Windows.Forensics.JumpLists
Windows.Forensics.JumpLists
Parses Windows AutomaticDestinations JumpList files to extract LNK entries with application IDs and target paths.
The automaticdestinations jumplist is an OLE2 container containing LNK files as individual streams.
name: Windows.Forensics.JumpLists
description: |
Parses Windows AutomaticDestinations JumpList files to extract LNK
entries with application IDs and target paths.
The automaticdestinations jumplist is an OLE2 container containing
LNK files as individual streams.
imports:
- Windows.Forensics.Lnk
parameters:
- name: Globs
default: C:\Users\*\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
sources:
- query: |
// https://raw.githubusercontent.com/EricZimmerman/JumpList/a72a510b01922f60ce550c307e5f04131272448f/JumpList/Resources/AppIDs.txt
LET AppIdTable <= '''AppId|Description
0006f647f9488d7a|AIM 7.5.11.9 (custom AppID + JL support)
00098b0ef1c84088|fulDC 6.78
012dc1ea8e34b5a6|Microsoft Paint 6.1
01b29f0dc90366bb|AIM 5.9.3857
b08971c77377bde3|Visual Studio Enterprise 2015 Version 14.0 Update 3
c31b3d36438b5e2c|Visual Studio Enterprise 2017 Version 15.9.10
03d877ec11607fe4|Thunderbird 6.0.2
044a50e6c87bc012|Classic FTP Plus 2.15
a2b95ca27b6c33d9|Windows Live Photo Gallery
fdbd48d45512dffc|Photoshop 7
e26f61afb0824f2e|Photoshop CC 2015
050620fe75ee0093|VMware Player 3.1.4
a55ed4fbb973aefb|Microsoft Teams version 1.3.0.4461
05e01ecaf82f7d8e|Scour Exchange 0.0.0.228
06059df4b02360af|Kadu 0.10.0 / 0.6.5.5
070b52cf73249257|Sococo 1.5.0.2274
0a1d19afe5a80f80|FileZilla 2.2.32
0a79a7ce3c45d781|CuteFTP 7.1 (Build 06.06.2005.1)
0b17d3d0c9ca7e29|Document ViewerPicasa 3.8.0 (Build 117.43, 0)
0b3f13480c2785ae|Paint 6.1 (build 7601: SP1)
0b48ce76eda60b97|Shareaza 8.0.0.112300
0cfab0ec14b6f953|Express NewsPictures 2.41 (Build 08.05.07.0)
0ef606b196796ebb|HP MediaSmart Photo
10f5a20c21466e85|FTP Voyager 15.2.0.17
1110d9896dceddb3|imgSeek 0.8.5
12dc1ea8e34b5a6|Microsoft Paint (built-in Win7)
12dc1ea8e34b5a6|Microsoft Paint 6.1
134620458666ccb0|TeraCopy 2.3 64-bit
135df2a440abe9bb|SoulSeek 156c
13eb0e5d9a49eaef|Binjet 3.0.2
1434d6d62d64857d|BitLord 1.2.0-66
14354e216395983a|Remote Desktop Manager 2.1.0.0 FREE
1461132e553e2e6c|Firefox 6.0
169b3be0bc43d592|FastPictureViewer Professional 1.6 (Build 211)
16d71406474462b5|Snagit Editor 12.4.1
16ec093b8f51508f|Opera 8.54 build 7730 / 9.64 build 10487 / 11.50 build 1074
174c2c811c286c58|InfraRecorder 0.53.0.0 64-bit
177aeb41deb606ae|Adobe Photoshop CS6 (64 Bit)
17d3eb086439f0d7|TrueCrypt 7.0a
17d3eb086439f0d7|TrueCrypt 7.1a 64-bit
18434d518c3a61eb|Minitab 17
186b5ccada1d986b|NewsGrabber 3.0.36
19ccee0274976da8|mIRC 4.72 / 5.61
19e6043495a5b4da|Edit Pad Pro
1a60b1067913516a|Psi 0.14
1a89d1befe8e90e3|Adobe Acrobat Distiller Pro XI 32-bit 11.0.0779
1b29f0dc90366bb|AIM 5.9.3857
1b4dd67f29cb1962|Windows Explorer (Win7)
1b4dd67f29cb1962|Windows Explorer Pinned and Recent.
