diff --git a/iped-app/resources/config/conf/TaskInstaller.xml b/iped-app/resources/config/conf/TaskInstaller.xml index 92199de9d9..06c75a7a6e 100644 --- a/iped-app/resources/config/conf/TaskInstaller.xml +++ b/iped-app/resources/config/conf/TaskInstaller.xml @@ -15,6 +15,7 @@ + diff --git a/iped-app/resources/scripts/tasks/ClassifyJumplists.js b/iped-app/resources/scripts/tasks/ClassifyJumplists.js new file mode 100644 index 0000000000..7db31ce71a --- /dev/null +++ b/iped-app/resources/scripts/tasks/ClassifyJumplists.js @@ -0,0 +1,847 @@ +/* + * Javascript processing task example. It must be installed in TaskInstaller.xml to be executed. + * Must be implemented at least methods getName() and process(item). + * Script tasks can access properties, extracted text and raw content of items. Based on that, + * it can ignore items, set extra attributes or create bookmarks. + */ + + /* Returns the task name. */ +function getName(){ + return "ClassifyJumpListTask"; +} + +/* +The following list is maintained at https://github.com/EricZimmerman/JumpList/blob/master/JumpList/Resources/AppIDs.txt +If you want to add other IDs, please concat them latter in this IdsList variable for easy copy+paste maintainance of link content. +*/ +let IdsList = `"560D789A6A42AD5A"|"DC++ 0.261 / 0.698 / 0.782 (r2402.1)" +"BCC705F705D8132B"|"Instan-t 5.2 (Build 2824)" +"1D12F965B876DC87"|"Snagit 2021" +"4700FF5AE80A6713"|"PDFCreator 2.2" +"4A49906D074A3AD3"|"Media Go 1.8 (Build 121)" +"6824F4A902C78FBD"|"Firefox 64.0" +"FE9E0F7260000A12"|"RealVNC Server 5.3.0 64-bit (Connect+File Transfer)" +"A2C73C383525F1BB"|"RealVNC Viewer 5.3.0 64-bit" +"D3530C5294441522"|"HydraIRC 0.3.165" +"b37a182b9a7a8098"|"SAPIEN.Packager" +"EE0C103672A7A2B9"|"ManyCam 6.7.0" +"A1D19AFE5A80F80"|"FileZilla 2.2.32" +"FDBD48D45512DFFC"|"Photoshop 7" +"989D7545C2B2E7B2"|"IMVU 465.8.0.0" +"497f749b9f1a5d16"|"Microsoft.GamingApp" +"1EB796D87C32EFF9"|"Firefox 5.0" +"36801066F71B73C5"|"Binbot 2.0" +"CFB56C56FA0F0A54"|"Mozilla 0.9.9" +"50C5E019818564E3"|"Microsoft Excel Viewer 12.0.6219.1000" +"5F218922E0901EBF"|"MusicBee" +"9F5C7755804B850A"|"Windows Script Host - wscript.exe (64-bit)" +"23709F6439B9F03D"|"Hex Editor Neo 5.14(CHANGED)" +"436eb6eb1bd9f03f"|"Microsoft Visio 15" +"33a00252c0fa56de"|"Mozilla Firefox x32" +"ACCCA100973EF8DC"|"Azureus 2.0.8.4" +"D33ECF70F0B74A77"|"Picasa 2.2.0 (Build 28.08, 0)" +"A8DF13A46D66F6B5"|"Kommute (Calypso) 0.24" +"186B5CCADA1D986B"|"NewsGrabber 3.0.36" +"99C15CF3E6D52B61"|"mldonkey 3.1.0" +"FD1AD55E472F20E0"|"Google Earth Pro 7.3.2.5491" +"8f4ae1df7d39f816"|"X-Ways WinHex x64" +"62DBA7FB39BB0ADC"|"Yahoo Messenger 7.5.0.647 / 8.1.0.421 / 9.0.0.2162 / 10.0.0.1270" +"466D339D8F21CFBF"|"Microsoft Snip & Sketch" +"3917DD550D7DF9A8"|"Konvertor 4.06 (Build 10)" +"8A1C1C7C389A5320"|"Safari 3.2.3 (525.29)" +"BE4875BB3E0C158F"|"CrossFTP 1.75a" +"9e312f4adee9107"|"Opera Browser" +"F674C3A77CFE39D0"|"Winamp 2.95 / 5.1 / 5.621 / 5.666" +"f7699cf2eed599ac"|"Microsoft.SecHealthUI" +"d788e8bc973b89e9"|"PKWARE PKZIP for Windows 14" +"884FD37E05659F3A"|"VZOchat 6.3.5" +"1B29F0DC90366BB"|"AIM 5.9.3857" +"CBBE886ECA4BFC2D"|"ExoSee 1.0.0" +"36C36598B08891BF"|"Vovox 2.5.3.4250" +"607258d66273ff4d"|"Microsoft Edge" +"ADECFB853D77462A"|"Microsoft Office Word 2007 Pinned and Recent." +"19E6043495A5B4DA"|"Edit Pad Pro" +"D460280B17628695"|"Java Binary" +"d1cc3f047e70a200"|"SAPIEN SnippetEditor" +"FE57F5DF17B45FE"|"Wireshark 2.6.3" +"22CEFA022402327D"|"Meca Messenger 5.3.0.52 (CHANGED)" +"92a0e470eecc63d3"|"RegistryExplorer" +"74D7F43C1561FC1E"|"Windows Media Player 12.0.7601.17514" +"0EF606B196796EBB"|"HP MediaSmart Photo" +"CB996A858D7F15C"|"PDF Architect 4.0.09.25450 64-bit" +"E76A4EF13FBF2BB1"|"Manolito 3.1.1" +"EA83017CDD24374D"|"IrfanView Thumbnails" +"d014c0be50851f63"|"MusicBee 3.4.2.0 x86" +"BC03160EE1A59FC1"|"Foxit PDF Reader 5.4.5" +"C8AA3EAEE3D4343D"|"Trillian 0.74 / 3.1 / 4.2.0.25 / 5.0.0.35 (JL support)" +"27DA120D7E75CF1F"|"pbFTPClient 6.1" +"966FA7C312D9B10"|"Eraser 6.2.0.2970" +"c45108aa42339506"|"PowerPoint Show 8" +"b06bc47edd036329"|"SAPIEN PowerShell Studio" +"337ED59AF273C758"|"Sticky Notes (Windows 10)" +"2519133D6D830F7E"|"IMatch 3.6.0.113" +"7904145AF324576E"|"Total Commander 7.56a (Build 16.12.2010) / 8.52a 32-bit" +"4b5f45de9912de53"|"Microsoft.Office.Desktop.Access_16xxx" +"F6FD5D99E2B6E178"|"LibreOffice 5.1.0.3 Draw" +"BBA8A4896F0D26F"|"Ares Chat Client (3.1.9.4045)" +"7ff0b18f1611daa4"|"Opera Browser" +"4CB9C5750D51C07F"|"Microsoft Movies & TV (Build 10.19031.11411.0)" +"7593AF37134FD767"|"RealPlayer 6.0.6.99 / 7 / 8 / 10.5" +"780732558F827A42"|"AutoPix 5.3.3" +"DA7E8DE5B8273A0F"|"Yahoo Messenger 5.0.0.1226 / 6.0.0.1922" +"73C6A317412687C2"|"Google Talk 1.0.0.104" +"f039446000b1b829"|"SweetScape 010 Editor" +"6E855C85DE07BC6A"|"Microsoft Office Excel 2010 x64" +"47592b67dd97a119"|"Windows Notepad x32 (Notepad.exe)" +"20EF367747C22564"|"Bullet Proof