<?xml version="1.0" encoding="utf-8"?>
<Presets>
<!-- Concise format description: -->
<!--  -->
<!-- [App preset name]               [non-empty string]           preset name (if 'PacketRule' specified, packet rule will be created) -->
<!-- App=app1.exe, app2.exe          [set of non-empty strings]   list of executable files. comma-separated -->
<!-- CommandLine=app args            [string]                     arguments with witch process has been started -->
<!-- UseCommandLine=1                [1,0]                        use / not use command line parameter. 0 by default -->
<!-- Name=some App activity          [non-empty string]           rule name (must be the first line of each rule description) -->
<!-- Enable=1                        [1,0]                        enable / disable rule. 1 by default -->
<!-- Allow=1                         [1,0]                        allow / deny network activity. 1 by default -->
<!-- Protocol=TCP                    [TCP,UDP]                    protocol. TCP by default -->
<!-- Direction=OutboundStream        [Inbound,Outbound,InboundOutbound,InboundStream,OutboundStream] direction. InboundOutbound by default -->
<!-- RemotePort=21, 22, 25-28        [set of port numbers]        remote ports (only for TCP and UDP protocols may be specified). comma-separated -->
<!-- LocalPort=21, 22, 25-27         [set of port numbers]        local ports (only for TCP and UDP protocols may be specified). comma-separated -->
<!-- RemoteAddress=1.2.3.4, 4.3.2.1  [set of ip-addresses]        remote addresses. comma-separated -->
<!-- RemoteAddressIPv6=1234::0       [set of ip-addresses]        remote addresses only for IPv6 protocol. comma-separated -->
<!-- LocalAddress=1.2.3.4, 4.3.2.1   [set of ip-addresses]        remote addresses. comma-separated. for packet rules only. -->
<!-- LocalAddressIPv6=1234::0        [set of ip-addresses]        remote addresses only for IPv6 protocol. comma-separated. for packet rules only. -->
<!-- Log=1                           [1,0]                        log then applied. 0 by default -->
<!-- Warning=1                       [1,0]                        notify (show ballon) then applied. 0 by default -->
  <AppRule>
    <Name>Allow All</Name>
    <Rule>
      <Name>Allow Any TCP Activity</Name>
      <Protocol>TCP</Protocol>
    </Rule>
    <Rule>
      <Name>Allow Any UDP Activity</Name>
      <Protocol>UDP</Protocol>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Block All</Name>
    <Rule>
      <Name>Block Any TCP Activity</Name>
      <Allow>0</Allow>
      <Protocol>TCP</Protocol>
    </Rule>
    <Rule>
      <Name>Block Any UDP Activity</Name>
      <Allow>0</Allow>
      <Protocol>UDP</Protocol>
    </Rule>
  </AppRule>
<!-- General -->
  <AppRule>
    <Name>Mail Client</Name>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Default Mail Client</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Read News By Default Mail Client</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Default Mail Client</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Default Mail Client IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Browser</Name>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Browser HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Browser HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Browser SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Browser PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Browser FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Browser FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Download Manager</Name>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Manager HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Manager FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Manager FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTP Client</Name>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Telnet Client</Name>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Secure Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>22</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Time Synchronizer</Name>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Time Synchronizer Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
    <Rule>
      <Name>Time Synchronizer Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>37</RemotePort>
    </Rule>
    <Rule>
      <Name>Time Synchronizer Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Time Synchronizer Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Windows services -->
  <AppRule>
    <Name>Microsoft ICS Manager</Name>
    <App>icsmgr.exe</App>
    <Rule>
      <Name>Microsoft ICS Manager DNS Resolving</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft ICS Manager Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>67</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft ActiveSync</Name>
    <App>wcescomm.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Microsoft ActiveSync</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Microsoft ActiveSync</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft ActiveSync IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft ActiveSync HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Generic Host Process</Name>
    <App>svchost.exe</App>
    <Rule>
      <Name>Localhost UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <RemotePort>1024-65535</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Svchost DNS Service Over UDP</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Svchost DNS Service Over TCP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Svchost DCOM Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DHCP Service</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>68</LocalPort>
      <RemotePort>67</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <RuleIPv6>
      <Name>DHCPv6 Service</Name>
      <Protocol>UDP</Protocol>
      <RemoteAddressIPv6>FF02::1:2</RemoteAddressIPv6>
      <Direction>InboundOutbound</Direction>
    </RuleIPv6>
    <Rule>
      <Name>HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Time Synchronizer Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;SSDP Discovery Service&quot; And &quot;UPnP device Host&quot; Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1024-65535</LocalPort>
      <RemotePort>1900</RemotePort>
      <RemoteAddress>10.0.0.0/255.0.0.0, 169.254.0.0/255.255.0.0, 172.16.0.0/255.240.0.0, 192.168.0.0/255.255.0.0, 239.255.255.250/255.255.255.255</RemoteAddress>
      <RemoteAddressIPv6>ff02::/16</RemoteAddressIPv6>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>&quot;SSDP Discovery Service&quot; And &quot;UPnP device Host&quot; Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1900</LocalPort>
      <RemoteAddress>10.0.0.0/255.0.0.0, 169.254.0.0/255.255.0.0, 172.16.0.0/255.240.0.0, 192.168.0.0/255.255.0.0</RemoteAddress>
      <RemoteAddressIPv6>fe80::/64</RemoteAddressIPv6>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;SSDP Discovery Service&quot; And &quot;UPnP device Host&quot; Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Remote Desktop TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>3389</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Generic Host Process LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;Link-Local Multicast Name Resolution&quot; Inbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5355</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;Link-Local Multicast Name Resolution&quot; Outbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>5355</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>&quot;Web Services Discovery&quot; Inbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>3702</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;Web Services Discovery&quot; Outbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>3702</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>&quot;Web Services Discovery&quot; Inbound TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>2869, 5357, 5358</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;Web Services Discovery&quot; Outbound TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>2869, 5357, 5358</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <RuleNonTCPUDP>
      <Name>Any ICMP Activity</Name>
      <Protocol>1</Protocol>
      <Direction>Outbound</Direction>
    </RuleNonTCPUDP>
    <RuleNonTCPUDP>
      <Name>Any ICMPv6 Activity</Name>
      <Protocol>58</Protocol>
      <Direction>Outbound</Direction>
    </RuleNonTCPUDP>
    <RuleNonTCPUDP>
      <Name>Any Raw IP Activity</Name>
      <Protocol>0</Protocol>
      <SocketType>raw</SocketType>
      <Direction>InboundOutbound</Direction>
    </RuleNonTCPUDP>
  </AppRule>
  <AppRule>
    <Name>Microsoft ALG Service</Name>
    <App>alg.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Allow ALG Redirect</Name>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Application Layer Gateway Service Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Application Error Reporting</Name>
    <App>dw.exe, dwwin.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Application Error Reporting HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Registration Wizard</Name>
    <App>regwiz.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Registration Wizard HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft RDP CIip Monitor</Name>
    <App>rdpclip.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft RDP CIip Monitor TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3389</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft RDP CIip Monitor UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>3389</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Remote Desktop</Name>
    <App>mstsc.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Remote Desktop TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3389</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Remote Desktop UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>3389</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Remote Desktop Help Session Manager</Name>
    <App>sessmgr.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Remote Desktop Help Session Manager Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>1900, 2234</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Synchronization Manager</Name>
    <App>mobsync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Synchronization Manager HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Windows AutoUpdate</Name>
    <App>wuauclt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Windows AutoUpdate HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Run a DLL as an App</Name>
    <App>rundll32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;SSDP Discovery Service&quot; And &quot;UPnP device Host&quot; Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1024-65535</LocalPort>
      <RemotePort>1900</RemotePort>
      <RemoteAddress>10.0.0.0/255.0.0.0, 169.254.0.0/255.255.0.0, 172.16.0.0/255.240.0.0, 192.168.0.0/255.255.0.0, 239.255.255.250/255.255.255.255</RemoteAddress>
      <RemoteAddressIPv6>ff02::/16, fe80::/64</RemoteAddressIPv6>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>&quot;SSDP Discovery Service&quot; And &quot;UPnP device Host&quot; Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1900</LocalPort>
      <RemoteAddress>10.0.0.0/255.0.0.0, 169.254.0.0/255.255.0.0, 172.16.0.0/255.240.0.0, 192.168.0.0/255.255.0.0</RemoteAddress>
      <RemoteAddressIPv6>ff02::/16, fe80::/64</RemoteAddressIPv6>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>&quot;SSDP Discovery Service&quot; And &quot;UPnP device Host&quot; Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICS TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1000-4000</LocalPort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICS UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1000-4000</LocalPort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SSDP Service</Name>
    <App>ssdpsrv.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICS TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1000-4000</LocalPort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICS UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1000-4000</LocalPort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Spooler SubSystem App</Name>
    <App>spoolsv.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>53</RemotePort>
    </Rule>
    <Rule>
      <Name>Spooler SubSystem DCOM Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135, 1025-1040</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Mail -->
  <AppRule>
    <Name>FoxMail</Name>
    <App>foxmail.exe, foxhot.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By FoxMail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By FoxMail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FoxMail HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>IncrediMail</Name>
    <App>incmail.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By IncrediMail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By IncrediMail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>IncrediMail IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>IncrediMail HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Outlook Express</Name>
    <App>msimn.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Outlook Express</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Outlook Express NNTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Outlook Express</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Outlook Express IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Outlook Express HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Outlook Express LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Outlook Express Exchange Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Outlook</Name>
