title: Possible DLL Hijacking
id: f63cc1b6-356a-4d57-95d3-8af7db36741d
status: experimental
description: Detects possible DLL hijacking by looking for suspicious file writes of known DLL hijacking candidates to unexpected locations.
references:
    - http://hijacklibs.net
author: "Wietze Beukema"
date: 2026-03-14
tags:
    - attack.defense_evasion
    - attack.T1574.001
logsource:
    product: windows
    category: file_event
detection:
    selection_0:
        TargetFileName:
          - '*\vcomp100.dll'
          - '*\relay.dll'
          - '*\dsp_bridge_x64.dll'
          - '*\quickdeskband.dll'
          - '*\providers.dll'
          - '*\shellsel.ocx'
          - '*\tmtap.dll'
          - '*\utiluniclient.dll'
          - '*\x32bridge.dll'
          - '*\axeonoffhelper.dll'
          - '*\cdpsgshims.dll'
          - '*\microsoft.ui.xaml.xamltypeinfo.dll'
          - '*\mstracer.dll'
          - '*\oci.dll'
          - '*\offdmpsvc.dll'
          - '*\shellchromeapi.dll'
          - '*\tsmsisrv.dll'
          - '*\tsvipsrv.dll'
          - '*\wlbsctrl.dll'
          - '*\wow64log.dll'
          - '*\wptsextensions.dll'

    filter_1:
        TargetFileName:
          - 'c:\users\\*\appdata\local\ciscosparklauncher\\*'
          - 'c:\users\\*\appdata\local\programs\cisco spark\\*'
          - 'c:\program files\cisco spark\*'
          - 'c:\program files (x86)\cisco spark\*'
    selection_1:
        TargetFileName:
          - '*\ciscosparklauncher.dll'

    filter_2:
        TargetFileName:
          - 'c:\users\\*\appdata\local\gitkraken\app-*\\*'
    selection_2:
        TargetFileName:
          - '*\libcares-2.dll'

    filter_3:
        TargetFileName:
          - 'c:\users\\*\appdata\local\google\chrome\application\\*'
          - 'c:\program files\google\chrome\application\*'
          - 'c:\program files (x86)\google\chrome\application\*'
    selection_3:
        TargetFileName:
          - '*\chrome_frame_helper.dll'

    filter_4:
        TargetFileName:
          - 'c:\users\\*\appdata\local\programs\opera\\*\\*'
          - 'c:\users\\*\appdata\local\programs\opera gx\\*\\*'
          - 'c:\program files\opera\\*\*'
          - 'c:\program files (x86)\opera\\*\*'
    selection_4:
        TargetFileName:
          - '*\opera_elf.dll'

    filter_5:
        TargetFileName:
          - 'c:\users\\*\appdata\local\temp\\*\application2\\*'
          - 'c:\program files\baidu\baidupinyin\\*\*'
          - 'c:\program files (x86)\baidu\baidupinyin\\*\*'
    selection_5:
        TargetFileName:
          - '*\basicnetutils.dll'

    filter_6:
        TargetFileName:
          - 'c:\users\\*\appdata\local\temp\\*\windows\\*'
    selection_6:
        TargetFileName:
          - '*\unityplayer.dll'

    filter_7:
        TargetFileName:
          - 'c:\users\\*\appdata\local\temp\clnextor\pccnt\\*'
          - 'c:\program files\trend micro\security agent\*'
          - 'c:\program files (x86)\trend micro\security agent\*'
    selection_7:
        TargetFileName:
          - '*\tmdbg64.dll'

    filter_8:
        TargetFileName:
          - 'c:\users\\*\appdata\local\vivaldi\application\\*'
          - 'c:\users\\*\appdata\local\vivaldi\application\\*\\*'
          - 'c:\users\\*\appdata\local\programs\vivaldi\application\\*\\*'
    selection_8:
        TargetFileName:
          - '*\vivaldi_elf.dll'

    filter_9:
        TargetFileName:
          - 'c:\users\\*\appdata\local\razer\ingameengine\cache\rzfpsapplet\\*'
    selection_9:
        TargetFileName:
          - '*\rzlog4cpp_logger.dll'

    filter_10:
        TargetFileName:
          - 'c:\users\\*\appdata\local\rustdesk\\*'
          - 'c:\program files\rustdesk\*'
          - 'c:\program files (x86)\rustdesk\*'
    selection_10:
        TargetFileName:
          - '*\flutter_gpu_texture_renderer_plugin.dll'

    filter_11:
        TargetFileName:
          - 'c:\programdata\microsoft\windows defender\platform\\*\\*'
          - 'c:\program files\windows defender\\*\*'
          - 'c:\program files (x86)\windows defender\\*\*'
    selection_11:
        TargetFileName:
          - '*\mpsvc.dll'

    filter_12:
        TargetFileName:
          - 'c:\program files\*'
          - 'c:\program files (x86)\*'
    selection_12:
        TargetFileName:
          - '*\libsqlite3-0.dll'

    filter_13:
        TargetFileName:
          - 'c:\program files\aomei\aomei backupper\\*\*'
          - 'c:\program files (x86)\aomei\aomei backupper\\*\*'
    selection_13:
        TargetFileName:
          - '*\comn.dll'

    filter_14:
        TargetFileName:
          - 'c:\program files\asus\axsp\\*\*'
          - 'c:\program files (x86)\asus\axsp\\*\*'
    selection_14:
        TargetFileName:
          - '*\asio.dll'
          - '*\asus_wmi.dll'

    filter_15:
        TargetFileName:
          - 'c:\program files\asus\gpu tweakii\*'
          - 'c:\program files (x86)\asus\gpu tweakii\*'
          - 'c:\program files\asus\vga com\\*\*'
          - 'c:\program files (x86)\asus\vga com\\*\*'
    selection_15:
        TargetFileName:
          - '*\vender.dll'

    filter_16:
        TargetFileName:
          - 'c:\program files\avast software\avast\*'
          - 'c:\program files (x86)\avast software\avast\*'
          - 'c:\program files\norton\suite\*'
          - 'c:\program files (x86)\norton\suite\*'
          - 'c:\program files\avg\antivirus\*'
          - 'c:\program files (x86)\avg\antivirus\*'
    selection_16:
        TargetFileName:
          - '*\wsc.dll'

    filter_17:
        TargetFileName:
          - 'c:\program files\adobe\acrobat *\acrobat\*'
          - 'c:\program files (x86)\adobe\acrobat *\acrobat\*'
    selection_17:
        TargetFileName:
          - '*\acrodistdll.dll'

    filter_18:
        TargetFileName:
          - 'c:\program files\adobe\acrobat reader dc\reader\*'
          - 'c:\program files (x86)\adobe\acrobat reader dc\reader\*'
          - 'c:\program files\adobe\acrobat dc\acrobat\*'
          - 'c:\program files (x86)\adobe\acrobat dc\acrobat\*'
    selection_18:
        TargetFileName:
          - '*\sqlite.dll'

    filter_19:
        TargetFileName:
          - 'c:\program files\adobe\adobe photoshop cc *\*'
          - 'c:\program files (x86)\adobe\adobe photoshop cc *\*'
    selection_19:
        TargetFileName:
          - '*\tbb.dll'

    filter_20:
        TargetFileName:
          - 'c:\program files\ahnenblatt4\ahnenblatt4.exe\*'
          - 'c:\program files (x86)\ahnenblatt4\ahnenblatt4.exe\*'
    selection_20:
        TargetFileName:
          - '*\cc32290mt.dll'

    filter_21:
        TargetFileName:
          - 'c:\program files\anymp4 studio\anymp4 blu-ray creator\*'
          - 'c:\program files (x86)\anymp4 studio\anymp4 blu-ray creator\*'
    selection_21:
        TargetFileName:
          - '*\avdevice-54.dll'

    filter_22:
        TargetFileName:
          - 'c:\program files\anyviewer\*'
          - 'c:\program files (x86)\anyviewer\*'
    selection_22:
        TargetFileName:
          - '*\duilib_u.dll'

    filter_23:
        TargetFileName:
          - 'c:\program files\audacity\*'
          - 'c:\program files (x86)\audacity\*'
    selection_23:
        TargetFileName:
          - '*\wxmsw313u_aui_vc_custom.dll'

    filter_24:
        TargetFileName:
          - 'c:\program files\audacity\*'
          - 'c:\program files (x86)\audacity\*'
          - 'c:\program files\aomei\aomei backupper\\*\*'
          - 'c:\program files (x86)\aomei\aomei backupper\\*\*'
    selection_24:
        TargetFileName:
          - '*\qtgui4.dll'

    filter_25:
        TargetFileName:
          - 'c:\program files\bitdefender antivirus free\*'
          - 'c:\program files (x86)\bitdefender antivirus free\*'
          - 'c:\program files\bitdefender agent\\*\*'
          - 'c:\program files (x86)\bitdefender agent\\*\*'
          - 'c:\program files\bitdefender agent\\*\x64\*'
          - 'c:\program files (x86)\bitdefender agent\\*\x64\*'
          - 'c:\program files\bitdefender\bitdefender security\*'
          - 'c:\program files (x86)\bitdefender\bitdefender security\*'
          - 'c:\program files\bitdefender\bitdefender security app\*'
          - 'c:\program files (x86)\bitdefender\bitdefender security app\*'
    selection_25:
        TargetFileName:
          - '*\log.dll'