1bc392b8e104a00e|Remote Desktop
1bc392b8e104a00e|Remote Desktop Connection 6.1.7600 (Win7)
1bc9bbbe61f14501|OneNote
1c30573bdfce4155|Zenmap GUI 6.49BETA4
1cf97c38a5881255|MediaPortal 1.1.3
1cffbe973a437c74|DSPlayer 0.889 Lite
1da3c90a72bf5527|Safari 4.0.5 (531.22.7) / 5.1 (7534.50)
1eb796d87c32eff9|Firefox 5.0
20ef367747c22564|Bullet Proof FTP 2010.75.0.75
223bf0f360c6fea5|I2P 0.8.8 (restartable)
226400522157fe8b|FileZilla Server 0.9.39 beta
22c4d315e96389e0|FastCopy 3.12
22cefa022402327d|Meca Messenger 5.3.0.52
22cefa022402327d|Meca Messenger 5.3.0.52 (CHANGED)
236461219accfae0|This is new 1(NEW)
23646679aaccfae0|Adobe Acrobat 9.4.0
23646679aaccfae0|Adobe Reader 9 x64
23646679aaccfae0|Adobe Reader 9.
23646679aaccfae0|Adobe Reader 9.x
23646679aaccfae0|Adobe Reader 9.x(CHANGED)
23709f643539f03d|TGHIS IS NEW 2(NEW)
23709f6439b9f03d|Hex Editor Neo 5.14
23709f6439b9f03d|Hex Editor Neo 5.14(CHANGED)
23ef200ca6364eff|Oracle VM VirtualBox 5.0.16
23f08dab0f6aaf30|SoMud 1.3.3
2417caa1f2a881d4|ICQ 7.6 (Build 5617)
2437d4d14b056114|EiskaltDC++ 2.2.3
2519133d6d830f7e|IMatch 3.6.0.113
2544ff74641b639d|WiseFTP 6.1.5
26717493b25aa6e1|Adobe Dreamweaver CS5 (32-bit)
26753c97ea000ecd|LibreOffice 5.1.0.3 Math
271e609288e1210a|Microsoft Office Access 2010 x86
27da120d7e75cf1f|pbFTPClient 6.1
27ececd8d89b6767|AIM 6.2.14.2 / 6.5.3.12 / 6.9.17.2
28493d9d08e13aa6|UltraVNC Viewer 1.2.1.0
28c8b86deab549a1|Internet Explorer 8 / 9
28c8b86deab549a1|Internet Explorer 8 / 9 / 10 (32-bit)
28c8b86deab549a1|Internet Explorer 8.0.7600.16385 / 9
290532160612e071|WinRAR 2.90 / 3.60 / 4.01
290532160612e071|WinRar x64
292a746334889a7e|SQLiteSpy 1.9.13
2a5a615382a84729|X-Chat 2 2.8.6-2
2aa756186e21b320|RealTimeQuery 3.2
2b164f512891ae37|NewsWolf NSListGen
2b53c4ddf69195fc|Zune x64
2b5841989b3857da|RealVNC Server 5.3.0 64-bit (Chat)
2ca2a1a69dc5465f|UltraVNC 1.2.1.0 Server Property Page
2d1658d5dc3cbe2d|MySpaceIM 1.0.823.0 Beta
2d61cccb4338dfc8|BitTorrent 5.0.0 / 6.0.0 / 7.2.1 (Build 25548)
2db8e25112ab4453|Deluge 1.3.12 / 1.3.3
2db8e25112ab4453|Deluge 1.3.3
2fa14c7753239e4c|Paint.NET 2.72 / 3.5.8.4081.24580
2ff9dc8fb7e11f39|I2P 0.8.8 (no window)
3094cdb43bf5e9c2|Microsoft Office OneNote 2010 x86
30d23723bdd5d908|Digsby (Build 30140) (JL support)
315e29a36e961336|Roboform 7.8
3168cc975b354a01|Slypheed 3.1.2 (Build 1120)