    <App>outlook.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Microsoft Outlook</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Outlook NNTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Microsoft Outlook</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Outlook IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Outlook HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Outlook LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Outlook Exchange Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Pegasus Mail</Name>
    <App>winpm-32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Pegasus Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Pegasus Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Pegasus Mail IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Pegasus Mail HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>The BAT</Name>
    <App>thebat.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By The BAT</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Read News By The BAT</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By The BAT</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The BAT IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The Bat LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Express Plus</Name>
    <App>expressplus.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Express Plus</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Express Plus</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Express Plus IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Express Plus HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Becky!</Name>
    <App>b2.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Becky!</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Read News By Becky!</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Becky!</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Becky! IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Eudora</Name>
    <App>eudora.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Eudora</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Eudora</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Eudora IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Eudora HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Calypso</Name>
    <App>calypso.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Calypso</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Calypso</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Calypso LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Calypso HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mozilla Thunderbird</Name>
    <App>thunderbird.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Mozilla Thunderbird</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Mozilla Thunderbird</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Thunderbird IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Thunderbird HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Thunderbird Localhost TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Read News By Mozilla Thunderbird</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>YahooPOPs!</Name>
    <App>yahoopops.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By YahooPOPs!</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Yahta</Name>
    <App>yahta.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Yahta</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AD MailBox Manager</Name>
    <App>mbm.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AD MailBox Manager Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Magic Mail Monitor</Name>
    <App>magic.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Magic Mail Monitor Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MailBell</Name>
    <App>Mailbell.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MailBell Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mail Navigator</Name>
    <App>connect.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Mail Navigator</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Mail Navigator</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mail.Ru Agent</Name>
    <App>mra.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mail.Ru Agent HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mail.Ru Agent Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>2041, 2042</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>POP Peeper</Name>
    <App>poppeeper.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By POP Peeper</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By POP Peeper</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>POP Peeper HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MSGTAG</Name>
    <App>MSGTAG.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Tagged Mail By MSGTAG</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSGTAG HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>GMail Notifier</Name>
    <App>gnotify.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GMail Notifier HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Windows Mail</Name>
    <App>winmail.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Windows Mail Client</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Read News By Windows Mail Client</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By Windows Mail Client</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Mail Client IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Mail Client HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Mail Client LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Mail Client Exchange Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Browser -->
  <AppRule>
    <Name>Windows Explorer</Name>
    <App>explorer.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Explorer HTTP Activity</Name>
      <Enable>0</Enable>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Explorer FTP Activity</Name>
      <Enable>0</Enable>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Explorer FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Explorer LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>389, 3268</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Amaya</Name>
    <App>amaya.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Amaya HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Avant Browser</Name>
    <App>avant.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Avant Browser HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Avant Browser HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Avant Browser SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Avant Browser PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Avant Browser FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Avant Browser FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Internet Explorer</Name>
    <App>iexplore.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer Web Folders</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1375</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer Web Folders</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1040-1050</LocalPort>
    </Rule>
    <Rule>
      <Name>Internet Explorer FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Internet Explorer show video</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>554</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Netscape Navigator</Name>
    <App>netscape.exe, netscp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape Messenger Send Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape Messenger Read News</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape Messenger Receive Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape Messenger IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Netscape Mail Notification</Name>
    <App>nsnotify.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Netscape Mail Notification</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Crazy Browser</Name>
    <App>crazy browser.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crazy Browser FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>The Off By One Web Browser</Name>
    <App>ob1.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The Off By One Web Browser HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The Off By One Web Browser HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The Off By One Web Browser SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The Off By One Web Browser PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Opera</Name>
    <App>opera.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera NNTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera SMTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera POP3 Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Opera IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143, 993</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NetCaptor</Name>
    <App>netcaptor.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor Web Folders</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1375</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor Web Folders</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1040-1050</LocalPort>
    </Rule>
    <Rule>
      <Name>NetCaptor FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetCaptor FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NeoPlanet</Name>
    <App>np.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet Web Folders</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1375</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet Web Folders</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1040-1050</LocalPort>
    </Rule>
    <Rule>
      <Name>NeoPlanet FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NeoPlanet FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Phoenix Web Browser</Name>
    <App>phoenix.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Phoenix Web Browser HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Phoenix Web Browser HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Phoenix Web Browser SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Phoenix Web Browser PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Phoenix Web Browser FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Phoenix Web Browser FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mozilla Firebird</Name>
    <App>mozillafirebird.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firebird HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firebird HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firebird SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firebird PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firebird FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firebird FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mozilla Firefox</Name>
    <App>firefox.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox Localhost Activity</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Firefox FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Smart Explorer</Name>
    <App>sexplorer.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer Web Folders</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1375</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer Web Folders</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1040-1050</LocalPort>
    </Rule>
    <Rule>
      <Name>Smart Explorer FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Smart Explorer FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mozilla</Name>
    <App>mozilla.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Localhost Activity</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Send Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Read News</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla Receive Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mozilla IMAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>143</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Maxthon Web Browser</Name>
    <App>maxthon.exe,myie.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Folders</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1375</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Folders</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1040-1050</LocalPort>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Maxthon Web Browser FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>GoSURF</Name>
    <App>gosurf.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF SOCKS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF Gopher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>70</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF Web Folders</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1375</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GoSURF Web Folders</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>1040-1050</LocalPort>
    </Rule>
  </AppRule>
<!-- Proxies -->
  <AppRule>
    <Name>AnalogX Proxy</Name>
    <App>proxy.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AnalogX Proxy HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 1080, 3128, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AnalogX Proxy HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By AnalogX Proxy</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By AnalogX Proxy</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Read news By AnalogX Proxy</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>119</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AnalogX Proxy FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AnalogX Proxy FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebWasher</Name>
    <App>wwasher.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebWasher Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>The Proxomitron</Name>
    <App>proxomitron.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>The Proxomitron Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Allow Local Proxomitron Activity</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Block Inbound Proxomitron Activity</Name>