    filter_26:
        TargetFileName:
          - 'c:\program files\ccleaner\*'
          - 'c:\program files (x86)\ccleaner\*'
    selection_26:
        TargetFileName:
          - '*\ccleanerreactivator.dll'

    filter_27:
        TargetFileName:
          - 'c:\program files\calibre2\*'
          - 'c:\program files (x86)\calibre2\*'
    selection_27:
        TargetFileName:
          - '*\calibre-launcher.dll'

    filter_28:
        TargetFileName:
          - 'c:\program files\canon\canon ij printer assistant tool\\*'
          - 'c:\program files (x86)\canon\canon ij printer assistant tool\\*'
    selection_28:
        TargetFileName:
          - '*\cnmpaui.dll'

    filter_29:
        TargetFileName:
          - 'c:\program files\checkmal\appcheck\*'
          - 'c:\program files (x86)\checkmal\appcheck\*'
    selection_29:
        TargetFileName:
          - '*\mfc140u.dll'

    filter_30:
        TargetFileName:
          - 'c:\program files\cisco systems\cisco jabber\*'
          - 'c:\program files (x86)\cisco systems\cisco jabber\*'
          - 'c:\program files\webex\applications\*'
          - 'c:\program files (x86)\webex\applications\*'
          - 'c:\program files\webex\plugins\*'
          - 'c:\program files (x86)\webex\plugins\*'
    selection_30:
        TargetFileName:
          - '*\wcldll.dll'

    filter_31:
        TargetFileName:
          - 'c:\program files\classic shell\*'
          - 'c:\program files (x86)\classic shell\*'
          - 'c:\program files\open-shell\*'
          - 'c:\program files (x86)\open-shell\*'
    selection_31:
        TargetFileName:
          - '*\classicexplorer32.dll'

    filter_32:
        TargetFileName:
          - 'c:\program files\common files\apple\apple application support\*'
          - 'c:\program files (x86)\common files\apple\apple application support\*'
          - 'c:\program files\itunes\*'
          - 'c:\program files (x86)\itunes\*'
          - 'c:\windows\system32\\*'
    selection_32:
        TargetFileName:
          - '*\corefoundation.dll'

    filter_33:
        TargetFileName:
          - 'c:\program files\common files\microsoft shared\modi\11.0\*'
          - 'c:\program files (x86)\common files\microsoft shared\modi\11.0\*'
    selection_33:
        TargetFileName:
          - '*\mspgimme.dll'

    filter_34:
        TargetFileName:
          - 'c:\program files\common files\microsoft shared\notesync forms\*'
          - 'c:\program files (x86)\common files\microsoft shared\notesync forms\*'
    selection_34:
        TargetFileName:
          - '*\formdll.dll'

    filter_35:
        TargetFileName:
          - 'c:\program files\common files\thunder network\tp\\*\*'
          - 'c:\program files (x86)\common files\thunder network\tp\\*\*'
    selection_35:
        TargetFileName:
          - '*\atl71.dll'

    filter_36:
        TargetFileName:
          - 'c:\program files\common files\microsoft shared\clicktorun\*'
          - 'c:\program files (x86)\common files\microsoft shared\clicktorun\*'
          - 'c:\program files\common files\microsoft shared\clicktorun\updates\\*\*'
          - 'c:\program files (x86)\common files\microsoft shared\clicktorun\updates\\*\*'
          - 'c:\program files\microsoft office\root\client\*'
          - 'c:\program files (x86)\microsoft office\root\client\*'
          - 'c:\program files\microsoft office\root\office*\*'
          - 'c:\program files (x86)\microsoft office\root\office*\*'
          - 'c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office*\*'
          - 'c:\program files (x86)\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office*\*'
    selection_36:
        TargetFileName:
          - '*\appvisvsubsystems64.dll'

    filter_37:
        TargetFileName:
          - 'c:\program files\confer\scanner\upd.exe\*'
          - 'c:\program files (x86)\confer\scanner\upd.exe\*'
    selection_37:
        TargetFileName:
          - '*\avupdate.dll'

    filter_38:
        TargetFileName:
          - 'c:\program files\cyberark\endpoint privilege manager\agent\x32\*'
          - 'c:\program files (x86)\cyberark\endpoint privilege manager\agent\x32\*'
          - 'c:\program files\cyberark\endpoint privilege manager\agent\x64\*'
          - 'c:\program files (x86)\cyberark\endpoint privilege manager\agent\x64\*'
          - 'c:\program files\cyberark\endpoint privilege manager\agent\*'
          - 'c:\program files (x86)\cyberark\endpoint privilege manager\agent\*'
    selection_38:
        TargetFileName:
          - '*\vftrace.dll'

    filter_39:
        TargetFileName:
          - 'c:\program files\ds clock\*'
          - 'c:\program files (x86)\ds clock\*'
    selection_39:
        TargetFileName:
          - '*\zlibwapi.dll'

    filter_40:
        TargetFileName:
          - 'c:\program files\digiarty\winx blu-ray decrypter\*'
          - 'c:\program files (x86)\digiarty\winx blu-ray decrypter\*'
          - 'c:\windows\system32\\*'
    selection_40:
        TargetFileName:
          - '*\ci.dll'

    filter_41:
        TargetFileName:
          - 'c:\program files\dropbox\update\*'
          - 'c:\program files (x86)\dropbox\update\*'
          - 'c:\program files\dropbox\update\\*\*'
          - 'c:\program files (x86)\dropbox\update\\*\*'
          - 'c:\users\\*\appdata\local\dropboxupdate\update\\*'
    selection_41:
        TargetFileName:
          - '*\goopdate.dll'

    filter_42:
        TargetFileName:
          - 'c:\program files\dualsafe password manager\*'
          - 'c:\program files (x86)\dualsafe password manager\*'
    selection_42:
        TargetFileName:
          - '*\rtl120.dll'

    filter_43:
        TargetFileName:
          - 'c:\program files\electronic arts\ea desktop\ea desktop\*'
          - 'c:\program files (x86)\electronic arts\ea desktop\ea desktop\*'
    selection_43:
        TargetFileName:
          - '*\eacore.dll'

    filter_44:
        TargetFileName:
          - 'c:\program files\electronic arts\ea desktop\ea desktop\*'
          - 'c:\program files (x86)\electronic arts\ea desktop\ea desktop\*'
          - 'c:\program files\microsoft onedrive\\*\*'
          - 'c:\program files (x86)\microsoft onedrive\\*\*'
          - 'c:\users\\*\appdata\local\microsoft\onedrive\\*\\*'
          - 'c:\program files\dropbox\client\\*\*'
          - 'c:\program files (x86)\dropbox\client\\*\*'
          - 'c:\program files\logioptionsplus\*'
          - 'c:\program files (x86)\logioptionsplus\*'
    selection_44:
        TargetFileName:
          - '*\qt5core.dll'

    filter_45:
        TargetFileName:
          - 'c:\program files\epson software\document capture server\*'
          - 'c:\program files (x86)\epson software\document capture server\*'
          - 'c:\program files\epson software\event manager\*'
          - 'c:\program files (x86)\epson software\event manager\*'
    selection_45:
        TargetFileName:
          - '*\epnsm.dll'

    filter_46:
        TargetFileName:
          - 'c:\program files\f-secure\anti-virus\*'
          - 'c:\program files (x86)\f-secure\anti-virus\*'
    selection_46:
        TargetFileName:
          - '*\qrt.dll'

    filter_47:
        TargetFileName:
          - 'c:\program files\g data\totalsecurity\avkkid\*'
          - 'c:\program files (x86)\g data\totalsecurity\avkkid\*'
    selection_47:
        TargetFileName:
          - '*\avkkid.dll'

    filter_48:
        TargetFileName:
          - 'c:\program files\geekerpdf\geekerpdf\*'
          - 'c:\program files (x86)\geekerpdf\geekerpdf\*'
    selection_48:
        TargetFileName:
          - '*\amindpdfcore.dll'

    filter_49:
        TargetFileName:
          - 'c:\program files\hp\*'
          - 'c:\program files (x86)\hp\*'
    selection_49:
        TargetFileName:
          - '*\hpcustpartui.dll'
          - '*\hpqhvsei.dll'

    filter_50:
        TargetFileName:
          - 'c:\program files\haihaisoft pdf reader\*'
          - 'c:\program files (x86)\haihaisoft pdf reader\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_50:
        TargetFileName:
          - '*\msimg32.dll'

    filter_51:
        TargetFileName:
          - 'c:\program files\handy viewer\*'
          - 'c:\program files (x86)\handy viewer\*'
    selection_51:
        TargetFileName:
          - '*\iepdf32.dll'

    filter_52:
        TargetFileName:
          - 'c:\program files\icqlite\*'
          - 'c:\program files (x86)\icqlite\*'
    selection_52:
        TargetFileName:
          - '*\liteskinutils.dll'
          - '*\skinutils.dll'

