpcPath=*\BaseNamedObjects*\mchMixCache* OpenIpcPath=*\BaseNamedObjects*\mhicce* [Template_Microsoft_EMET] Tmpl.Title=Enhanced Mitigation Experience Toolkit (Microsoft EMET) Tmpl.Class=Security # old EMET homepage # Tmpl.Url=http://www.microsoft.com/downloads/en/confirmation.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04 Tmpl.Url=http://technet.microsoft.com/en-us/security/jj653751 Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Microsoft\EMET OpenIpcPath=*\BaseNamedObjects*\emet_pid_* OpenWinClass=$:EMET_notifier.exe/IgnoreUIPI # EMET 4 OpenPipePath=\Device\Mailslot\EMET_Agent_* OpenPipePath=\Device\Mailslot\EMET_Recipient_* [Template_Kaspersky] Tmpl.Title=Kaspersky Anti-Virus/Internet Security Tmpl.Class=Security Tmpl.Url=http://www.kaspersky.com/kaspersky_internet_security Tmpl.Scan=s Tmpl.ScanService=klim5 Tmpl.ScanService=klim6 OpenIpcPath=\RPC Control\PRRemote:* OpenIpcPath=*\BaseNamedObjects*\PRCustomProps* OpenIpcPath=*\BaseNamedObjects*\PREvent* OpenIpcPath=*\BaseNamedObjects*\PRObjects* OpenIpcPath=*\BaseNamedObjects*\KLObj_mt_KLSCRIPTCHECKER_PR_* OpenIpcPath=*\BaseNamedObjects*\__hex30-90__ OpenPipePath=\Device\NamedPipe\sa_hlp_srv LingerProcess=klwtblfs.exe # following setting comes from value DataRoot of the following key # HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\protected\AVP9\environment OpenPipePath=%Tmpl.KasperskyDataRoot%\~PR*.dat [Template_Kaspersky_Pure_Password_Manager] Tmpl.Title=Kaspersky Pure Password Manager Tmpl.Class=Security Tmpl.Url=http://www.kaspersky.com/kaspersky_internet_security Tmpl.Scan=s Tmpl.ScanProduct={1A59064A-12A9-469F-99F6-04BF118DBCFF} OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API* OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap* OpenIpcPath=*\BaseNamedObjects*\mchLLEW2* OpenIpcPath=*\BaseNamedObjects*\mchMixCache* OpenIpcPath=*\BaseNamedObjects*\TtsMappedObject_Tts* # settings specific to Kaspersky Pure OpenIpcPath=*\BaseNamedObjects*\kpmPasswordAssistantClosedEvent:* OpenIpcPath=*\BaseNamedObjects*\kpmAutofillInfo:* [Template_KeyScrambler] Tmpl.Title=KeyScrambler Tmpl.Class=Security Tmpl.Url=http://www.qfxsoftware.com/ Tmpl.Scan=i OpenIpcPath=\Device\KeyScrambler OpenIpcPath=\RPC Control\KSControlEp.Default* OpenIpcPath=*\BaseNamedObjects*\KeyScrambler* OpenIpcPath=*\BaseNamedObjects*\KSEncryptionEvent* OpenIpcPath=*\BaseNamedObjects*\KSProcEvent* OpenIpcPath=*\BaseNamedObjects*\KSEncStatusEvent OpenIpcPath=*\BaseNamedObjects*\KSSettingsEvent* OpenPipePath=\Device\NamedPipe\KSTIPipe* OpenPipePath=\Device\NamedPipe\KSSettingsPipe* [Template_HideMyIp] Tmpl.Title=Hide My IP Tmpl.Class=Security Tmpl.Url=http://www.hide-my-ip.com/ Tmpl.Scan=s Tmpl.ScanService=HideMyIpSRV OpenIpcPath=*\BaseNamedObjects*\Redirector_event OpenClsid={B1A429DB-FB06-4645-B7C0-0CC405EAD3CD} OpenClsid={6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} [Template_HitmanProAlert] Tmpl.Title=Hitman Pro Alert Tmpl.Class=Security Tmpl.Url=https://www.hitmanpro.com/en-us/alert.aspx Tmpl.Scan=s Tmpl.ScanProduct=HitmanPro.Alert Tmpl.ScanService=hmpalertsvc OpenPipePath=\Device\NamedPipe\hmpalert [Template_HmaProVpn] Tmpl.Title=HMA! Pro VPN Tmpl.Class=Security Tmpl.Url=http://www.hidemyass.com/vpn/ Tmpl.Scan=s Tmpl.ScanProduct=HMA! Pro VPN OpenIpcPath=*\BaseNamedObjects*\{3A4BE5AC-E783-4939-A746-05920ACDE790} OpenIpcPath=*\BaseNamedObjects*\{73B2E84B-B7D9-464d-8376-68D43DE31E1D} [Template_LastPass] Tmpl.Title=LastPass Tmpl.Class=Security Tmpl.Url=https://lastpass.com/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\lpgetr Tmpl.ScanFile=%{A520A1A4-1780-4FF6-BD18-167343C5AF16}%\LastPass OpenFilePath=,%UserProfile%\*\LastPass\* ProcessGroup=,iexplore.exe,firefox.exe,opera.exe,chrome.exe [Template_McAfee_Guardian_Firewall] Tmpl.Title=McAfee Guardian Firewall Tmpl.Class=Security Tmpl.Url=http://www.mcafee.com/us/index.html Tmpl.Scan=i OpenIpcPath=\RPC Control\McAfee_FW_RPC [Template_Microsoft_Security_Essentials] Tmpl.Title=Microsoft Security Essentials Tmpl.Class=Security Tmpl.Url=http://windows.microsoft.com/en-US/windows/products/security-essentials Tmpl.Scan=s Tmpl.ScanService=MsMpSvc OpenWinClass=msseces_class OpenWinClass=$:msseces.exe/IgnoreUIPI IContextMenuClsid={09A47860-11B0-4DA5-AFA5-26D86198A780} [Template_Mirekusoft_Install_Monitor] Tmpl.Title=Mirekusoft Install Monitor Tmpl.Class=Security Tmpl.Url=http://www.mirekusoft.com/ Tmpl.Scan=s Tmpl.ScanService=MSpyData Tmpl.ScanService=MSpyMon #Tmpl.ScanProduct={E4ED1ADE-60A6-4660-811E-6E4096EBCA36} SkipHook=//start.exe,createproc,cocreate ClosedFilePath=*\MSpyDll.dll [Template_NetNanny] Tmpl.Title=NetNanny Tmpl.Class=Security Tmpl.Url=http://www.netnanny.com/ Tmpl.Scan=s Tmpl.ScanService=CwAltaService20 OpenPipePath=\Device\NamedPipe\CWIPCServer_ContentWatch* OpenIpcPath=*\BaseNamedObjects*\*STRulesSTRules* OpenIpcPath=*\BaseNamedObjects*\*SearchTree_* OpenIpcPath=*\BaseNamedObjects*\Alta::* OpenIpcPath=*\BaseNamedObjects*\SM::* OpenIpcPath=*\BaseNamedObjects*\CW::* OpenIpcPath=*\BaseNamedObjects*\CW_* OpenIpcPath=*\BaseNamedObjects*\CP_SHARED_* OpenIpcPath=*\BaseNamedObjects*\WORD_PARSER_* OpenIpcPath=*\BaseNamedObjects*\CwAlta* OpenFilePath=%AllUsersProfile%\*\ContentWatch\Internet Protection\* OpenFilePath=%AppData%\ContentWatch\Internet Protection\* # NetNanny 5 OpenIpcPath=*\BaseNamedObjects*\*/NETNANNY5/* OpenClsid={056CDF58-CD7A-41D2-AF75-7CA1F44B84E9} [Template_NOD32] Tmpl.Title=ESET NOD32 Antivirus Tmpl.Class=Security Tmpl.Url=http://www.eset.com/ Tmpl.Scan=s Tmpl.ScanService=eamon Tmpl.ScanService=ehdrv Tmpl.ScanService=ekrn OpenIpcPath=*\BaseNamedObjects*\NOD32* OpenIpcPath=*\BaseNamedObjects*\NODCOMM* [Template_NormanSecuritySuite] Tmpl.Title=Norman Security Suite with Parental Controls Tmpl.Class=Security Tmpl.Url=http://norman.com/Product/Home_Home_office/49887/en-us Tmpl.Scan=s Tmpl.ScanService=NPROSECSVC OpenIpcPath=*\BaseNamedObjects*\SEM32_COM_MUTEX OpenIpcPath=*\BaseNamedObjects*\SEM32_EVENT_* OpenIpcPath=*\BaseNamedObjects*\SHAREMEM_*_MEM* [Template_NortonInternetSecurity] Tmpl.Title=Norton Internet Security / AntiVirus / Norton 360 Tmpl.Class=Security Tmpl.Url=https://www.norton.com Tmpl.Scan=s Tmpl.ScanService=NortonSecurity Tmpl.ScanService=NIS Tmpl.ScanService=NAV Tmpl.ScanService=N360 OpenIpcPath=\RPC Control\{__hex8__-__hex4__-__hex4__-__hex4__-__hex12__} OpenIpcPath=*\BaseNamedObjects*\ccSetMgr_Running* OpenIpcPath=*\BaseNamedObjects*\NewWCIDConfig* OpenIpcPath=*\BaseNamedObjects*\LockWCIDConfig* OpenIpcPath=*\BaseNamedObjects*\IDS_STORAGE_MUTEX OpenIpcPath=*\BaseNamedObjects*\CGSCE OpenIpcPath=*\BaseNamedObjects*\CSECE OpenIpcPath=*\BaseNamedObjects*\CNDIE [Template_NortonSafeWebLite] Tmpl.Title=Norton Safe Web Lite Tmpl.Class=Security Tmpl.Url=http://safeweb.norton.com/lite Tmpl.Scan=s Tmpl.ScanService=NSL ProcessGroup=,firefox.exe,iexplore.exe OpenIpcPath=,\RPC Control\{__hex8__-__hex4__-__hex4__-__hex4__-__hex12__} OpenIpcPath=,*\BaseNamedObjects*\ccSetMgr_Running* [Template_PandaCloudAntivirus] Tmpl.Title=Panda Cloud Antivirus Tmpl.Class=Security Tmpl.Url=http://www.cloudantivirus.com/en/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{39655A7E-1CCB-4BC7-8686-342A4581CA94} OpenIpcPath=*\BaseNamedObjects*\76529309-F679-41df-8CAD-383D589867CF