FTP 2010.75.0.75" +"A7BD71699CD38D1C"|"Microsoft Office Word 2010 x86" +"431A5B43435CC60B"|"Python (.pyc)" +"CDB6F0C373F2DA0F"|"stunnel 5.31" +"E107946BB682CE47"|"Filezilla 3.5.1 / 3.16" +"E26F61AFB0824F2E"|"Photoshop CC 2015" +"B8AB77100DF80AB2"|"Microsoft Office Excel x64" +"447E6AA2BBDFBC8A"|"Slack 4.11.3" +"F92E607F9DE02413"|"RealPlayer 14.0.6.666" +"7c8adb9f2028b7d4"|"SAPIEN Packager" +"8904A5FD2D98B546"|"IceChat 7.70 20101031" +"4CDF7858C6673F4B"|"Bullet Proof FTP 1.26" +"7A4BA998575FF2A4"|"FreeCommander XE 2016 Build 715 32-bit" +"4ACAE695C73A28C7"|"VLC 0.3.0 / 0.4.6" +"83B03B46DCD30A0E"|"iTunes 9.0.0.70 / 9.2.1.5 / 10.4.1.10 (begin custom 'Tasks' JL capability) / 12.3.2.35 64-bit" +"1C30573BDFCE4155"|"Zenmap GUI 6.49BETA4" +"7E4DCA80246863E3"|"Control Panel - Settings" +"9027FE24326910D2"|"Thunderbird 38.6.0" +"18ae7cda503d746e"|"Advanced System Optimizer 3" +"2DB8E25112AB4453"|"Deluge 1.3.3" +"d4e1769e47ffde26"|"Cyberlink PhotoDirector 9" +"46E77B87767B92"|"Opera Browser 75" +"B223C3FFBC0A7A42"|"Bersirc 2.2.14" +"265142389b98fcb1"|"DVDFab 9 x86" +"d1d9b843a81139c6"|"KeePass" +"1CED32D74A95C7BC"|"Microsoft Visual Studio Code" +"F5AC5390B9115FDB"|"Microsoft Office PowerPoint 2007" +"21982dade69f78d8"|"Opera Browser" +"EBD8C95D87F25154"|"Carrier 2.5.5" +"10F5A20C21466E85"|"FTP Voyager 15.2.0.17" +"ECD21B58C2F65A2F"|"StealthNet 0.8.7.9" +"D00655D2AA12FF6D"|"Microsoft PowerPoint 2016 64-bit" +"9B9CDC69C1C24E2B"|"Notepad 64-bit" +"7494A606A9EEF18E"|"Crystal Player 1.98" +"135DF2A440ABE9BB"|"SoulSeek 156c" +"B06A975B62567622"|"Windows Live Messenger 8.5.1235.0517 BETA" +"78F0AFB5BD4BB278"|"Microsoft Lync 2016 64-bit (Skype for Business)" +"F82607A219AF2999"|"Cyberduck 4.1.2 (Build 8999)" +"CB1D97ACA3FB7E6B"|"Newz Crawler 1.9.0 (Build 4100)" +"E6EF42224B845020"|"ALFTP 5.20.0.4" +"CB984E3BC7FAF234"|"NewsRover 17.0 (Rev.0)" +"F920768FE275F7F4"|"Grabit 1.5.3 Beta (Build 909) / 1.6.2 (Build 940) / 1.7.2 Beta 4 (Build 997)" +"40371339ad31a7e6"|"Mozilla Firefox x64" +"E0532B20AA26A0C9"|"QQ International 1.1 (2042)" +"A75B276F6E72CF2A"|"WinMX 3.53" +"98B0EF1C84088"|"fulDC 6.78" +"D2D0FC95675FB2C8"|"Microsoft Built-in Print Management (Win10)" +"BAEA31EACD87186B"|"BinaryBoy 1.97 (Build 55)" +"6FEE01BD55A634FE"|"Smuxi 0.8.0.0" +"D356105FAC5527EF"|"Steam 1/22/2021" +"23EF200CA6364EFF"|"Oracle VM VirtualBox 5.0.16" +"3c355482cb54f75b"|"Microsoft.GetHelp" +"122c907c4dc5911f"|"Mozilla Firefox x32" +"8BD5C6433CA967E9"|"ACDSee Photo Manager 2009 (v11.0 Build 113)" +"43929ae4535c8dea"|"Microsoft.SkypeApp 15 x86" +"CC4B36FBFB69A757"|"gtk-gnutella 0.97" +"D4A589CAB4F573F7"|"Microsoft Project 2010 x86" +"971cc6ad207f36cb"|"PaintShopPro (X9)" +"0A1D19AFE5A80F80"|"FileZilla 2.2.32" +"CD40EAD0B1EB15AB"|"NNTPGrab 0.6.2" +"2a64b26bd99f0d16"|"Shareaza" +"9C32E2313792E6E8"|"Microsoft Built-in Disk Cleanup (Win10)" +"F784591FF7F60F76"|"Microsoft Built-in Defragment and Optimize Drives (Win10)" +"C312E260E424AE76"|"Mail.Ru Agent 5.8 (JL support)" +"2A5A615382A84729"|"X-Chat 2 2.8.6-2" +"3C93A049A30E25E6"|"J. River Media Center 16.0.149" +"CC76755E0F925CE6"|"AllPicturez 1.2" +"497B42680F564128"|"Zoner PhotoStudio 13 (Build 7)" +"D8081F151F4BD8A5"|"CuteFTP 8.3 Lite (Build 8.3.4.0007)" +"44A3621B32122D64"|"Microsoft Office Word 2010 x64" +"1C7A9BE1B15A03BA"|"Microsoft Snip & Sketch" +"EFBB2BF3C1D06466"|"Auslogics Disk Defrag 6.2.1.0" +"F91FD0C57C4FE449"|"ExpanDrive 2.1.0" +"BF483B423EBBD327"|"Binary Vortex 5.0" +"4A7E4F6A181D3D08"|"broolzShare" +"9D91276B0BE3E46B"|"Windows Help and Support (Built-in) Win7" +"7937DF3C65790919"|"FTP Explorer 10.5.19 (Build 001)" +"4FD44F9938892CAA"|"CDBurnerXP" +"1BC9BBBE61F14501"|"OneNote" +"6F647F9488D7A"|"AIM 7.5.11.9 (custom AppID + JL support)" +"B50EE40805BD280F"|"QuickTime Alternative 1.9.5 (Media Player Classic 6.4.9.1)" +"06059DF4B02360AF"|"Kadu 0.10.0 / 0.6.5.5" +"B7173093B23B9A6A"|"Beyond Compare 4" +"CBEB786F0132005D"|"VLC 0.7.2" +"E0246018261A9CCC"|"qutIM 0.2.80.0" +"65F7DD884B016AB2"|"LimeChat 2.39" +"22C4D315E96389E0"|"FastCopy 3.12" +"3ED70EF3495535F7"|"Gravity 3.0.4" +"65009083BFA6A094"|"(app launched via XPMode)" +"D64D36B238C843A3"|"Microsoft Office InfoPath 2010 x86" +"8A461F82E9EB4102"|"Foxit Reader 7.2.0.722" +"c88c76a215679365"|"Axialis IconWorkshop 6" +"e4ea035065b5789a"|"Maël Hörz HxD Hex Editor 2.5" +"50620FE75EE0093"|"VMware Player 3.1.4" +"F1A4C04EEBEF2906"|"[i2p] Robert 0.0.29 Preferences" +"B0236D03C0627AC4"|"ICQ 5.1 / ICQLite Build 1068" +"AEDD2DE3901A77F4"|"Pidgin 2.10.11" +"5E01ECAF82F7D8E"|"Scour Exchange 0.0.0.228" +"0B3F13480C2785AE"|"Paint 6.1 (build 7601: SP1)" +"319F01BF9FE00F2D"|"Microsoft Access 2016 64-bit" +"30D23723BDD5D908"|"Digsby (Build 30140) (JL support)" +"76F6F1BD18C19698"|"aMule 2.2.6" +"C5C24A503B1727DF"|"XnView 1.98.2 Small / 1.98.2 Standard / 2.35" +"A8C43EF36DA523B1"|"Microsoft Office Word 2003 Pinned and Recent." +"B8C13A5DD8C455A2"|"Titan FTP Server 8.40 (Build 