3198e37206f28dc7|CuteFTP 8.3 Professional (Build 8.3.4.0007)
319f01bf9fe00f2d|Microsoft Access 2013 64-bit
319f01bf9fe00f2d|Microsoft Access 2016 64-bit
31e8ac6b0784ed7d|Foxit Reader 9.4.0.16811
3353b940c074fd0c|Microsoft Built-in Snipping Tool
337ed59af273c758|Sticky Notes
337ed59af273c758|Sticky Notes (Windows 10)
3461e4d1eb393c9c|WTW 0.8.18.2852 / 0.8.19.2940
353e9052cccbec5d|Kindle for PC 1.21.0
3594aab44bca414b|Windows Photo Viewer
36801066f71b73c5|Binbot 2.0
36c36598b08891bf|Vovox 2.5.3.4250
36f6bc3efe1d99e0|Alt.Binz 0.25.0 (Build 27.09.2007)
37392221756de927|RealPlayer SP 12
3866ff352d7719e1|Paint.NET 4.0.9
386a2f6aa7967f36|EyeBrowse 2.7
387d72eb9c9aa960|UltraVNC 1.2.1.0 Launcher
3917dd550d7df9a8|Konvertor 4.06 (Build 10)
3a5148bf2288a434|Secure FTP 2.6.1 (Build 20101209.1254)
3be7b307dfccb58f|NiouzeFire 0.8.7.0
3c0022d9de573095|QuteCom 2.2
3c309c17f7e8ffe1|GIMP 2.8.16
3c93a049a30e25e6|J. River Media Center 16.0.149
3cf13d83b0bd3867|RevConnect 0.674p (based on DC++)
3d877ec11607fe4|Thunderbird 6.0.2
3dc02b55e44d6697|7-Zip 3.13 / 4.20
3df22b7648cec4c1|TeamViewer 11.0.55321
3e9850346f375d41|Foxit Phantom PDF 7.2.2.929
3ed70ef3495535f7|Gravity 3.0.4
3edf100b207e2199|digiKam 1.7.0 (KDE 4.4.4)
3f2cd46691bbee90|GOIM 1.1.0
3f97341a65bac63a|Ozum 6.07 (Build 6070)
409b67100697bcc0|Revo Uninstaller Pro 3.1.5
40f2aca05d8a33f2|Minitab 16
411447f7de177c68|Windows DVD Maker 64-bit (Win7)
4278d3dc044fc88a|Gaim 1.5.0
431a5b43435cc60b|Python (.pyc)
43578521d78096c6|Windows Media Player Classic Home Cinema 1.3 (32-bit)
435a2f986b404eb7|SmartFTP 4.0.1214.0
435a2f986b404eb7|SmartFTP 4.0.1214.0 / 7.0.2200.0
43886ba3395acdcc|Easy Post 3.0
44a3621b32122d64|Microsoft Office Word 2010 x64
44a398496acc926d|Adobe Premiere Pro CS5 (64-bit)
44a50e6c87bc012|Classic FTP Plus 2.15
454ef7dca3bb16b2|Exodus 0.10.0.0
469e4a7982cea4d4|? (.job)
469e4a7982cea4d4|Windows Wordpad
46f433176bc0b3d2|WinRAR 5.30 beta 64-bit
4700ff5ae80a6713|PDFCreator 2.2
490c000889535727|WinMX 4.9.3.0
4975d6798a8bdf66|7-Zip 4.65 / 9.20
497b42680f564128|Zoner PhotoStudio 13 (Build 7)
49b5edbd92d8cd58|FTP Commander 8.02
49db7ed4f2703c22|LogMeIn Client 1.3.1835
4a49906d074a3ad3|Media Go 1.8 (Build 121)
4a7e4f6a181d3d08|broolzShare
4aa2a5710da3efe0|DCSharpHub 2.0.0
4acae695c73a28c7|VLC 0.3.0 / 0.4.6
4b632cf2ceceac35|Robo-FTP Server 3.2.5