    filter_53:
        TargetFileName:
          - 'c:\program files\iobit\driver booster\\*\*'
          - 'c:\program files (x86)\iobit\driver booster\\*\*'
    selection_53:
        TargetFileName:
          - '*\register.dll'

    filter_54:
        TargetFileName:
          - 'c:\program files\installshield\\*\system\*'
          - 'c:\program files (x86)\installshield\\*\system\*'
    selection_54:
        TargetFileName:
          - '*\fnp_act_installer.dll'

    filter_55:
        TargetFileName:
          - 'c:\program files\j river\media center *\*'
          - 'c:\program files (x86)\j river\media center *\*'
    selection_55:
        TargetFileName:
          - '*\jrtools.dll'

    filter_56:
        TargetFileName:
          - 'c:\program files\java\\*\bin\*'
          - 'c:\program files (x86)\java\\*\bin\*'
          - 'c:\program files\\*\jre\bin\*'
          - 'c:\program files (x86)\\*\jre\bin\*'
          - 'c:\users\\*\appdata\local\temp\\*\bin\\*'
    selection_56:
        TargetFileName:
          - '*\jli.dll'

    filter_57:
        TargetFileName:
          - 'c:\program files\keyscrambler\*'
          - 'c:\program files (x86)\keyscrambler\*'
    selection_57:
        TargetFileName:
          - '*\keyscramblerie.dll'

    filter_58:
        TargetFileName:
          - 'c:\program files\kingsoft\wps office\\*\office6\*'
          - 'c:\program files (x86)\kingsoft\wps office\\*\office6\*'
    selection_58:
        TargetFileName:
          - '*\krpt.dll'

    filter_59:
        TargetFileName:
          - 'c:\program files\lsoft technologies\active@ data studio\*'
          - 'c:\program files (x86)\lsoft technologies\active@ data studio\*'
          - 'c:\program files\lsoft technologies\active@ file recovery\*'
          - 'c:\program files (x86)\lsoft technologies\active@ file recovery\*'
          - 'c:\program files\lsoft technologies\active@ disk editor\*'
          - 'c:\program files (x86)\lsoft technologies\active@ disk editor\*'
          - 'c:\program files\lsoft technologies\active@ password changer\*'
          - 'c:\program files (x86)\lsoft technologies\active@ password changer\*'
          - 'c:\program files\lsoft technologies\active@ iso manager\*'
          - 'c:\program files (x86)\lsoft technologies\active@ iso manager\*'
          - 'c:\program files\lsoft technologies\active@ uneraser\*'
          - 'c:\program files (x86)\lsoft technologies\active@ uneraser\*'
          - 'c:\program files\lsoft technologies\active@ killdisk 25\*'
          - 'c:\program files (x86)\lsoft technologies\active@ killdisk 25\*'
          - 'c:\program files\lsoft technologies\active@ undelete\*'
          - 'c:\program files (x86)\lsoft technologies\active@ undelete\*'
          - 'c:\program files\lsoft technologies\active@ disk monitor\*'
          - 'c:\program files (x86)\lsoft technologies\active@ disk monitor\*'
          - 'c:\program files\lsoft technologies\active@ partition manager\*'
          - 'c:\program files (x86)\lsoft technologies\active@ partition manager\*'
    selection_59:
        TargetFileName:
          - '*\qt5network.dll'

    filter_60:
        TargetFileName:
          - 'c:\program files\lenovo\communications utility\*'
          - 'c:\program files (x86)\lenovo\communications utility\*'
    selection_60:
        TargetFileName:
          - '*\commfunc.dll'

    filter_61:
        TargetFileName:
          - 'c:\program files\logmein\*'
          - 'c:\program files (x86)\logmein\*'
          - 'c:\program files\logmein\x86\*'
          - 'c:\program files (x86)\logmein\x86\*'
          - 'c:\program files\logmein\x64\*'
          - 'c:\program files (x86)\logmein\x64\*'
    selection_61:
        TargetFileName:
          - '*\lmiguardiandll.dll'

    filter_62:
        TargetFileName:
          - 'c:\program files\mpc-hc\crashreporter\*'
          - 'c:\program files (x86)\mpc-hc\crashreporter\*'
    selection_62:
        TargetFileName:
          - '*\crashrpt.dll'

    filter_63:
        TargetFileName:
          - 'c:\program files\mcafee inc.\mcafee total protection 2009\*'
          - 'c:\program files (x86)\mcafee inc.\mcafee total protection 2009\*'
    selection_63:
        TargetFileName:
          - '*\mcutil.dll'

    filter_64:
        TargetFileName:
          - 'c:\program files\mcafee.com\vso\*'
          - 'c:\program files (x86)\mcafee.com\vso\*'
    selection_64:
        TargetFileName:
          - '*\ashldres.dll'

    filter_65:
        TargetFileName:
          - 'c:\program files\mcafee\virusscan enterprise\*'
          - 'c:\program files (x86)\mcafee\virusscan enterprise\*'
    selection_65:
        TargetFileName:
          - '*\lockdown.dll'
          - '*\vsodscpl.dll'

    filter_66:
        TargetFileName:
          - 'c:\program files\mediainfo\*'
          - 'c:\program files (x86)\mediainfo\*'
    selection_66:
        TargetFileName:
          - '*\mediainfo_i386.dll'

    filter_67:
        TargetFileName:
          - 'c:\program files\microsoft office\office*\*'
          - 'c:\program files (x86)\microsoft office\office*\*'
          - 'c:\program files\microsoft office\root\office*\*'
          - 'c:\program files (x86)\microsoft office\root\office*\*'
          - 'c:\program files\microsoft office *\clientx86\root\office*\*'
          - 'c:\program files (x86)\microsoft office *\clientx86\root\office*\*'
          - 'c:\program files\microsoft office *\clientx64\root\office*\*'
          - 'c:\program files (x86)\microsoft office *\clientx64\root\office*\*'
    selection_67:
        TargetFileName:
          - '*\outllib.dll'
          - '*\ppcore.dll'

    filter_68:
        TargetFileName:
          - 'c:\program files\microsoft sdks\windows\\*\bin\*'
          - 'c:\program files (x86)\microsoft sdks\windows\\*\bin\*'
    selection_68:
        TargetFileName:
          - '*\tedutil.dll'

    filter_69:
        TargetFileName:
          - 'c:\program files\microsoft visual studio 11.0\common7\tools\*'
          - 'c:\program files (x86)\microsoft visual studio 11.0\common7\tools\*'
    selection_69:
        TargetFileName:
          - '*\atltracetoolui.dll'

    filter_70:
        TargetFileName:
          - 'c:\program files\microsoft visual studio\\*\community\common7\ide\vc\vcpackages\*'
          - 'c:\program files (x86)\microsoft visual studio\\*\community\common7\ide\vc\vcpackages\*'
          - 'c:\program files\microsoft visual studio\\*\buildtools\common7\ide\vc\vcpackages\*'
          - 'c:\program files (x86)\microsoft visual studio\\*\buildtools\common7\ide\vc\vcpackages\*'
          - 'c:\program files\microsoft visual studio\\*\buildtools\common7\ide\*'
          - 'c:\program files (x86)\microsoft visual studio\\*\buildtools\common7\ide\*'
          - 'c:\program files\microsoft intune management extension\*'
          - 'c:\program files (x86)\microsoft intune management extension\*'
          - 'c:\program files\microsoft\edge\application\\*\*'
          - 'c:\program files (x86)\microsoft\edge\application\\*\*'
          - 'c:\program files\microsoft\edgewebview\application\\*\*'
          - 'c:\program files (x86)\microsoft\edgewebview\application\\*\*'
          - 'c:\program files\microsoft\edgewebview\application\\*\*'
          - 'c:\program files (x86)\microsoft\edgewebview\application\\*\*'
          - 'c:\program files\microsoft rdinfra\rdmonitoringagent_*\agent\*'
          - 'c:\program files (x86)\microsoft rdinfra\rdmonitoringagent_*\agent\*'
          - 'c:\program files\windowsapps\microsoft.vclibs.*\*'
          - 'c:\program files (x86)\windowsapps\microsoft.vclibs.*\*'
          - 'c:\program files\windowsapps\microsoft.outlookforwindows_*\*'
          - 'c:\program files (x86)\windowsapps\microsoft.outlookforwindows_*\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_70:
        TargetFileName:
          - '*\concrt140.dll'

    filter_71:
        TargetFileName:
          - 'c:\program files\microsoft\edgeupdate\\*\*'
          - 'c:\program files (x86)\microsoft\edgeupdate\\*\*'
          - 'c:\program files\microsoft\temp\\*\*'
          - 'c:\program files (x86)\microsoft\temp\\*\*'
          - 'c:\users\\*\appdata\local\microsoft\edgeupdate\\*\\*'
    selection_71:
        TargetFileName:
          - '*\msedgeupdate.dll'

    filter_72:
        TargetFileName:
          - 'c:\program files\microsoft\edge\application\\*\*'
          - 'c:\program files (x86)\microsoft\edge\application\\*\*'
          - 'c:\program files\microsoft\edgecore\\*\*'
          - 'c:\program files (x86)\microsoft\edgecore\\*\*'
          - 'c:\program files\microsoft\edgewebview\\*\*'
          - 'c:\program files (x86)\microsoft\edgewebview\\*\*'
    selection_72:
        TargetFileName:
          - '*\msedge_elf.dll'