      <Allow>0</Allow>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Download Manager -->
  <AppRule>
    <Name>Download Accelerator Plus</Name>
    <App>dap.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Accelerator Plus HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Accelerator Plus FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Accelerator Plus FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>LeechGet</Name>
    <App>LeechGet.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>LeechGet HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>LeechGet FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>LeechGet FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Download Master</Name>
    <App>dmaster.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Master HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Master FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download Master FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>ReGet</Name>
    <App>reget.exe, regetdx.exe, regetjr.exe, regetpro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ReGet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ReGet FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ReGet FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>ReGet Update</Name>
    <App>regetupd.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ReGet Updater</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80, 3128, 8080, 1080, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>3wGet</Name>
    <App>3wget.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>3wGet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>3wGet FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>3wGet FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mass Downloader</Name>
    <App>massdown.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mass Downloader Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mass Downloader FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mass Downloader FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NetAnts</Name>
    <App>netants.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetAnts Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetAnts FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetAnts FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Lightning Download</Name>
    <App>lightning.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Lightning Download Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Lightning Download FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Lightning Download FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Star Downloader</Name>
    <App>stardown.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Star Downloader Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Star Downloader FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Star Downloader FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FlashGet</Name>
    <App>jetcar.exe, flashget.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FlashGet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FlashGet FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FlashGet FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Go!Zilla</Name>
    <App>go.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Go!Zilla Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Go!Zilla FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Go!Zilla FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>GetRight</Name>
    <App>getright.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GetRight Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GetRight FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>GetRight FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Net Vampire</Name>
    <App>vampire.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Net Vampire Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Net Vampire FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Net Vampire FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WGET</Name>
    <App>wget.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WGET Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WGET FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WGET FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Bit Torrent Client</Name>
    <App>btdownloadgui.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Bit Torrent HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Bit Torrent HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Bit Torrent Network TCP Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1024-65535</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Bit Torrent Network TCP Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>6881-6999</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TCP Inbound Coverage Activity</Name>
      <Allow>0</Allow>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TCP Outbound Coverage Activity</Name>
      <Allow>0</Allow>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>UDP Coverage Activity</Name>
      <Allow>0</Allow>
      <Protocol>UDP</Protocol>
    </Rule>
  </AppRule>
<!-- Offline Browser -->
  <AppRule>
    <Name>DISCo Pump</Name>
    <App>dpump.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DISCo Pump Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>DISCo Pump Update</Name>
    <App>dupgrad.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DISCo Pump Update Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Teleport Pro</Name>
    <App>pro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Teleport Pro Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Offline Explorer</Name>
    <App>oe.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Offline Explorer Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SuperHTTP Web Spider</Name>
    <App>superhttp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SuperHTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebZIP</Name>
    <App>webzip.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebZIP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebCopier</Name>
    <App>webcopier.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebCopier Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebSite eXtractor</Name>
    <App>webextra.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebSite eXtractor Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Agnitum Products -->
  <AppRule>
    <Name>Tauscan Update</Name>
    <App>taupdate.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tauscan Update</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Agnitum Products Update</Name>
    <App>aupdrun.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Agnitum Products Update</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Jammer</Name>
    <App>jammer.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Jammer Report</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Agnitum Auto FeedBack</Name>
    <App>feedback.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Agnitum Auto FeedBack</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Agnitum Outpost Firewall</Name>
    <App>outpost.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Outpost Firewall News</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- FTP -->
  <AppRule>
    <Name>Windows FTP Client</Name>
    <App>ftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows FTP Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>CuteFTP</Name>
    <App>cutftp32.exe, cftppro.exe, ftpte.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CuteFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CuteFTP FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CuteFTP HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>BulletProof FTP</Name>
    <App>bpftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>BulletProof FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>BulletProof FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Dreamweaver FTP client</Name>
    <App>dreamweaver.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dreamweaver FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dreamweaver FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>PrimaSoft AutoFTP</Name>
    <App>ftppro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PrimaSoft FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PrimaSoft FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FlashFXP</Name>
    <App>flashfxp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FlashFXP FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FlashFXP FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTP Now</Name>
    <App>ftp now.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Now Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Now DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>TurboFTP</Name>
    <App>turboftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TurboFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TurboFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AbsoluteFTP</Name>
    <App>absoluteftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AbsoluteFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AbsoluteFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>RemFTP</Name>
    <App>remftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>RemFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>RemFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Simply COOL FTP</Name>
    <App>scftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Simply COOL FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Simply COOL FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Crystal FTP</Name>
    <App>crystalftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crystal FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crystal FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Crystal FTP Update</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>KenFTP</Name>
    <App>ken ftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KenFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KenFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTP Commander</Name>
    <App>ftpcomm.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Commander Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Commander DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTP Navigator</Name>
    <App>ftpnavi.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Navigator Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Navigator DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AceFTP</Name>
    <App>aceftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AceFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AceFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AutoSyncFTP</Name>
    <App>autosyncftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AutoSyncFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AutoSyncFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Click FTP</Name>
    <App>click ftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Click FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Click FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>CoffeeCup Direct FTP</Name>
    <App>directftp5.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CoffeeCup Direct FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CoffeeCup Direct FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>DC SmartFTP</Name>
    <App>dcsmartftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DC SmartFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DC SmartFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SmartFTP</Name>
    <App>smartftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SmartFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SmartFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SmartFTP HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FileZilla</Name>
    <App>filezilla.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FileZilla FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FileZilla FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Site Publisher</Name>
    <App>sitepub.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Site Publisher FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Site Publisher FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTP Voyager</Name>
    <App>ftpvoyager.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Voyager Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Voyager DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTPRight</Name>
    <App>ftpright.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTPRight Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTPRight DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>IglooFTP Pro</Name>
    <App>iglooftp pro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>IglooFTP Pro Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>IglooFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Magellan Explorer</Name>
    <App>magellan.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Magellan Explorer FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Magellan Explorer FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microviet Internet FTP</Name>
    <App>internet ftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microviet Internet FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microviet Internet FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>miniftp</Name>
    <App>miniftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>miniftp Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>miniftp DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NetLoad</Name>
    <App>netload.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetLoad FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetLoad FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SecureFX</Name>
