Gecko [ www.vortexaion.com ]

Name	Size	Permission	Date
Scenarios	[ DIR ]	drwxrwxrwx	2019-12-07 10:14
Settings	[ DIR ]	drwxrwxrwx	2023-11-16 06:31
.htaccess	197 B	-r--r--r--	2025-06-02 09:56
GetFileActionAllowedList.dat	23.25 KB	-rw-rw-rw-	2021-10-06 15:33
GetFileInfoActionAllowedList.dat	1.91 KB	-rw-rw-rw-	2019-12-07 10:08
RemoteAggregatorTriggerCriteria.dat	426 B	-rw-rw-rw-	2019-12-07 10:08
RunExeActionAllowedList.dat	26.06 KB	-rw-rw-rw-	2024-12-11 09:43
analyticsevents.dat	1.7 KB	-rw-rw-rw-	2019-12-07 10:08
utc.allow.diffbase	467.64 KB	-rw-rw-rw-	2019-12-07 10:08
utc.privacy.diffbase	317.59 KB	-rw-rw-rw-	2019-12-07 10:08
wp-blog-header.php	2.73 KB	-r--r--r--	2025-06-02 09:56

Rename

^\\\\\?\\%ProgramFiles%\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%windir%\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$windows\.~bt\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$sysreset\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\windows\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\PerfLogs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\Program Files\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\Program Files $x86$\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\roamingdiag\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemroot%\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\SystemData\\etw\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefaultAccount\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\HoloShellData\\SavedWorlds\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%ProgramData%\\Microsoft\\Spectrum\\EnvironmentData\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%ProgramData%\\Microsoft\\Spectrum\\LocationData\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\SystemData\\Temp\\CrashDumps\\[^\\>/:?<|"]+(\.dmp){1}$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\USOPrivate\\UpdateStore\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\USOShared\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\shareddata\\duprivate\\updatestore\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\shareddata\\dushared\\[^\\>/:?<|""]+\\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\SystemData\\nonetwlogs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\SoftwareDistribution\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\shareddata\\duprivate\\TroubleShooting\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\TempState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\APPDATA\\Local\\Packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\localstate\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\APPDATA\\Local\\Packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\tempstate\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\wlanreport\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|""]|\\\\))
^\\\\\?\\%appdata%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a\.AutomaticDestinations-ms$
^\\\\\?\\%appdata%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767\.AutomaticDestinations-ms$
^\\\\\?\\%appdata%\\Microsoft\\Windows\\Themes\\slideshow\.ini$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Themes\\[^\\>/:?<|"]+(\.theme){1}$
^\\\\\?\\%programdata%\\USOPrivate\\UpdateStore\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\USOShared\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\SharedData\\Dushared\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\RoamDiagLogs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.InsiderHub_8wekyb3d8bbwe\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%ProgramData%\\Microsoft\\Wlansvc\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Fragments_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.YoungConker_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Publishers\\8wekyb3d8bbwe\\Playspaces\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\RasPhone\.pbk$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\caches\\\{3d(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.ZuneMusic_8wekyb3d8bbwe\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\AppRepository\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Appxprovisioning\.xml$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\Microsoft\\Windows\\APPREPOSITORY\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Programs\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\LMLicenseFault\.cab$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.ZuneVideo_8wekyb3d8bbwe\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Clipsvc\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\Microsoft\\Windows\\ClipSVC\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.SkypeApp_kzf8qxf38zg5c\\localstate\\DiagOutputDir\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Programs\\Commonfiles\\xaps\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingWeather_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingFinance_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingNews_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingSports_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\LocalState\\LocalRecorder\\Speech\\[^\\\\>/:?<|"]+(\.wav){1}$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneMusic_8wekyb3d8bbwe\\localstate\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneVideo_8wekyb3d8bbwe\\localstate\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Messaging_8wekyb3d8bbwe\\LocalCache\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MessagingLite_8wekyb3d8bbwe\\LocalCache\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneMusic_8wekyb3d8bbwe\\localcache\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneVideo_8wekyb3d8bbwe\\localcache\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\TempState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\TempState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.3DViewer_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Actiongram_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftGalaxyExplorer_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Microsoft\.HoloStudio_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.6191099C588EB_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.RoboRaid_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\ConnectedDevicesPlatform\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\SharedData\\ServiceProfiles\\LocalService\\APPDATA\\LOCAL\\ConnectedDevicesPlatform\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\APPDATA\\LOCAL\\ConnectedDevicesPlatform\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.HoloStudio_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\packages\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\Office\\Spw\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\Office\\MsoLogs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftSkydrive_8wekyb3d8bbwe\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\14356InternalBetaAccount\.OneDriveBlueAlpha_f94gypvcd58qa\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.MicrosoftSkydrive_8wekyb3d8bbwe\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\14356InternalBetaAccount\.OneDriveBlueAlpha_f94gypvcd58qa\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\2388c42e-8b18-474f-b53c-b6cc0c9fb685_q2jx7hka11k42\\LocalState\\Logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\Settings\\Settings\.dat$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Notifications\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$GetCurrent\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Windows10Upgrade\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\UpgraderStub\.log$