    filter_73:
        TargetFileName:
          - 'c:\program files\microsoft\edge\application\\*\*'
          - 'c:\program files (x86)\microsoft\edge\application\\*\*'
          - 'c:\program files\microsoft\edgewebview\application\\*\*'
          - 'c:\program files (x86)\microsoft\edgewebview\application\\*\*'
          - 'c:\program files\microsoft\edgecore\\*\*'
          - 'c:\program files (x86)\microsoft\edgecore\\*\*'
    selection_73:
        TargetFileName:
          - '*\msedge.dll'

    filter_74:
        TargetFileName:
          - 'c:\program files\mobatek\mobaxterm personal edition\*'
          - 'c:\program files (x86)\mobatek\mobaxterm personal edition\*'
          - 'c:\program files\mobatek\mobaxterm\*'
          - 'c:\program files (x86)\mobatek\mobaxterm\*'
    selection_74:
        TargetFileName:
          - '*\libxfont-1.dll'

    filter_75:
        TargetFileName:
          - 'c:\program files\multimedia\k-lite codec pack\filters\madvr\*'
          - 'c:\program files (x86)\multimedia\k-lite codec pack\filters\madvr\*'
          - 'c:\program files\k-lite codec pack\filters\madvr\*'
          - 'c:\program files (x86)\k-lite codec pack\filters\madvr\*'
    selection_75:
        TargetFileName:
          - '*\madhcnet32.dll'

    filter_76:
        TargetFileName:
          - 'c:\program files\nvidia corporation\display\*'
          - 'c:\program files (x86)\nvidia corporation\display\*'
    selection_76:
        TargetFileName:
          - '*\nvsmartmax.dll'

    filter_77:
        TargetFileName:
          - 'c:\program files\nvidia corporation\nvidia geforce experience\*'
          - 'c:\program files (x86)\nvidia corporation\nvidia geforce experience\*'
    selection_77:
        TargetFileName:
          - '*\libcef.dll'

    filter_78:
        TargetFileName:
          - 'c:\program files\networx\*'
          - 'c:\program files (x86)\networx\*'
    selection_78:
        TargetFileName:
          - '*\sqlite.dll'

    filter_79:
        TargetFileName:
          - 'c:\program files\nitro\pdf pro\\*'
          - 'c:\program files (x86)\nitro\pdf pro\\*'
          - 'c:\program files\nitro\pro\*'
          - 'c:\program files (x86)\nitro\pro\*'
    selection_79:
        TargetFileName:
          - '*\bugsplat64.dll'

    filter_80:
        TargetFileName:
          - 'c:\program files\notepad++\plugins\*'
          - 'c:\program files (x86)\notepad++\plugins\*'
          - 'c:\program files\notepad++\plugins\mimetools\*'
          - 'c:\program files (x86)\notepad++\plugins\mimetools\*'
    selection_80:
        TargetFileName:
          - '*\mimetools.dll'

    filter_81:
        TargetFileName:
          - 'c:\program files\notepad++\updater\*'
          - 'c:\program files (x86)\notepad++\updater\*'
          - 'c:\program files\windowsapps\msteams_*\*'
          - 'c:\program files (x86)\windowsapps\msteams_*\*'
          - 'c:\program files\coolmuster\coolmuster pdf creator pro\\*\bin\*'
          - 'c:\program files (x86)\coolmuster\coolmuster pdf creator pro\\*\bin\*'
    selection_81:
        TargetFileName:
          - '*\libcurl.dll'

    filter_82:
        TargetFileName:
          - 'c:\program files\oracle\virtualbox\*'
          - 'c:\program files (x86)\oracle\virtualbox\*'
    selection_82:
        TargetFileName:
          - '*\qtcorevbox4.dll'
          - '*\vboxrt.dll'

    filter_83:
        TargetFileName:
          - 'c:\program files\pde\*'
          - 'c:\program files (x86)\pde\*'
    selection_83:
        TargetFileName:
          - '*\tutil32.dll'

    filter_84:
        TargetFileName:
          - 'c:\program files\pspad editor\*'
          - 'c:\program files (x86)\pspad editor\*'
    selection_84:
        TargetFileName:
          - '*\libeay32.dll'

    filter_85:
        TargetFileName:
          - 'c:\program files\palo alto networks\traps\*'
          - 'c:\program files (x86)\palo alto networks\traps\*'
    selection_85:
        TargetFileName:
          - '*\winutils.dll'

    filter_86:
        TargetFileName:
          - 'c:\program files\python310\*'
          - 'c:\program files (x86)\python310\*'
          - 'c:\users\\*\appdata\local\temp\\*\\*'
          - 'c:\program files\dwagent\runtime\*'
          - 'c:\program files (x86)\dwagent\runtime\*'
          - '%userprofile%\anaconda3\\*'
    selection_86:
        TargetFileName:
          - '*\python310.dll'

    filter_87:
        TargetFileName:
          - 'c:\program files\python311\*'
          - 'c:\program files (x86)\python311\*'
          - 'c:\users\\*\appdata\local\programs\python\python311\\*'
    selection_87:
        TargetFileName:
          - '*\python311.dll'

    filter_88:
        TargetFileName:
          - 'c:\program files\python39\*'
          - 'c:\program files (x86)\python39\*'
          - 'c:\users\\*\appdata\local\temp\\*\\*'
          - 'c:\program files\microsoft visual studio\2022\community\common7\ide\commonextensions\microsoft\vc\securityissueanalysis\python\*'
          - 'c:\program files (x86)\microsoft visual studio\2022\community\common7\ide\commonextensions\microsoft\vc\securityissueanalysis\python\*'
          - '%userprofile%\anaconda3\\*'
    selection_88:
        TargetFileName:
          - '*\python39.dll'

    filter_89:
        TargetFileName:
          - 'c:\program files\replay media splitter\*'
          - 'c:\program files (x86)\replay media splitter\*'
    selection_89:
        TargetFileName:
          - '*\asfbncor.dll'

    filter_90:
        TargetFileName:
          - 'c:\program files\sql developer\ide\bin\*'
          - 'c:\program files (x86)\sql developer\ide\bin\*'
          - 'c:\program files\sqldeveloper\ide\bin\*'
          - 'c:\program files (x86)\sqldeveloper\ide\bin\*'
    selection_90:
        TargetFileName:
          - '*\launcher.dll'

    filter_91:
        TargetFileName:
          - 'c:\program files\sangfor\ssl\remoteappclient\\*'
          - 'c:\program files (x86)\sangfor\ssl\remoteappclient\\*'
    selection_91:
        TargetFileName:
          - '*\libngs.dll'

    filter_92:
        TargetFileName:
          - 'c:\program files\seamonkey\*'
          - 'c:\program files (x86)\seamonkey\*'
          - 'c:\program files\mozilla firefox\*'
          - 'c:\program files (x86)\mozilla firefox\*'
          - 'c:\program files\mozilla thunderbird\*'
          - 'c:\program files (x86)\mozilla thunderbird\*'
    selection_92:
        TargetFileName:
          - '*\mozglue.dll'

    filter_93:
        TargetFileName:
          - 'c:\program files\sentinelone\sentinel agent *\*'
          - 'c:\program files (x86)\sentinelone\sentinel agent *\*'
    selection_93:
        TargetFileName:
          - '*\sentinelagentcore.dll'

    filter_94:
        TargetFileName:
          - 'c:\program files\siber systems\ai roboform\*'
          - 'c:\program files (x86)\siber systems\ai roboform\*'
    selection_94:
        TargetFileName:
          - '*\roboform.dll'

    filter_95:
        TargetFileName:
          - 'c:\program files\siber systems\ai roboform\\*\*'
          - 'c:\program files (x86)\siber systems\ai roboform\\*\*'
    selection_95:
        TargetFileName:
          - '*\roboform-x64.dll'

    filter_96:
        TargetFileName:
          - 'c:\program files\siteadvisor\\*\*'
          - 'c:\program files (x86)\siteadvisor\\*\*'
    selection_96:
        TargetFileName:
          - '*\siteadv.dll'

    filter_97:
        TargetFileName:
          - 'c:\program files\smadav\*'
          - 'c:\program files (x86)\smadav\*'
    selection_97:
        TargetFileName:
          - '*\smadhook32c.dll'

    filter_98:
        TargetFileName:
          - 'c:\program files\sophos\sophos anti-virus\*'
          - 'c:\program files (x86)\sophos\sophos anti-virus\*'
    selection_98:
        TargetFileName:
          - '*\safestore32.dll'

    filter_99:
        TargetFileName:
          - 'c:\program files\soundpad\*'
          - 'c:\program files (x86)\soundpad\*'
    selection_99:
        TargetFileName:
          - '*\tts.dll'

    filter_100:
        TargetFileName:
          - 'c:\program files\steam\*'
          - 'c:\program files (x86)\steam\*'
    selection_100:
        TargetFileName:
          - '*\crashhandler.dll'
          - '*\vstdlib_s64.dll'

