diff --git a/src/editor.c b/src/editor.c
index ec9cace1..e6c9abc0 100644
--- a/src/editor.c
+++ b/src/editor.c
@@ -535,7 +535,7 @@ INT_PTR CALLBACK PropertiesPagesProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM
 					while (_r_obj_enumhashtablepointer (apps_table, &ptr_app, NULL, &enum_key))
 					{
 						// check for services
-						is_enabled = (_r_obj_findhashtable (context->ptr_rule->apps, ptr_app->app_hash)) || (context->ptr_rule->is_forservices && (ptr_app->app_hash == config.ntoskrnl_hash || ptr_app->app_hash == config.svchost_hash));
+						is_enabled = (_r_obj_findhashtable (context->ptr_rule->apps, ptr_app->app_hash)) || (context->ptr_rule->is_forservices && _app_issystemhash (ptr_app->app_hash));
 
 						_app_setcheckboxlock (hwnd, IDC_RULE_APPS_ID, TRUE);
 
@@ -637,7 +637,7 @@ INT_PTR CALLBACK PropertiesPagesProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM
 						continue;
 
 					// check for services
-					is_enabled = ((ptr_rule->is_forservices && (context->ptr_app->app_hash == config.ntoskrnl_hash || context->ptr_app->app_hash == config.svchost_hash)) || _r_obj_findhashtable (ptr_rule->apps, context->ptr_app->app_hash));
+					is_enabled = ((ptr_rule->is_forservices && _app_issystemhash (context->ptr_app->app_hash)) || _r_obj_findhashtable (ptr_rule->apps, context->ptr_app->app_hash));
 
 					_app_setcheckboxlock (hwnd, IDC_APP_RULES_ID, TRUE);
 
@@ -1555,7 +1555,7 @@ INT_PTR CALLBACK PropertiesProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wpar
 
 								app_hash = _app_getlistviewitemcontext (hpage_apps, IDC_RULE_APPS_ID, i);
 
-								if (context->ptr_rule->is_forservices && (app_hash == config.ntoskrnl_hash || app_hash == config.svchost_hash))
+								if (context->ptr_rule->is_forservices && _app_issystemhash (app_hash))
 									continue;
 
 								if (_app_isappfound (app_hash))
diff --git a/src/global.h b/src/global.h
index 89793b60..6e97d2a9 100644
--- a/src/global.h
+++ b/src/global.h
@@ -29,6 +29,7 @@
 #include "resource.h"
 
 DECLSPEC_SELECTANY STATIC_DATA config = {0};
+DECLSPEC_SELECTANY PROFILE_DATA profile_info = {0};
 
 DECLSPEC_SELECTANY PR_HASHTABLE apps_table = NULL;
 DECLSPEC_SELECTANY PR_HASHTABLE context_table = NULL;
diff --git a/src/helper.c b/src/helper.c
index 35198a42..f6d2ea32 100644
--- a/src/helper.c
+++ b/src/helper.c
@@ -631,7 +631,7 @@ HICON _app_getfileiconsafe (_In_ ULONG_PTR app_hash)
 
 LPCWSTR _app_getappdisplayname (_In_ PITEM_APP ptr_app, _In_ BOOLEAN is_shortened)
 {
-	if (ptr_app->app_hash == config.ntoskrnl_hash)
+	if (ptr_app->app_hash == profile_info.ntoskrnl_hash)
 	{
 		if (ptr_app->original_path)
 			return ptr_app->original_path->buffer;
@@ -1979,7 +1979,7 @@ BOOLEAN _app_getnetworkpath (_In_ ULONG pid, _In_opt_ PULONG64 modules, _Inout_
 	}
 	else if (pid == PROC_SYSTEM_PID)
 	{
-		ptr_network->app_hash = config.ntoskrnl_hash;
+		ptr_network->app_hash = profile_info.ntoskrnl_hash;
 		ptr_network->type = DATA_APP_REGULAR;
 		ptr_network->path = _r_obj_createstring (PROC_SYSTEM_NAME);
 
@@ -2873,16 +2873,14 @@ VOID _app_generate_timerscontrol (_In_ HMENU hsubmenu, _In_opt_ PITEM_APP ptr_ap
 	}
 
 	if (!is_checked)
-	{
 		_r_menu_checkitem (hsubmenu, IDM_DISABLETIMER, IDM_DISABLETIMER, MF_BYCOMMAND, IDM_DISABLETIMER);
-	}
 }
 