    <App>securefx.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SecureFX Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SecureFX SFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>22</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SecureFX FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebFTP</Name>
    <App>webftp3.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WS_FTP</Name>
    <App>ftp95pro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WS_FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WS_FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Windows Sockets FTP Client</Name>
    <App>winftp32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinFTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinFTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FAR Manager</Name>
    <App>far.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FAR Manager FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FAR Manager FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Total Commander</Name>
    <App>totalcmd.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Total Commander FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Total Commander FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Windows Commander</Name>
    <App>wincmd32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Commander FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Commander FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Telnet -->
  <AppRule>
    <Name>SecureCRT</Name>
    <App>securecrt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SecureCRT Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>22</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AlphaCom Terminal Emulator</Name>
    <App>alpha.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AlphaCom Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Anzio</Name>
    <App>anzio32r.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Anzio Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Anzio Rlogin Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>513</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Com</Name>
    <App>com75.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Com Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Com Inbound Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>23</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Com FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Com FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Emu</Name>
    <App>emu.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Emu Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>IVT</Name>
    <App>ivt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>IVT Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>KoalaTerm</Name>
    <App>mkt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KoalaTerm Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KoalaTerm Echo Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>7</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Mocha</Name>
    <App>mtn5250.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Mocha Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NetTerm</Name>
    <App>netterm.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetTerm Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Nexus Mainframe Terminal</Name>
    <App>nmt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Nexus Mainframe Terminal Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Putty</Name>
    <App>nmt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Putty Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Quick3270</Name>
    <App>quick3270.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Quick3270 Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>ShellTelnet</Name>
    <App>shellnet.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ShellTelnet Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>TelStar</Name>
    <App>telstar.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TelStar Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Telnet Streamer</Name>
    <App>xns.exe, tns.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Telnet Streamer Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Tera Term Pro</Name>
    <App>ttermpro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tera Term Pro Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>22, 23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>TN3270</Name>
    <App>tn3270.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TN3270 Telnet Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Windows Telnet Client</Name>
    <App>telnet.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Telnet Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Telnet Client RLOGIN Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>513</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Communications -->
  <AppRule>
    <Name>AOL Instant Messenger</Name>
    <App>aim.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AOL Instant Messenger Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5190</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AOL Instant Messenger HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Boomerang SST</Name>
    <App>shuttle.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Boomerang SST Activity</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>216.129.147.0/255.255.255.0</RemoteAddress>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Dwyco CDC32</Name>
    <App>cdc32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dwyco CDC32 Server Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6700-6703</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dwyco CDC32 Direct Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6780</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dwyco CDC32 File Transfer</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1024-5000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dwyco CDC32 Real-Time Audio And Video</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>10096, 12000-16090</RemotePort>
    </Rule>
    <Rule>
      <Name>Dwyco CDC32 Link Test</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>0</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>ICQ</Name>
    <App>icq.exe, icqlite.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICQ Server Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>4000</RemotePort>
    </Rule>
    <Rule>
      <Name>ICQ Client Outbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>5140, 5150</RemotePort>
      <Direction>Outbound</Direction>
    </Rule>
    <Rule>
      <Name>ICQ Client Inbound TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1024-65535</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICQ Client Outbound TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1024-65535</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICQ Client Send Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICQ Client Receive Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICQ Client HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Miranda IM</Name>
    <App>miranda32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Miranda IRC AUTH Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>113</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Miranda IRC Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6667-7000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Miranda MSN Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1863</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Miranda Yahoo Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5050</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Miranda Jabber Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5222</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Miranda HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 5190, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MSN Messenger</Name>
    <App>msmsgs.exe, msnmsgr.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN Messenger Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1863</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN Messenger Voice Communications</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>6901</LocalPort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN Messenger Voice Communications</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>6901, 7001</RemotePort>
    </Rule>
    <Rule>
      <Name>MSN Messenger File Transfer</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6891-6900</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN Messenger Remote Assistance</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3389</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN Messenger Application Sharing And Whiteboard</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1503</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN Messenger RTP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5004-65535</LocalPort>
    </Rule>
    <Rule>
      <Name>MSN Messenger Main Activity Via Proxy</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Odigo</Name>
    <App>odigo.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Odigo Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 2562, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Eyeball Chat</Name>
    <App>eyeballchat.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Eyeball Chat TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5500, 5501, 5515</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Eyeball Chat UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>5700-5702</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Trillian</Name>
    <App>trillian.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Trillian IRC AUTH Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>113</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Trillian IRC Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6667-7000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Trillian MSN Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1863</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Trillian Yahoo Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5050</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Trillian Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 5190, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>mIRC</Name>
    <App>mirc32.exe, mirc.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>mIRC Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6660-6670</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>mIRC AUTH Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>113</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft NetMeeting</Name>
    <App>conf.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft NetMeeting Conference</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1000-2999</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft NetMeeting Conference</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>49600-49700</RemotePort>
    </Rule>
    <Rule>
      <Name>Microsoft NetMeeting LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft NetMeeting HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Chat</Name>
    <App>cchat.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Chat Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6667</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Chat AUTH Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>113</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SMSTation</Name>
    <App>smstation.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SMSTation Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Yahoo! Messenger</Name>
    <App>ypager.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Send Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 465</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Login</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>23, 5050</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Conference TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5000, 5001</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Conference UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5000</LocalPort>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Call Center</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>6801</RemotePort>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Call Center</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5000, 5055</LocalPort>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger Call Center</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>7800-7825</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger WebCam</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5100</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Yahoo! AutoUpdater</Name>
    <App>yupdater.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Yahoo! Messenger AutoUpdater</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Quiet Internet Pager</Name>
    <App>qip.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>QIP HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 5190, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Skype</Name>
    <App>Skype.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Skype Voice UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>80, 443, 1024-65535</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>Skype Voice TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80, 443, 1024-65535</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>Skype HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Simple Instant Messenger</Name>
    <App>sim.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SIM MSN Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1863</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SIM Yahoo Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5050</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SIM Jabber Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5222</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SIM HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 5190, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Gizmo</Name>