    filter_101:
        TargetFileName:
          - 'c:\program files\symantec\network connected devices auto setup\*'
          - 'c:\program files (x86)\symantec\network connected devices auto setup\*'
          - 'c:\windows\system32\\*'
    selection_101:
        TargetFileName:
          - '*\rastls.dll'

    filter_102:
        TargetFileName:
          - 'c:\program files\symantec_client_security\symantec antivirus\*'
          - 'c:\program files (x86)\symantec_client_security\symantec antivirus\*'
          - 'c:\program files\symantec antivirus\*'
          - 'c:\program files (x86)\symantec antivirus\*'
    selection_102:
        TargetFileName:
          - '*\ldvpocx.ocx'

    filter_103:
        TargetFileName:
          - 'c:\program files\techsmith\camtasia studio 8\*'
          - 'c:\program files (x86)\techsmith\camtasia studio 8\*'
    selection_103:
        TargetFileName:
          - '*\mfcu100u.dll'

    filter_104:
        TargetFileName:
          - 'c:\program files\tivo\desktop\*'
          - 'c:\program files (x86)\tivo\desktop\*'
    selection_104:
        TargetFileName:
          - '*\cc3260mt.dll'

    filter_105:
        TargetFileName:
          - 'c:\program files\toshiba\bluetooth toshiba stack\*'
          - 'c:\program files (x86)\toshiba\bluetooth toshiba stack\*'
    selection_105:
        TargetFileName:
          - '*\tosbtkbd.dll'

    filter_106:
        TargetFileName:
          - 'c:\program files\trend micro\titanium\*'
          - 'c:\program files (x86)\trend micro\titanium\*'
    selection_106:
        TargetFileName:
          - '*\tmdbglog.dll'

    filter_107:
        TargetFileName:
          - 'c:\program files\true burner\*'
          - 'c:\program files (x86)\true burner\*'
    selection_107:
        TargetFileName:
          - '*\badata_x64.dll'

    filter_108:
        TargetFileName:
          - 'c:\program files\vmware\vmware tools\*'
          - 'c:\program files (x86)\vmware\vmware tools\*'
          - 'c:\program files\common files\thinprint\*'
          - 'c:\program files (x86)\common files\thinprint\*'
    selection_108:
        TargetFileName:
          - '*\tpsvc.dll'

    filter_109:
        TargetFileName:
          - 'c:\program files\vmware\vmware tools\*'
          - 'c:\program files (x86)\vmware\vmware tools\*'
          - 'c:\program files\vmware\vmware workstation\*'
          - 'c:\program files (x86)\vmware\vmware workstation\*'
          - 'c:\program files\vmware\vmware player\*'
          - 'c:\program files (x86)\vmware\vmware player\*'
    selection_109:
        TargetFileName:
          - '*\glib-2.0.dll'
          - '*\vmtools.dll'

    filter_110:
        TargetFileName:
          - 'c:\program files\vso\convertx\7\*'
          - 'c:\program files (x86)\vso\convertx\7\*'
          - 'c:\program files\vso\convertxtodvd\*'
          - 'c:\program files (x86)\vso\convertxtodvd\*'
          - 'c:\program files\common files\oracle\java\javapath\*'
          - 'c:\program files (x86)\common files\oracle\java\javapath\*'
    selection_110:
        TargetFileName:
          - '*\avutil.dll'

    filter_111:
        TargetFileName:
          - 'c:\program files\venta\ventafax & voice\*'
          - 'c:\program files (x86)\venta\ventafax & voice\*'
    selection_111:
        TargetFileName:
          - '*\vntfxf32.dll'

    filter_112:
        TargetFileName:
          - 'c:\program files\videolan\vlc\*'
          - 'c:\program files (x86)\videolan\vlc\*'
    selection_112:
        TargetFileName:
          - '*\libvlc.dll'
          - '*\libvlccore.dll'

    filter_113:
        TargetFileName:
          - 'c:\program files\windows defender\*'
          - 'c:\program files (x86)\windows defender\*'
          - 'c:\programdata\microsoft\windows defender\platform\\*\\*'
    selection_113:
        TargetFileName:
          - '*\mpclient.dll'

    filter_114:
        TargetFileName:
          - 'c:\program files\windows defender advanced threat protection\classification\*'
          - 'c:\program files (x86)\windows defender advanced threat protection\classification\*'
          - 'c:\windows\system32\mrt\\*\\*'
    selection_114:
        TargetFileName:
          - '*\mpgear.dll'

    filter_115:
        TargetFileName:
          - 'c:\program files\windows kits\\*\debuggers\x86\*'
          - 'c:\program files (x86)\windows kits\\*\debuggers\x86\*'
          - 'c:\program files\windows kits\\*\debuggers\x64\*'
          - 'c:\program files (x86)\windows kits\\*\debuggers\x64\*'
          - 'c:\program files\windows kits\\*\debuggers\arm\*'
          - 'c:\program files (x86)\windows kits\\*\debuggers\arm\*'
          - 'c:\program files\windows kits\\*\debuggers\arm64\*'
          - 'c:\program files (x86)\windows kits\\*\debuggers\arm64\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_115:
        TargetFileName:
          - '*\dbgeng.dll'

    filter_116:
        TargetFileName:
          - 'c:\program files\windows kits\\*\bin\\*\x64\mdmerge.exe\*'
          - 'c:\program files (x86)\windows kits\\*\bin\\*\x64\mdmerge.exe\*'
          - 'c:\program files\windows kits\\*\bin\\*\x86\mdmerge.exe\*'
          - 'c:\program files (x86)\windows kits\\*\bin\\*\x86\mdmerge.exe\*'
    selection_116:
        TargetFileName:
          - '*\midlrtmd.dll'

    filter_117:
        TargetFileName:
          - 'c:\program files\windows kits\10\debuggers\\*\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\\*\*'
    selection_117:
        TargetFileName:
          - '*\gflagsui.dll'
          - '*\symsrv.dll'

    filter_118:
        TargetFileName:
          - 'c:\program files\windows kits\10\windows performance toolkit\*'
          - 'c:\program files (x86)\windows kits\10\windows performance toolkit\*'
    selection_118:
        TargetFileName:
          - '*\windowsperformancerecorderui.dll'

    filter_119:
        TargetFileName:
          - 'c:\program files\windows kits\10\bin\\*\\*\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\\*\*'
    selection_119:
        TargetFileName:
          - '*\rcdll.dll'

    filter_120:
        TargetFileName:
          - 'c:\program files\windows kits\10\bin\\*\x86\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\x86\*'
          - 'c:\program files\windows kits\10\bin\\*\x64\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\x64\*'
          - 'c:\program files\windows kits\10\bin\\*\arm\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\arm\*'
          - 'c:\program files\windows kits\10\bin\\*\arm64\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\arm64\*'
    selection_120:
        TargetFileName:
          - '*\iviewers.dll'

    filter_121:
        TargetFileName:
          - 'c:\program files\windowsapps\microsoft.desktopappinstaller_*_x64__8wekyb3d8bbwe\*'
          - 'c:\program files (x86)\windowsapps\microsoft.desktopappinstaller_*_x64__8wekyb3d8bbwe\*'
    selection_121:
        TargetFileName:
          - '*\libsmartscreenn.dll'

    filter_122:
        TargetFileName:
          - 'c:\program files\wireshark\*'
          - 'c:\program files (x86)\wireshark\*'
    selection_122:
        TargetFileName:
          - '*\libglib-2.0-0.dll'
          - '*\libwsutil.dll'

    filter_123:
        TargetFileName:
          - 'c:\program files\audinate\shared files\*'
          - 'c:\program files (x86)\audinate\shared files\*'
    selection_123:
        TargetFileName:
          - '*\dal_keepalives.dll'

    filter_124:
        TargetFileName:
          - 'c:\program files\itop screen recorder\*'
          - 'c:\program files (x86)\itop screen recorder\*'
    selection_124:
        TargetFileName:
          - '*\webui.dll'

    filter_125:
        TargetFileName:
          - 'c:\program files\iroot\*'
          - 'c:\program files (x86)\iroot\*'
    selection_125:
        TargetFileName:
          - '*\common.dll'

    filter_126:
        TargetFileName:
          - 'c:\program files\luxand\facesdk\bin\win64\*'
          - 'c:\program files (x86)\luxand\facesdk\bin\win64\*'
    selection_126:
        TargetFileName:
          - '*\facesdk.dll'

    filter_127:
        TargetFileName:
          - 'c:\program files\msn messenger\*'
          - 'c:\program files (x86)\msn messenger\*'
    selection_127:
        TargetFileName:
          - '*\msidcrl40.dll'

    filter_128:
        TargetFileName:
          - 'c:\program files\windows kits\\*\bin\\*\*'
          - 'c:\program files (x86)\windows kits\\*\bin\\*\*'
    selection_128:
        TargetFileName:
          - '*\wmicodegen.dll'