OpenIpcPath=*\BaseNamedObjects*\psanmsrvcppal_* OpenIpcPath=*\BaseNamedObjects*\_sbf_*panda2* [Template_PandaInternetSecurity] Tmpl.Title=Panda Internet Security Tmpl.Class=Security Tmpl.Url=http://www.pandasecurity.com/usa/homeusers/solutions/internet-security/ Tmpl.Scan=s Tmpl.ScanService=Panda Software Controller Tmpl.ScanService=pavboot Tmpl.ScanService=PAVDRV Tmpl.ScanService=PAVFNSVR Tmpl.ScanService=PavProc Tmpl.ScanService=PavPrSrv Tmpl.ScanService=PAVSRV OpenIpcPath=*\BaseNamedObjects*\*PAVPROT_* OpenIpcPath=*\BaseNamedObjects*\PAVKRE_* OpenIpcPath=*\BaseNamedObjects*\PAV_icl_proxy_evento_fin OpenIpcPath=*\BaseNamedObjects*\pavwp_* OpenIpcPath=*\BaseNamedObjects*\TPSRV_* OpenIpcPath=*\BaseNamedObjects*\TP_MINIDUMPER_* OpenIpcPath=*\BaseNamedObjects*\Mutex_Lect_Escri_Memoria_Compartida_* OpenIpcPath=*\BaseNamedObjects*_ACTIVATION_SHARED_OBJECT_EVENT OpenIpcPath=*\BaseNamedObjects*_IPC_COMMAND OpenIpcPath=*\BaseNamedObjects*_IPC_COMMAND_ANSWER OpenIpcPath=*\BaseNamedObjects*_IPC_CONTROL OpenIpcPath=*\BaseNamedObjects*_IPC_CONTROL_MUTEX OpenIpcPath=*\BaseNamedObjects*_IPC_IS_OPEN OpenIpcPath=*\BaseNamedObjects*_IPC_MUTEX OpenIpcPath=*\BaseNamedObjects*_IPC_NEW_MESSAGE OpenIpcPath=*\BaseNamedObjects*_RULES_CHANGE_SHARED_OBJECT_EVENT [Template_PasswordDoor] Tmpl.Title=Password Door Tmpl.Class=Security Tmpl.Url=http://toplang.com/passworddoor.htm Tmpl.Scan=s Tmpl.ScanProduct=Password Door OpenPipePath=\Device\NamedPipe\PasswordDoor* [Template_PC_Tools_Security] Tmpl.Title=PC Tools Security Tmpl.Class=Security Tmpl.Url=http://www.pctools.com/ Tmpl.Scan=s Tmpl.ScanService=ThreatFire OpenIpcPath=\RPC Control\mchIpcThreatfireApiHook OpenIpcPath=*\BaseNamedObjects*\ThreatfireApiHookAnswerBuf* OpenIpcPath=*\BaseNamedObjects*\Mutex*mAH*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mAH*Process*API* OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mix*Process*API* OpenIpcPath=*\BaseNamedObjects*\Ipc2Cnt* OpenIpcPath=*\BaseNamedObjects*\mchMixCache* OpenIpcPath=*\BaseNamedObjects*\mchLLEW2* OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap* OpenIpcPath=*\BaseNamedObjects*\{1E57CBD2-232C-4f17-867C-7F9B4052D89C} OpenIpcPath=*\BaseNamedObjects*\{CB98E8A0-6E8B-4a24-9953-41D8F2FED3FC} OpenIpcPath=*\BaseNamedObjects*\{0C84A7BB-7D57-4b00-A418-1448159824DA} DelayLoadDll=TfWah.dll [Template_PGP] Tmpl.Title=PGP (Pretty Good Privacy) Tmpl.Class=Security Tmpl.Url=http://www.pgp.com/products/desktop_home/index.html Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\PGPhkSharedMemory OpenIpcPath=*\BaseNamedObjects*\PGPocTrayInstSem OpenIpcPath=*\BaseNamedObjects*\PGPocTrayListenSem OpenIpcPath=*\BaseNamedObjects*\PGPtray_Hidden_Window OpenIpcPath=*\BaseNamedObjects*\PGPlsp Debug Print Mutex OpenPipePath=\Device\NamedPipe\pgpserv OpenPipePath=\Device\NamedPipe\pgpsdkserv [Template_Proxifier] Tmpl.Title=Proxifier Tmpl.Class=Security Tmpl.Url=http://www.proxifier.com/ # this template disabled our own proxying hence don't set it automatically #Tmpl.Scan=w OpenWinClass=Proxifier32Cls OpenWinClass=$:proxifier.exe/IgnoreUIPI OpenIpcPath=*\BaseNamedObjects*\Proxifier* OpenPipePath=\Device\NamedPipe\proxifier DllSkipHook=ws2_32.dll [Template_ProxyCap] Tmpl.Title=ProxyCap Tmpl.Class=Security Tmpl.Url=http://www.proxycap.com/ Tmpl.Scan=s Tmpl.ScanService=pcapsvc OpenIpcPath=*\BaseNamedObjects*\proxycap_*_event* OpenPipePath=\Device\NamedPipe\proxycap_s_pipe [Template_ReHIPS] Tmpl.Title=ReHIPS Tmpl.Class=Security Tmpl.Url=https://rehips.com/ Tmpl.Scan=s Tmpl.ScanService=ReHIPSService DenyHostAccess=HIPSAgent64.exe,y [Template_RoboForm] Tmpl.Title=RoboForm Tmpl.Class=Security Tmpl.Url=http://www.roboform.com/ Tmpl.Scan=i OpenFilePath=%Tmpl.RoboForm% OpenFilePath=%Tmpl.RoboForm%\* OpenIpcPath=*\BaseNamedObjects*\{45DB34C3-955C-11D3-ABEF-444553540000}* OpenPipePath=\Device\NamedPipe\{9A04C483-2EDC-40CE-B4F9-D9809ADA75E1} # ProcessGroup=,identities.exe OpenWinClass=RfWatcher333233 [Template_SafeEyes] Tmpl.Title=Safe Eyes Tmpl.Class=Security Tmpl.Url=http://www.internetsafety.com/safe-eyes-parental-control-software.php Tmpl.Scan=s Tmpl.ScanWinClass=SE_LSP_MsgSink OpenWinClass=ICA_Class [Template_SafeCentral] Tmpl.Title=SafeCentral Tmpl.Class=Security Tmpl.Url=http://www.safecentral.com/index.html Tmpl.Scan=s Tmpl.ScanService=AuthPluginServer OpenPipePath=\Device\NamedPipe\*AuthPluginServer_Pipe OpenPipePath=\Device\NamedPipe\*WebAdvisor_IpcPipe OpenIpcPath=*\BaseNamedObjects*\LauncherServer* OpenIpcPath=*\BaseNamedObjects*\CREATEPROCESS_RESPONCE_EVENT [Template_SafeNet] Tmpl.Title=SafeNet Authentication Tmpl.Class=Security Tmpl.Url=http://www.safenet-inc.com/products/data-protection/multi-factor-authentication/ Tmpl.Scan=s Tmpl.ScanIpc=*\BaseNamedObjects*\DatakeyTokenServerReadyEvent OpenIpcPath=*\BaseNamedObjects*\Datakey* [Template_SiteAdvisor] Tmpl.Title=McAfee SiteAdvisor Tmpl.Class=Security Tmpl.Url=http://www.siteadvisor.com/ Tmpl.Scan=s Tmpl.ScanService=McAfee SiteAdvisor Service # -- second version: run SiteAdvisor in sandbox StartService=McAfee SiteAdvisor Service LingerProcess=McSACore.exe LingerProcess=McSvHost.exe # -- first version: talk to SiteAdvisor outside sandbox # Tmpl.Scan=s # Tmpl.ScanKey=\REGISTRY\MACHINE\Software\Classes\Clsid\{5A90F5EE-16B8-4C2A-81B3-FD5329BA477C} # OpenClsid={5A90F5EE-16B8-4C2A-81B3-FD5329BA477C} # OpenClsid={5A90F5EE-16B8-4C2A-81B3-FD5329BA4780} # OpenIpcPath=*\BaseNamedObjects*\McSACore_* # OpenWinClass=ATL:1009CD70 # OpenWinClass=ATL:1009DDD8 [Template_Super_Socks5Cap] Tmpl.Title=Super Socks5Cap / Super Network Tunnel / Ssh Tunnel Easy (LSP + Tunnel All) Tmpl.Class=Security Tmpl.Url=http://www.networktunnel.net/ # Super Network Tunnel OpenIpcPath=*\BaseNamedObjects*\*tunnelapi* OpenIpcPath=*\RPC Control\*tunnelapi* OpenIpcPath=*\BaseNamedObjects*\*NetworkTunnel* OpenIpcPath=*\RPC Control\*NetworkTunnel* OpenIpcPath=$:TunnelClient.exe OpenIpcPath=$:TunnelClient_Portable.exe # Super Socks5cap OpenIpcPath=*\RPC Control\*networkdll* OpenIpcPath=*\BaseNamedObjects*\*networkdll* OpenIpcPath=*\BaseNamedObjects*\*SuperSocks5Cap* OpenIpcPath=*\RPC Control\*SuperSocks5Cap* OpenIpcPath=$:SuperSocks5Cap.exe # Ssh Tunnel Easy OpenIpcPath=*\BaseNamedObjects\*SshTunnelEasy* OpenIpcPath=*\RPC Control\*SshTunnelEasy* OpenIpcPath=$:SshTunnelEasy.exe Tmpl.Scan=w OpenWinClass=TSetupSocksForm [Template_VipreAntiVirus] Tmpl.Title=Vipre Antivirus Tmpl.Class=Security Tmpl.Url=http://www.vipreantivirus.com/Software/VIPRE-Antivirus/ Tmpl.Scan=s Tmpl.ScanService=SBAMSvc OpenIpcPath=*\BaseNamedObjects*\SBAM* OpenIpcPath=*\BaseNamedObjects*\OEAPI* [Template_WindowsDefender] Tmpl.Title=Windows Defender Tmpl.Class=Security Tmpl.Url=http://www.microsoft.com/windows/products/winfamily/defender/default.mspx Tmpl.Scan=i OpenIpcPath=\RPC Control\MsMp-* [Template_ZoneAlarmSecuritySuite] Tmpl.Title=ZoneAlarm Internet Security Toolbar Tmpl.Class=Security Tmpl.Url=http://www.zonealarm.com/security/en-us/zonealarm-computer-security-suite.htm Tmpl.Scan=s Tmpl.ScanService=IswSvc OpenPipePath=\Device\NamedPipe\IswSvc