    <App>Gizmo.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo Main UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>1024-65535</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo RTP Traffic Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5004</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo Real Time Control Protocol Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5005</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo SIP Messaging Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>64064</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo Localhost TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <RemotePort>1024-65535</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo SRS Relay And Jabber Protocol Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>7070</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gizmo HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Bonjour Service</Name>
    <App>mDNSResponder.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Bonjour Service UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5353</LocalPort>
      <RemotePort>5353</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
  </AppRule>
<!-- Antiviral -->
  <AppRule>
    <Name>Dr. Web Update</Name>
    <App>drwebupw.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dr. Web Update</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SpIDer Mail</Name>
    <App>spiderml.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SpIDer Mail Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995 </RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NOD32 AntiVirus Control Centre</Name>
    <App>nod32cc.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NOD32 Update</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NOD32 AntiVirus EMail Scanner</Name>
    <App>pop3scan.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Scan Inbound Mail For Viruses</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Symantec Common Client Application</Name>
    <App>ccapp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Scan Inbound Mail For Viruses</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 110, 143, 465, 993, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Symantec LiveUpdate</Name>
    <App>lucomserver.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Symantec LiveUpdate HTTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Symantec LiveUpdate FTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Symantec LiveUpdate FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>KAV Updater</Name>
    <App>avpupd.exe, kavsvc.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KAV Updater HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KAV Updater FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KAV Updater FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>McAfee Update</Name>
    <App>mupdate.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>McAfee Update</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>BitDefender Update</Name>
    <App>bdmcon.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>BitDefender Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SpywareBlaster AutoUpdate</Name>
    <App>spywareblaster.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SpywareBlaster AutoUpdate Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AntiSpywareMain</Name>
    <App>GIANTAntiSpywareMain.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft AntiSpyware Main HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AntiSpyware Data Service</Name>
    <App>gcasDtServ.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft AntiSpyware Data Service HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AntiSpyware Updater</Name>
    <App>GIANTAntiSpywareUpdater.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft AntiSpyware Updater HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AntiSpyware Service User Interface</Name>
    <App>gcasServAlert.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft AntiSpyware Service User Interface HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Ad-Aware SE</Name>
    <App>Ad-Aware.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Ad-Aware SE Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Spybot - Search&amp;Destroy</Name>
    <App>SpybotSD.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Spybot - Search &amp; Destroy HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>HiJackThis</Name>
    <App>hijackthis.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>HiJackThis Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MooSoft Trojan Scanner And Cleaner</Name>
    <App>cleaner.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MooSoft Trojan Scanner And Cleaner FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>21</RemotePort>
    </Rule>
    <Rule>
      <Name>MooSoft Trojan Scanner And Cleaner FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
      <RemotePort>20</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MooSoft Live Update</Name>
    <App>moolive.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MooSoft Live Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
<!-- Net Utilites -->
  <AppRule>
    <Name>NetLab</Name>
    <App>netlab.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Get Time NetLab Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetLab WhoIs Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>43</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetLab Quote Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>17</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetLab Finger Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>79</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SmartWhois</Name>
    <App>sw3.exe, sw.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SmartWhoIs Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>43</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NeoTrace</Name>
    <App>neotrace.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Neotrace HTTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Neotrace WhoIs</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>43</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>VisualRoute</Name>
    <App>visualroute.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>VisualRoute HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>VisualRoute WhoIs Activity</Name>
      <Protocol>TCP </Protocol>
      <RemotePort>43 </RemotePort>
      <Direction>OutboundStream </Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>DiamondCS Port Explorer</Name>
    <App>PORTEXPLORER.EXE</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DiamondCS Port Explorer NICNAME/WHOIS Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>43</RemotePort>
    </Rule>
    <Rule>
      <Name>DiamondCS Port Explorer Update Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Ping utility</Name>
    <App>ping.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <RuleNonTCPUDP>
      <Name>Any ICMP Activity</Name>
      <Protocol>1</Protocol>
      <Direction>Outbound</Direction>
    </RuleNonTCPUDP>
    <RuleNonTCPUDP>
      <Name>Any ICMPv6 Activity</Name>
      <Protocol>58</Protocol>
      <Direction>Outbound</Direction>
    </RuleNonTCPUDP>
  </AppRule>
  <AppRule>
    <Name>Tracert utility</Name>
    <App>tracert.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NSLookup utility</Name>
    <App>nslookup.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Finger utility</Name>
    <App>finger.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Finger TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>79</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Rcp utility</Name>
    <App>rcp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Rcp TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>514</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Remote Process Execution utility</Name>
    <App>rexec.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Remote Process Execution TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>512</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Lpq utility</Name>
    <App>lpq.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Lpq TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>515</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Rsh utility</Name>
    <App>rsh.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Rsh TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>514</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Lpr utility</Name>
    <App>lpr.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Lpr TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>515</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Tftp utility</Name>
    <App>tftp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tftp UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>69</RemotePort>
    </Rule>
  </AppRule>
<!-- Time Synchronizers -->
  <AppRule>
    <Name>Chameleon Clock</Name>
    <App>chamclock.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Chameleon Clock Time Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Advanced System Agent</Name>
    <App>asa_ext.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Advanced System Agent Time Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>12Ghosts Synchronize</Name>
    <App>12sync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>12Ghosts Synchronize SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
    <Rule>
      <Name>12Ghosts Synchronize Time Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>37</RemotePort>
    </Rule>
    <Rule>
      <Name>12Ghosts Synchronize Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>1st Atomic Time</Name>
    <App>1stat.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>1st Atomic Time SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
    <Rule>
      <Name>1st Atomic Time Daytime Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Absolute Time Corrector</Name>
    <App>atc.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Absolute Time Corrector Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AceClock Pro</Name>
    <App>aceclock.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AceClock Pro SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
    <Rule>
      <Name>AceClock Pro Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Atom Timer</Name>
    <App>atomt.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Atom Timer Daytime Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AtomSync</Name>
    <App>atomuhr.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AtomSync SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Attache Transparent Clock</Name>
    <App>attacheclock.exe, configtool.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Attache Clock SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Desktop Atomic Clock</Name>
    <App>dac.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Desktop Atomic Clock Daytime Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>DS Clock</Name>
    <App>dsclock.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DS Clock SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Easy Time</Name>
    <App>easytime.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Easy Time SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>EZTimeSync</Name>
    <App>eztimesync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>EZTimeSync Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Dimension 4</Name>
    <App>d4.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dimension 4 SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
    <Rule>
      <Name>Dimension 4 Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Dimension 4 Time Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>37</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NMEATime</Name>
    <App>nmeatime.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NMEATime Daytime Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NMEATime SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SolidSync</Name>
    <App>solidsync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SolidSync Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Tardis</Name>
    <App>tardis.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tardis SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
    <Rule>
      <Name>Tardis Time Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>37</RemotePort>
    </Rule>
    <Rule>
      <Name>Tardis Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tardis Daytime Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tardis HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Tech-Pro World Clock</Name>
    <App>worldclock.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Tech-Pro World Clock Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>TimeSync</Name>
    <App>timesync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TimeSync Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Time Sync Pro</Name>
    <App>timesync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Time Sync Pro SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>TSync</Name>
    <App>tsync.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>TSync Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebTime</Name>
    <App>webtime.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebTime Time Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>37</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>YATS32</Name>
    <App>yats32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>YATS32 SNTP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>123</RemotePort>
    </Rule>
  </AppRule>
<!-- Multimedia -->
  <AppRule>
    <Name>Ashampoo Media Player+</Name>
    <App>ampplus.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Ashampoo Media Player+ Info Channel</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>195.125.111.109</RemoteAddress>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>DivX Player</Name>