    filter_129:
        TargetFileName:
          - 'c:\program files\windows kits\10\bin\\*\x64\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\x64\*'
          - 'c:\program files\windows kits\10\bin\\*\x86\*'
          - 'c:\program files (x86)\windows kits\10\bin\\*\x86\*'
          - 'c:\program files\windows kits\10\redist\d3d\x64\*'
          - 'c:\program files (x86)\windows kits\10\redist\d3d\x64\*'
          - 'c:\program files\windows kits\10\redist\d3d\x86\*'
          - 'c:\program files (x86)\windows kits\10\redist\d3d\x86\*'
          - 'c:\program files\wireshark\*'
          - 'c:\program files (x86)\wireshark\*'
          - 'c:\program files\logioptionsplus\*'
          - 'c:\program files (x86)\logioptionsplus\*'
          - 'c:\program files\cisco systems\cisco jabber\*'
          - 'c:\program files (x86)\cisco systems\cisco jabber\*'
          - 'c:\program files\microsoft\edge\application\\*\*'
          - 'c:\program files (x86)\microsoft\edge\application\\*\*'
          - 'c:\program files\microsoft\edgewebview\application\\*\*'
          - 'c:\program files (x86)\microsoft\edgewebview\application\\*\*'
          - 'c:\program files\microsoft\edgecore\application\\*\*'
          - 'c:\program files (x86)\microsoft\edgecore\application\\*\*'
          - 'c:\program files\google\chrome\application\\*\*'
          - 'c:\program files (x86)\google\chrome\application\\*\*'
          - 'c:\program files\island\island\application\\*\*'
          - 'c:\program files (x86)\island\island\application\\*\*'
          - 'c:\program files\zoom\bin\*'
          - 'c:\program files (x86)\zoom\bin\*'
          - 'c:\users\\*\appdata\roaming\zoom\bin\\*'
          - 'c:\users\\*\appdata\local\microsoft\teams\stage\\*'
          - 'c:\users\\*\appdata\local\programs\microsoft vs code\\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_129:
        TargetFileName:
          - '*\d3dcompiler_47.dll'

    filter_130:
        TargetFileName:
          - 'c:\program files\windows kits\10\debuggers\arm\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm\*'
          - 'c:\program files\windows kits\10\debuggers\arm\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm\srcsrv\*'
          - 'c:\program files\windows kits\10\debuggers\arm64\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm64\*'
          - 'c:\program files\windows kits\10\debuggers\arm64\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm64\srcsrv\*'
          - 'c:\program files\windows kits\10\debuggers\x64\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x64\*'
          - 'c:\program files\windows kits\10\debuggers\x64\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x64\srcsrv\*'
          - 'c:\program files\windows kits\10\debuggers\x86\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x86\*'
          - 'c:\program files\windows kits\10\debuggers\x86\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x86\srcsrv\*'
          - 'c:\program files\cisco systems\cisco jabber\*'
          - 'c:\program files (x86)\cisco systems\cisco jabber\*'
          - 'c:\program files\microsoft office\root\office*\*'
          - 'c:\program files (x86)\microsoft office\root\office*\*'
          - 'c:\program files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140\*'
          - 'c:\program files (x86)\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_130:
        TargetFileName:
          - '*\dbghelp.dll'

    filter_131:
        TargetFileName:
          - 'c:\program files\windows kits\10\debuggers\arm\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm\*'
          - 'c:\program files\windows kits\10\debuggers\arm\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm\srcsrv\*'
          - 'c:\program files\windows kits\10\debuggers\arm64\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm64\*'
          - 'c:\program files\windows kits\10\debuggers\arm64\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\arm64\srcsrv\*'
          - 'c:\program files\windows kits\10\debuggers\x64\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x64\*'
          - 'c:\program files\windows kits\10\debuggers\x64\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x64\srcsrv\*'
          - 'c:\program files\windows kits\10\debuggers\x86\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x86\*'
          - 'c:\program files\windows kits\10\debuggers\x86\srcsrv\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\x86\srcsrv\*'
          - 'c:\program files\microsoft office\root\office*\*'
          - 'c:\program files (x86)\microsoft office\root\office*\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_131:
        TargetFileName:
          - '*\dbgcore.dll'

    filter_132:
        TargetFileName:
          - 'c:\program files\windows kits\10\windows performance toolkit\*'
          - 'c:\program files (x86)\windows kits\10\windows performance toolkit\*'
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_132:
        TargetFileName:
          - '*\windowsperformancerecordercontrol.dll'

    filter_133:
        TargetFileName:
          - 'c:\program files\windows live\installer\*'
          - 'c:\program files (x86)\windows live\installer\*'
    selection_133:
        TargetFileName:
          - '*\uxcore.dll'

    filter_134:
        TargetFileName:
          - 'c:\windows\system32\\*'
    selection_134:
        TargetFileName:
          - '*\bderepair.dll'
          - '*\bootmenuux.dll'
          - '*\bootux.dll'
          - '*\configmanager2.dll'
          - '*\coredplus.dll'
          - '*\dcntel.dll'
          - '*\dmenterprisediagnostics.dll'
          - '*\dwmcore.dll'
          - '*\dynamoapi.dll'
          - '*\fhsvcctl.dll'
          - '*\fveskybackup.dll'
          - '*\fvewiz.dll'
          - '*\fxsst.dll'
          - '*\inproclogger.dll'
          - '*\iumbase.dll'
          - '*\iumsdk.dll'
          - '*\kdstub.dll'
          - '*\lockhostingframework.dll'
          - '*\lrwizdll.dll'
          - '*\maintenanceui.dll'
          - '*\mbaexmlparser.dll'
          - '*\mdmdiagnostics.dll'
          - '*\mintdh.dll'
          - '*\msdtctm.dll'
          - '*\osksupport.dll'
          - '*\pkeyhelper.dll'
          - '*\proximityservicepal.dll'
          - '*\reseteng.dll'
          - '*\resetengine.dll'
          - '*\spectrumsyncclient.dll'
          - '*\srcore.dll'
          - '*\systemsettingsthresholdadminflowui.dll'
          - '*\timesync.dll'
          - '*\unattend.dll'
          - '*\upshared.dll'
          - '*\vcruntime140.dll'
          - '*\wcnnetsh.dll'
          - '*\winmde.dll'
          - '*\wmpdui.dll'

    filter_135:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\program files\common files\microsoft shared\clicktorun\*'
          - 'c:\program files (x86)\common files\microsoft shared\clicktorun\*'
    selection_135:
        TargetFileName:
          - '*\appvpolicy.dll'

    filter_136:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\system32\driverstore\filerepository\prnms002.inf_*\amd64\\*'
    selection_136:
        TargetFileName:
          - '*\fxstiff.dll'

    filter_137:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\system32\driverstore\filerepository\prnms002.inf_*\amd64\\*'
          - 'c:\windows\syswow64\\*'
    selection_137:
        TargetFileName:
          - '*\fxsapi.dll'