1338)" +"03D877EC11607FE4"|"Thunderbird 6.0.2" +"56C5204009D2B915"|"uTorrent 3.5.5" +"69d97cdc8d4d5043"|"Microsoft.windowscommunicationsapps " +"8172865A9D5185CB"|"Binreader 1.0 (Beta 1)" +"fbb3e7490ba71a30"|"SQLite Expert" +"A79A7CE3C45D781"|"CuteFTP 7.1 (Build 06.06.2005.1)" +"92F1D5DB021CD876"|"NewsLeecher 4.0 / 5.0 Beta 6" +"8DCCA8B24A5E822E"|"CDBurnerXP 4.5.7.6623" +"FB230A9FE81E71A8"|"Yahoo Messenger 11.0.0.2014-us" +"7fa8bdd163836f0c"|"WinRAR" +"4B632CF2CECEAC35"|"Robo-FTP Server 3.2.5" +"D7D647C92CD5D1E6"|"uTalk 2.6.4 r47692" +"D7666C416CBA240C"|"NewsMan Pro 3.0.5.2" +"7B7F65AAECA20A8C"|"Dropbox App 5.4.24" +"ea64ce14e5470c33"|"Microsoft.PowerShell_7.2.1.0 x64" +"5B72F67ADCCE9045"|"UltraVNC 1.2.1.0 Settings" +"E6EE34AC9913C0A9"|"VLC 0.6.2" +"3EDF100B207E2199"|"digiKam 1.7.0 (KDE 4.4.4)" +"44A50E6C87BC012"|"Classic FTP Plus 2.15" +"F0275E8685D95486"|"Microsoft Office Excel 2013 x86" +"D53B52FB65BDE78C"|"Android Newsgroup Downloader 6.2" +"D93F411851D7C929"|"Windows Powershell 5.0 32-bit" +"3461E4D1EB393C9C"|"WTW 0.8.18.2852 / 0.8.19.2940" +"4C58CF9096EF3EFD"|"Kindle for PC 1.24.3 " +"31b6ebfff794ef0d"|"Opera Browser (Opera.exe)" +"6059DF4B02360AF"|"Kadu 0.10.0 / 0.6.5.5" +"2FF9DC8FB7E11F39"|"I2P 0.8.8 (no window)" +"f2d2624b34821c85"|"Opera Browser (Opera.exe)" +"C98AB5CCF25DDA79"|"NewsShark 2.0" +"b8a48bfb1f2f0c8d"|"NordVPN" +"D22AD6D9D20E6857"|"ALLPlayer 4.7" +"A4DEF57EE99D77E9"|"Nomad News 1.43" +"26753C97EA000ECD"|"LibreOffice 5.1.0.3 Math" +"1BC392B8E104A00E"|"Remote Desktop Connection 6.1.7600 (Win7)" +"8EAFBD04EC8631CE"|"VMware Workstation 9 x64" +"FB7CA8059B8F2123"|"ooVoo 3.0.7.21" +"FF103E2CC310D0D"|"Adobe Reader XI" +"8FD1364019DC2115"|"Calibre E-Book Manager 2.33" +"a7500ee83f4868ab"|"DVBViewer" +"D7528034B5BD6F28"|"Windows Live Mail Pinned and Recent." +"BC0C37E84E063727"|"Windows Command Processor - cmd.exe (32-bit)" +"B3016B8DA2077262"|"eMule 0.50a" +"EDC786643819316C"|"HoneyView3 #5834" +"3C309C17F7E8FFE1"|"GIMP 2.8.16" +"2AA756186E21B320"|"RealTimeQuery 3.2" +"F18460FDED109990"|"Windows Connected Devices" +"FC98C00F85D4CE77"|"EditPad Pro 8" +"C634153E7F5FCE9C"|"IrfanView 3.10 / 4.30 / 4.41 32-bit" +"1DA3C90A72BF5527"|"Safari 4.0.5 (531.22.7) / 5.1 (7534.50)" +"BC2F88ECCD3461B4"|"Microsoft Built-in Event Viewer 1.0 (Win10)" +"b916037c1e115fe0"|"Microsoft Skype (Microsoft.SkypeApp_15)" +"C9374251EDB4C1A8"|"BitTornado T-0.3.17" +"A52B0784BD667468"|"Photos Microsoft 16.526.11220.0 (Windows 10)" +"67730e20cf5d43f7"|"MiTec JSON Viewer (JSONView.exe)" +"3F2CD46691BBEE90"|"GOIM 1.1.0" +"E36BFC8972E5AB1D"|"XPS Viewer" +"f065ac336abcaa3e"|"Adobe Acrobat DC" +"B74736C2BD8CC8A5"|"WinZip 15.5 (9468)" +"E70D383B15687E37"|"Notepad++ 6.6.7" +"D7DB75DB9CDD7C5D"|"Xnews 5.04.25" +"EC3E36AF0CDCB3E1"|"Steam build 2/4/2016" +"1B4DD67F29CB1962"|"Windows Explorer Pinned and Recent." +"BF9AE1F46BD9C491"|"Nimbuzz 2.0.0 (rev 6266)" +"69bacc0499d41c4"|"Microsoft Excel 12" +"977A5D147AA093F4"|"Lphant 3.51" +"a968adcd5f3991cd"|"CorelDraw Home 20" +"4B8A4727AA452343"|"Firefox 56.0.2" +"9FDA41B86DDCF1DB"|"VLC Media Player 0.5.3 / 0.8.6i / 0.9.7 / 1.1.11 / 2.2.1" +"f1dfe90245a04467"|"MPC-BE 64 (Media Player Classic - Black Edition)" +"69639DF789022856"|"Google Chrome 86.0.4240.111" +"3866FF352D7719E1"|"Paint.NET 4.0.9" +"BFC1D76F16FA778F"|"Ares (Galaxy) 1.8.4 / 1.9.8 / 2.1.0 / 2.1.7.3041 / 3.1.9.4045" +"6f39a16f693777f6"|"Microsoft.MSPaint_8wekyb3d8bbwe" +"7A7C60EFD66817A2"|"Spotnet 1.7.4" +"CDF30B95C55FD785"|"Microsoft Office Excel 2007" +"BAC8A6B507360131"|"Remote Desktop Connection Manager 2.2" +"A581B8002A6EB671"|"WiseFTP 5.5.9" +"5F6E7BC0FB699772"|"Microsoft Office PowerPoint 2010 x64" +"7DCA40FD2A5A971F"|"LibreOffice 5.1.0.3" +"CD2ACD4089508507"|"AbsoluteTelnet 9.18 Lite" +"5F7B5F1E01B83767"|"Quick Access" +"F0C7BD3E0584A65A"|"InfraRecorder 0.53.0.0 32-bit" +"792699A1373F1386"|"Piolet 3.1.1" +"86B804F7A28A3C17"|"Miranda IM 0.6.8 / 0.7.6 / 0.8.27 / 0.9.9 / 0.9.29 (ANSI + Unicode)" +"25cfc5224e58d5d9"|"Corel Photo Paint Home" +"AE3F2ACD395B622E"|"QuickTime Player 6.5.1 / 7.0.3 / 7.5.5 (Build 249.13)" +"D1FC019238236806"|"Newsgroup Commander Pro 9.05" +"647853318c96dfa5"|"Microsoft.Windows.Cortana" +"D97EFDF3888FE7EB"|"KeePass 2.31" +"95962cd8e90977ca"|"Emsisoft Anti-Malware (a2start.exe)" +"DBA909A61476CCEC"|"NewsWolf 1.41" +"558C5BD9F906860A"|"BearShare Lite 5.2.5.1" +"CD8CAFB0FB6AFDAB"|"uTorrent 1.7.7 (Build 8179) / 1.8.5 / 2.0 / 2.21 (Build 25113) / 3.0 (Build 25583)" +"8E4E81D9ADC545B8"|"Microsoft Your Phone" +"969252CE11249FDD"|"Mozilla Firefox 40.0 / 44.0.2" +"43578521D78096C6"|"Windows Media Player Classic Home Cinema 1.3 (32-bit)" +"12DC1EA8E34B5A6"|"Microsoft Paint 6.1" +"7192F2DE78FD9E96"|"TIFNY 5.0.3" +"e7f34dee82980c52"|"LibreOffice Calc" +"271E609288E1210A"|"Microsoft Office Access 2010 x86" +"B77EF7F3FC946302"|"Pale Moon Browser 26.1.1 (32-bit)" +"13EB0E5D9A49EAEF"|"Binjet 3.0.2" +"714B179E552596DF"|"Bullet Proof