 BOOLEAN _app_setruletoapp (_In_ HWND hwnd, _Inout_ PITEM_RULE ptr_rule, _In_ INT item_id, _In_ PITEM_APP ptr_app, _In_ BOOLEAN is_enable)
 {
 	INT listview_id;
 
-	if (ptr_rule->is_forservices && (ptr_app->app_hash == config.ntoskrnl_hash || ptr_app->app_hash == config.svchost_hash))
+	if (ptr_rule->is_forservices && _app_issystemhash (ptr_app->app_hash))
 		return FALSE;
 
 	if (is_enable == (_r_obj_findhashtable (ptr_rule->apps, ptr_app->app_hash) != NULL))
diff --git a/src/main.c b/src/main.c
index a4635eae..af2316d8 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1696,18 +1696,18 @@ VOID _app_initialize ()
 		_r_obj_initializestringref_ex (&config.windows_dir, config.windows_dir_buffer, length * sizeof (WCHAR));
 	}
 
-	_r_str_printf (config.profile_path, RTL_NUMBER_OF (config.profile_path), L"%s\\" XML_PROFILE, _r_app_getprofiledirectory ());
-	_r_str_printf (config.profile_path_backup, RTL_NUMBER_OF (config.profile_path_backup), L"%s\\" XML_PROFILE L".bak", _r_app_getprofiledirectory ());
-	_r_str_printf (config.profile_internal_path, RTL_NUMBER_OF (config.profile_internal_path), L"%s\\" XML_PROFILE_INTERNAL, _r_app_getprofiledirectory ());
+	_r_str_printf (profile_info.profile_path, RTL_NUMBER_OF (profile_info.profile_path), L"%s\\" XML_PROFILE, _r_app_getprofiledirectory ());
+	_r_str_printf (profile_info.profile_path_backup, RTL_NUMBER_OF (profile_info.profile_path_backup), L"%s\\" XML_PROFILE L".bak", _r_app_getprofiledirectory ());
+	_r_str_printf (profile_info.profile_internal_path, RTL_NUMBER_OF (profile_info.profile_internal_path), L"%s\\" XML_PROFILE_INTERNAL, _r_app_getprofiledirectory ());
 
-	config.my_path = _r_obj_createstring (_r_sys_getimagepath ());
-	config.svchost_path = _r_obj_concatstrings (2, _r_sys_getsystemdirectory (), PATH_SVCHOST);
-	config.system_path = _r_obj_createstring (PROC_SYSTEM_NAME);
-	config.ntoskrnl_path = _r_obj_concatstrings (2, _r_sys_getsystemdirectory (), PATH_NTOSKRNL);
+	profile_info.my_path = _r_obj_createstring (_r_sys_getimagepath ());
+	profile_info.svchost_path = _r_obj_concatstrings (2, _r_sys_getsystemdirectory (), PATH_SVCHOST);
+	profile_info.system_path = _r_obj_createstring (PROC_SYSTEM_NAME);
+	profile_info.ntoskrnl_path = _r_obj_concatstrings (2, _r_sys_getsystemdirectory (), PATH_NTOSKRNL);
 
-	config.my_hash = _r_obj_getstringhash (config.my_path);
-	config.ntoskrnl_hash = _r_obj_getstringhash (config.system_path);
-	config.svchost_hash = _r_obj_getstringhash (config.svchost_path);
+	profile_info.my_hash = _r_obj_getstringhash (profile_info.my_path);
+	profile_info.ntoskrnl_hash = _r_obj_getstringhash (profile_info.system_path);
+	profile_info.svchost_hash = _r_obj_getstringhash (profile_info.svchost_path);
 
 	// initialize free list
 	_r_freelist_initialize (&context_free_list, sizeof (ITEM_CONTEXT), 32);
@@ -1854,9 +1854,9 @@ INT_PTR CALLBACK DlgProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam, _In
 			if (!_r_config_getboolean (L"IsInternalRulesDisabled", FALSE))
 			{
 				WCHAR internal_profile_version[64];
-				_r_str_fromlong64 (internal_profile_version, RTL_NUMBER_OF (internal_profile_version), config.profile_internal_timestamp);
+				_r_str_fromlong64 (internal_profile_version, RTL_NUMBER_OF (internal_profile_version), profile_info.profile_internal_timestamp);
 