    <App>DivX Player 2.0 Alpha.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DivX Player HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MusicMatch Jukebox</Name>
    <App>mmjb.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MusicMatch Jukebox HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MusicMatch Jukebox Update</Name>
    <App>mmupdatemgr.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MusicMatch Jukebox Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Sonique</Name>
    <App>sqstart.exe, Sonique.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Sonique HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WinAmp</Name>
    <App>winamp.exe, studio.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinAmp Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>8000-8900</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinAmp MiniBrowser Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Windows Media Player</Name>
    <App>mplayer2.exe, wmplayer.exe, wmpnetwk.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Media Player HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Media Player Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1755, 2869, 8000, 8001, 9000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>CDex</Name>
    <App>cdex.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CDex HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 888, 1080, 3128, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>QuickTime</Name>
    <App>quicktimeplayer.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>QuickTime Player Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>554</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>QuickTime Player Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>2001</RemotePort>
    </Rule>
    <Rule>
      <Name>QuickTime Player HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>RealPlayer</Name>
    <App>realplay.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>RealPlayer Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>554, 7070, 7071</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>RealPlayer HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>RealPlayer Inbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>6770-32000</LocalPort>
    </Rule>
    <Rule>
      <Name>RealPlayer Outbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>6770-32000</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>RealNetworks Event Launcher</Name>
    <App>realevent.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>RealNetworks Event Launcher HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Nero 6 Updater</Name>
    <App>NeroStartSmart.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Nero 6 Updater HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>jetCast streaming server</Name>
    <App>JCSERVER.EXE</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>jetCast Server MediaStream Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
      <LocalPort>9000, 9001</LocalPort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>jetAudio</Name>
    <App>JETAUDIO.EXE</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>JetAudio HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 9000, 9001, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>jetCast</Name>
    <App>JETCAST.EXE</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>jetCast HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 9000, 9001, 11523</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>jetChat</Name>
    <App>JETCHAT.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>jetChat Outbound Chatting Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 9010, 11523</RemotePort>
    </Rule>
    <Rule>
      <Name>jetChat Inbound Chatting Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
      <LocalPort>9010</LocalPort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>jetAudio TrueUpdate 2.0 Client</Name>
    <App>JETUPDATE.EXE</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>JetAudio Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
    </Rule>
  </AppRule>
<!-- Internet Search -->
  <AppRule>
    <Name>Copernic</Name>
    <App>copernicsvr.exe, copernic.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Copernic Search Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- P2P -->
  <AppRule>
    <Name>eMule Default</Name>
    <App>emule.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>eMule Client To Client Source Exchange</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>4662</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>eMule Client To Client Source Exchange</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>4662</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>eMule Queue Rating, File Reask Ping</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>4672</LocalPort>
    </Rule>
    <Rule>
      <Name>eMule Queue Rating, File Reask Ping</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>4672</RemotePort>
    </Rule>
    <Rule>
      <Name>eMule Activity To Server</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>4661</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>eMule Source Asking On Servers</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>4665</RemotePort>
    </Rule>
    <Rule>
      <Name>eMule Webserver</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>4711</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>eMule HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>iMesh</Name>
    <App>imeshclient.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>iMesh Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>4000-5000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>iMesh HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>KaZaA Media Desktop</Name>
    <App>kazaa.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KaZaA Media Desktop Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1214</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KaZaA Media Desktop Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1214</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>KaZaA Media Desktop HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Morpheus</Name>
    <App>morpheus.exe, morpheusp.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Morpheus Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1214</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Morpheus Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>1214</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Morpheus HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WinMX</Name>
    <App>winmx.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinMX Server Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5690, 6257, 6699, 7729-7735, 7940-7952</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinMX Inbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>6257</RemotePort>
    </Rule>
    <Rule>
      <Name>WinMX Inbound TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>6699</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WinMX HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Direct Connect</Name>
    <App>direct connect.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Direct Connect Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>411</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Direct Connect Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>412</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Direct Connect HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>AudioGalaxy</Name>
    <App>agsatellite.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AudioGalaxy Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21, 1117-5190, 41000 - 50000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>AudioGalaxy Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>21, 1117-5190, 41000 - 50000</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>BearShare</Name>
    <App>bearshare.exe, bearsharepro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>BearShare HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>BearShare Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6346-6349</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>BearShare Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>6346</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Gnotella</Name>
    <App>gnotella.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gnotella HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80, 3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gnotella Outbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6346-6352</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Gnotella Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>6346</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Soulseek</Name>
    <App>slsk.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Soulseek HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80, 3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Soulseek HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Soulseek Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>2234-2240, 5534, 6997</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Soulseek Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>2234</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Blubster</Name>
    <App>blubster.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Blubster HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80, 3128, 8080, 8088</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Blubster Outbound Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>41170</RemotePort>
    </Rule>
    <Rule>
      <Name>Blubster Inbound Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>41170</LocalPort>
    </Rule>
  </AppRule>
<!-- Storage -->
  <AppRule>
    <Name>Storage</Name>
    <App>idriveproxy.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>I-drive Storage Server</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>443</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Microsoft -->
  <AppRule>
    <Name>Microsoft Excel</Name>
    <App>excel.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Excel HTTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Excel FTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Excel FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Excel Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 110</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Excel LDAP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Excel MSSQL</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1433, 1434</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Word</Name>
    <App>winword.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Word HTTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Word FTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Word FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Word Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 110</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Word LDAP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Microsoft Access</Name>
    <App>msaccess.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Access HTTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Access FTP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Access FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Access Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25, 110</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Access LDAP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Word Processing -->
  <AppRule>
    <Name>Adobe Acrobat</Name>
    <App>acrobat.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Update Adobe Acrobat</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Adobe Acrobat Reader</Name>
    <App>acrord32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Update Adobe Acrobat Reader</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>EditPad Pro</Name>
    <App>editpadpro.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By EditPad Pro</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Download/Update EPP Syntax Colour Schemes</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80</RemotePort>
      <RemoteAddress>216.92.230.239</RemoteAddress>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Babylon</Name>
    <App>babylon.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Babylon HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Encryption -->
  <AppRule>
    <Name>ECM SignCode</Name>
    <App>signcode.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ECM SignCode HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>PGP Keys</Name>
    <App>pgpkeys.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PGP Keys HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PGP Keys Server Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>11370-11371</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PGP Keys LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- E-Commerce -->
  <AppRule>
    <Name>Cyphermint PayCash</Name>
    <App>wallet.exe, cyphermintwallet.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Cyphermint PayCash Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>8128</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Cyphermint PayCash PROXY Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3128, 8080</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Cyphermint PayCash Inbound Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>8128</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WebMoney</Name>
    <App>webmoney.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebMoney Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>2802</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>WebMoney HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- ARC -->
  <AppRule>
    <Name>PowerArchiver</Name>