4b6925efc53a3c08|BCWipe 5.02.2 Task Manager 3.02.3
4b6925efc53a3c08|BCWipe Task Manager 3.02.3 / 3.06.5.5
4b8a4727aa452343|Firefox 56.0.2
4c58cf9096ef3efd|Kindle for PC 1.24.3
4cdf7858c6673f4b|Bullet Proof FTP 1.26
4d72cfa1d0a67418|Newsgroup Image Collector
4d7bdaea55ad352|PeaZip 6.0.0
4d8bdacf5265a04f|The KMPlayer 2.9.4.1434
4dd48f858b1a6ba7|Free Download Manager 3.0 (Build 852)
4e0ac37db19cba15|Xfire 1.138 (Build 44507)
4e538fde985a3c01|Torch Browser 65.0.0.1614 (x86)
4f24a7b84a7de5a6|Palringo 2.6.3 (r45983)
4fceec8e021ac978|CoffeeCup Free FTP 3.5.0.0
4fd44f9938892caa|CDBurnerXP
500b8c1d5302fc9c|Python (.pyw)
50620fe75ee0093|VMware Player 12 build-3272444
50620fe75ee0093|VMware Player 3.1.4
50c5e019818564e3|Microsoft Excel Viewer 12.0.6219.1000
521a29e5d22c13b4|Skype 1.4.0.84 / 2.5.0.154 / 3.8.0.139 / 4.2.0.187 / Skype 5.3.0.120 / 5.5.0.115 / 5.5.32.117
54c803dfc87b52ba|Nettalk 6.7.12
550abc1cb58eb92c|VeraCrypt 1.16 / 1.19 64-bit
550abc1cb58eb92c|VeraCrypt 1.16 64-bit
558c5bd9f906860a|BearShare Lite 5.2.5.1
560d789a6a42ad5a|DC++ 0.261 / 0.698 / 0.782 (r2402.1)
56c5204009d2b915|uTorrent 3.5.5
590aee7bdd69b59b|Powershell Windows 10
590aee7bdd69b59b|Windows Powershell 5.0 64-bit
59e86071b87ac1c3|CuteFTP 8.3 (Build 8.3.4.0007)
59f56184c796cfd4|ACDSee Photo Manager 10 (Build 219)
5b186fc4a0b40504|Dtella 1.2.5 (Purdue network only)
5b72f67adcce9045|UltraVNC 1.2.1.0 Settings
5b7f3287093c1623|Total Commander 8.52a 64-bit
5bb830f67194431a|7-Zip 18.05 (x64)
5c450709f7ae4396|Firefox 1.0 / 2.0 / 3.0
5c450709f7ae4396|Firefox 3.6.13 (32-bit)
5d696d521de238c3|Chrome 9.0.597.84 / 12.0.742.100 / 13.0.785.215
5d696d521de238c3|Chrome 9.0.597.84 / 12.0.742.100 / 13.0.785.215 / 26
5d696d521de238c3|Google Chrome 9.0.597.84 / 12.0.742.100 / 13.0.785.215 / 48.0.2564.116
5d6f13ed567aa2da|Microsoft Office Outlook 2010 x64
5d7b4175afdcc260|Shareaza 2.0.0.0
5da8f997fd5f9428|Internet Explorer x64
5df4765359170e26|Firefox 4.0.1
5e01ecaf82f7d8e|Scour Exchange 0.0.0.228
5ea2a50c7979fbdc|TrustyFiles 3.1.0.22
5f6e7bc0fb699772|Microsoft Office PowerPoint 2010 x64
5f7b5f1e01b83767|Quick Access
5fb817cd5a8cad21|Google Drive
5fd959f6fe6b8ae7|PuTTY 0.70 (x64)
6059df4b02360af|Kadu 0.10.0 / 0.6.5.5
606a33f5a27b57d4|Microsoft Built-in Computer Management 10.0.10011.16384 (Win10)
6224453d9701a612|BinTube 3.7.1.0 (requires VLC 10.5!)