OpenPipePath=\Device\NamedPipe\IswSessionMin* OpenIpcPath=*\BaseNamedObjects*\ISW_WIEC_* OpenIpcPath=*\BaseNamedObjects*\ISWUL_* OpenIpcPath=*\BaseNamedObjects*\_ISWINTERNAL_* OpenIpcPath=*\BaseNamedObjects*\IswSessionMinShared* OpenIpcPath=*\BaseNamedObjects*\ISWDMP_* # # Desktop Utilities # [Template_4tTrayMinimizer] Tmpl.Title=4t Tray Minimizer Tmpl.Class=Desktop Tmpl.Url=http://www.4t-niagara.com/tray.html Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\ShellEh*.dll OpenWinClass=*UtilWindow [Template_7zipShellEx] Tmpl.Title=7-Zip Shell Extension Tmpl.Class=Desktop Tmpl.Url=http://www.7-zip.org/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} OpenIpcPath=*\BaseNamedObjects*\7zCompressMapping* OpenIpcPath=*\BaseNamedObjects*\7zMap* [Template_ActiveCaptions] Tmpl.Title=Active Captions Tmpl.Class=Desktop Tmpl.Url=http://www.shelltoys.com/minimize_tray/index.html Tmpl.Scan=w OpenWinClass=ActiveCaptions [Template_ASUS_CapsHook] Tmpl.Title=ASUS CapsHook Tmpl.Class=Desktop Tmpl.Url=http://support.asus.com/Download.aspx?SLanguage=en&m=Eee+PC+1015PX&p=20&s=1 Tmpl.Scan=s Tmpl.ScanProduct={4B5092B6-F231-4D18-83BC-2618B729CA45} OpenWinClass=$:CapsHook.exe/IgnoreUIPI [Template_AcerGridVista] Tmpl.Title=Acer GridVista Tmpl.Class=Desktop Tmpl.Scan=w OpenWinClass=DritekScreenSplitterMainWindowClass OpenIpcPath=*\BaseNamedObjects*\Dritek-WindowMessageHooker-FileMappingStamp [Template_ActualWindowManager] Tmpl.Title=Actual Tools Actual Window Manager Tmpl.Class=Desktop Tmpl.Url=http://www.actualtools.com/ OpenIpcPath=*\BaseNamedObjects*\*_ServiceMapping OpenIpcPath=*\BaseNamedObjects*\*_ParamStrings_* OpenIpcPath=*\BaseNamedObjects*\MMF{*} OpenIpcPath=*\BaseNamedObjects*\ActualTools* OpenWinClass=*_MessengerServerWindow Tmpl.Scan=s Tmpl.ScanIpc=*\BaseNamedObjects*\ActualTools_* [Template_AdFender] Tmpl.Title=AdFender Tmpl.Class=Desktop Tmpl.Url=http://www.adfender.com/ OpenIpcPath=*\BaseNamedObjects*\AdFenderActive_* OpenIpcPath=*\BaseNamedObjects*\AdFenderDisabled_* Tmpl.Scan=s Tmpl.ScanProduct=AdFender [Template_AdGuard] Tmpl.Title=AdGuard (Browser Assistant) Tmpl.Class=Desktop Tmpl.Url=https://www.adguard.com/ Tmpl.Scan=s Tmpl.ScanService=Adguard Service NormalFilePath=%ProgramData%\Adguard\HostManifests\ OpenFilePath=Adguard.BrowserExtensionHost.exe,\Device\NamedPipe\????????-????-????-????-???????????? OpenIpcPath=Adguard.BrowserExtensionHost.exe,*\BaseNamedObjects*\Adguard* OpenIpcPath=Adguard.BrowserExtensionHost.exe,*\BaseNamedObjects*\net.pipe:?bmV0LnBpcGU6Ly8rL0FER1VBUkRBUElFTkRQT0lOVC8= [Template_ArumSwitcher] Tmpl.Title=Arum Switcher Tmpl.Class=Desktop Tmpl.Url=http://www.arumswitcher.com/ OpenIpcPath=*\BaseNamedObjects*\Arum_Switcher_Hook* [Template_Asutype] Tmpl.Title=Asutype Tmpl.Class=Desktop Tmpl.Url=http://www.asutype.com/index.html Tmpl.Scan=w OpenIpcPath=*\BaseNamedObjects*\fa00000* OpenWinClass=*asutype [Template_AutoSizer] Tmpl.Title=AutoSizer Tmpl.Class=Desktop Tmpl.Url=http://www.southbaypc.com/autosizer/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\AutoSizer123 OpenWinClass=SysListView32 [Template_Babylon] Tmpl.Title=Babylon Tmpl.Class=Desktop Tmpl.Url=http://www.babylon.com/ Tmpl.Scan=w OpenPipePath=\device\namedpipe\babypipe [Template_BingToolbar] Tmpl.Title=Bing Search Toolbar Tmpl.Class=Desktop Tmpl.Url=http://www.discoverbing.com/toolbar/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\ChannelReady_ac620ca9-6743-44d7-b861-e1d5ad76dd2c OpenPipePath=\Device\NamedPipe\msn\toolbar* [Template_Bins_Windows7Taskbar] Tmpl.Title=Bins for Windows 7 Taskbar Tmpl.Class=Desktop Tmpl.Url=http://www.1upindustries.com/bins/ Tmpl.Scan=s Tmpl.ScanProduct=Bins ClosedFilePath=*\TaskbarDockAppIntegration32.dll ClosedFilePath=*\TaskbarDockAppIntegration64.dll [Template_BookmarkBuddy] Tmpl.Title=Bookmark Buddy Tmpl.Class=Desktop Tmpl.Url=http://www.bookmarkbuddy.net/ Tmpl.Scan=w OpenWinClass=BMKBUDDY [Template_Chameleon_Window_Manager] Tmpl.Title=Chameleon Window Manager Tmpl.Class=Desktop Tmpl.Url=http://www.chameleon-managers.com/window-manager/ Tmpl.Scan=s Tmpl.ScanProduct=Chameleon Window Manager OpenIpcPath=*\BaseNamedObjects*\{System-*-*-*-*-*} OpenIpcPath=*\BaseNamedObjects*\chameleon* [Template_DialogMate2] Tmpl.Title=Dialog Mate 2 Tmpl.Class=Desktop Tmpl.Url=http://dm2.sourceforge.net/ Tmpl.Scan=iw OpenIpcPath=*\BaseNamedObjects*\DM2_SharedMem OpenIpcPath=*\BaseNamedObjects*\DM2_RollWindow_SharedMem OpenWinClass=DM2 Server class [Template_DragonNaturallySpeaking] Tmpl.Title=Dragon NaturallySpeaking Tmpl.Class=Desktop Tmpl.Url=http://www.nuance.com/naturallyspeaking/products/default.asp Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\Dragon NaturallySpeaking* [Template_FeedDemon] Tmpl.Title=FeedDemon Tmpl.Class=Desktop Tmpl.Url=http://www.feeddemon.com/ Tmpl.Scan=s Tmpl.ScanProduct=FeedDemon_is1 OpenPipePath=FeedDemon.exe,*\FeedDemon\v1\* OpenIpcPath=FeedDemon.exe,*\BaseNamedObjects*\FeedDemonMutex OpenWinClass=FeedDemon.exe,* [Template_FileEx] Tmpl.Title=File-Ex 3 Tmpl.Class=Desktop Tmpl.Url=http://www.cottonwoodsw.com/fx3summ.html Tmpl.Scan=s Tmpl.ScanProduct=File-Ex v3.* OpenWinClass=$:FileEx.exe/IgnoreUIPI [Template_GoogleToolbarIE] Tmpl.Title=Google Toolbar for Internet Explorer Tmpl.Class=Desktop Tmpl.Url=http://toolbar.google.com/ OpenIpcPath=*\BaseNamedObjects*\{40635BCA-4026-4CE3-9741-C8DC476E6268} OpenIpcPath=*\BaseNamedObjects*\{B7F1F778-8315-4EB2-AC1E-5AFCAA603271} OpenIpcPath=*\BaseNamedObjects*\{DEBFCCE1-B446-4992-9C9E-CA1CB548C718} OpenIpcPath=*\BaseNamedObjects*\*{E709AE98-F4E6-40DE-BE47-CFBA9B4605C0} OpenWinClass={A7E495BF-9589-4A6E-8479-DDA2D8D3C05F} OpenWinClass=$:GoogleToolbarNotifier.exe/IgnoreUIPI OpenClsid={FBA44040-BD27-4A09-ACC8-C08B7C723DCD} LingerProcess=GoogleToolbarUser.exe LingerProcess=GoogleToolbarUser_32.exe Tmpl.Scan=s Tmpl.ScanProduct={18455581-E099-4BA8-BC6B-F34B2F06600C} [Template_Intel_HD_Graphics] Tmpl.Title=Intel HD Graphics Driver Tmpl.Class=Desktop OpenIpcPath=\RPC Control\{27B4FD7B-035B-4853-938E-CC13FE3724D4} OpenIpcPath=*\BaseNamedObjects*\{3BFDD3D2-761C-4206-990C-3CC0643CF73A} OpenIpcPath=*\BaseNamedObjects*\? Tmpl.Scan=s Tmpl.ScanIpc=\RPC Control\{27B4FD7B-035B-4853-938E-CC13FE3724D4} [Template_IntelliTypePro] Tmpl.Title=IntelliType Pro Tmpl.Class=Desktop Tmpl.Url=http://www.microsoft.com/hardware/download/download.aspx?category=MK OpenWinClass=TInstanceManager [Template_Folder_Size] Tmpl.Title=Folder Size Tmpl.Url=http://foldersize.sourceforge.net/ Tmpl.Class=Desktop Tmpl.Scan=s Tmpl.ScanService=FolderSize OpenPipePath=\Device\NamedPipe\FolderSize OpenIpcPath=*\BaseNamedObjects*\FolderSizeShellUpdateMutex [Template_JetStart] Tmpl.Title=JetStart Tmpl.Class=Desktop Tmpl.Url=http://www.codesector.com/jetstart.php Tmpl.Scan=w OpenWinClass=MetaLauncher OpenIpcPath=*\BaseNamedObjects*\MetaLauncherMapObject* [Template_gMote] Tmpl.Title=gMote Tmpl.Class=Desktop Tmpl.Url=http://www.handform.net/gmote.php Tmpl.Scan=w OpenWinClass=TGestureConfigForm [Template_GoogleJapaneseIME] Tmpl.Title=Google Japanese Input Method (IME) Tmpl.Class=Desktop Tmpl.Url=http://www.google.com/intl/ja/ime/ Tmpl.Scan=s Tmpl.ScanService=GoogleIMEJaCacheService OpenPipePath=\Device\NamedPipe\googlejapaneseinput.