    filter_138:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
    selection_138:
        TargetFileName:
          - '*\shfolder.dll'
          - '*\aclui.dll'
          - '*\activeds.dll'
          - '*\adsldpc.dll'
          - '*\aepic.dll'
          - '*\apphelp.dll'
          - '*\applicationframe.dll'
          - '*\appwiz.cpl'
          - '*\appxalluserstore.dll'
          - '*\appxdeploymentclient.dll'
          - '*\archiveint.dll'
          - '*\atl.dll'
          - '*\audioses.dll'
          - '*\auditpolcore.dll'
          - '*\authfwcfg.dll'
          - '*\authz.dll'
          - '*\avrt.dll'
          - '*\batmeter.dll'
          - '*\bcd.dll'
          - '*\bcp47langs.dll'
          - '*\bcp47mrm.dll'
          - '*\bcrypt.dll'
          - '*\cabinet.dll'
          - '*\cabview.dll'
          - '*\certcli.dll'
          - '*\certenroll.dll'
          - '*\cfgmgr32.dll'
          - '*\cldapi.dll'
          - '*\clipc.dll'
          - '*\clusapi.dll'
          - '*\cmpbk32.dll'
          - '*\cmutil.dll'
          - '*\coloradapterclient.dll'
          - '*\colorui.dll'
          - '*\comdlg32.dll'
          - '*\connect.dll'
          - '*\coremessaging.dll'
          - '*\coreuicomponents.dll'
          - '*\credui.dll'
          - '*\cryptbase.dll'
          - '*\cryptdll.dll'
          - '*\cryptnet.dll'
          - '*\cryptsp.dll'
          - '*\cryptui.dll'
          - '*\cryptxml.dll'
          - '*\cscapi.dll'
          - '*\cscobj.dll'
          - '*\cscui.dll'
          - '*\d2d1.dll'
          - '*\d3d10.dll'
          - '*\d3d10_1.dll'
          - '*\d3d10_1core.dll'
          - '*\d3d10core.dll'
          - '*\d3d10warp.dll'
          - '*\d3d11.dll'
          - '*\d3d12.dll'
          - '*\d3d9.dll'
          - '*\d3dx9_43.dll'
          - '*\dataexchange.dll'
          - '*\davclnt.dll'
          - '*\dcomp.dll'
          - '*\defragproxy.dll'
          - '*\desktopshellext.dll'
          - '*\deviceassociation.dll'
          - '*\devicecredential.dll'
          - '*\devicepairing.dll'
          - '*\devobj.dll'
          - '*\devrtl.dll'
          - '*\dhcpcmonitor.dll'
          - '*\dhcpcsvc.dll'
          - '*\dhcpcsvc6.dll'
          - '*\directmanipulation.dll'
          - '*\dismapi.dll'
          - '*\dmcfgutils.dll'
          - '*\dmcmnutils.dll'
          - '*\dmcommandlineutils.dll'
          - '*\dmenrollengine.dll'
          - '*\dmiso8601utils.dll'
          - '*\dmoleaututils.dll'
          - '*\dmprocessxmlfiltered.dll'
          - '*\dmpushproxy.dll'
          - '*\dmxmlhelputils.dll'
          - '*\dnsapi.dll'
          - '*\dot3api.dll'
          - '*\dot3cfg.dll'
          - '*\dpx.dll'
          - '*\drprov.dll'
          - '*\drvstore.dll'
          - '*\dsclient.dll'
          - '*\dsparse.dll'
          - '*\dsprop.dll'
          - '*\dsreg.dll'
          - '*\dsrole.dll'
          - '*\dui70.dll'
          - '*\duser.dll'
          - '*\dusmapi.dll'
          - '*\dwmapi.dll'
          - '*\dwrite.dll'
          - '*\dxcore.dll'
          - '*\dxgi.dll'
          - '*\dxva2.dll'
          - '*\eappcfg.dll'
          - '*\eappprxy.dll'
          - '*\edgeiso.dll'
          - '*\edputil.dll'
          - '*\efsadu.dll'
          - '*\efsutil.dll'
          - '*\esent.dll'
          - '*\execmodelproxy.dll'
          - '*\explorerframe.dll'
          - '*\faultrep.dll'
          - '*\fddevquery.dll'
          - '*\feclient.dll'
          - '*\fhcfg.dll'
          - '*\firewallapi.dll'
          - '*\flightsettings.dll'
          - '*\fltlib.dll'
          - '*\framedynos.dll'
          - '*\fveapi.dll'
          - '*\fwbase.dll'
          - '*\fwcfg.dll'
          - '*\fwpolicyiomgr.dll'
          - '*\fwpuclnt.dll'
          - '*\getuname.dll'
          - '*\gpapi.dll'
          - '*\hid.dll'
          - '*\hnetmon.dll'
          - '*\httpapi.dll'
          - '*\icmp.dll'
          - '*\idstore.dll'
          - '*\ieadvpack.dll'
          - '*\iedkcs32.dll'
          - '*\iernonce.dll'
          - '*\iertutil.dll'
          - '*\ifmon.dll'
          - '*\ifsutil.dll'
          - '*\iphlpapi.dll'
          - '*\iri.dll'
          - '*\iscsidsc.dll'
          - '*\iscsiexe.dll'
          - '*\iscsium.dll'
          - '*\isv.exe_rsaenh.dll'
          - '*\joinutil.dll'
          - '*\ksuser.dll'
          - '*\ktmw32.dll'
          - '*\licensemanagerapi.dll'
          - '*\licensingdiagspp.dll'
          - '*\linkinfo.dll'
          - '*\loadperf.dll'
          - '*\logoncli.dll'
          - '*\logoncontroller.dll'
          - '*\lpksetupproxyserv.dll'
          - '*\magnification.dll'
          - '*\mapistub.dll'
          - '*\mfc42u.dll'
          - '*\mfcore.dll'
          - '*\mfplat.dll'
          - '*\mi.dll'
          - '*\midimap.dll'
          - '*\miutils.dll'
          - '*\mlang.dll'
          - '*\mmdevapi.dll'
          - '*\mobilenetworking.dll'
          - '*\mpr.dll'
          - '*\mprapi.dll'
          - '*\mrmcorer.dll'
          - '*\msacm32.dll'
          - '*\msasn1.dll'
          - '*\mscms.dll'
          - '*\mscoree.dll'
          - '*\msctf.dll'
          - '*\msctfmonitor.dll'
          - '*\msdrm.dll'
          - '*\msftedit.dll'
          - '*\msi.dll'
          - '*\msiso.dll'
          - '*\msutb.dll'
          - '*\msvcp110_win.dll'
          - '*\msvcr100.dll'
          - '*\mswb7.dll'
          - '*\mswsock.dll'
          - '*\msxml3.dll'
          - '*\mtxclu.dll'
          - '*\napinsp.dll'
          - '*\ncrypt.dll'
          - '*\ndfapi.dll'
          - '*\netapi32.dll'
          - '*\netid.dll'
          - '*\netiohlp.dll'
          - '*\netjoin.dll'
          - '*\netplwiz.dll'
          - '*\netprofm.dll'
          - '*\netprovfw.dll'
          - '*\netsetupapi.dll'
          - '*\netshell.dll'
          - '*\nettrace.dll'
          - '*\netutils.dll'
          - '*\networkexplorer.dll'
          - '*\newdev.dll'
          - '*\ninput.dll'
          - '*\nlaapi.dll'
          - '*\nlansp_c.dll'
          - '*\npmproxy.dll'
          - '*\nshhttp.dll'
          - '*\nshipsec.dll'
          - '*\nshwfp.dll'
          - '*\ntdsapi.dll'
          - '*\ntlanman.dll'
          - '*\ntlmshared.dll'
          - '*\ntmarta.dll'
          - '*\ntprint.dll'
          - '*\ntshrui.dll'
          - '*\oleacc.dll'
          - '*\omadmapi.dll'
          - '*\onex.dll'
          - '*\opcservices.dll'
          - '*\osbaseln.dll'
          - '*\osuninst.dll'
          - '*\p2p.dll'
          - '*\p2pnetsh.dll'
          - '*\p9np.dll'
          - '*\pcaui.dll'
          - '*\pdh.dll'
          - '*\peerdistsh.dll'
          - '*\pla.dll'
          - '*\playsndsrv.dll'
          - '*\pnrpnsp.dll'
          - '*\policymanager.dll'
          - '*\polstore.dll'
          - '*\powrprof.dll'
          - '*\printui.dll'
          - '*\prntvpt.dll'
          - '*\profapi.dll'
          - '*\propsys.dll'
          - '*\proximitycommon.dll'
          - '*\prvdmofcomp.dll'
          - '*\puiapi.dll'
          - '*\radcui.dll'
          - '*\rasapi32.dll'
          - '*\rasdlg.dll'
          - '*\rasgcw.dll'
          - '*\rasman.dll'
          - '*\rasmontr.dll'
          - '*\reagent.dll'
          - '*\regapi.dll'
          - '*\resutils.dll'
          - '*\rmclient.dll'
          - '*\rpcnsh.dll'
          - '*\rsaenh.dll'
          - '*\rtutils.dll'
          - '*\rtworkq.dll'
          - '*\samcli.dll'
          - '*\samlib.dll'
          - '*\sapi_onecore.dll'
          - '*\sas.dll'
          - '*\scansetting.dll'
          - '*\scecli.dll'
          - '*\schedcli.dll'
          - '*\secur32.dll'
          - '*\security.dll'
          - '*\sensapi.dll'
          - '*\shell32.dll'
          - '*\slc.dll'
          - '*\snmpapi.dll'
          - '*\spp.dll'
          - '*\sppc.dll'
          - '*\sppcext.dll'
          - '*\srclient.dll'
          - '*\srmtrace.dll'
          - '*\srpapi.dll'
          - '*\srvcli.dll'
          - '*\ssp.exe_rsaenh.dll'
          - '*\ssp_isv.exe_rsaenh.dll'
          - '*\sspicli.dll'
          - '*\ssshim.dll'
          - '*\staterepository.core.dll'
          - '*\sti.dll'
          - '*\structuredquery.dll'
          - '*\sxshared.dll'
          - '*\tapi32.dll'
          - '*\tbs.dll'
          - '*\tdh.dll'
          - '*\textshaping.dll'
          - '*\tpmcoreprovisioning.dll'
          - '*\tquery.dll'
          - '*\tsworkspace.dll'
          - '*\ttdrecord.dll'
          - '*\twext.dll'
          - '*\twinapi.dll'
          - '*\twinui.appcore.dll'
          - '*\uianimation.dll'
          - '*\uiautomationcore.dll'
          - '*\uireng.dll'
          - '*\uiribbon.dll'
          - '*\umpdc.dll'
          - '*\updatepolicy.dll'
          - '*\urlmon.dll'
          - '*\userenv.dll'
          - '*\utildll.dll'
          - '*\uxinit.dll'
          - '*\uxtheme.dll'
          - '*\vaultcli.dll'
          - '*\vdsutil.dll'
          - '*\version.dll'
          - '*\virtdisk.dll'
          - '*\vssapi.dll'
          - '*\vsstrace.dll'
          - '*\wbemcomn.dll'
          - '*\wcmapi.dll'
          - '*\wdi.dll'
          - '*\wdscore.dll'
          - '*\webservices.dll'
          - '*\wecapi.dll'
          - '*\wer.dll'
          - '*\wevtapi.dll'
          - '*\whhelper.dll'
          - '*\winbio.dll'
          - '*\winbrand.dll'
          - '*\windows.storage.dll'
          - '*\windows.storage.search.dll'
          - '*\windows.ui.immersive.dll'
          - '*\windowscodecs.dll'
          - '*\windowscodecsext.dll'
          - '*\windowsudk.shellcommon.dll'
          - '*\winhttp.dll'
          - '*\wininet.dll'
          - '*\winipsec.dll'
          - '*\winmm.dll'
          - '*\winnsi.dll'
          - '*\winrnr.dll'
          - '*\winscard.dll'
          - '*\winsqlite3.dll'
          - '*\winsta.dll'
          - '*\winsync.dll'
          - '*\wkscli.dll'
          - '*\wlanapi.dll'
          - '*\wlancfg.dll'
          - '*\wldp.dll'
          - '*\wlidprov.dll'
          - '*\wmiclnt.dll'
          - '*\wmidcom.dll'
          - '*\wmsgapi.dll'
          - '*\wofutil.dll'
          - '*\wpdshext.dll'
          - '*\wscapi.dll'
          - '*\wsdapi.dll'
          - '*\wshbth.dll'
          - '*\wshelper.dll'
          - '*\wsmsvc.dll'
          - '*\wtsapi32.dll'
          - '*\wwancfg.dll'
          - '*\wwapi.dll'
          - '*\xmllite.dll'
          - '*\xolehlp.dll'
          - '*\xpsservices.dll'
          - '*\xwizards.dll'
          - '*\xwtpw32.dll'