62bff50b969c2575|"Quintessential Media Player 5.0 (Build 121) - also usage stats (times used, tracks played, total time used)"
62bff50b969c2575|Quintessential Media Player 5.0 (Build 121)
62dba7fb39bb0adc|Yahoo Messenger 7.5.0.647 / 8.1.0.421 / 9.0.0.2162 / 10.0.0.1270
65009083bfa6a094|(app launched via XPMode)
65f7dd884b016ab2|LimeChat 2.39
669967f27afdebec|NirSoft PstPassword 1.20 (x86)
6728dd69a3088f97|Command Prompt
6728dd69a3088f97|Windows Command Processor - cmd.exe (64-bit)
6824f4a902c78fbd|Firefox 64.0
689319b6547cda85|emesene 2.11.7
6a316aa67a46820b|Core FTP LE 1.3c (Build 1437) / 2.2 (Build 1689)
6a8b377d0f5cb666|WinSCP 2.3.0 (Build 146)
6aa18a60024620ae|GCN 2.9.1
6b3a5ce7ad4af9e4|IceChat 9 RC2
6bb54d82fa42128d|WinSCP 4.3.4 (Build 1428)
6bb98fb8cdc26d69|Calculator (Windows built-in)
6bc3383cb68a3e37|iTunes 7.6.0.29 / 8.0.0.35
6d2bac8f1edf6668|Microsoft Office Outlook 365
6d2bac8f1edf6668|Microsoft Outlook 2013 32-bit
6d2bac8f1edf6668|Microsoft Outlook 2016 64-bit
6e855c85de07bc6a|Microsoft Office Excel 2010 x64
6e9a79992da9ea2|Nokia PC Suite 7.1
6e9d40a4c63bb562|Real Player Alternative 1.25 (Media Player Classic 6.4.8.2 / 6.4.9.0)
6f647f9488d7a|AIM 7.5.11.9 (custom AppID + JL support)
6fee01bd55a634fe|Smuxi 0.8.0.0
7010c278903c2b0f|Adobe Acrobat XI Pro 32-bit
70b52cf73249257|Sococo 1.5.0.2274
70d9ada92108d731|IrfanView 4.51 (x64)
714b179e552596df|Bullet Proof FTP 2.4.0 (Build 31)
7192f2de78fd9e96|TIFNY 5.0.3
728008617bc3e34b|eM Client 3.0.10206.0
73c6a317412687c2|Google Talk 1.0.0.104
73ce3745a843c0a4|FrostWire 5.1.4
7494a606a9eef18e|Crystal Player 1.98
74d7f43c1561fc1e|Windows Media Player 12 (32-bit)
74d7f43c1561fc1e|Windows Media Player 12.0.7600.16415 / 12.0.7601.17514
74d7f43c1561fc1e|Windows Media Player 12.0.7601.17514
74ea779831912e30|Skype 7.18.0.112
74ea779831912e30|Skype 7.24.0.104
7526de4a8b5914d9|Forte Agent 6.00 (Build 32.1186)
7593af37134fd767|RealPlayer 6.0.6.99 / 7 / 8 / 10.5
76689ff502a1fd9e|Imagine Image and Animation Viewer 1.0.7
76f6f1bd18c19698|aMule 2.2.6
776beb1fcfc6dfa5|Thunderbird 1.0.6 (20050716) / 3.0.2
777483d3cdac1727|Gajim 0.14.4
780732558f827a42|AutoPix 5.3.3
784182360de0c5b6|Kazaa Lite 1.7.1
78f0afb5bd4bb278|Microsoft Lync 2016 64-bit (Skype for Business)
7904145af324576e|Total Commander 7.56a (Build 16.12.2010)
7904145af324576e|Total Commander 7.56a (Build 16.12.2010) / 8.52a 32-bit
792699a1373f1386|Piolet 3.1.1
79370f660ab51725|UploadFTP 2.0.1.0
7937df3c65790919|FTP Explorer 10.5.19 (Build 001)
7a4ba998575ff2a4|FreeCommander XE 2016 Build 715 32-bit
7a7c60efd66817a2|Spotnet 1.7.4
7a8db574299c8568|Windows Movie Maker 2012 (build 16.4.3528.0331)
7b2b4f995b54387d|News Reactor 20100224.16
7b4d500e147e4391|Tor Browser 8.0.4 (x64)
7b7f65aaeca20a8c|Dropbox App 5.4.24
7c2916afd6f116a6|LibreOffice 5.1.0.3 Base
7cb0735d45243070|CDisplay 1.8.1.0
7dca40fd2a5a971f|LibreOffice 5.1.0.3
7e4dca80246863e3|Control Panel
7e4dca80246863e3|Control Panel (?)