* LingerProcess=GoogleIMEJaTool.exe LingerProcess=GoogleIMEJaRenderer.exe [Template_WeTypeIME] Tmpl.Title=WeType Input Method (IME) Tmpl.Class=Desktop Tmpl.Url=https://z.weixin.qq.com/ Tmpl.Scan=s Tmpl.ScanService=WeType Management Service OpenPipePath=\Device\NamedPipe\wetype.* [Template_KeyboardNinja] Tmpl.Title=Keyboard Ninja Tmpl.Class=Desktop Tmpl.Url=http://www.intelife.net/ninja/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\KEYBOARD_NINJA_2 OpenWinClass=$:ninja.exe/IgnoreUIPI [Template_Lingoes] Tmpl.Title=Lingoes Translator Tmpl.Class=Desktop Tmpl.Url=http://www.lingoes.net/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\OpenText_ZWFilter_GlobaData* OpenIpcPath=*\BaseNamedObjects*\OpenText_GrabText_GlobaData* OpenIpcPath=*\BaseNamedObjects*\OpenText_GrabText_Mutex* OpenWinClass=$:lingoes.exe/IgnoreUIPI [Template_Linkman] Tmpl.Title=Linkman Tmpl.Class=Desktop Tmpl.Url=http://www.outertech.com/index.php?_charisma_page=product&id=5 Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\Linkman* OpenWinClass=TLinkmanF OpenWinClass=opera.exe,op* OpenWinClass=opera.exe,DDEMLAnsiClient [Template_LinkStash] Tmpl.Title=LinkStash Tmpl.Class=Desktop Tmpl.Url=http://www.xrayz.co.uk/ Tmpl.Scan=w OpenWinClass=LinkStash OpenWinClass=LinkStashMonitor OpenWinClass=$:lnkstash.exe/IgnoreUIPI [Template_Listary] Tmpl.Title=Listary Tmpl.Class=Desktop Tmpl.Url=https://www.listary.com/ Tmpl.Scan=s Tmpl.ScanProduct=Listary_is1 OpenWinClass=ListaryToolbarCls OpenWinClass=$:listary.exe/IgnoreUIPI # v5 OpenIpcPath=*\BaseNamedObjects*\Listary_MainSharedMemory # v6 OpenIpcPath=*\BaseNamedObjects*\ListaryX_MainSharedMemory [Template_Logitech_G15_Keyboard] Tmpl.Title=Logitech Keyboard LCD Display Tmpl.Class=Desktop Tmpl.Url=https://support.logi.com/hc/en-us/articles/360024851053--Downloads-G15-Gaming-Keyboard # This scan is unreliable and it should be disabled by default #Tmpl.Scan=s #Tmpl.ScanProduct=Logitech Gaming Software OpenPipePath=\Device\NamedPipe\LGLCDPIPE-* [Template_LogitechProcessMonitor] Tmpl.Title=Logitech Process Monitor Service Tmpl.Class=Desktop Tmpl.Scan=s Tmpl.ScanService=LVPrcSrv DelayLoadDll=LVPrcInj.dll [Template_LogitechSetPoint] Tmpl.Title=Logitech SetPoint Mouse Tmpl.Class=Desktop Tmpl.Url=https://www.logitech.com/en-us/articles/11650 Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Logitech\SetPoint NoRenameWinClass=Internet Explorer_Server [Template_LogitechScrollApp] Tmpl.Title=Logitech Scroll App Tmpl.Class=Desktop Tmpl.Url=https://www.softpedia.com/get/Tweak/System-Tweak/Scroll-App.shtml Tmpl.Scan=w OpenWinClass=LogiSmoothScrlBckGrndWnd NoRenameWinClass=IEFrame OpenIpcPath=*\BaseNamedObjects*\LogiSmoothWheelInUse [Template_MacroExpress] Tmpl.Title=Macro Express Tmpl.Class=Desktop Tmpl.Url=http://www.macroexpress.com Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\ME98aveR OpenIpcPath=*\BaseNamedObjects*\MEBA3KGR OpenIpcPath=*\BaseNamedObjects*\me4hml OpenIpcPath=*\BaseNamedObjects*\me4hsd OpenIpcPath=*\BaseNamedObjects*\me4mmm OpenIpcPath=*\BaseNamedObjects*\me4msd OpenIpcPath=*\BaseNamedObjects*\me4pml OpenIpcPath=*\BaseNamedObjects*\me4esd OpenWinClass=TMainWin [Template_ManyCam] Tmpl.Title=ManyCam Tmpl.Class=Desktop Tmpl.Url=http://www.manycam.com/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\ManyCam_FileMapping* [Template_Microsoft_MSMQ] Tmpl.Title=Microsoft Message Queuing (MSMQ) Tmpl.Class=Desktop Tmpl.Url=http://msdn.microsoft.com/en-us/library/windows/desktop/ms711472%28v=vs.85%29.aspx Tmpl.Scan=i OpenIpcPath=\RPC Control\QMsvc$* [Template_NTrig_DuoSense] Tmpl.Title=N-Trig DuoSense Tmpl.Class=Desktop Tmpl.Url=http://www.n-trig.com/Content.aspx?Page=DualModeTechnology Tmpl.Scan=w OpenIpcPath=*\BaseNamedObjects*\ntrignativegesturesmutex OpenWinClass=NtrigSessionClient [Template_nVidia_nView] Tmpl.Title=nVidia nView Tmpl.Class=Desktop Tmpl.Url=http://www.nvidia.com/object/nview_display_us.html Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\nView Shared * OpenIpcPath=*\BaseNamedObjects*\nView * Event [Template_nVidia_Stereoscopic3D] Tmpl.Title=nVidia Stereoscopic 3D Driver Tmpl.Class=Desktop Tmpl.Url=http://www.nvidia.com/object/3d-vision-main.html Tmpl.Scan=s Tmpl.ScanService=Stereo Service OpenPipePath=\Device\NamedPipe\stereosvrpipe [Template_ObjectDock] Tmpl.Title=ObjectDock Tmpl.Class=Desktop Tmpl.Url=http://www.stardock.com/products/objectdock/ Tmpl.Scan=w OpenWinClass=ObjectDockServer [Template_OfficeLicensing] Tmpl.Title=Windows and Office Licensing Services Tmpl.Class=Desktop Tmpl.Url=http://office.microsoft.com Tmpl.Scan=s Tmpl.ScanService=osppsvc # Office 2010 OpenIpcPath=\RPC Control\OSPPCTransportEndpoint-* # Office 2013 Tmpl.ScanService=sppsvc OpenIpcPath=\RPC Control\SPPCTransportEndpoint-* # piggyback a fix for Excel UseDragDropHack=excel.exe,n [Template_OfficeClickToRun] Tmpl.Title=Microsoft Office Click-to-Run Tmpl.Class=Desktop Tmpl.Url=http://office.microsoft.com Tmpl.Scan=s Tmpl.ScanService=ClickToRunSvc HostInjectDll=\SboxHostDll.dll HostInjectDll64=\SboxHostDll.dll HostInjectDllARM64=\SboxHostDll.dll HostInjectProcess=OfficeClicktoRun.exe|ClickToRunSvc OpenIpcPath=\RPC Control\C2RClientAPI_Server_System* OpenIpcPath=\RPC Control\ClickToRun_Pipeline* OpenIpcPath=\RPC Control\AppV-ISV-* BoxNameTitle=EXCEL.EXE,- BoxNameTitle=MSACCESS.EXE,- BoxNameTitle=MSPUB.EXE,- BoxNameTitle=ONENOTE.EXE,- BoxNameTitle=OUTLOOK.EXE,- BoxNameTitle=POWERPNT.EXE,- BoxNameTitle=WINWORD.EXE,- [Template_QQ] Tmpl.Title=Tencent QQ Tmpl.Class=Desktop Tmpl.Url=https://im.qq.com/pcqq Tmpl.Scan=s Tmpl.ScanProduct={052CFB79-9D62-42E3-8A15-DE66C2C97C3E} NoRenameWinClass=QQ.exe,* [Template_RadeonPro] Tmpl.Title=RadeonPro Tmpl.Class=Desktop Tmpl.Url=http://radeonpro.info/ Tmpl.Scan=s Tmpl.ScanService=RadeonPro Support Service OpenIpcPath=*\BaseNamedObjects*\_rppmdata OpenIpcPath=*\BaseNamedObjects*\__rpapicf OpenIpcPath=*\BaseNamedObjects*\__rpssd [Template_RBTray] Tmpl.Title=RBTray Tmpl.Class=Desktop Tmpl.Url=http://rbtray.sourceforge.net/ Tmpl.Scan=w OpenWinClass=RBTrayHook [Template_RemoteDesktop] Tmpl.Title=Remote Desktop Tmpl.Class=Desktop Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\RDPSound* [Template_RoboType3] Tmpl.Title=RoboType 3 (PC Magazine Downloads) Tmpl.Class=Desktop Tmpl.Url=http://www.pcmag.com/article2/0,2817,427378,00.asp Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\RoboType.document OpenWinClass=Afx:400000:b:10003:* OpenWinClass=Afx:400000:b:10011:* [Template_RocketDock] Tmpl.Title=RocketDock Tmpl.Class=Desktop Tmpl.Url=http://rocketdock.com/ Tmpl.Scan=iw OpenIpcPath=*\BaseNamedObjects*\FdMe OpenWinClass=ROCKETDOCK [Template_RTSS] Tmpl.Title=Rivatuner Statistics Server Tmpl.Class=Desktop Tmpl.Url=https://www.guru3d.com/files-details/rtss-rivatuner-statistics-server-download.html Tmpl.Scan=s Tmpl.ScanProduct=RTSS OpenPipePath=\Device\NamedPipe\rtss_frametime OpenIpcPath=*\BaseNamedObjects*\RTSSSharedMemoryV2 [Template_ShortKeys] Tmpl.Title=ShortKeys (Lite) Tmpl.Class=Desktop Tmpl.Url=http://www.shortkeys.com Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\sh02hasd OpenIpcPath=*\BaseNamedObjects*\sh03hasd OpenIpcPath=*\BaseNamedObjects*\sh02mpas OpenIpcPath=*\BaseNamedObjects*\sh03mpas OpenWinClass=TMainWin [Template_SnagIt] Tmpl.Title=TechSmith SnagIt Tmpl.Class=Desktop Tmpl.Url=http://www.techsmith.com/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\SnagPriv* OpenPipePath=\Device\NamedPipe\SnagPriv.