    <App>powerarc.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Update PowerArchiver</Name>
      <Protocol>TCP</Protocol>
      <RemoteAddress>140.99.102.66</RemoteAddress>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Server -->
  <AppRule>
    <Name>Pointcast SMTP Server</Name>
    <App>pointcastserver.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By PointCast Server</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PointCast Server HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>FTP Server</Name>
    <App>ftpserve.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>FTP Server Inbound FTP Activity </Name>
      <Protocol>TCP</Protocol>
      <LocalPort>21</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Serv-U FTP Server</Name>
    <App>servudaemon.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Serv-U FTP Server Activity </Name>
      <Protocol>TCP</Protocol>
      <LocalPort>21</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Cerberus FTP Server</Name>
    <App>cerberus.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Cerberus FTP Server Activity </Name>
      <Protocol>TCP</Protocol>
      <LocalPort>21</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Games -->
  <AppRule>
    <Name>Catch the Sperm!</Name>
    <App>catchthesperm.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Catch The Sperm! HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Catch the Sperm II</Name>
    <App>catchthesperm2.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Catch the Sperm! HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Medal of Honour: Allied Assault</Name>
    <App>mohaa.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Medal Of Honour Outbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>12203, 12206</RemotePort>
    </Rule>
    <Rule>
      <Name>Medal Of Honour Inbound UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>12203, 12206</RemotePort>
    </Rule>
    <Rule>
      <Name>Medal Of Honour Send &apos;heartbeat&apos; To Master Server</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>27900</RemotePort>
      <RemoteAddress>216.177.89.34</RemoteAddress>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Championship Manager</Name>
    <App>cm0001.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Championship Manager TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6667</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Championship Manager UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>6667</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Ultima Online</Name>
    <App>uo.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Ultima Online</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>7785, 9999, 5001-5010, 7775-7777, 8800-8900</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Quake II</Name>
    <App>quake2.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Quake II TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>27901</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Quake II UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>27910-27961</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Quake III</Name>
    <App>quake3.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Quake III TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>27950-30000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Quake III UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>1025, 27910-30000</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Unreal</Name>
    <App>unreal.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Unreal TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>7777, 8888, 27900</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Unreal UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>7777-7781</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Delta Force</Name>
    <App>df.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Delta Force TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>3100-3999</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Delta Force UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>3100-3999, 3568-3569</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Half-Life</Name>
    <App>hl.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Half-Life TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>6000-6003, 7001</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Half-Life UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>27000-28000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Half-Life Server UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>27015</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Game Zone</Name>
    <App>zclientm.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN(tm) Zone TCP Activity</Name>
      <Enable>0</Enable>
      <Protocol>TCP</Protocol>
      <RemotePort>6667, 8000-9000, 9110, 9113, 8995-11000, 28800-29000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MSN(tm) Zone UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>0, 8000-9000, 9000-9100, 28800-29000</RemotePort>
    </Rule>
    <Rule>
      <Name>DirectX And Direct Play Games TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>2300-2400, 47264</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>DirectX And Direct Play Games UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>2300-2400</RemotePort>
    </Rule>
    <Rule>
      <Name>MSN(tm) Zone HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Ricochet</Name>
    <App>ricochet.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Ricochet HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Counter Strike Source</Name>
    <App>hl2.exe, steam.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Client Find Friends Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>1200</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Client Get Servers List Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>27011</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Client Get Servers Info Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>27000-28000</RemotePort>
      <Direction>InboundOutbound</Direction>
    </Rule>
    <Rule>
      <Name>CSS Client In-Game Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>27005-27020</LocalPort>
      <RemotePort>27015-27020</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Client Steam Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>27020-27039</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>CSS Dedicated Server</Name>
    <App>srcds.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Dedicated Server Registration Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>27015-27020</LocalPort>
      <RemotePort>27011</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Dedicated Server In-Game Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>27015-27020</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Dedicated Server Remote Console Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>27015-27020</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
    <Rule>
      <Name>CSS Dedicated Server Steam Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>27020-27039</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Administration -->
  <AppRule>
    <Name>Citrix ICA</Name>
    <App>pn.exe, wfica32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>ICA Server Search</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>1604</RemotePort>
    </Rule>
    <Rule>
      <Name>ICA Data Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1494</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>NetAdmin (MySQL)</Name>
    <App>netadmin.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>NetAdmin MySQL Data Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>3306</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>PCAnywhere Remote Control</Name>
    <App>awrem32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PCAnywhere UDP Activity (OUT)</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>5632</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PCAnywhere TCP Activity (OUT)</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>5631</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>PCAnywhere Host</Name>
    <App>awhost32.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>PCAnywhere UDP Activity (IN)</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>5632</LocalPort>
    </Rule>
    <Rule>
      <Name>PCAnywhere TCP Activity (IN)</Name>
      <Protocol>TCP</Protocol>
      <Direction>InboundStream</Direction>
      <LocalPort>5631</LocalPort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Remote Administrator Client</Name>
    <App>radmin.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Remote Administrator Client Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>4899</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Remote Administrator Host</Name>
    <App>r_service.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Remote Administrator Host Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>4899</LocalPort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Kaspersky Network Agent</Name>
    <App>KLNAGENT.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Kaspersky Network Agent UDP Main Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>15000</LocalPort>
      <Direction>Inbound</Direction>
    </Rule>
    <Rule>
      <Name>Kaspersky Network Agent TCP Main Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>13000, 14000</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Development tools -->
  <AppRule>
    <Name>Namo WebEditor 2006</Name>
    <App>WEBEDITOR.EXE</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Namo WebEditor 2006 HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Namo WebEditor 2006 FTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>21</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Namo WebEditor 2006 FTP DATA Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>20</RemotePort>
      <Direction>InboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Other -->
  <AppRule>
    <Name>United Devices</Name>
    <App>ud.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>United Devices HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>MTS Balance</Name>
    <App>mtsbalance.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>MTS Balance HTTPS Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>443</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Semagic LiveJournal Client</Name>
    <App>livejournalu.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Semagic LiveJournal Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Google Earth</Name>
    <App>GoogleEarth.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Google Earth HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SiSoftware Sandra Thin Client</Name>
    <App>sandra.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SiSoftware Sandra WebUpdate HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SiSoftware Sandra &apos;Named Pipes&apos; Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>135, 445</RemotePort>
    </Rule>
    <Rule>
      <Name>SiSoftware Sandra HTTP Through IIS Activity</Name>
      <Protocol>TCP</Protocol>
      <Direction>OutboundStream</Direction>
      <RemotePort>80</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SiSoftware Sandra Server</Name>
    <App>RpcSandraSrv.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SiSoftware Sandra Server Internet Peerage Benchmark HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Ulead PhotoImpact</Name>
    <App>iedit.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Ulead PhotoImpact HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Ulead PhotoImpact Updater</Name>
    <App>BatchDL.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Ulead PhotoImpact Update HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Weather Bug - Maxthon Web Browser Plugin</Name>
    <App>weatherbug.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Weather Bug HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Punto Switcher Updater</Name>
    <App>Update.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Punto Switcher Updater HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Anti-Spam -->
  <AppRule>
    <Name>Bounce Spam Mail</Name>
    <App>bsm18.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Send Mail By Bounce Spam Mail</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>25</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SpamPal</Name>
    <App>spampal.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>SpamPal HTTP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>80-83, 443, 1080, 3128, 8000, 8080, 8088, 11523</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Receive Mail By SpamPal</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>110, 995</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- NTDomain -->
  <AppRule>
    <Name>LSASS.EXE</Name>
    <App>lsass.exe</App>
    <Rule>
      <Name>Local Security Authority Service Kerberos TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>88</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Local Security Authority Service Kerberos UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>88</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Local Security Authority Service LDAP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Local Security Authority Service DNS Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Local Security Authority Service DCOM dynamic port allocation</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1025-1040</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Local Security Authority Service DCOM Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>SERVICES.EXE</Name>
    <App>services.exe</App>
    <Rule>
      <Name>Localhost UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemoteAddress>127.0.0.1</RemoteAddress>
      <RemoteAddressIPv6>::1</RemoteAddressIPv6>