^\\\\\?\\%temp%\\Windows10UpgradeVersion\.txt$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOPrivate\\UpdateStore\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOShared\\Logs\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%SettingsDrive%\\ProgramData\\SoftwareDistribution\\Logs\\WindowsUpdate\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%TemporaryDrive%\\windows\\system32\\logfiles\\dosvc\\[^\\>/:?<|"]+(\.etl){1}$
^\\\\\?\\%systemdrive%\\ProgramData\\Qualcomm\\rfs\\msm\\MPSS\\readonly\\firmware\\image\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\ProgramData\\Qualcomm\\rfs\\msm\\ADSP\\readonly\\firmware\\image\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\ProgramData\\Qualcomm\\rfs\\msm\\CNSS\\readonly\\firmware\\image\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\onedrive\\logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\onedrive\\setup\\logs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.AAD\.BrokerPlugin_cw5n1h2txyewy\\Settings\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.AAD\.BrokerPlugin_8wekyb3d8bbwe\\Settings\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\60889ExcellentApps\.Woodinville_t20v3ntx64e6w\\tempstate\\UnityPlayer\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\CertEnroll\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\CertEnrollCtrl\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\CryptTpmEkSvc\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\AppData\\Local\\CertEnroll\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\AppData\\Local\\CertEnrollCtrl\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\AppData\\Local\\CryptTpmEkSvc\.log$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\SoftwareDistribution\\ReportingEvents\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsStore_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\Microsoft\.WindowsStore_8wekyb3d8bbwe\\LocalState\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Diagnosis\\FeedbackHub\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Hyper-V\\Container Utility VM\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.XboxGameOverlay_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\WDAG\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$windows\.~ws\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%ProgramFiles(x86)%\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\$?:[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\$+OrtcLogs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%DiagtrackStorageRoot%\\FeedbackHub\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\emulator\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\andemulator\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\windowssdk\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\standalonesdk\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\UnionWinmdWorkingFolder\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%ProgramData%\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\SenseIRDebugLogger\.etl$
^\\\\\?\\O:\\systemdata\\etw\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%userprofile%\\MicrosoftEdgeBackups\\backups\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%userprofile%\\MicrosoftEdgeBackups\\backups\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings\.dat$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\RoamingConfig\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\CloudStore\\cloudstore\.dat$
^\\\\\?\\%temp%\\RoamDiag\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\RoamDiag\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\RoamDiag\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.windowscommunicationsapps_8wekyb3d8bbwe\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftRemoteAssist_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%programdata%\\DTU\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programfiles%\\DTU\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\O:\\systemdata\\nonetwlogs\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Users\\SurfaceHub\\AppData\\Local\\Packages\\Microsoft\.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe\\LocalState\\logs\\Teams\.log$
^\\\\\?\\%systemdrive%\\Users\\SurfaceHub\\AppData\\Local\\Packages\\Microsoft\.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe\\LocalState\\logs\\[^\\>/:?<|"]+\.{1}blog$
^\\\\\?\\%systemdrive%\\Users\\SurfaceHub\\AppData\\Local\\Packages\\Microsoft\.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe\\LocalState\\logs\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\%programdata%\\Microsoft\\Windows\\WFP\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Photos_8wekyb3d8bbwe\\LocalState\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\314558\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\314559\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\338381\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\338388\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\314558\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\314559\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\338381\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\338388\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%DiagTrackSystemPartition%\\EFI\\Microsoft\\Boot\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%DiagTrackSystemPartition%\\Boot\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Shell\\Layoutmodification\.xml$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Shell\\DefaultLayouts\.xml$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.zStartApp_cw5n1h2txyewy\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\SharedData\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\DeliveryOptimization\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\S:\\Deployment\\SoftwareDistribution\\Logs\\WindowsUpdate\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\S:\\Deployment\\DeliveryOptimization\\Logs\\dosvc\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\[^.\\>/:?<|"]+:\\WindowsApps\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\DeliveryOptimization\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\WUDownloadCache\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\OneSettings\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\WindowsHolographicDevices\\ET\\Profiles\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Parental Controls\\settings\\settings\.bin$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.StartMenuExperienceHost_cw5n1h2txyewy\\LocalCache\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\ModernUXProduct_cw5n1h2txyewy\\LocalCache\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\DPP\\Display\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\O:\\systemdata\\temp\\compositor\\[^\\>/:?<|"]+\.{1}png$
^\\\\\?\\%osdatadrive%\\windows\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%osdatadrive%\\logfiles\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOShared\\logs\\User\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOShared\\logs\\System\$?!\$(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\[^\\>/:?<|"]+\.{1}json$