GIF89a; %PDF-1.5 %���� ºaâÚÎΞ-ÌE1ÍØÄ÷{òò2ÿ ÛÖ^ÔÀá TÎ{¦?§®¥kuµù Õ5sLOšuY Donat Was Here
DonatShell
Server IP : 134.29.175.74  /  Your IP : 216.73.216.160
Web Server : nginx/1.10.2
System : Windows NT CST-WEBSERVER 10.0 build 19045 (Windows 10) i586
User : Administrator ( 0)
PHP Version : 7.1.0
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Windows/DiagTrack/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ HOME SHELL ]     

Current File : C:/Windows/DiagTrack/GetFileActionAllowedList.dat
^\\\\\?\\%ProgramFiles%\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%windir%\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$windows\.~bt\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$sysreset\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\windows\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\PerfLogs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\Program Files\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\Program Files \(x86\)\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\roamingdiag\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemroot%\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\SystemData\\etw\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefaultAccount\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\HoloShellData\\SavedWorlds\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%ProgramData%\\Microsoft\\Spectrum\\EnvironmentData\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%ProgramData%\\Microsoft\\Spectrum\\LocationData\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\SystemData\\Temp\\CrashDumps\\[^\\>/:?<|"]+(\.dmp){1}$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\USOPrivate\\UpdateStore\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\USOShared\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\shareddata\\duprivate\\updatestore\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\shareddata\\dushared\\[^\\>/:?<|""]+\\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\SystemData\\nonetwlogs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\SoftwareDistribution\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\shareddata\\duprivate\\TroubleShooting\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\TempState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\APPDATA\\Local\\Packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\localstate\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\APPDATA\\Local\\Packages\\Microsoft\.WindowsCommunicationsApps_8wekyb3d8bbwe\\tempstate\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\wlanreport\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|""]|\\\\))
^\\\\\?\\%appdata%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a\.AutomaticDestinations-ms$
^\\\\\?\\%appdata%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767\.AutomaticDestinations-ms$
^\\\\\?\\%appdata%\\Microsoft\\Windows\\Themes\\slideshow\.ini$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Themes\\[^\\>/:?<|"]+(\.theme){1}$
^\\\\\?\\%programdata%\\USOPrivate\\UpdateStore\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\USOShared\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\SharedData\\Dushared\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\RoamDiagLogs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.InsiderHub_8wekyb3d8bbwe\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%ProgramData%\\Microsoft\\Wlansvc\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Fragments_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.YoungConker_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Publishers\\8wekyb3d8bbwe\\Playspaces\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\RasPhone\.pbk$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\caches\\\{3d(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.ZuneMusic_8wekyb3d8bbwe\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\AppRepository\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Appxprovisioning\.xml$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\Microsoft\\Windows\\APPREPOSITORY\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Programs\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\LMLicenseFault\.cab$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.ZuneVideo_8wekyb3d8bbwe\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Clipsvc\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\Microsoft\\Windows\\ClipSVC\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.SkypeApp_kzf8qxf38zg5c\\localstate\\DiagOutputDir\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Programs\\Commonfiles\\xaps\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.Windows\.FeatureOnDemand\.InsiderHub_cw5n1h2txyewy\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingWeather_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingFinance_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingNews_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%appdata%\\Local\\Packages\\Microsoft\.BingSports_8wekyb3d8bbwe\\LocalState\\Diagnostics\\ApplicationLog\.etl$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\LocalState\\LocalRecorder\\Speech\\[^\\\\>/:?<|"]+(\.wav){1}$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneMusic_8wekyb3d8bbwe\\localstate\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneVideo_8wekyb3d8bbwe\\localstate\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Messaging_8wekyb3d8bbwe\\LocalCache\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MessagingLite_8wekyb3d8bbwe\\LocalCache\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneMusic_8wekyb3d8bbwe\\localcache\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.ZuneVideo_8wekyb3d8bbwe\\localcache\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\TempState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.WindowsFeedbackHub_8wekyb3d8bbwe\\TempState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.3DViewer_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Actiongram_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftGalaxyExplorer_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Microsoft\.HoloStudio_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.6191099C588EB_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.RoboRaid_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\ConnectedDevicesPlatform\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\SharedData\\ServiceProfiles\\LocalService\\APPDATA\\LOCAL\\ConnectedDevicesPlatform\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\APPDATA\\LOCAL\\ConnectedDevicesPlatform\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.HoloStudio_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\packages\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\Office\\Spw\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\Office\\MsoLogs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftSkydrive_8wekyb3d8bbwe\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\14356InternalBetaAccount\.OneDriveBlueAlpha_f94gypvcd58qa\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.MicrosoftSkydrive_8wekyb3d8bbwe\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\14356InternalBetaAccount\.OneDriveBlueAlpha_f94gypvcd58qa\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\2388c42e-8b18-474f-b53c-b6cc0c9fb685_q2jx7hka11k42\\LocalState\\Logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Cortana_cw5n1h2txyewy\\Settings\\Settings\.dat$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Notifications\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$GetCurrent\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Windows10Upgrade\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\UpgraderStub\.log$