-				_r_update_addcomponent (L"Internal rules", L"rules", internal_profile_version, config.profile_internal_path, FALSE);
+				_r_update_addcomponent (L"Internal rules", L"rules", internal_profile_version, profile_info.profile_internal_path, FALSE);
 			}
 
 			// create network monitor thread
@@ -1932,7 +1932,7 @@ INT_PTR CALLBACK DlgProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam, _In
 
 			_r_queuedlock_releaseexclusive (&lock_rules_config);
 
-			_r_fs_makebackup (config.profile_path, TRUE);
+			_r_fs_makebackup (profile_info.profile_path, TRUE);
 
 			_app_profile_load (hwnd, NULL);
 
@@ -2214,7 +2214,7 @@ INT_PTR CALLBACK DlgProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam, _In
 
 						if ((lpnmlv->uNewState & LVIS_STATEIMAGEMASK) == INDEXTOSTATEIMAGEMASK (1))
 						{
-							if (app_hash == config.my_hash)
+							if (app_hash == profile_info.my_hash)
 							{
 								if (!_r_show_confirmmessage (hwnd, L"WARNING!", L"If you disallow this, you cannot use resolve network addresses option. Continue?", NULL))
 								{
@@ -2225,7 +2225,7 @@ INT_PTR CALLBACK DlgProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam, _In
 						}
 						else if ((lpnmlv->uNewState & LVIS_STATEIMAGEMASK) == INDEXTOSTATEIMAGEMASK (2))
 						{
-							if (app_hash == config.svchost_hash)
+							if (app_hash == profile_info.svchost_hash)
 							{
 								if (!_r_show_confirmmessage (hwnd, L"WARNING!", L"Be careful, through service host (svchost.exe) internet traffic can let out through unexpected ways. Continue?", NULL))
 								{
@@ -2730,7 +2730,7 @@ INT_PTR CALLBACK DlgProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam, _In
 								else
 								{
 									// made backup
-									_r_fs_deletefile (config.profile_path_backup, TRUE);
+									_r_fs_deletefile (profile_info.profile_path_backup, TRUE);
 									_app_profile_save ();
 
 									_app_profile_load (hwnd, path->buffer); // load profile
@@ -2772,7 +2772,7 @@ INT_PTR CALLBACK DlgProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam, _In
 								_app_profile_save ();
 
 								// added information for export profile failure (issue #707)
-								if (!_r_fs_copyfile (config.profile_path, path->buffer, 0))
+								if (!_r_fs_copyfile (profile_info.profile_path, path->buffer, 0))
 								{
 									R_ERROR_INFO error_info = {0};
 									error_info.description = path->buffer;
diff --git a/src/notifications.c b/src/notifications.c
index f30a71b5..5c722905 100644
--- a/src/notifications.c
+++ b/src/notifications.c
@@ -1099,7 +1099,7 @@ INT_PTR CALLBACK NotificationProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wp
 
 				if (ptr_log)
 				{
-					if (ptr_log->app_hash && !(ptr_rule->is_forservices && (ptr_log->app_hash == config.ntoskrnl_hash || ptr_log->app_hash == config.svchost_hash)))
+					if (ptr_log->app_hash && !(ptr_rule->is_forservices && _app_issystemhash (ptr_log->app_hash)))
 					{
 						ptr_app = _app_getappitem (ptr_log->app_hash);
 
diff --git a/src/profile.c b/src/profile.c
index 5b3527e9..ab1c4ad4 100644
--- a/src/profile.c
+++ b/src/profile.c
@@ -192,7 +192,7 @@ ULONG_PTR _app_addapplication (_In_opt_ HWND hwnd, _In_ ENUM_TYPE_DATA type, _In
 		return app_hash; // already exists
 
 	ptr_app = _r_obj_allocate (sizeof (ITEM_APP), &_app_dereferenceapp);
-	is_ntoskrnl = (app_hash == config.ntoskrnl_hash);
+	is_ntoskrnl = (app_hash == profile_info.ntoskrnl_hash);
 
 	ptr_app->app_hash = app_hash;
 
@@ -225,7 +225,7 @@ ULONG_PTR _app_addapplication (_In_opt_ HWND hwnd, _In_ ENUM_TYPE_DATA type, _In
 			ptr_app->type = PathIsNetworkPath (path_temp.buffer) ? DATA_APP_NETWORK : DATA_APP_REGULAR;
 		}
 