* [Template_SrsAudioSandbox] Tmpl.Title=SRS Audio Sandbox Tmpl.Class=Desktop Tmpl.Url=http://www.srslabs.com/store/audioproducts.asp OpenIpcPath=*\BaseNamedObjects*\AudioEngineDuplicateHandleApiPort* [Template_StrokeIt] Tmpl.Title=StrokeIt Tmpl.Class=Desktop Tmpl.Url=http://www.tcbmi.com/strokeit/ Tmpl.Scan=w OpenWinClass=StrokeIt OpenWinClass=StrokeIt/IgnoreUIPI OpenWinClass=# [Template_SynapticsTouchPad] Tmpl.Title=Synaptics TouchPad Tmpl.Class=Desktop Tmpl.Url=http://www.synaptics.com/support/drivers Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Synaptics\SynTP NoRenameWinClass=MozillaWindowClass [Template_SystemAudioStream] Tmpl.Title=System Audio Stream Tmpl.Class=Desktop Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\System_Audio_Stream_* [Template_TIM] Tmpl.Title=Tencent TIM Tmpl.Class=Desktop Tmpl.Url=https://office.qq.com/ Tmpl.Scan=s Tmpl.ScanProduct=TIM NoRenameWinClass=TIM.exe,* [Template_TypingAssistant] Tmpl.Title=Typing Assistance Tmpl.Class=Desktop Tmpl.Url=http://www.sumitsoft.com/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\Typing Assistant (*) OpenWinClass=$:Typing Assistant (English).exe/IgnoreUIPI OpenWinClass=$:Typing Assistant (French).exe/IgnoreUIPI OpenWinClass=$:Typing Assistant (German).exe/IgnoreUIPI OpenWinClass=$:Typing Assistant (Hungarian).exe/IgnoreUIPI OpenWinClass=$:Typing Assistant (Italian).exe/IgnoreUIPI OpenWinClass=$:Typing Assistant (Portuguese).exe/IgnoreUIPI OpenWinClass=$:Typing Assistant (Spanish).exe/IgnoreUIPI [Template_TwoPilots_SpeedTyping] Tmpl.Title=Two Pilots Speed Typing Tmpl.Class=Desktop Tmpl.Url=http://www.colorpilot.com/speed-typing.html Tmpl.Scan=w OpenWinClass=TYPEPILOTMAINWND [Template_UltraMon] Tmpl.Title=UltraMon Tmpl.Class=Desktop Tmpl.Url=http://www.realtimesoft.com/de/ultramon/ Tmpl.Scan=w OpenWinClass=UltraMon App OpenWinClass=UltraMonWndExtMsg [Template_WacomTablet] Tmpl.Title=Wacom Tablet Tmpl.Class=Desktop Tmpl.Url=http://www.wacom.com/customercare/drivers.aspx OpenIpcPath=*\BaseNamedObjects*\Wacom*WintabConnection* OpenIpcPath=$:Tablet.exe Tmpl.Scan=i [Template_WindowGrid] Tmpl.Title=WindowGrid Modern Window Management Program Tmpl.Class=Desktop Tmpl.Url=http://windowgrid.net/ Tmpl.Scan=i Tmpl.ScanIpc=*\BaseNamedObjects*\WindowGrid* OpenIpcPath=*\BaseNamedObjects*\WindowGridMapping_GridWindowHandle OpenIpcPath=*\BaseNamedObjects*\WindowGridMapping_Hook OpenIpcPath=*\BaseNamedObjects*\WindowGridMapping_Input OpenWinClass=HwndWrapper[WindowGridOverlay.exe;;*-*-*-*-* [Template_WindowsRasMan] Tmpl.Title=Windows Remote Access Connection Manager (dial-up/VPN) Tmpl.Class=Desktop Tmpl.Scan=i OpenIpcPath=\RPC Control\RasManLrpc [Template_VirtuaWin] Tmpl.Title=VirtuaWin Tmpl.Class=Desktop Tmpl.Url=http://virtuawin.sourceforge.net/ Tmpl.Scan=w OpenWinClass=VirtuaWinMainClass NoAutoExitExplorer=y [Template_Volumouse] Tmpl.Title=NirSoft Volumouse Tmpl.Class=Desktop Tmpl.Url=http://www.nirsoft.net/utils/volumouse.html Tmpl.Scan=w OpenWinClass=NirSoft_VolumouseMsg* [Template_Weasel] Tmpl.Title=Weasel (Rime for Windows) Tmpl.Class=Desktop Tmpl.Url=https://github.com/rime/weasel Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A} OpenPipePath=\Device\NamedPipe\%user%\WeaselNamedPipe ReadFilePath=%LocalAppData%\Microsoft\Windows\Fonts [Template_WindowsLive] Tmpl.Title=Windows Live Tmpl.Class=Desktop Tmpl.Url=http://www.live.com Tmpl.Scan=s Tmpl.ScanService=wlidsvc OpenIpcPath=\RPC Control\LiveIdSvc ClosedFilePath=%SystemRoot%\System32\IDStore.dll ClosedFilePath=%SystemRoot%\System32\wlidprov.dll ClosedKeyPath=\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetworkServiceTriggers\Triggers\bc90d167-9470-4139-a9ba-be0bbbf5b74d\CC105610-DA03-467E-BC73-5B9E2937458D [Template_WindowBlinds] Tmpl.Title=WindowBlinds Tmpl.Class=Desktop Tmpl.Url=http://www.stardock.com/products/windowblinds/ Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\Software\Stardock\WindowBlinds OpenPipePath=\Device\NamedPipe\WBServer* OpenIpcPath=*\BaseNamedObjects*\WB_WAIT [Template_ZoomText] Tmpl.Title=ZoomText Tmpl.Class=Desktop Tmpl.Url=http://www.synapseadaptive.com/aisquared/zoomtext_9/zoomtext_9_home_page.htm Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\AH_XMSAA_* OpenIpcPath=*\BaseNamedObjects*\ZSMEscapeKeyEvent OpenIpcPath=*\BaseNamedObjects*\Ai2_HOOKDATA_FILEMAP* OpenIpcPath=*\BaseNamedObjects*\ZoomTextRunning* OpenWinClass=ZT9MainWindow # # Media Players # [Template_VLC_Force] Tmpl.Title=#4323,VLC Tmpl.Class=MediaPlayer ForceProcess=vlc.exe [Template_VLC_DirectAccess_Profile] Tmpl.Title=#4338,VLC Tmpl.Class=MediaPlayer OpenFilePath=vlc.exe,%AppData%\vlc\* [Template_VLC_DirectAccess_Photos] Tmpl.Title=#4395,VLC Tmpl.Class=MediaPlayer OpenFilePath=vlc.exe,%UserProfile%\Pictures\* [Template_MPC-HC_Force] Tmpl.Title=#4323,MPC-HC Tmpl.Class=MediaPlayer ForceProcess=mpc-hc64.exe ForceProcess=mpc-hc.exe [Template_MPC-HC_DirectAccess_Profile] Tmpl.Title=#4338,MPC-HC Tmpl.Class=MediaPlayer OpenFilePath=mpc-hc64.exe,%AppData%\MPC-HC\* OpenFilePath=mpc-hc.exe,%AppData%\MPC-HC\* [Template_MPC-HC_DirectAccess_Photos] Tmpl.Title=#4395,MPC-HC Tmpl.Class=MediaPlayer OpenFilePath=mpc-hc64.exe,%UserProfile%\Pictures\* OpenFilePath=mpc-hc.exe,%UserProfile%\Pictures\* [Template_MPC-BE_Force] Tmpl.Title=#4323,MPC-BE Tmpl.Class=MediaPlayer ForceProcess=mpc-be64.exe ForceProcess=mpc-be.exe NoRenameWinClass=MPC-BE [Template_MPC-BE_DirectAccess_Profile] Tmpl.Title=#4338,MPC-BE Tmpl.Class=MediaPlayer OpenFilePath=mpc-be64.exe,%AppData%\MPC-BE\* OpenFilePath=mpc-be.exe,%AppData%\MPC-BE\* [Template_MPC-BE_DirectAccess_Photos] Tmpl.Title=#4395,MPC-BE Tmpl.Class=MediaPlayer OpenFilePath=mpc-be64.exe,%UserProfile%\Pictures\* OpenFilePath=mpc-be.exe,%UserProfile%\Pictures\* [Template_PotPlayer_Force] Tmpl.Title=#4323,PotPlayer Tmpl.Class=MediaPlayer ForceProcess=PotPlayerMini64.exe ForceProcess=PotPlayerMini.exe [Template_PotPlayer_DirectAccess_Profile] Tmpl.Title=#4338,PotPlayer Tmpl.Class=MediaPlayer OpenFilePath=PotPlayerMini64.exe,%AppData%\PotPlayerMini64 OpenFilePath=PotPlayerMini.exe,%AppData%\PotPlayerMini [Template_SMPlayer_Force] Tmpl.Title=#4323,SMPlayer Tmpl.Class=MediaPlayer ForceProcess=smplayer.exe [Template_SMPlayer_DirectAccess_Profile] Tmpl.Title=#4338,SMPlayer Tmpl.Class=MediaPlayer OpenFilePath=smplayer.exe,%AppData%\mpv\* [Template_SMPlayer_DirectAccess_Photos] Tmpl.Title=#4395,SMPlayer Tmpl.Class=MediaPlayer OpenFilePath=smplayer.exe,%UserProfile%\Pictures\smplayer_screenshots OpenFilePath=smplayer.exe,%UserProfile%\Pictures\smplayer_screenshots [Template_KMPlayer_Force] Tmpl.Title=#4323,KMPlayer Tmpl.Class=MediaPlayer ForceProcess=KMPlayer64.exe ForceProcess=KMPlayer.exe [Template_KMPlayer_DirectAccess_Profile] Tmpl.Title=#4338,KMPlayer Tmpl.Class=MediaPlayer OpenFilePath=KMPlayer64.exe,%AppData%\KMP