      <RemotePort>1024-65535</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Services DNS Service Over UDP</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Services DNS Service Over TCP</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Services DCOM Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Services DCOM Dynamic Port Allocation</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>1090-1110</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Services LDAP Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>WINLOGON.EXE</Name>
    <App>winlogon.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Winlogon LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <RuleNonTCPUDP>
      <Name>Any ICMP Activity</Name>
      <Protocol>1</Protocol>
      <Direction>Outbound</Direction>
    </RuleNonTCPUDP>
    <RuleNonTCPUDP>
      <Name>Any ICMPv6 Activity</Name>
      <Protocol>58</Protocol>
      <Direction>Outbound</Direction>
    </RuleNonTCPUDP>
  </AppRule>
  <AppRule>
    <Name>USERINIT.EXE</Name>
    <App>userinit.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Userinit LDAP Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>389, 3268</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Microsoft Userinit DCOM Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>135</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>System</Name>
    <App>system</App>
    <Rule>
      <Name>Allow Any UDP Activity</Name>
      <Protocol>UDP</Protocol>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Cisco VPN Client</Name>
    <App>vpngui.exe, cvpnd.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Cisco VPN Client Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>62514, 62516</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Cisco VPN Client Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>500</LocalPort>
      <RemotePort>500</RemotePort>
    </Rule>
  </AppRule>
  <AppRule>
    <Name>Kerio VPN Client</Name>
    <App>kvpnclient.exe</App>
    <Rule>
      <Name>DNS Service</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>53</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Kerio VPN Client UDP Activity</Name>
      <Protocol>UDP</Protocol>
      <LocalPort>4090</LocalPort>
      <RemotePort>4090</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Kerio VPN Client TCP Activity</Name>
      <Protocol>TCP</Protocol>
      <LocalPort>4090</LocalPort>
      <RemotePort>4090</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Win98 -->
  <AppRule>
    <Name>Windows Routing Process</Name>
    <App>MPREXE.EXE</App>
    <Rule>
      <Name>Windows Routing Process NetBIOS Name Service Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>137</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Routing Process NetBIOS Datagram Service Activity</Name>
      <Protocol>UDP</Protocol>
      <RemotePort>138</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
    <Rule>
      <Name>Windows Routing Process NetBIOS Session Service Activity</Name>
      <Protocol>TCP</Protocol>
      <RemotePort>139</RemotePort>
      <Direction>OutboundStream</Direction>
    </Rule>
  </AppRule>
<!-- Packet Rules -->
  <PacketRule>
    <Name>ICMP Type 3 (Destination unreachable)</Name>
    <Protocol>1</Protocol>
    <Direction>Inbound</Direction>
    <IcmpCode>3</IcmpCode>
  </PacketRule>
  <PacketRule>
    <Name>ICMP Type 0 (Echo Reply)</Name>
    <Protocol>1</Protocol>
    <Direction>Inbound</Direction>
    <IcmpCode>0</IcmpCode>
  </PacketRule>
  <PacketRule>
    <Name>ICMP Type 11 (Time Exceeded)</Name>
    <Protocol>1</Protocol>
    <Direction>Inbound</Direction>
    <IcmpCode>11</IcmpCode>
  </PacketRule>
  <PacketRule>
    <Name>Other ICMP Types</Name>
    <Allow>0</Allow>
    <Protocol>1</Protocol>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRuleIPv6>
    <Name>ICMPv6 Type 128 (Echo)</Name>
    <Allow>0</Allow>
    <Protocol>58</Protocol>
    <Direction>Inbound</Direction>
    <IcmpCode>128</IcmpCode>
  </PacketRuleIPv6>
  <PacketRuleIPv6>
    <Name>ICMPv6 Type 129 (Echo Reply)</Name>
    <Allow>0</Allow>
    <Protocol>58</Protocol>
    <Direction>Outbound</Direction>
    <IcmpCode>129</IcmpCode>
  </PacketRuleIPv6>
  <PacketRule>
    <Name>DHCP Client Activity</Name>
    <Protocol>UDP</Protocol>
    <LocalPort>68, 546</LocalPort>
    <RemotePort>67, 547</RemotePort>
    <Direction>InboundOutbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;DCOM RPC&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>135</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;DCOM RPC&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>135</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;Internet Name Service&quot; Activity</Name>
    <Protocol>UDP</Protocol>
    <LocalPort>137</LocalPort>
    <Direction>InboundOutbound</Direction>
    <RemoteAddress>%wins%</RemoteAddress>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;NetBIOS Name Service&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>137</LocalPort>
    <Direction>InboundOutbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;NetBIOS Datagram Service&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>138</LocalPort>
    <Direction>InboundOutbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;NetBIOS Session Service&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>139</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;Server Message Block&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>445</LocalPort>
    <Direction>InboundOutbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Windows &quot;Server Message Block&quot; Activity</Name>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>445</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Localhost Loopback UDP Activity</Name>
    <Enable>0</Enable>
    <Protocol>UDP</Protocol>
    <RemoteAddress>127.0.0.1</RemoteAddress>
    <RemoteAddressIPv6>::1</RemoteAddressIPv6>
  </PacketRule>
  <PacketRule>
    <Name>Localhost Loopback TCP Activity</Name>
    <Enable>0</Enable>
    <Protocol>TCP</Protocol>
    <RemoteAddress>127.0.0.1</RemoteAddress>
    <RemoteAddressIPv6>::1</RemoteAddressIPv6>
  </PacketRule>
  <PacketRule>
    <Name>PPTP Control Activity</Name>
    <Enable>0</Enable>
    <Protocol>TCP</Protocol>
    <LocalPort>1024-65535</LocalPort>
    <RemotePort>1723</RemotePort>
    <Direction>OutboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;NetSky&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>82, 665</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Padobot&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>113, 3067, 2041</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Farnaz&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>133</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Krass&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>456</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Backdoor.jr&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>777</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Sobig&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>995, 996, 997, 998, 999</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Dumaru&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1001, 2283, 10000</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Kipis&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1029</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;MyDoom&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1034, 1042, 1080, 3127-3198, 5422, 5424, 10080</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Warhome.a&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1035</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Bugbear&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1080</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Bagle&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1080, 1234, 2535, 2556, 2745, 4751, 6777, 8866, 9035</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Orion&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1150</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Plexus&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1250</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Bofra&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1639</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Bifrose&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>1971</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Skybag&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>2345</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Vesser&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>2766</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Brador&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>2989</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Mimail&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>3000</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Delf&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>3195</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;OptixPro&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>3410</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Busters&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>3950</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Lovesan&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>4444</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Backdoor.iw/Nail&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>4567</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Tettona&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>5001</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Jix&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>5533</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Sasser&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>5554, 9996</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Sysbug/Mimail&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>5555</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;LovGate&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>6000</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Glace.a&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>7386</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;G_Door&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>7626</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Zebroxy&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>8137, 23116, 54112</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Zafi&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>8181</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Bozori&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>8594</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Mytob&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>8888, 33333</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Dabber&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>8967, 9898</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Mitglieder&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>11117</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;DipNet&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>11768</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Latinus.svr&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>11831, 29559</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;NetBus&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>12345</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Backdoor.qr&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>12973, 12975</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Haxdoor&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>16661</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Kuang&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>17300</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;XControl&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>18081</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Rux.30&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>22222</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;SubSeven&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>27374</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Small.a/Small.ad&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>28185, 44888</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;BackOrifice&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>31337</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Tanatos&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>36794</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Mitglieder&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>39999</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Autooter&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>57005</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Agobot&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>TCP</Protocol>
    <LocalPort>65506</LocalPort>
    <Direction>InboundStream</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Gst&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>1047, 2048</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Scalper&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>2001</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Osf&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>3049</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Hupigon&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>8310</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Sobig&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>8998</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Small.a/Small.b&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>12345, 48992</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
  <PacketRule>
    <Name>Malicious Software &quot;Netso&quot; Ports</Name>
    <Enable>0</Enable>
    <Allow>0</Allow>
    <Protocol>UDP</Protocol>
    <LocalPort>34031, 34033</LocalPort>
    <Direction>Inbound</Direction>
  </PacketRule>
</Presets>
; 0XLSznpdI71fB300e7Uwj1gJHeyRrqvBbkBToE7okYz6oY4gwInrM6KuIo­­