-		ptr_app->real_path = is_ntoskrnl ? _r_obj_createstring2 (config.ntoskrnl_path) : _r_obj_createstring3 (&path_temp);
+		ptr_app->real_path = is_ntoskrnl ? _r_obj_createstring2 (profile_info.ntoskrnl_path) : _r_obj_createstring3 (&path_temp);
 	}
 
 	ptr_app->original_path = _r_obj_createstring3 (&path_temp);
@@ -804,7 +804,7 @@ VOID _app_ruleblocklistset (_In_opt_ HWND hwnd, _In_ INT spy_state, _In_ INT upd
 		if (hwnd)
 			_app_updatelistviewbylparam (hwnd, DATA_RULE_BLOCKLIST, PR_UPDATE_TYPE | PR_UPDATE_NORESIZE);
 
-			if (is_instantapply)
+		if (is_instantapply)
 		{
 			if (rules->count)
 			{
@@ -886,7 +886,7 @@ PR_STRING _app_rulesexpandapps (_In_ PITEM_RULE ptr_rule, _In_ BOOLEAN is_fordis
 
 	if (is_fordisplay && ptr_rule->is_forservices)
 	{
-		string = _r_obj_concatstrings (4, PROC_SYSTEM_NAME, delimeter, _r_obj_getstring (config.svchost_path), delimeter);
+		string = _r_obj_concatstrings (4, PROC_SYSTEM_NAME, delimeter, _r_obj_getstring (profile_info.svchost_path), delimeter);
 
 		_r_obj_appendstringbuilder2 (&buffer, string);
 
@@ -976,7 +976,7 @@ PR_STRING _app_rulesexpandrules (_In_opt_ PR_STRING rule, _In_ LPCWSTR delimeter
 
 BOOLEAN _app_isappfromsystem (_In_opt_ PR_STRING path, _In_ ULONG_PTR app_hash)
 {
-	if (app_hash == config.ntoskrnl_hash || app_hash == config.svchost_hash)
+	if (_app_issystemhash (app_hash))
 		return TRUE;
 
 	if (path)
@@ -1141,6 +1141,11 @@ BOOLEAN _app_isnetworkfound (_In_ ULONG_PTR network_hash)
 	return is_found;
 }
 
+BOOLEAN _app_issystemhash (_In_ ULONG_PTR app_hash)
+{
+	return (app_hash == profile_info.ntoskrnl_hash || app_hash == profile_info.svchost_hash);
+}
+
 BOOLEAN _app_profile_load_check (_In_ LPCWSTR path)
 {
 	R_XML_LIBRARY xml_library;
@@ -1181,27 +1186,27 @@ VOID _app_profile_load_fallback ()
 {
 	ULONG_PTR app_hash;
 
-	if (!_app_isappfound (config.my_hash))
+	if (!_app_isappfound (profile_info.my_hash))
 	{
-		app_hash = _app_addapplication (NULL, DATA_UNKNOWN, &config.my_path->sr, NULL, NULL);
+		app_hash = _app_addapplication (NULL, DATA_UNKNOWN, &profile_info.my_path->sr, NULL, NULL);
 
 		if (app_hash)
 			_app_setappinfobyhash (app_hash, INFO_IS_ENABLED, IntToPtr (TRUE));
 	}
 
-	_app_setappinfobyhash (config.my_hash, INFO_IS_UNDELETABLE, IntToPtr (TRUE));
+	_app_setappinfobyhash (profile_info.my_hash, INFO_IS_UNDELETABLE, IntToPtr (TRUE));
 
 	// disable deletion for this shit ;)
 	if (!_r_config_getboolean (L"IsInternalRulesDisabled", FALSE))
 	{
-		if (!_app_isappfound (config.ntoskrnl_hash) && config.system_path)
-			_app_addapplication (NULL, DATA_UNKNOWN, &config.system_path->sr, NULL, NULL);
+		if (!_app_isappfound (profile_info.ntoskrnl_hash) && profile_info.system_path)
+			_app_addapplication (NULL, DATA_UNKNOWN, &profile_info.system_path->sr, NULL, NULL);
 
-		if (!_app_isappfound (config.svchost_hash) && config.svchost_path)
-			_app_addapplication (NULL, DATA_UNKNOWN, &config.svchost_path->sr, NULL, NULL);
+		if (!_app_isappfound (profile_info.svchost_hash) && profile_info.svchost_path)
+			_app_addapplication (NULL, DATA_UNKNOWN, &profile_info.svchost_path->sr, NULL, NULL);
 