OpenFilePath=KMPlayer.exe,%AppData%\KMP [Template_Clementine_Force] Tmpl.Title=#4323,Clementine Tmpl.Class=MediaPlayer ForceProcess=clementine.exe [Template_Clementine_DirectAccess_Profile] Tmpl.Title=#4338,Clementine Tmpl.Class=MediaPlayer OpenFilePath=clementine.exe,%UserProfile%\current\.config\Clementine\* [Template_Clementine_DirectAccess_Music] Tmpl.Title=#4398,Clementine Tmpl.Class=MediaPlayer OpenFilePath=clementine.exe,%UserProfile%\Music\* [Template_Strawberry_Force] Tmpl.Title=#4323,Strawberry Music Player Tmpl.Class=MediaPlayer ForceProcess=strawberry.exe [Template_Strawberry_DirectAccess_Profile] Tmpl.Title=#4338,Strawberry Music Player Tmpl.Class=MediaPlayer OpenFilePath=strawberry.exe,%Local AppData%\Strawberry [Template_Strawberry_DirectAccess_Music] Tmpl.Title=#4398,Strawberry Music Player Tmpl.Class=MediaPlayer OpenFilePath=strawberry.exe,%UserProfile%\Music\* # # Torrent Clients # [Template_qBittorrent_Force] Tmpl.Title=#4323,qBittorrent Tmpl.Class=TorrentClient ForceProcess=qBittorrent.exe [Template_qBittorrent_DirectAccess_Profile] Tmpl.Title=#4338,qBittorrent Tmpl.Class=TorrentClient OpenFilePath=qBittorrent.exe,%Local AppData%\qBittorrent OpenFilePath=qBittorrent.exe,%AppData%\qBittorrent [Template_Transmission_Force] Tmpl.Title=#4323,Transmission Tmpl.Class=TorrentClient ForceProcess=transmission-qt.exe [Template_Transmission_DirectAccess_Profile] Tmpl.Title=#4338,Transmission Tmpl.Class=TorrentClient OpenFilePath=transmission-qt.exe,%Local AppData%\transmission [Template_BiglyBT_Force] Tmpl.Title=#4323,BiglyBT Tmpl.Class=TorrentClient ForceProcess=BiglyBT.exe [Template_BiglyBT_DirectAccess_Profile] Tmpl.Title=#4338,BiglyBT Tmpl.Class=TorrentClient OpenFilePath=BiglyBT.exe,%AppData%\BiglyBT [Template_Popcorn-Time_Force] Tmpl.Title=#4323,Popcorn Time (popcorntime.app) Tmpl.Class=TorrentClient ForceProcess=Popcorn-Time.exe [Template_Popcorn-Time_DirectAccess_Profile] Tmpl.Title=#4338,Popcorn Time (popcorntime.app) Tmpl.Class=TorrentClient OpenFilePath=Popcorn-Time.exe,%Local AppData%\popcorn-time [Template_PicoTorrent_Force] Tmpl.Title=#4323,Pico Torrent Tmpl.Class=TorrentClient ForceProcess=PicoTorrent.exe ForceRestart=PicoTorrent.exe # # Download Managers # [Template_FreeDownloadManager] Tmpl.Title=Free Download Manager Tmpl.Class=Download Tmpl.Url=http://www.freedownloadmanager.org/ RpcMgmtSetComTimeout=fdm.exe,y [Template_SothinkWebVideoDownloader] Tmpl.Title=Sothink Web Video Downloader Stand-alone Tmpl.Class=Download Tmpl.Url=http://www.sothinkmedia.com/web-video-downloader/ Tmpl.Scan=w OpenWinClass=WVD_Class OpenIpcPath=$:VideoDownloader.exe [Template_OrbitDownloader] Tmpl.Title=Orbit Downloader Tmpl.Class=Download Tmpl.Url=http://www.orbitdownloader.com Tmpl.Scan=w OpenIpcPath=*\BaseNamedObjects*\GRABPRO_WEBSITEMUTEX_* OpenIpcPath=*\BaseNamedObjects*\orbitcth_ipc* OpenIpcPath=*\BaseNamedObjects*\orbitdm_app* OpenIpcPath=*\BaseNamedObjects*\ORBTPROS_APP OpenWinClass=ORBTPROS_APP OpenWinClass=orbitdm_app [Template_Replay_Music] Tmpl.Title=Applian Replay Music Tmpl.Class=Download Tmpl.Url=http://www.applian.com/replay-music/index.php Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\{034DBD6D-6784-4CB3-97D8-749947D01F70} OpenIpcPath=*\BaseNamedObjects*\{3EA1EB13-8045-44FC-AD59-B4F05478B400} OpenIpcPath=*\BaseNamedObjects*\{6560EAD3-F709-4B66-B90B-EA2D2C85AE30} OpenIpcPath=*\BaseNamedObjects*\{F22F2429-009C-4B5D-959F-519B59E25170} [Template_Replay_Media_Catcher] Tmpl.Title=Applian Replay Media Catcher Tmpl.Class=Download Tmpl.Url=http://www.applian.com/download-videos/ Tmpl.Scan=i OpenIpcPath=*\BaseNamedObjects*\{F22F2429-009C-4B5D-959F-519B59E25176} OpenIpcPath=*\BaseNamedObjects*\{6560EAD3-F709-4B66-B90B-EA2D2C85AE3B} OpenIpcPath=*\BaseNamedObjects*\{3EA1EB13-8045-44FC-AD59-B4F05478B40D} OpenIpcPath=*\BaseNamedObjects*\{034DBD6D-6784-4CB3-97D8-749947D01F72} # # Other # [Template_ScreenReader] Tmpl.Title=#4305,JAWS, NVDA, Window-Eyes, System Access Tmpl.Class=Misc # Tmpl.Scan=i Tmpl.Hide=y OpenIpcPath=\RPC Control\epmapper OpenIpcPath=\RPC Control\OLE* OpenIpcPath=\RPC Control\LRPC* OpenIpcPath=*\BaseNamedObjects*\JAWS* OpenIpcPath=*\BaseNamedObjects*\JFW* OpenIpcPath=*\BaseNamedObjects*\GWM* OpenIpcPath=*\BaseNamedObjects*\GWSync* OpenIpcPath=*\BaseNamedObjects*\GWSync* OpenIpcPath=*\BaseNamedObjects*\FS_CACHED_MSAA_DATA_MUTEX OpenIpcPath=*\BaseNamedObjects*\FS_FSDOM_LOADER_MUTEX OpenIpcPath=*\BaseNamedObjects*\SharedFSDomLoaderData* OpenIpcPath=\RPC Control\nvdaHelperRemote_* OpenIpcPath=*\BaseNamedObjects*\Serotek-* OpenWinClass=* # [Template_PlugPlayService] # Tmpl.Title=#3938 # Tmpl.Class=Misc # OpenIpcPath=\RPC Control\plugplay # OpenIpcPath=\RPC Control\ntsvcs [Template_TaskbarJumpList] Tmpl.Title=#4294 Tmpl.Class=Misc OpenPipePath=%Recent%\AutomaticDestinations\* OpenPipePath=%Recent%\CustomDestinations\* [Template_ActivIdentity] Tmpl.Title=ActivIdentity (CAC) Tmpl.Url=https://www.hidglobal.com/identity-management Tmpl.Class=Security Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\ActivCard OpenClsid={5E248397-8614-4EC5-8926-BD242DC9830A} OpenClsid={30E5C61A-E359-498B-B833-1FB56CCDDCE2} OpenClsid={884E2007-217D-11DA-B2A4-000E7BBB2B09} OpenClsid={8BF9A910-A8FF-457F-999F-A5CA10B4A885} OpenIpcPath=\RPC Control\LSMApi OpenIpcPath=\RPC Control\samss lpc OpenIpcPath=*\BaseNamedObjects*\Microsoft Smart Card Resource Manager* [Template_Yubikey] Tmpl.Title=FIDO2 security key (Yubikey), passkey Authentication Tmpl.Class=Security OpenIpcPath=\RPC Control\keysvc [Template_SymantecEP] Tmpl.Title=Symantec Endpoint Protection Tmpl.Class=Security Tmpl.Scan=s Tmpl.Url=http://www.broadcom.com/ Tmpl.ScanProduct={AB2C803C-5D82-4D6A-AC6A-5A7357D8B2F9} NormalFilePath=*\sysfer.dll [Template_Chrome_KB5027231_fix] Tmpl.Title=Chromium fix for Windows 11 with KB5027231 Tmpl.Class=WebBrowser #Tmpl.Scan=u #Tmpl.ScanUpd=KB5027231 Tmpl.ScanScript=if(system.version().major != 11) return false; return system.checkUpdates("KB5027231"); ClosedKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice ClosedKeyPath=,HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice ProcessGroup=,chrome.exe [Template_NotepadPlusPlus_fix] Tmpl.Title=#4342,Notepad++ Tmpl.Class=Misc Tmpl.Url=https://github.com/search?q=repo%3Asandboxie-plus%2FSandboxie+NppShell.dll&type=issues Tmpl.Scan=s Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\PackagedCom\Package\NotepadPlusPlus_1.0.0.0_neutral__7njy0v32s6xk6 #Tmpl.ScanScript=if(system.version().major != 11) return false; return system.checkRegKey("\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}") ClosedFilePath=explorer.exe,*\contextMenu\NppShell.dll [Template_Joplin] Tmpl.Title=Joplin Tmpl.Class=Misc Tmpl.Url=https://joplinapp.org/ Tmpl.Scan=s Tmpl.ScanProduct=499c114e-8890-5040-9c02-24abe7d3ebe9 OpenKeyPath=Joplin.exe,HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\* # # Default settings # [Template_AutoRecoverIgnore] Tmpl.Title=#4291 Tmpl.Class=Misc AutoRecoverIgnore=.part AutoRecoverIgnore=.jc! AutoRecoverIgnore=.leechget AutoRecoverIgnore=.dlm AutoRecoverIgnore=.tmp AutoRecoverIgnore=.download AutoRecoverIgnore=.dtapart