FTP 2.4.0 (Build 31)" +"84F066768A22CC4F"|"Adobe Photoshop CS5 (64-bit)" +"D8671C1ED93C75C8"|"Tor Browser 5.5.2" +"26717493B25AA6E1"|"Adobe Dreamweaver CS5 (32-bit)" +"EB3300E672136BC7"|"Stream Reactor 1.0 Beta 9 (uses VLC!)" +"24728462b60c215d"|"Microsoft.WindowsMaps x64" +"72b0317636c8dbc0"|"FSPro Event Log Explorer" +"B08971C77377BDE3"|"Microsoft Visual Studio Community 2015" +"169B3BE0BC43D592"|"FastPictureViewer Professional 1.6 (Build 211)" +"3fe28476179ff940"|"Turnipsoft Freda (ebook reader)" +"A10B45ADB36C1D27"|"PST Walker 5.54" +"1CFFBE973A437C74"|"DSPlayer 0.889 Lite" +"3594AAB44BCA414B"|"Windows Photo Viewer" +"C04F69101C131440"|"CuteFTP 5.0 (Build 50.6.10.2)" +"3CF13D83B0BD3867"|"RevConnect 0.674p (based on DC++)" +"EB7E629258D326A1"|"WindowWasher 6.6.1.18" +"BEC10D3AAF939FFA"|"Pale Moon Browser 26.1.1 (64-bit)" +"6b8904e2b6864f0f"|"Mozilla Firefox x32" +"5BB830F67194431A"|"7-Zip 18.05 (x64)" +"E30BBEA3E1642660"|"Neebly 1.0.4" +"3BE7B307DFCCB58F"|"NiouzeFire 0.8.7.0" +"8F3D7202AA5D4C01"|"ImgBurn 2.5.8.0" +"C71EF2C372D322D7"|"PGP Desktop 10" +"4E0AC37DB19CBA15"|"Xfire 1.138 (Build 44507)" +"4d939776340f1d18"|"LibreOffice Writer" +"A777AD264B54ABAB"|"JetVideo 8.0.2.200 Basic" +"34b9a7ad69ff9c1b"|"Microsoft Access" +"BCD7BA75303ACBCF"|"BitLord 1.1" +"13d1f3ea8d0e7308"|"Tracker Software PDF-Xchange Viewer" +"9149d0f5ebf7f710"|"Microsoft Outlook (15)" +"F01B4D95CF55D32A"|"Windows Explorer Windows 8.1" +"FB3B0DBFEE58FAC8"|"Microsoft Word 2016 64-bit" +"6b81d0477f64e02f"|"JSONBuddyApp" +"78aa210563284496"|"Windows Performance Toolkit (wpa.exe)" +"05E01ECAF82F7D8E"|"Scour Exchange 0.0.0.228" +"23646679AACCFAE0"|"Adobe Reader 9.x(CHANGED)" +"817E5AD5BE351574"|"Microsoft Built-in Services 10.0.10011.16384 (Win10)" +"E31A6A8A7506F733"|"Image AXS Pro 4.1" +"3B94415067DD2C5D"|"GOG Galaxy" +"6E9A79992DA9EA2"|"Nokia PC Suite 7.1" +"E40CB5A291AD1A5B"|"Songbird 1.9.3 (Build 1959)" +"8211531A7918B389"|"Newsbin Pro 6.00 (Build 1019) (JL support)" +"D38ADEC6953449BA"|"Microsoft Office OneNote 2010 x64" +"70FFD305907C983B"|"7zip 18.05" +"C5EF839D8D1C76F4"|"LimeWire 5.2.13" +"C8112AC53C5ED250"|"Jetico Log Viewer 1.1" +"95597e2f40dbd9aa"|"PotPlayerMini64 (potplayer.daum.net)" +"817BB211C92FD254"|"GOM Player 2.0.12.3375 / 2.1.28.5039" +"C31B3D36438B5E2C"|"Visual Studio Enterprise 2017 Version 15.9.10" +"F64DE962764B9B0F"|"FTPRush 1.1.3 / 2.15" +"3DC02B55E44D6697"|"7-Zip 3.13 / 4.20" +"16F2F0042DDBE0E8"|"Windows Terminal" +"6dc04f5ccc522861"|"Microsoft.Windows.ShellExperienceHost" +"28C8B86DEAB549A1"|"Internet Explorer 8.0.7600.16385 / 9" +"70D9ADA92108D731"|"IrfanView 4.51 (x64)" +"01B29F0DC90366BB"|"AIM 5.9.3857" +"75fdabdc3f4b24fc"|"Microsoft Windows Event Viewer (eventvwr.exe)" +"14a48fbe3d43239a"|"Windows System Information(msinfo32.exe)" +"1110D9896DCEDDB3"|"imgSeek 0.8.5" +"FA7144034D7D083D"|"Directory Opus 10.0.2.0.4269 (JL tasks supported)" +"8DEB27DFA31C5C2A"|"CoffeeCup Free FTP 4.4 (Build 1904)" +"2FA14C7753239E4C"|"Paint.NET 2.72 / 3.5.8.4081.24580" +"5FB817CD5A8CAD21"|"Google Drive" +"C01827D56FF89056"|"Microsoft Sticky Notes" +"1A60B1067913516A"|"Psi 0.14" +"134620458666CCB0"|"TeraCopy 2.3 64-bit" +"BD249197A6FAEFF2"|"Windows Live Messenger 2011" +"f203793bf9d14ff"|"Razer Central" +"5e86fbbffae5937b"|"Waterfox Browser" +"EAB25958DBDDBAA4"|"Binary News Reaper 2 (Beta 0.14.7.448)" +"75FDACD8330BAC18"|"AnyDesk" +"C02BAF50D02056FC"|"FotoVac 1.0" +"3e4d62cf2c569bdf"|"MPC-HC (Media Player Classic - Home Cinema)" +"28EFB5B6D2E28389"|"EA Origin" +"86781FE8437DB23E"|"Messenger Pro 2.66.6.3353" +"3DF22B7648CEC4C1"|"TeamViewer 11.0.55321" +"cf02284227526d80"|"Powershell ISE" +"56bd4efc8f2e1f9c"|"XnSoft XnViewMP" +"4AC866364817F10C"|"Microsoft Edge (Chromium)" +"ED49E1E6CCDBA2F5"|"GNUnet 0.8.1a" +"3094CDB43BF5E9C2"|"Microsoft Office OneNote 2010 x86" +"ce0e7345de1f1e26"|"Microsoft.Windows.PrintQueueActionCenter 1.0.1.0" +"A4A5324453625195"|"Microsoft Word 2013 32-bit" +"51dceba79099d8d2"|"Sapien PowerShell Studio" +"728008617BC3E34B"|"eM Client 3.0.10206.0" +"C8E4C10E5460B00C"|"iMesh 6.5.0.16898" +"1434D6D62D64857D"|"BitLord 1.2.0-66" +"5DF4765359170E26"|"Firefox 4.0.1" +"18434D518C3A61EB"|"Minitab 17" +"7FD04185AF357BD5"|"UltraLeeacher 1.7.0.2969 / 1.8 Beta (Build 3490)" +"6dcad003123a22fe"|"Android Studio" +"5D6F13ED567AA2DA"|"Microsoft Office Outlook 2010 x64" +"59E86071B87AC1C3"|"CuteFTP 8.3 (Build 8.3.4.0007)" +"3C0022D9DE573095"|"QuteCom 2.2" +"6f4d358e50595ac1"|"Emsisoft Anti-Malware (a2start.exe)" +"2B5841989B3857DA"|"RealVNC Server 5.3.0 64-bit (Chat)" +"4D72CFA1D0A67418"|"Newsgroup Image Collector" +"17D3EB086439F0D7"|"TrueCrypt 7.1a 64-bit" +"C5236FD5824C9545"|"PLAYXPERT 1.0.140.2822" +"daa1194a2bd88bd7"|"SAPIEN Packager" +"254995f62cc3531a"|"Sanderson Forensics BPLister" +"939C10C2C101C1B0"|"Stickies 9.0d" +"8FDB062F1E486CAC"|"Microsoft Powerpoint 2013 32-bit" +"6728DD69A3088F97"|"Windows Command Processor - cmd.exe (64-bit)" +"FA02AA2C575837A6"|"Microsoft Built-in Task Scheduler 1.0 (Win10)" +"918E0ECB43D17E23"|"Notepad (32-bit)" +"EF473FAB8120B354"|"uTorrent 3.5.5" +"FDBACA0A1FCE6055"|"MozBackup 1.5.1" +"9CE6555426F54B46"|"HxD 1.7.7.0" +"22e699ddc3928886"|"Fineprint PdfFactory" +"9C08AD74AD8708DF"|"Microsoft Publisher 2016 64-bit" +"490C000889535727"|"WinMX 4.9.3.0" +"44A398496ACC926D"|"Adobe Premiere Pro CS5 (64-bit)" +"58a5af636f485ff2"|"RegistryExplorer" +"290532160612E071"|"WinRar x64" +"C7A4093872176C74"|"Paint Shop Pro Pinned and Recent." +"387D72EB9C9AA960"|"UltraVNC 1.2.1.0 Launcher" +"B8C29862D9F95832"|"Microsoft Office InfoPath 2010 x86" +"CCC0FA1B9F86F7B3"|"CCleaner 5.15.5513 64-bit" +"F61B65550A84027E"|"iMesh 11.0.0.112351" +"70a4c8cfd9c64000"|"Programmer's Notepad (pn.exe)" +"ee6d1f704cdeb7f9"|"Opera Browser" +"411447F7DE177C68"|"Windows DVD Maker 64-bit (Win7)" +"70202c58f1bc64fe"|"JeticoSoftware BCArchive" +"58170C92FA4B91A1"|"MediaMonkey" +"6224453D9701A612"|"BinTube 3.7.1.0 (requires VLC 10.5!)" +"cf0c5b2c9773bfa4"|"IDA Pro x64" +"70B52CF73249257"|"Sococo 1.5.0.2274" +"C6F7B5BF1B9675E4"|"BitWise IM 1.7.3a" +"a61657a5e5dfbdc"|"Microsoft.WindowsNotepad" +"9839AEC31243A928"|"Microsoft Office Excel 2010 x86" +"590AEE7BDD69B59B"|"Windows Powershell 5.0 64-bit" +"4278D3DC044FC88A"|"Gaim 1.5.0" +"174C2C811C286C58"|"InfraRecorder 0.53.0.0 64-bit" +"9AD1EC169BF2DA7F"|"FlylinkDC++ r405 (Build 7358)" +"2D1658D5DC3CBE2D"|"MySpaceIM 1.0.823.0 Beta" +"CCB36FF8A8C03B4B"|"Azureus 2.5.0.4 / Vuze 3.0.5.0" +"4DD48F858B1A6BA7"|"Free Download Manager 3.0 (Build 852)" +"B39C5F226977725D"|"ACDSee Pro 8.1.99" +"409B67100697BCC0"|"Revo Uninstaller Pro 3.1.5" +"AE069D21DF1C57DF"|"mIRC 6.35 / 7.19" +"FE8BB4692DE7B989"|"Smart Defrag 4.3.0.847" +"D5C02FC7AFBB3FD4"|"NNTPGrab 0.6.2 Server" +"B39BC6B590F53961"|"HexChat 2.10.2 32-bit" +"43886BA3395ACDCC"|"Easy Post 3.0" +"BD050AC447F6CD65"|"Microsoft Xbox App" +"6BB54D82FA42128D"|"WinSCP 4.3.4 (Build 1428)" +"399fb4899502f372"|"Mozilla Firefox" +"79370F660AB51725"|"UploadFTP 2.0.1.0" +"D28EE773B2CEA9B2"|"3D-FTP 9.0 build 7" +"5e4713eb935be0b1"|"foobar2000" +"4D8BDACF5265A04F"|"The KMPlayer 2.9.4.1434" +"784182360DE0C5B6"|"Kazaa Lite 1.7.1" +"36F6BC3EFE1D99E0"|"Alt.Binz 0.25.0 (Build 27.09.2007)" +"d57380f96fcfde2f"|"RegistryExplorer" +"188F5EC9D11DED56"|"Microsoft Edge (Chromium)" +"1461132E553E2E6C"|"Firefox 6.0" +"4F24A7B84A7DE5A6"|"Palringo 2.6.3 (r45983)" +"9A464053CD82DE6D"|"LINE Messenger" +"044A50E6C87BC012"|"Classic FTP Plus 2.15" +"5D7B4175AFDCC260"|"Shareaza 2.0.0.0" +"5B186FC4A0B40504"|"Dtella 1.2.5 (Purdue network only)" +"FA496FE13DD62EDF"|"KVIrc 3.4.2.1 / 4.0.4" +"cb83010e2bf88ad0"|"PowerShell ISE x64" +"556353beba95157c"|"7Z" +"6B3A5CE7AD4AF9E4"|"IceChat 9 RC2" +"6AA18A60024620AE"|"GCN 2.9.1" +"9EDAFE4BA4B22CE7"|"Eclipse IDE Oxygen (4.7.3a)" +"4FCEEC8E021AC978"|"CoffeeCup Free FTP 3.5.0.0" +"9390EE5B658E96E"|"PuTTY 0.72 / 0.73" +"3353B940C074FD0C"|"Microsoft Built-in Snipping Tool" +"E2A593822E01AED3"|"Adobe Flash CS5 (32-bit)" +"D5C3931CAAD5F793"|"Adobe Soundbooth CS5 (32-bit)" +"3168CC975B354A01"|"Slypheed 3.1.2 (Build 1120)" +"0CFAB0EC14B6F953"|"Express NewsPictures 2.41 (Build 08.05.07.0)" +"9501e18d7c2ab92e"|"Google Chrome" +"AE6DF75DF512BD06"|"Microsoft Groove Music (Build 10.19031.1141.0)" +"BE71009FF8BB02A2"|"Microsoft Office Outlook x86" +"14354E216395983A"|"Remote Desktop Manager 2.1.0.0 FREE" +"be2fd48be71f4560"|"Autodesk DWG TrueView" +"d27ff2aece1fd1bf"|"Epic Privacy Browser" +"905C98E216107AA1"|"Microsoft Lync 2013 15.0.4753.1000" +"F5E4E50707BCD215"|"Microsoft Message Analyzer 1.4" +"27ECECD8D89B6767"|"AIM 6.2.14.2 / 6.5.3.12 / 6.9.17.2" +"59fe1486d27aa9d0"|"Electronic Arts Origin" +"9C7CC110FF56D1BD"|"Microsoft Office PowerPoint 2010 x86" +"C9950C443027C765"|"WinZip 9.0 SR-1 (6224) / 10.0 (6667)" +"FE5E840511621941"|"JetAudio 5.1.9.3018 Basic / 6.2.5.8220 Basic / 7.0.0 Basic / 8.0.16.2000 Basic" +"54C803DFC87B52BA"|"Nettalk 6.7.12" +"B3F13480C2785AE"|"Paint 6.1 (build 7601: SP1)" +"D78150E0484A4E1D"|"Evernote 5.9.6.9494" +"1CF97C38A5881255"|"MediaPortal 1.1.3" +"292A746334889A7E"|"SQLiteSpy 1.9.13" +"A5DB18F617E28A51"|"ICQ 6.5 (Build 2024)" +"DD658A07478B46C2"|"PIRCH98 1.0.1.1190" +"4D7BDAEA55AD352"|"PeaZip 6.0.0" +"46F433176BC0B3D2"|"WinRAR 5.30 beta 64-bit" +"a6744f520b56975c"|"SAPIEN SnippetEditor" +"2544FF74641B639D"|"WiseFTP 6.1.5" +"223BF0F360C6FEA5"|"I2P 0.8.8 (restartable)" +"0006F647F9488D7A"|"AIM 7.5.11.9 (custom AppID + JL support)" +"B868D9201B866D96"|"Microsoft Lync 4.0.7577.0" +"B7CB1D1C1991ACCF"|"FlashFXP 4.0.0 (Build 1548)" +"E57CFC995BDC1D98"|"Snagit 11" +"14a989d191548bbc"|"Cyberlink PowerDVD16" +"469E4A7982CEA4D4"|"Windows Wordpad" +"6da48f37c95d6e1"|"Google Chrome" +"74EA779831912E30"|"Skype 7.24.0.104" +"EFB08D4E11E21ECE"|"Paltalk Messenger 10.0 (Build 409)" +"9EFF0B23D51FE003"|"XMind 201807140020" +"5DA8F997FD5F9428"|"Internet Explorer