    filter_139:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
          - 'c:\program files\*'
          - 'c:\program files (x86)\*'
    selection_139:
        TargetFileName:
          - '*\msvcp140.dll'

    filter_140:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
          - 'c:\program files\common files\microsoft shared\ime14\shared\*'
          - 'c:\program files (x86)\common files\microsoft shared\ime14\shared\*'
    selection_140:
        TargetFileName:
          - '*\imjp14k.dll'

    filter_141:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
          - 'c:\program files\html help workshop\*'
          - 'c:\program files (x86)\html help workshop\*'
    selection_141:
        TargetFileName:
          - '*\hha.dll'

    filter_142:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
          - 'c:\program files\windows kits\10\assessment and deployment kit\deployment tools\arm64\dism\*'
          - 'c:\program files (x86)\windows kits\10\assessment and deployment kit\deployment tools\arm64\dism\*'
    selection_142:
        TargetFileName:
          - '*\wimgapi.dll'

    filter_143:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
          - 'c:\program files\windows kits\10\debuggers\\*\*'
          - 'c:\program files (x86)\windows kits\10\debuggers\\*\*'
    selection_143:
        TargetFileName:
          - '*\dbgmodel.dll'

    filter_144:
        TargetFileName:
          - 'c:\windows\system32\\*'
          - 'c:\windows\syswow64\\*'
          - 'c:\windows\prefetch\\*'
    selection_144:
        TargetFileName:
          - '*\bthprops.cpl'

    filter_145:
        TargetFileName:
          - 'c:\windows\system32\systemresetplatform\\*'
          - 'c:\windows\syswow64\systemresetplatform\\*'
    selection_145:
        TargetFileName:
          - '*\rjvplatform.dll'

    filter_146:
        TargetFileName:
          - 'c:\windows\system32\dism\\*'
          - 'c:\windows\syswow64\dism\\*'
    selection_146:
        TargetFileName:
          - '*\dismcore.dll'

    filter_147:
        TargetFileName:
          - 'c:\windows\system32\wbem\\*'
          - 'c:\windows\syswow64\wbem\\*'
    selection_147:
        TargetFileName:
          - '*\fastprox.dll'
          - '*\wbemprox.dll'
          - '*\wbemsvc.dll'
          - '*\wmiutils.dll'

    filter_148:
        TargetFileName:
          - 'c:\windows\microsoft.net\framework\v*\\*'
          - 'c:\windows\microsoft.net\framework64\v*\\*'
    selection_148:
        TargetFileName:
          - '*\mscorsvc.dll'

    filter_149:
        TargetFileName:
          - 'c:\windows\miracast\\*'
    selection_149:
        TargetFileName:
          - '*\miracastview.dll'

    condition: (selection_0) or (selection_1 and not filter_1) or (selection_2 and not filter_2) or (selection_3 and not filter_3) or (selection_4 and not filter_4) or (selection_5 and not filter_5) or (selection_6 and not filter_6) or (selection_7 and not filter_7) or (selection_8 and not filter_8) or (selection_9 and not filter_9) or (selection_10 and not filter_10) or (selection_11 and not filter_11) or (selection_12 and not filter_12) or (selection_13 and not filter_13) or (selection_14 and not filter_14) or (selection_15 and not filter_15) or (selection_16 and not filter_16) or (selection_17 and not filter_17) or (selection_18 and not filter_18) or (selection_19 and not filter_19) or (selection_20 and not filter_20) or (selection_21 and not filter_21) or (selection_22 and not filter_22) or (selection_23 and not filter_23) or (selection_24 and not filter_24) or (selection_25 and not filter_25) or (selection_26 and not filter_26) or (selection_27 and not filter_27) or (selection_28 and not filter_28) or (selection_29 and not filter_29) or (selection_30 and not filter_30) or (selection_31 and not filter_31) or (selection_32 and not filter_32) or (selection_33 and not filter_33) or (selection_34 and not filter_34) or (selection_35 and not filter_35) or (selection_36 and not filter_36) or (selection_37 and not filter_37) or (selection_38 and not filter_38) or (selection_39 and not filter_39) or (selection_40 and not filter_40) or (selection_41 and not filter_41) or (selection_42 and not filter_42) or (selection_43 and not filter_43) or (selection_44 and not filter_44) or (selection_45 and not filter_45) or (selection_46 and not filter_46) or (selection_47 and not filter_47) or (selection_48 and not filter_48) or (selection_49 and not filter_49) or (selection_50 and not filter_50) or (selection_51 and not filter_51) or (selection_52 and not filter_52) or (selection_53 and not filter_53) or (selection_54 and not filter_54) or (selection_55 and not filter_55) or (selection_56 and not filter_56) or (selection_57 and not filter_57) or (selection_58 and not filter_58) or (selection_59 and not filter_59) or (selection_60 and not filter_60) or (selection_61 and not filter_61) or (selection_62 and not filter_62) or (selection_63 and not filter_63) or (selection_64 and not filter_64) or (selection_65 and not filter_65) or (selection_66 and not filter_66) or (selection_67 and not filter_67) or (selection_68 and not filter_68) or (selection_69 and not filter_69) or (selection_70 and not filter_70) or (selection_71 and not filter_71) or (selection_72 and not filter_72) or (selection_73 and not filter_73) or (selection_74 and not filter_74) or (selection_75 and not filter_75) or (selection_76 and not filter_76) or (selection_77 and not filter_77) or (selection_78 and not filter_78) or (selection_79 and not filter_79) or (selection_80 and not filter_80) or (selection_81 and not filter_81) or (selection_82 and not filter_82) or (selection_83 and not filter_83) or (selection_84 and not filter_84) or (selection_85 and not filter_85) or (selection_86 and not filter_86) or (selection_87 and not filter_87) or (selection_88 and not filter_88) or (selection_89 and not filter_89) or (selection_90 and not filter_90) or (selection_91 and not filter_91) or (selection_92 and not filter_92) or (selection_93 and not filter_93) or (selection_94 and not filter_94) or (selection_95 and not filter_95) or (selection_96 and not filter_96) or (selection_97 and not filter_97) or (selection_98 and not filter_98) or (selection_99 and not filter_99) or (selection_100 and not filter_100) or (selection_101 and not filter_101) or (selection_102 and not filter_102) or (selection_103 and not filter_103) or (selection_104 and not filter_104) or (selection_105 and not filter_105) or (selection_106 and not filter_106) or (selection_107 and not filter_107) or (selection_108 and not filter_108) or (selection_109 and not filter_109) or (selection_110 and not filter_110) or (selection_111 and not filter_111) or (selection_112 and not filter_112) or (selection_113 and not filter_113) or (selection_114 and not filter_114) or (selection_115 and not filter_115) or (selection_116 and not filter_116) or (selection_117 and not filter_117) or (selection_118 and not filter_118) or (selection_119 and not filter_119) or (selection_120 and not filter_120) or (selection_121 and not filter_121) or (selection_122 and not filter_122) or (selection_123 and not filter_123) or (selection_124 and not filter_124) or (selection_125 and not filter_125) or (selection_126 and not filter_126) or (selection_127 and not filter_127) or (selection_128 and not filter_128) or (selection_129 and not filter_129) or (selection_130 and not filter_130) or (selection_131 and not filter_131) or (selection_132 and not filter_132) or (selection_133 and not filter_133) or (selection_134 and not filter_134) or (selection_135 and not filter_135) or (selection_136 and not filter_136) or (selection_137 and not filter_137) or (selection_138 and not filter_138) or (selection_139 and not filter_139) or (selection_140 and not filter_140) or (selection_141 and not filter_141) or (selection_142 and not filter_142) or (selection_143 and not filter_143) or (selection_144 and not filter_144) or (selection_145 and not filter_145) or (selection_146 and not filter_146) or (selection_147 and not filter_147) or (selection_148 and not filter_148) or (selection_149 and not filter_149)
falsepositives:
    - False positives are likely. This rule is more suitable for hunting than for generating detections.