AutoRecoverIgnore=.crdownload AutoRecoverIgnore=.crx AutoRecoverIgnore=.ob! AutoRecoverIgnore=.partial AutoRecoverIgnore=.!ut AutoRecoverIgnore=.lnk AutoRecoverIgnore=desktop.ini AutoRecoverIgnore=.opdownload [Template_LingerPrograms] Tmpl.Title=#4292 Tmpl.Class=Misc LingerProcess=mscorsvw.exe LingerProcess=AcroRd32.exe LingerProcess=Adobe_Updater.exe LingerProcess=JUSched.exe LingerProcess=SynCor.exe LingerProcess=GoogleUpdate.exe LingerProcess=GoogleToolbarNotifier.exe LingerProcess=RunDll32.exe LingerProcess=RealSched.exe LingerProcess=wisptis.exe LingerProcess=CS5ServiceManager.exe LingerProcess=AcrobatInfo.exe LingerProcess=IeLowUtil.exe LingerProcess=DllHost.exe LingerProcess=SplWow64.exe LingerProcess=nacl.exe LingerProcess=nacl64.exe LingerProcess=pdf24.exe LingerProcess=RuntimeBroker.exe LingerProcess=ssh-agent.exe # Vivaldi Updater LingerProcess=update_notifier.exe # Firefox telemetry process LingerProcess=pingsender.exe # Chrome telemetry process LingerProcess=software_reporter_tool.exe # Opera background processes LingerProcess=opera_crashreporter.exe LingerProcess=opera_autoupdate.exe # Daemon Tools Shell Helper LingerProcess=DTShellHlp.exe [Template_BlockPorts] Tmpl.Title=#4293 Tmpl.Class=Misc #BlockPort=137,138,139,445 NetworkAccess=*,Block;Port=137,138,139,445 [Template_BlockDNS] Tmpl.Title=Block DNS Tmpl.Class=Misc NetworkAccess=*,Block;Port=53;Protocol=UDP [Template_BlockAccessWMI] Tmpl.Title=Block Accessing WMI Tmpl.Class=Misc ClosedFilePath=%SystemRoot%\System32\wbem\* [Template_BlockLocalConnect] Tmpl.Title=Block Local Connect Tmpl.Class=Misc NetworkAccess=*,Block;Address=127.0.0.0-127.255.255.255;Protocol=Any NetworkAccess=*,Block;Address=::1;Protocol=Any [Template_BlockTelemetry] Tmpl.Title=#4307 Tmpl.Class=Misc # Block Firefox telemetry process ClosedFilePath=pingsender.exe # Block Chrome telemetry process ClosedFilePath=software_reporter_tool.exe # Block Opera telemetry process ClosedFilePath=opera_crashreporter.exe [Template_qWave] Tmpl.Title=#3459 Tmpl.Class=Misc OpenPipePath=\Device\QWAVEdrv [Template_SkipHook] Tmpl.Title=#3460 Tmpl.Class=Misc SkipHook=DragonSaga.exe,ntqsi,enumwin,findwin SkipHook=BatmanAC.exe,enumwin,findwin SkipHook=PotPlayer64.exe,cocreate SkipHook=PotPlayerMini64.exe,cocreate SkipHook=mpc-hc64.exe,cocreate [Template_FileCopy] Tmpl.Title=#4295 Tmpl.Class=Misc DontCopy=*.url CopyEmpty=*\microsoft\windows\explorer\thumbcache_* CopyEmpty=*\microsoft\windows\explorer\iconcache_* # firefox CopyAlways=*\places.sqlite CopyAlways=*\xul.mfl # windows installer etc CopyAlways=*\qmgr0.dat CopyAlways=*\qmgr1.dat CopyAlways=*\infcache.1 CopyAlways=*\cbs.log # internet explorer 10 web cache CopyAlways=*\webcachev*.dat # Media Players DontCopy=*.aac DontCopy=*.ac3 DontCopy=*.aiff DontCopy=*.ape DontCopy=*.asf DontCopy=*.avi DontCopy=*.f4v DontCopy=*.flac DontCopy=*.flv DontCopy=*.m4a DontCopy=*.m4v DontCopy=*.mid DontCopy=*.mka DontCopy=*.mkv DontCopy=*.mov DontCopy=*.mp3 DontCopy=*.mp4 DontCopy=*.mpeg DontCopy=*.mpg DontCopy=*.oga DontCopy=*.ogg DontCopy=*.ogv DontCopy=*.opus DontCopy=*.ra DontCopy=*.rm DontCopy=*.rmvb #DontCopy=*.ts DontCopy=*.vob DontCopy=*.wav DontCopy=*.webm DontCopy=*.wma DontCopy=*.wmv # For ProtectHostImages=y (issues 4394 and 4424) DontCopy=!updater.exe,*\Program Files*\Mozilla Firefox\* DontCopy=!updater.exe,*\Program Files*\Firefox Nightly\* DontCopy=!updater.exe,*\Program Files*\Firefox Developer Edition\* DontCopy=!LibreWolf-WinUpdater.exe,*\Program Files*\LibreWolf\* DontCopy=!updater.exe,*\Program Files*\Waterfox\* DontCopy=!updater.exe,*\Program Files*\Ablaze Floorp\* [Template_RpcPortBindings] Tmpl.Title=#4296 Tmpl.Class=Misc #Tmpl.Scan=s #Tmpl.ScanService=RpcSs #Tmpl.ScanService=RpcEptMapper #Tmpl.ScanService=DcomLaunch # hardcoded options: #RpcPortBinding=*,{906B0CE0-C70B-1067-B317-00DD010662DA},IpcPort="samss lpc" #RpcPortBinding=winspool.drv,'ncalrpc:[,Security=Impersonation Dynamic False]',Resolve=PrintSpooler #RpcPortBindingSvc=Spooler,PrintSpooler # AppInfo RpcPortBinding=kernel32.dll,'0497b57d-2e66-424f-a0c6-157cd5d41700@ncalrpc:',Resolve=AppInfo,TimeOut=y RpcPortBindingIfId=AppInfo,{0497b57d-2e66-424f-a0c6-157cd5d41700} #RpcPortBindingSvc=AppInfo,appinfo # AppInfo for Store Apps RpcPortBinding=apisethost.appexecutionalias.dll,'0497b57d-2e66-424f-a0c6-157cd5d41700@ncalrpc:',Resolve=AppInfo,TimeOut=n # RpcMgmtSetComTimeout presets #UseRpcMgmtSetComTimeout=AppXDeploymentClient.dll,y UseRpcMgmtSetComTimeout=WINNSI.DLL,n # windows proxy auto discovery #Tmpl.ScanService=WinHttpAutoProxySvc RpcPortBinding=WinHttp.dll,'ncalrpc:',Resolve=WPAD,TimeOut=y RpcPortBindingSvc=WPAD,WinHttpAutoProxySvc #RpcPortFilter=WPAD,1,WinHttpResetAutoProxy RpcPortFilter=WPAD,2,AutoProxySaveProxyCredentials RpcPortFilter=WPAD,3,AutoProxyStoreSavedProxyCredentialsForClient RpcPortFilter=WPAD,4,AutoProxyDeleteSavedProxyCredentials #RpcPortFilter=WPAD,5,AutoProxyReindicateAllProxies #RpcPortFilter=WPAD,6,ReadProxySettingsInternal RpcPortFilter=WPAD,7,WinHttpWriteProxySettings RpcPortFilter=WPAD,8,WinHttpSetProxySettingsPerUser #RpcPortFilter=WPAD,9,WinHttpConnectionUpdateIfIndexTable RpcPortFilter=WPAD,10,WinHttpConnectionSetPolicyEntries RpcPortFilter=WPAD,11,WinHttpConnectionDeletePolicyEntries # windows 10 game port #Tmpl.ScanService=??? RpcPortBinding=resourcepolicyclient.dll,{00000000-0000-0000-0000-000000000000},Resolve=GamePort RpcPortBindingIfId=GamePort,{88ABCBC3-34EA-76AE-8215-767520655A23} # windows 11 NLA RpcPortBinding=nlansp_c.dll,'ncalrpc:',Resolve=NetworkProfiles,TimeOut=y RpcPortBindingIfId=NetworkProfiles,{3F787932-3452-4363-8651-6EA97BB373BB} #RpcPortBindingSvc=NetworkProfiles,netprofm [Template_NoUACProxy] Tmpl.Title=#4306 Tmpl.Class=Misc NoUACProxy=y #UAC for compartment Mode Win10 RpcPortBinding=windows.storage.dll,'201ef99a-7fa0-444c-9399-19ba84f12a1a@ncalrpc:',Resolve=UAC,TimeOut=n RpcPortBindingIfId=UAC,{201EF99A-7FA0-444C-9399-19BA84F12A1A} #UAC for compartment Mode Win7 RpcPortBinding=SHELL32.dll,'201ef99a-7fa0-444c-9399-19ba84f12a1a@ncalrpc:',IpcPort=senssvc,TimeOut=n # # COM/RPC Presets # [Template_OpenCOM] OpenIpcPath=*\BaseNamedObjects*\__ComCatalogCache__ OpenIpcPath=\RPC Control\epmapper OpenIpcPath=\RPC Control\OLE* OpenIpcPath=\RPC Control\LRPC* [Template_BoxedCOM] NormalIpcPath=*BaseNamedObjects*\__ComCatalogCache__ NormalIpcPath=*BaseNamedObjects*\ComPlusCOMRegTable NormalIpcPath=*BaseNamedObjects*\RotHintTable NormalIpcPath=*BaseNamedObjects*\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5} NormalIpcPath=*BaseNamedObjects*\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9} NormalIpcPath=\RPC Control\actkernel NormalIpcPath=\RPC Control\epmapper NormalIpcPath=\RPC Control\OLE* NormalIpcPath=\RPC Control\LRPC* # # Optional RPC Port Config # [Template_RpcPortBindingsExt] Tmpl.Title=#4300 Tmpl.Class=Misc # NSI RpcPortBinding=WINNSI.DLL,'ncalrpc:[,Security=Impersonation Dynamic True]',Resolve=NSI,TimeOut=n RpcPortBindingIfId=NSI,{7ea70bcf-48af-4f6a-8968-6a440754d5fa} #RpcPortBindingSvc=NSI,nsi [Template_OpenBluetooth] Tmpl.Title=#4297 Tmpl.Class=Misc #bluetooth RpcPortBinding=BluetoothApis.dll,'ncalrpc:',Resolve=Bluetooth,TimeOut=y