x64" +"68a0dbfb7d0781d5"|"Corel Photo Paint Home" +"c343543d4ee31de7"|"Microsoft Access" +"4fc234e682fa0fff"|"Fineprint pdfFactory" +"070B52CF73249257"|"Sococo 1.5.0.2274" +"5FD959F6FE6B8AE7"|"PuTTY 0.70 (x64)" +"D0261ED6E16B200B"|"News File Grabber 4.6.0.4" +"3F97341A65BAC63A"|"Ozum 6.07 (Build 6070)" +"dfc4675a96730ede"|"Microsoft.WindowsFeedbackHub x64" +"2B53C4DDF69195FC"|"Zune x64" +"90E5E8B21D7E7924"|"Winamp 3.0d (Build 488)" +"6ded8e6daa05cb0c"|"Cyberlink PhotoDirector 8" +"7CB0735D45243070"|"CDisplay 1.8.1.0" +"386A2F6AA7967F36"|"EyeBrowse 2.7" +"CA1EB46544793057"|"RetroShare 0.5.2a (Build 4550)" +"2bcef060ace5a6db"|"NordVPN" +"ECD1A5E2C3AF9C46"|"LibreOffice 5.1.0.3 Press" +"16EC093B8F51508F"|"Opera 8.54 build 7730 / 9.64 build 10487 / 11.50 build 1074" +"9303de56d0685af1"|"plist Editor Pro for Windows" +"58bee77c49899591"|"Apple iTunes 12xxx x64" +"2B164F512891AE37"|"NewsWolf NSListGen" +"E73D9F534ED5618A"|"BitSpirit 1.2.0.228 / 2.0 / 2.6.3.168 / 2.7.2.239 / 2.8.0.072 / 3.1.0.077 / 3.6.0.550" +"E4BD2558BFAB368D"|"UltraDefrag 7.0.0" +"9D78513A8998829C"|"Microsoft Built-in Run Dialog (Win7 + Win10)" +"4AA2A5710DA3EFE0"|"DCSharpHub 2.0.0" +"60536f49b49e4689"|"Microsoft XmlNotepad 2007" +"770ecebb12dff1ca"|"Microsoft.Windows.CloudExperienceHost" +"dfe3790e91d3a22f"|"Tracker Software PDF-XChange Editor" +"59F56184C796CFD4"|"ACDSee Photo Manager 10 (Build 219)" +"FB1F39D1F230480A"|"Bopup Messenger 5.6.2.9178 (all languages: en;du;fr;ger;rus;es)" +"ECDD9154E84D5544"|"Wickr Top Secret Messenger Desktop 2.3.5" +"606A33F5A27B57D4"|"Microsoft Built-in Computer Management 10.0.10011.16384 (Win10)" +"A0D6B1B874C6E9D2"|"TOR Browser 6.0.2" +"B17D3D0C9CA7E29"|"Picasa 3.8.0 (Build 117.43, 0)" +"FF224628F0E8103C"|"Morpheus 3.0.3.6" +"9A3BDAE86D5576EE"|"WinSCP 3.2.1 (Build 174) / 3.8.0 (Build 312)" +"2417CAA1F2A881D4"|"ICQ 7.6 (Build 5617)" +"3198E37206F28DC7"|"CuteFTP 8.3 Professional (Build 8.3.4.0007)" +"FAC3AA4105C6C466"|"Microsoft Built-in System Restore (Win7)" +"BAACB5294867B833"|"Notepad++ 7.8.6" +"2D61CCCB4338DFC8"|"BitTorrent 5.0.0 / 6.0.0 / 7.2.1 (Build 25548)" +"AA11F575087B3BDC"|"Unzbin 2.6.8" +"9645f58513b1a821"|"Windows Live Mail (wlmail.exe)" +"EF606B196796EBB"|"HP MediaSmart Photo" +"AC8920ED05001800"|"DMDirc 0.6.5 (Profile store: C:\Users\$user\AppData\Roaming\DMDirc\)" +"5C450709F7AE4396"|"Firefox 3.6.13 (32-bit)" +"226400522157FE8B"|"FileZilla Server 0.9.39 beta" +"A18DF73203B0340E"|"Microsoft Word 2016" +"9AD84C52EFEAE190"|"1Password 4.6.0.604" +"ED7A5CC3CCA8D52A"|"CCleaner 1.32.345 / 1.41.544 / 2.36.1233 / 3.10.1525" +"0B48CE76EDA60B97"|"Shareaza 8.0.0.112300" +"A028C9DB28AA15A3"|"Piriform Defraggler 2.20.989 64-bit" +"A3E0D98F5653B539"|"Instantbird 1.0 (20110623121653) (JL support)" +"603eaabe372fb7ee"|"CorelDraw 17" +"D41746B133D17456"|"Tkabber 0.11.1" +"40F2ACA05D8A33F2"|"Minitab 16" +"D249D9DDD424B688"|"Google Chrome 81.0.4044.138" +"8de2636cecd37184"|"MusicBee" +"521A29E5D22C13B4"|"Skype 1.4.0.84 / 2.5.0.154 / 3.8.0.139 / 4.2.0.187 / Skype 5.3.0.120 / 5.5.0.115 / 5.5.32.117" +"31E8AC6B0784ED7D"|"Foxit Reader 9.4.0.16811" +"C997D2E1A0F0929"|"BCWipe 6.08.6" +"B3965C840BF28EF4"|"AIM 4.8.2616" +"1f1f846f76251ea8"|"Microsoft.Office.Desktop.Word_16xxx" +"6518d6ae55cb5b8e"|"CorelDraw Home 20" +"62BFF50B969C2575"|"Quintessential Media Player 5.0 (Build 121)" +"F214CA2DD40C59C1"|"FrostWire 4.20.9" +"8C816C711D66A6B5"|"MSN Messenger 6.2.0137 / 7.0.0820" +"9FDB10E18CDD0101"|"Cisco AnyConnect Secure Mobility Client 3.1.02040" +"E9A39DFBA105EA23"|"Faststone Image Viewer 4.6 / 5.5" +"4975D6798A8BDF66"|"7-Zip 4.65 / 9.20" +"AC3A63B839AC9D3A"|"Vuze 4.6.0.4" +"5e877db63dec2f8"|"JetBrains dotPeek" +"B0459DE4674AAB56"|"Windows Virtual PC - vmwindow.exe (32- and 64-bit)" +"98aaea517363a6fa"|"Microsoft.DiagnosticDataViewer" +"500B8C1D5302FC9C"|"Python (.pyw)" +"F2CB1C38AB948F58"|"X-Chat 1.8.10 / 2.6.9 / 2.8.9" +"A6D4DFEC09C69409"|"Microsoft Word Viewer 11.8169.8172" +"bd6f833ece9f9890"|"Microsoft Sticky Notes" +"DE76415E0060CE13"|"Noworyta News Reader 2.9" +"C01D68E40226892B"|"ClicksAndWhistles 2.7.146" +"624c8eb4922c2308"|"Modern CSV" +"a97085ebdc30067f"|"microsoft.windowscommunicationsapps" +"D38A3EA7EC79FBED"|"LibreOffice 5.1.0.3 Writer" +"16D71406474462B5"|"Snagit Editor 12.4.1" +"23F08DAB0F6AAF30"|"SoMud 1.3.3" +"4d202cabc6786cf7"|"Opera Browser" +"435A2F986B404EB7"|"SmartFTP 4.0.1214.0 / 7.0.2200.0" +"5e852f5f576f812c"|"MiTec JSON Viewer (JSONView.exe)" +"6274ff22c2061c60"|"Google PhotoViewer (Picasa)" +"b2a0df3f22cec7e0"|"Microsoft.People_10" +"E1D47CB031DAFB9F"|"BearShare 6.0.0.22717 / 8.1.0.70928 / 10.0.0.112380" +"DE48A32EDCBE79E4"|"Adobe Acrobat Reader DC 2015.010.20056" +"3ebcdfa8943cc8b8"|"SAPIEN SnippetEditor" +"550ABC1CB58EB92C"|"VeraCrypt 1.16 64-bit" +"5a2098e080cf7ac4"|"OneDrive ?? (ClassicMru)" +"C91D08DCFC39A506"|"SM Player 0.6.9 r3447" +"FC999F29BC5C3560"|"Robo-FTP 3.7.9" +"6D2BAC8F1EDF6668"|"Microsoft Outlook 2016 