-		_app_setappinfobyhash (config.ntoskrnl_hash, INFO_IS_UNDELETABLE, IntToPtr (TRUE));
-		_app_setappinfobyhash (config.svchost_hash, INFO_IS_UNDELETABLE, IntToPtr (TRUE));
+		_app_setappinfobyhash (profile_info.ntoskrnl_hash, INFO_IS_UNDELETABLE, IntToPtr (TRUE));
+		_app_setappinfobyhash (profile_info.svchost_hash, INFO_IS_UNDELETABLE, IntToPtr (TRUE));
 	}
 }
 
@@ -1429,7 +1434,7 @@ VOID _app_profile_load_helper (_Inout_ PR_XML_LIBRARY xml_library, _In_ ENUM_TYP
 
 						if (app_hash)
 						{
-							if (ptr_rule->is_forservices && (app_hash == config.ntoskrnl_hash || app_hash == config.svchost_hash))
+							if (ptr_rule->is_forservices && _app_issystemhash (app_hash))
 							{
 								_r_obj_dereference (path_string);
 								continue;
@@ -1671,18 +1676,18 @@ VOID _app_profile_load (_In_opt_ HWND hwnd, _In_opt_ LPCWSTR path_custom)
 
 	_r_queuedlock_acquireshared (&lock_profile);
 
-	hr = _r_xml_parsefile (&xml_library, path_custom ? path_custom : config.profile_path);
+	hr = _r_xml_parsefile (&xml_library, path_custom ? path_custom : profile_info.profile_path);
 
 	// load backup
 	if (hr != S_OK && !path_custom)
-		hr = _r_xml_parsefile (&xml_library, config.profile_path_backup);
+		hr = _r_xml_parsefile (&xml_library, profile_info.profile_path_backup);
 
 	_r_queuedlock_releaseshared (&lock_profile);
 
 	if (hr != S_OK)
 	{
 		if (hr != HRESULT_FROM_WIN32 (ERROR_FILE_NOT_FOUND))
-			_r_log (LOG_LEVEL_ERROR, &GUID_TrayIcon, L"_r_xml_parsefile", hr, path_custom ? path_custom : config.profile_path);
+			_r_log (LOG_LEVEL_ERROR, &GUID_TrayIcon, L"_r_xml_parsefile", hr, path_custom ? path_custom : profile_info.profile_path);
 	}
 	else
 	{
@@ -1730,7 +1735,7 @@ VOID _app_profile_load (_In_opt_ HWND hwnd, _In_opt_ LPCWSTR path_custom)
 
 	// load internal rules (new!)
 	if (!_r_config_getboolean (L"IsInternalRulesDisabled", FALSE))
-		_app_profile_load_internal (config.profile_internal_path, MAKEINTRESOURCE (IDR_PROFILE_INTERNAL), &config.profile_internal_timestamp);
+		_app_profile_load_internal (profile_info.profile_internal_path, MAKEINTRESOURCE (IDR_PROFILE_INTERNAL), &profile_info.profile_internal_timestamp);
 
 	if (hwnd)
 	{
@@ -1785,7 +1790,7 @@ VOID _app_profile_save ()
 	HRESULT hr;
 
 	current_time = _r_unixtime_now ();
-	is_backuprequired = _r_config_getboolean (L"IsBackupProfile", TRUE) && (!_r_fs_exists (config.profile_path_backup) || ((current_time - _r_config_getlong64 (L"BackupTimestamp", 0)) >= _r_config_getlong64 (L"BackupPeriod", BACKUP_HOURS_PERIOD)));
+	is_backuprequired = _r_config_getboolean (L"IsBackupProfile", TRUE) && (!_r_fs_exists (profile_info.profile_path_backup) || ((current_time - _r_config_getlong64 (L"BackupTimestamp", 0)) >= _r_config_getlong64 (L"BackupPeriod", BACKUP_HOURS_PERIOD)));
 
 	hr = _r_xml_initializelibrary (&xml_library, FALSE, NULL);
 
@@ -1795,11 +1800,11 @@ VOID _app_profile_save ()
 		return;
 	}
 
-	hr = _r_xml_createfile (&xml_library, config.profile_path);
+	hr = _r_xml_createfile (&xml_library, profile_info.profile_path);
 
 	if (hr != S_OK)
 	{
-		_r_log (LOG_LEVEL_ERROR, &GUID_TrayIcon, L"_r_xml_createfile", hr, config.profile_path);
+		_r_log (LOG_LEVEL_ERROR, &GUID_TrayIcon, L"_r_xml_createfile", hr, profile_info.profile_path);
 		return;
 	}
 