^\\\\\?\\%temp%\\Windows10UpgradeVersion\.txt$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOPrivate\\UpdateStore\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOShared\\Logs\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%SettingsDrive%\\ProgramData\\SoftwareDistribution\\Logs\\WindowsUpdate\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%TemporaryDrive%\\windows\\system32\\logfiles\\dosvc\\[^\\>/:?<|"]+(\.etl){1}$
^\\\\\?\\%systemdrive%\\ProgramData\\Qualcomm\\rfs\\msm\\MPSS\\readonly\\firmware\\image\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\ProgramData\\Qualcomm\\rfs\\msm\\ADSP\\readonly\\firmware\\image\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\ProgramData\\Qualcomm\\rfs\\msm\\CNSS\\readonly\\firmware\\image\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\onedrive\\logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\onedrive\\setup\\logs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.AAD\.BrokerPlugin_cw5n1h2txyewy\\Settings\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.AAD\.BrokerPlugin_8wekyb3d8bbwe\\Settings\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\60889ExcellentApps\.Woodinville_t20v3ntx64e6w\\tempstate\\UnityPlayer\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\CertEnroll\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\CertEnrollCtrl\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\CryptTpmEkSvc\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\AppData\\Local\\CertEnroll\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\AppData\\Local\\CertEnrollCtrl\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\System\\AppData\\Local\\CryptTpmEkSvc\.log$
^\\\\\?\\%systemdrive%\\Data\\ProgramData\\SoftwareDistribution\\ReportingEvents\.log$
^\\\\\?\\%systemdrive%\\Data\\Users\\DefApps\\AppData\\Local\\Packages\\Microsoft\.WindowsStore_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\packages\\Microsoft\.WindowsStore_8wekyb3d8bbwe\\LocalState\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Diagnosis\\FeedbackHub\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Hyper-V\\Container Utility VM\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.XboxGameOverlay_8wekyb3d8bbwe\\LocalState\\DiagOutputDir\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\WDAG\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\\$windows\.~ws\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%ProgramFiles(x86)%\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\(?:[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\)+OrtcLogs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%DiagtrackStorageRoot%\\FeedbackHub\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%temp%\\emulator\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\andemulator\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\windowssdk\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\standalonesdk\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\UnionWinmdWorkingFolder\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%ProgramData%\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\SenseIRDebugLogger\.etl$
^\\\\\?\\O:\\systemdata\\etw\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%userprofile%\\MicrosoftEdgeBackups\\backups\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%userprofile%\\MicrosoftEdgeBackups\\backups\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings\.dat$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\RoamingConfig\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\CloudStore\\cloudstore\.dat$
^\\\\\?\\%temp%\\RoamDiag\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\RoamDiag\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%temp%\\RoamDiag\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%systemdrive%\\Data\\Users\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\AppData\\Local\\Packages\\Microsoft\.windowscommunicationsapps_8wekyb3d8bbwe\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.MicrosoftRemoteAssist_8wekyb3d8bbwe\\TempState\\[^\\>/:?<|"]+\.{1}[^\\>/:?<|".]+$
^\\\\\?\\%programdata%\\DTU\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programfiles%\\DTU\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\O:\\systemdata\\nonetwlogs\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Users\\SurfaceHub\\AppData\\Local\\Packages\\Microsoft\.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe\\LocalState\\logs\\Teams\.log$
^\\\\\?\\%systemdrive%\\Users\\SurfaceHub\\AppData\\Local\\Packages\\Microsoft\.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe\\LocalState\\logs\\[^\\>/:?<|"]+\.{1}blog$
^\\\\\?\\%systemdrive%\\Users\\SurfaceHub\\AppData\\Local\\Packages\\Microsoft\.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe\\LocalState\\logs\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\%programdata%\\Microsoft\\Windows\\WFP\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Photos_8wekyb3d8bbwe\\LocalState\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\314558\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\314559\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\338381\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\338388\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\314558\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\314559\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\338381\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\v3\\338388\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%DiagTrackSystemPartition%\\EFI\\Microsoft\\Boot\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%DiagTrackSystemPartition%\\Boot\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Shell\\Layoutmodification\.xml$
^\\\\\?\\%localappdata%\\Microsoft\\Windows\\Shell\\DefaultLayouts\.xml$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.zStartApp_cw5n1h2txyewy\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\Data\\SharedData\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\DeliveryOptimization\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\S:\\Deployment\\SoftwareDistribution\\Logs\\WindowsUpdate\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\S:\\Deployment\\DeliveryOptimization\\Logs\\dosvc\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\[^.\\>/:?<|"]+:\\WindowsApps\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\DeliveryOptimization\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\[^.\\>/:?<|"]+:\\WUDownloadCache\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\Microsoft\\Windows\\OneSettings\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%programdata%\\WindowsHolographicDevices\\ET\\Profiles\\[^\\>/:?<|"]+\.{1}etl$
^\\\\\?\\%programdata%\\Microsoft\\Windows\\Parental Controls\\settings\\settings\.bin$
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.StartMenuExperienceHost_cw5n1h2txyewy\\LocalCache\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\ModernUXProduct_cw5n1h2txyewy\\LocalCache\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\DPP\\Display\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\O:\\systemdata\\temp\\compositor\\[^\\>/:?<|"]+\.{1}png$
^\\\\\?\\%osdatadrive%\\windows\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%osdatadrive%\\logfiles\\[^\\>/:?<|"]*?[^.\\>/:?<|"]\.?\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOShared\\logs\\User\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%systemdrive%\\windows\.old\\ProgramData\\USOShared\\logs\\System\\(?!\\)(?![\s\S]*((\.\.|\s(\\|$))|[>/:?<|"]|\\\\))
^\\\\\?\\%localappdata%\\Packages\\Microsoft\.Windows\.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\[^\\>/:?<|"]+\.{1}json$

Anon7 - 2022
AnonSec Team