64-bit" +"B91050D8B077A4E8"|"Windows Media Center x64" +"3D877EC11607FE4"|"Thunderbird 6.0.2" +"DD7C3B1ADB1C168B"|"Microsoft Game Bar" +"f2a9149d1c88d093"|"Tor Browser (Firefox)" +"9560577FD87CF573"|"LeechFTP 1.3 (Build 207)" +"AF0FDD562E3F275B"|"Snagit 2020" +"7010C278903C2B0F"|"Adobe Acrobat XI Pro 32-bit" +"5B7F3287093C1623"|"Total Commander 8.52a 64-bit" +"7B4D500E147E4391"|"Tor Browser 8.0.4 (x64)" +"2CA2A1A69DC5465F"|"UltraVNC 1.2.1.0 Server Property Page" +"959668A81D4F220E"|"Sublime Text 3.2.1 (Build 3207)" +"28493D9D08E13AA6"|"UltraVNC Viewer 1.2.1.0" +"CCA6383A507BAC64"|"Gadu-Gadu 10.5.2.13164" +"CAEA34D2E74F5C8"|"uTorrent 3.4.7" +"89B0D939F117F75C"|"Adobe Acrobat 9 Pro Extended (32-bit)" +"888F2FA044591EDA"|"Twitter - Trusted Microsoft Store App (Win10)" +"96252DAFF039437A"|"Lphant 7.0.0.112351" +"CA942805559495E9"|"aMSN 0.98.4" +"F09B920BFB781142"|"Camfrog 4.0.47 / 5.5.0 / 6.1 (build 146) (JL support)" +"6A316AA67A46820B"|"Core FTP LE 1.3c (Build 1437) / 2.2 (Build 1689)" +"9F03AE476AD461FA"|"GroupsAloud 1.0" +"9D1F905CE5044AEE"|"Edge Browser" +"669967F27AFDEBEC"|"NirSoft PstPassword 1.20 (x86)" +"777483D3CDAC1727"|"Gajim 0.14.4" +"352FD027C0E8F0E5"|"Zoom" +"353E9052CCCBEC5D"|"Kindle for PC 1.21.0" +"20513CDF29D09C0E"|"Hex Editor Neo" +"73CE3745A843C0A4"|"FrostWire 5.1.4" +"93B18ADF1D948FA3"|"qutIM 0.2" +"E42A8E0F4D9B8DCF"|"Sysax FTP Automation 5.15" +"573770283DC3D854"|"Windows Defender" +"6BB98FB8CDC26D69"|"Calculator (Windows built-in)" +"A55ED4FBB973AEFB"|"Microsoft Teams" +"930cf1dd2266e2cb"|"DB Browser for SQLite" +"A746F9625F7695E8"|"HeXHub 5.07" +"f8f05350c84c9d76"|"Mozilla Thunderbird" +"DEE18F19C7E3A2EC"|"PopNote 5.21" +"d992bcc31b3e5727"|"Opera Browser" +"DB3B8D985F0668E"|"FreeFileSync 10.7" +"C2D349A0E756411B"|"Adobe Reader 8.1.2" +"454EF7DCA3BB16B2"|"Exodus 0.10.0.0" +"ACE8715529916D31"|"40tude Dialog 2.0.15.1 (Beta 38)" +"37392221756DE927"|"RealPlayer SP 12" +"1ab724316049531"|"NordVPN" +"3E9850346F375D41"|"Foxit Phantom PDF 7.2.2.929" +"177AEB41DEB606AE"|"Adobe Photoshop CS6 (64 Bit)" +"7B2B4F995B54387D"|"News Reactor 20100224.16" +"F001EA668C0AA916"|"Cabos 0.8.2" +"E93DBDCEDE8623F2"|"Pandion 2.6.106" +"3A5148BF2288A434"|"Secure FTP 2.6.1 (Build 20101209.1254)" +"CFAB0EC14B6F953"|"Express NewsPictures 2.41 (Build 08.05.07.0)" +"9E0B3F677A26BBC4"|"BitKinex 3.2.3" +"689319B6547CDA85"|"emesene 2.11.7" +"0A79A7CE3C45D781"|"CuteFTP 7.1 (Build 06.06.2005.1)" +"C845F3A6022D647C"|"Another File 2.03 (Build 2/7/2004)" +"B48CE76EDA60B97"|"Shareaza 8.0.0.112300" +"A2B95CA27B6C33D9"|"Windows Live Photo Gallery" +"9DACEBAA9AC8CA4E"|"TLNews Newsreader 2.2.0 (Build 2430)" +"FF99BA2FB2E34B73"|"Windows Calculator" +"83DD64E7FA560BD5"|"LibreOffice 5.1.0.3 Calc" +"00098B0EF1C84088"|"fulDC 6.78" +"6E9D40A4C63BB562"|"Real Player Alternative 1.25 (Media Player Classic 6.4.8.2 / 6.4.9.0)" +"3643905fceab2635"|"Cyberlink PowerDVD 16" +"49B5EDBD92D8CD58"|"FTP Commander 8.02" +"AD57BD0F4825CCE"|"WinRAR 6.01 Russian 64 bit" +"53f58609d680cdbc"|"Isobuster" +"8BCE06A9E923E1F9"|"Slack 4.10.3" +"C54B96F328BDC28D"|"WiseFTP 7.3.0" +"A7BA40025DAC9A67"|"Microsoft Office Hub" +"ea5af8ce5aeb5617"|"Notepad++" +"954EA5F70258B502"|"Windows Script Host - wscript.exe (32-bit)" +"DC64DE6C91C18300"|"Brosix Communicator 3.1.3 (Build 110719 nid 1)" +"8FB5CE5E2B049CE"|"Windows Defender (Win10 built-in)" +"D838AAC097ABECE7"|"ACDSee Photo Manager 12 (Build 344)" +"5D696D521DE238C3"|"Google Chrome 9.0.597.84 / 12.0.742.100 / 13.0.785.215 / 48.0.2564.116" +"3C3871276E149215"|"PowerShell 7" +"3476342aab319002"|"Mozilla Firefox" +"4E538FDE985A3C01"|"Torch Browser 65.0.0.1614 (x86)" +"a712c324879904b1"|"Malwarebytes (assistant.exe)" +"BFE841F4D35C92B1"|"QuadSucker/News 5.0" +"6BC3383CB68A3E37"|"iTunes 7.6.0.29 / 8.0.0.35" +"1A89D1BEFE8E90E3"|"Adobe Acrobat Distiller Pro XI 32-bit 11.0.0779" +"8F852307189803B8"|"Far Manager 2.0.1807" +"CF6379A9A987366E"|"Digibin 1.31" +"49DB7ED4F2703C22"|"LogMeIn Client 1.3.1835" +"7111C0CE965B7246"|"Battle.net" +"4dde7d7a7dfc5f29"|"VSCodium" +"A31EC95FDD5F350F"|"BitComet 0.49 / 0.59 / 0.69 / 0.79 / 0.89 / 0.99 / 1.07 / 1.28" +"19CCEE0274976DA8"|"mIRC 4.72 / 5.61" +"b50f4a1d866b4b05"|"Microsoft.Office.Word 16xxx x64" +"2437D4D14B056114"|"EiskaltDC++ 2.2.3" +"CCBA5A5986C77E43"|"Microsoft Edge (Chromium)" +"9077B9C9CF187CC2"|"KeePass 1.36" +"e353de90c46ecf50"|"Hex-Rays IDA Pro" +"EE462C3B81ABB6F6"|"Adobe Reader X 10.1.0" +"c08dde8c94c16b10"|"Cyberlink PowerDVD 18" +"acb8cd11364e2de8"|"VisualStudio" +"CB5250EAEF7E3213"|"ApexDC++ 1.4.3.957" +"C99DDDE925D26DF3"|"Robo-FTP 3.7.9 CronMaker" +"8B87640A40EC9FC"|"Snagit 2020" +"B6267F3FCB700B60"|"WiseFTP 4.1.0" +"E0F7A40340179171"|"imule 1.4.5 (rev. 749)" +"D3C5CF21E86B28AF"|"SeaMonkey 2.3.3" +"4B6925EFC53A3C08"|"BCWipe Task Manager 3.02.3 / 3.06.5.5" +"5EA2A50C7979FBDC"|"TrustyFiles 3.1.0.22" +"FAEF7DEF55A1D4B"|"VLC 2.2.6" +"C1EECE5026414C64"|"Recuva 1.52.1086 (64-bit)" +"7C2916AFD6F116A6"|"LibreOffice 5.1.0.3 Base" +"6A8B377D0F5CB666"|"WinSCP 2.3.0 (Build 146)" +"C765823D986857BA"|"Adobe Illustrator CS5 (32-bit)" +"8628E76FD9020E81"|"Fling File Transfer Plus 2.24" +"776BEB1FCFC6DFA5"|"Thunderbird 1.0.6 (20050716) / 3.0.2" +"7A8DB574299C8568"|"Windows Movie Maker 2012 (build 16.4.3528.0331)" +"E6EA77A1D4553872"|"Gnucleus 1.8.6.0" +"a850d8ed37504c7c"|"Microsoft.Windows.Cortana" +"F0468CE1AE57883D"|"Adobe Reader 7.1.0" +"9A165F62EDBFA161"|"Microsoft Store" +"3fcb7925be48c6d4"|"JSONBuddyApp" +"18fa158a64c9508a"|"Mozilla Firefox x32" +"BA132E702C0147EF"|"KCeasy 0.19-rc1" +"76689FF502A1FD9E"|"Imagine Image and Animation Viewer 1.0.7" +"BA3A45F7FD2583E1"|"Blubster 3.1.1" +"9749CEA96D411F37"|"HexChat 2.10.2 64-bit" +"7526DE4A8B5914D9"|"Forte Agent 6.00 (Build 32.1186)" +"315E29A36E961336"|"Roboform 7.8" +"6fac1b1908485d3"|"Windows Font Viewer" +"31db872855923268"|"Microsoft Orca" +"42f16a31d9a2ec4"|"Microsoft Support Diagnostic Tool" +"e4ea035065b5789a"|"HxD 2.5" +"930cf1dd2266e2cb"|"DB Browser for SQLite 3.12.2" +"78aa210563284496"|"Windows Performance Analyzer 11.1.5.2" +"a48aff51c30d699a"|"qBittorrent 4.5.4 (64-bit)" +"f065ac336abcaa3e"|"Adobe Acrobat Reader DC (64-bit)" +"ace2e449a5dfce37"|"Windows Update Standalone Installer" +"db37f98b03e7cdde"|"WinMerge 2.16.30" +"7b8d39bd536c7feb"|"Microsoft XML Notepad" +"6f39a16f693777f6"|"Microsoft Paint 3D" +"82de7b745170a7a7"|"Microsoft App Installer" +`; + +/* + * Returns + an optional list of configurable objects that can load/save parameters from/to config files. + */ +function getConfigurables(){ + return null; +} + +/* Do some task initialization, like reading options and cofiguration params. + * This method is executed before starting the processing of items. + * It is executed by each processing thread. + * @Params + * configuration: configuration manager by which configurables could be retrieved after populated. + */ +function init(configuration){ + +} + +/* Finish task, maybe cleaning resources. It is executed after processing all items in case. + * It is executed by each processing thread. + * Objects "ipedCase" and "searcher" are shared, so case can be queried for items and bookmarks can be created, for example. + * TODO: document methods of those objects. + */ +function finish(){ + //Bookmark creation example + /* + var query = "type:pdf"; + + //set query into searcher + searcher.setQuery(query); + + //search in case and return item ids + var ids = searcher.search().getIds(); + + //create new bookmark and get its id + var bookmarkId = ipedCase.getBookmarks().newBookmark("PDF files"); + + //set bookmark comment + ipedCase.getBookmarks().setBookmarkComment(bookmarkId, "Documents of PDF file format"); + + //add item ids to created bookmark + ipedCase.getBookmarks().addBookmark(ids, bookmarkId); + + //save changes synchronously + ipedCase.getBookmarks().saveState(true); + */ +} + +/* + * Process object "item" of EvidenceFile class. This function is executed on all case items. + * It can access any method of EvidenceFile class: + * + * Some Getters: + * String: getName(), getExt(), getType(), getPath(), getHash(), getMediaType().toString(), getCategories() (categories separated by | ) + * Date: getModDate(), getCreationDate(), getAccessDate() (podem ser nulos) + * Boolean: isDeleted(), isDir(), isRoot(), isCarved(), isSubItem(), isTimedOut(), hasChildren() + * Long: getLength() + * Metadata getMetadata() + * Object: getExtraAttribute(String key) (returns an extra attribute) + * String: getParsedTextCache() (returns item extracted text, if this task is placed after ParsingTask) + * File: getTempFile() (returns a temp file with item content) + * BufferedInputStream: getBufferedInputStream() (returns an InputStream with item content) + * + * Some Setters: + * setToIgnore(boolean) (ignores the item and excludes it from processing and case) + * setAddToCase(boolean) (inserts or not item in case, after being processed: default true) + * addCategory(String), removeCategory(String), setMediaTypeStr(String) + * setExtraAttribute(key, value), setParsedTextCache(String) + * + */ +function process(item){ + var mime = item.getMediaType().toString(); + var name = item.getName().toLowerCase(); + var path = item.getPath().toLowerCase().replace(/\\/g, "/"); + var process=false; + if(mime.startsWith('application/x-automaticdestinations')){ + process=true; + patternExt = ".automaticdestinations"; + } + if(mime.startsWith('application/x-customdestinations')){ + process=true; + patternExt = ".customdestinations"; + } + if(process){ + var i = path.indexOf(patternExt); + if(i>0){ + id = path.substring(0,i); + id = id.substring(path.lastIndexOf("/")+1).toUpperCase(); + item.getMetadata().add("Application ID", id); + + var pos = IdsList.indexOf(id) + 19; + if(pos>18){ + item.getMetadata().add("Application Name", IdsList.substring(pos,IdsList.indexOf('"',pos))); + } + } + } +}