@@ -2014,7 +2019,7 @@ VOID _app_profile_save ()
 	// make backup
 	if (is_backuprequired)
 	{
-		_r_fs_copyfile (config.profile_path, config.profile_path_backup, 0);
+		_r_fs_copyfile (profile_info.profile_path, profile_info.profile_path_backup, 0);
 		_r_config_setlong64 (L"BackupTimestamp", current_time);
 	}
 }
diff --git a/src/profile.h b/src/profile.h
index be77717d..94d1a826 100644
--- a/src/profile.h
+++ b/src/profile.h
@@ -61,6 +61,8 @@ BOOLEAN _app_isappunused (_In_ PITEM_APP ptr_app);
 
 BOOLEAN _app_isnetworkfound (_In_ ULONG_PTR network_hash);
 
+BOOLEAN _app_issystemhash (_In_ ULONG_PTR app_hash);
+
 FORCEINLINE BOOLEAN _app_isappused (_In_ PITEM_APP ptr_app)
 {
 	if (ptr_app->is_enabled || ptr_app->is_silent || _app_isapphaverule (ptr_app->app_hash, TRUE))
diff --git a/src/wfp.c b/src/wfp.c
index 93783be6..59de0b6d 100644
--- a/src/wfp.c
+++ b/src/wfp.c
@@ -1221,12 +1221,12 @@ BOOLEAN _wfp_create4filters (_In_ HANDLE engine_handle, _In_  PR_LIST rules, _In
 			// apply rules for services hosts
 			if (ptr_rule->is_forservices)
 			{
-				if (!_wfp_createrulefilter (engine_handle, ptr_rule->type, rule_name, config.ntoskrnl_hash, &ptr_rule->config, &rule_remote_part, &rule_local_part, ptr_rule->weight, ptr_rule->action, 0, ptr_rule->guids))
+				if (!_wfp_createrulefilter (engine_handle, ptr_rule->type, rule_name, profile_info.ntoskrnl_hash, &ptr_rule->config, &rule_remote_part, &rule_local_part, ptr_rule->weight, ptr_rule->action, 0, ptr_rule->guids))
 				{
 					ptr_rule->is_haveerrors = TRUE;
 				}
 
-				if (!_wfp_createrulefilter (engine_handle, ptr_rule->type, rule_name, config.svchost_hash, &ptr_rule->config, &rule_remote_part, &rule_local_part, ptr_rule->weight, ptr_rule->action, 0, ptr_rule->guids))
+				if (!_wfp_createrulefilter (engine_handle, ptr_rule->type, rule_name, profile_info.svchost_hash, &ptr_rule->config, &rule_remote_part, &rule_local_part, ptr_rule->weight, ptr_rule->action, 0, ptr_rule->guids))
 				{
 					ptr_rule->is_haveerrors = TRUE;
 				}
@@ -1239,7 +1239,7 @@ BOOLEAN _wfp_create4filters (_In_ HANDLE engine_handle, _In_  PR_LIST rules, _In
 
 				while (_r_obj_enumhashtable (ptr_rule->apps, NULL, &hash_code, &enum_key))
 				{
-					if (ptr_rule->is_forservices && (hash_code == config.ntoskrnl_hash || hash_code == config.svchost_hash))
+					if (ptr_rule->is_forservices && _app_issystemhash (hash_code))
 						continue;
 
 					if (!_wfp_createrulefilter (engine_handle, ptr_rule->type, rule_name, hash_code, &ptr_rule->config, &rule_remote_part, &rule_local_part, ptr_rule->weight, ptr_rule->action, 0, ptr_rule->guids))
@@ -1875,7 +1875,7 @@ ULONG _FwpmGetAppIdFromFileName1 (_In_ PR_STRING path, _In_ ENUM_TYPE_DATA type,
 
 	if (type == DATA_APP_REGULAR || type == DATA_APP_NETWORK || type == DATA_APP_SERVICE)
 	{
-		if (_r_obj_getstringhash (path) == config.ntoskrnl_hash)
+		if (_r_obj_getstringhash (path) == profile_info.ntoskrnl_hash)
 		{
 			ByteBlobAlloc (path->buffer, path->length + sizeof (UNICODE_NULL), byte_blob);