RpcPortBindingIfId=Bluetooth,{2ACB9D68-B434-4B3E-B966-E06B4B3A84CB} #RpcPortBindingSvc=Bluetooth,bthserv [Template_OpenSmartCard] Tmpl.Title=#4298 Tmpl.Class=Misc #smartcard RpcPortBinding=WinSCard.dll,{00000000-0000-0000-0000-000000000000},Resolve=SmartCard RpcPortBindingIfId=SmartCard,{C6B5235A-E413-481D-9AC8-31681B1FAAF5} [Template_SSDP] Tmpl.Title=#4299 Tmpl.Class=Misc #upnp #Tmpl.ScanService=ssdpsrv RpcPortBinding=SSDPAPI.dll,'ncalrpc:',Resolve=SSDP RpcPortBindingIfId=SSDP,{4B112204-0E19-11D3-B42B-0000F81FEB9F} #RpcPortBindingSvc=SSDP,ssdpsrv # # Exclusions for FakeAdminRights # [Template_CredentialUIBroker] # never fake admin rights for CredentialUIBroker.exe (issue 3986) FakeAdminRights=CredentialUIBroker.exe,n [SysCallPresets] # # disabled hooks # DisableWinNtHook=MapViewOfSection DisableWinNtHook=YieldExecution # CallEnclave causes a BSOD when kernel stack protection is enabled DisableWinNtHook=CreateEnclave DisableWinNtHook=LoadEnclaveData DisableWinNtHook=InitializeEnclave DisableWinNtHook=CallEnclave DisableWinNtHook=TerminateEnclave # filtered system calls not allowed #DisableWinNtHook=CreatePagingFile # # approved system calls for Security Hardened sandboxes # # system calls filtered by driver ApproveWinNtSysCall=OpenFile ApproveWinNtSysCall=CreateFile ApproveWinNtSysCall=CreateMailslotFile ApproveWinNtSysCall=CreateNamedPipeFile ApproveWinNtSysCall=ConnectPort ApproveWinNtSysCall=SecureConnectPort ApproveWinNtSysCall=CreatePort ApproveWinNtSysCall=AlpcConnectPort ApproveWinNtSysCall=AlpcConnectPortEx ApproveWinNtSysCall=AlpcCreatePort ApproveWinNtSysCall=ImpersonateClientOfPort ApproveWinNtSysCall=AlpcImpersonateClientOfPort ApproveWinNtSysCall=RequestPort ApproveWinNtSysCall=RequestWaitReplyPort ApproveWinNtSysCall=AlpcSendWaitReceivePort ApproveWinNtSysCall=OpenEvent ApproveWinNtSysCall=CreateEvent ApproveWinNtSysCall=OpenEventPair ApproveWinNtSysCall=CreateEventPair ApproveWinNtSysCall=OpenKeyedEvent ApproveWinNtSysCall=CreateKeyedEvent ApproveWinNtSysCall=OpenMutant ApproveWinNtSysCall=CreateMutant ApproveWinNtSysCall=OpenSemaphore ApproveWinNtSysCall=CreateSemaphore ApproveWinNtSysCall=OpenSection ApproveWinNtSysCall=CreateSection ApproveWinNtSysCall=CreateSectionEx ApproveWinNtSysCall=OpenJobObject ApproveWinNtSysCall=CreateJobObject ApproveWinNtSysCall=CreateSymbolicLinkObject ApproveWinNtSysCall=OpenSymbolicLinkObject ApproveWinNtSysCall=CreateDirectoryObject ApproveWinNtSysCall=CreateDirectoryObjectEx ApproveWinNtSysCall=OpenDirectoryObject ApproveWinNtSysCall=DuplicateObject ApproveWinNtSysCall=GetNextProcess ApproveWinNtSysCall=GetNextThread ApproveWinNtSysCall=DeviceIoControlFile #ApproveWinNtSysCall=FsControlFile ApproveWinNtSysCall=QuerySystemInformation ApproveWinNtSysCall=OpenProcessToken ApproveWinNtSysCall=OpenProcessTokenEx ApproveWinNtSysCall=OpenThreadToken ApproveWinNtSysCall=OpenThreadTokenEx ApproveWinNtSysCall=SetInformationProcess ApproveWinNtSysCall=SetInformationThread ApproveWinNtSysCall=ImpersonateAnonymousToken ApproveWinNtSysCall=OpenProcess ApproveWinNtSysCall=OpenThread ApproveWinNtSysCall=AlpcOpenSenderProcess ApproveWinNtSysCall=AlpcOpenSenderThread # system calls allowed without filtering ApproveWinNtSysCall=OpenKey ApproveWinNtSysCall=OpenKeyEx ApproveWinNtSysCall=CreateKey #ApproveWinNtSysCall=DeleteKey ApproveWinNtSysCall=SetValueKey #ApproveWinNtSysCall=SaveKey #ApproveWinNtSysCall=SaveKeyEx ApproveWinNtSysCall=LoadKey ApproveWinNtSysCall=LoadKey2 ApproveWinNtSysCall=LoadKey3 ApproveWinNtSysCall=LoadKeyEx ApproveWinNtSysCall=SetInformationFile ApproveWinNtSysCall=SetInformationKey ApproveWinNtSysCall=SetInformationVirtualMemory ApproveWinNtSysCall=SetInformationWorkerFactory ApproveWinNtSysCall=SetInformationJobObject #ApproveWinNtSysCall=SetInformationSymbolicLink #ApproveWinNtSysCall=SetInformationToken #ApproveWinNtSysCall=SetInformationObject ApproveWinNtSysCall=RaiseHardError ApproveWinNtSysCall=DeleteFile ApproveWinNtSysCall=AlpcAcceptConnectPort ApproveWinNtSysCall=AlpcCreateSecurityContext ApproveWinNtSysCall=CreateLowBoxToken ApproveWinNtSysCall=TraceControl ApproveWinNtSysCall=NtTraceEvent ApproveWinNtSysCall=CreatePrivateNamespace ApproveWinNtSysCall=CreateTimer ApproveWinNtSysCall=CreateTimer2 ApproveWinNtSysCall=OpenTimer ApproveWinNtSysCall=CreateUserProcess #ApproveWinNtSysCall=CreateThreadEx ApproveWinNtSysCall=QueryAttributesFile ApproveWinNtSysCall=QueryFullAttributesFile # Windows Notification Facility ApproveWinNtSysCall=SubscribeWnfStateChange ApproveWinNtSysCall=UnsubscribeWnfStateChange ApproveWinNtSysCall=QueryWnfStateData # token stuff ApproveWinNtSysCall=DuplicateToken ApproveWinNtSysCall=FilterToken ApproveWinNtSysCall=AdjustPrivilegesToken ApproveWinNtSysCall=AccessCheck ApproveWinNtSysCall=AccessCheckByType # atom stuff ApproveWinNtSysCall=AddAtom ApproveWinNtSysCall=AddAtomEx ApproveWinNtSysCall=FindAtom ApproveWinNtSysCall=DeleteAtom # allowed Win32 system calls ApproveWin32SysCall=GdiDdDDI* # # Known Conflicts # [Template_KnownConflicts] Tmpl.Entry=Folder Lock | Folder Lock Tmpl.Entry=StrokeIt | StrokeIt #Tmpl.Entry=AquaSnap 1.16.2 | {CF0C7CA1-9BDC-4660-9CF5-E44446D49725} #Tmpl.Entry=avast! Antivirus | avast #Tmpl.Entry=AVG Antivirus | AVG #Tmpl.Entry=BitDefender Antivirus | BitDefender #Tmpl.Entry=Blue Ridge Networks AppGuard 3.0.13.1 | {2C9B1E69-DD05-40F5-8378-056A117028F9} #Tmpl.Entry=Comodo Antivirus | {4E9C1938-BDC8-4897-8368-9574F9AF83E3} #Tmpl.Entry=Comodo GeekBuddy 4.19.131 | {266FA04F-F0FA-4F7A-AA1E-387A57F579F2} #Tmpl.Entry=Dr. Web 9 | {937CFD3F-8BFB-4208-81CB-F5004CD7B000} #Tmpl.Entry=Dr. Web Katana | {7599F709-61D5-44F1-996C-4DFEB1B855E0} #Tmpl.Entry=iTunes | {FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E} #Tmpl.Entry=Kaspersky Total Security 16 | {77E7AE5C-181C-4CAF-ADBF-946F11C1CE26} #Tmpl.Entry=Norton Security | NS #Tmpl.Entry=Nuance Power PDF Advanced 1.0 | {BD71D245-1A8B-4FB3-83E4-74F77FB39267} #Tmpl.Entry=Office 2016 Click-to-Run | {90160000-007E-0000-0000-0000000FF1CE} #Tmpl.Entry=PC Tools Firewall Plus | PC Tools Firewall Plus # # Deprecated templates # [Template_Firefox_Addon_FoxNotes] [Template_Firefox_Addon_SpeedDial] [Template_Firefox_Addon_ScrapBook] [Template_Neon_Force] [Template_Neon_Bookmarks_DirectAccess] [Template_Neon_History_DirectAccess] [Template_Neon_Cookies_DirectAccess] [Template_Neon_Passwords_DirectAccess] [Template_Neon_Preferences_DirectAccess] [Template_Neon_Profile_DirectAccess] [Template_Neon_WallpaperAccess] [Template_Maxthon2_Force] [Template_Maxthon2_Favorites_DirectAccess] [Template_Maxthon2_SharedAccount_DirectAccess] [Template_Outlook_Express] [Template_DefenseWall] [Template_StickyPassword] [Template_ActiveSync] [Template_Windows2000Internat] [Template_FreeDownloadManager] [Template_WindowsFontCache] [Template_Windows10CoreUI] [Template_FireFix_for_Win7] [Template_PlugPlayService] [Template_IExplore_Credentials] [Template_VirtualDesktopManager] [Template_DeviceSecurity] [Template_OnlineArmor] [Template_VPNTunnel] [Template_Edge_Win11Fix] [Template_InternetDownloadManager] [Template_BullGuard] [Template_Bsecure] [Template_CyberPatrol]