7e4dca80246863e3|Control Panel - Settings
7fd04185af357bd5|UltraLeeacher 1.7.0.2969 / 1.8 Beta (Build 3490)
8172865a9d5185cb|Binreader 1.0 (Beta 1)
817bb211c92fd254|GOM Player 2.0.12.3375 / 2.1.28.5039
817e5ad5be351574|Microsoft Built-in Services 10.0.10011.16384 (Win10)
8211531a7918b389|Newsbin Pro 6.00 (Build 1019) (JL support)
83b03b46dcd30a0e|iTunes 10
83b03b46dcd30a0e|iTunes 9.0.0.70 / 9.2.1.5 / 10.4.1.10 (begin custom 'Tasks' JL capability)
83b03b46dcd30a0e|iTunes 9.0.0.70 / 9.2.1.5 / 10.4.1.10 (begin custom 'Tasks' JL capability) / 12.3.2.35 64-bit
83dd64e7fa560bd5|LibreOffice 5.1.0.3 Calc
84f066768a22cc4f|Adobe Photoshop CS5 (64-bit)
8628e76fd9020e81|Fling File Transfer Plus 2.24
86781fe8437db23e|Messenger Pro 2.66.6.3353
86b804f7a28a3c17|Miranda IM 0.6.8 / 0.7.6 / 0.8.27 / 0.9.9 / 0.9.29
86b804f7a28a3c17|Miranda IM 0.6.8 / 0.7.6 / 0.8.27 / 0.9.9 / 0.9.29 (ANSI + Unicode)
884fd37e05659f3a|VZOchat 6.3.5
888f2fa044591eda|Twitter - Trusted Microsoft Store App (Win10)
8904a5fd2d98b546|IceChat 7.70 20101031
89b0d939f117f75c|Adobe Acrobat 9 Pro Extended (32-bit)
8a1c1c7c389a5320|Safari 3.2.3 (525.29)
8a461f82e9eb4102|Foxit Reader 7.2.0.722
8bd5c6433ca967e9|ACDSee Photo Manager 2009 (v11.0 Build 113)
8c816c711d66a6b5|MSN Messenger 6.2.0137 / 7.0.0820
8dcca8b24a5e822e|CDBurnerXP 4.5.7.6623
8deb27dfa31c5c2a|CoffeeCup Free FTP 4.4 (Build 1904)
8eafbd04ec8631ce|VMware Workstation 11.0.0 build-2305329
8eafbd04ec8631ce|VMware Workstation 9 x64
8f3d7202aa5d4c01|ImgBurn 2.5.8.0
8f852307189803b8|Far Manager 2.0.1807
8fb5ce5e2b049ce|Windows Defender (Win10 built-in)
8fd1364019dc2115|Calibre E-Book Manager 2.33
8fdb062f1e486cac|Microsoft Powerpoint 2013 32-bit
9027fe24326910d2|Thunderbird 38.6.0
905c98e216107aa1|Microsoft Lync 2013 15.0.4753.1000
9077b9c9cf187cc2|KeePass 1.36
90e5e8b21d7e7924|Winamp 3.0d (Build 488)
918e0ecb43d17e23|Notepad (32-bit)
92f1d5db021cd876|NewsLeecher 4.0 / 5.0 Beta 6
939c10c2c101c1b0|Stickies 9.0d
93b18adf1d948fa3|qutIM 0.2
954ea5f70258b502|Windows Script Host - wscript.exe (32-bit)
9560577fd87cf573|LeechFTP 1.3 (Build 207)
96252daff039437a|Lphant 7.0.0.112351
966fa7c312d9b10|Eraser 6.2.0.2970
969252ce11249fdd|Mozilla Firefox 40.0 / 44.0.2
9749cea96d411f37|HexChat 2.10.2 64-bit
977a5d147aa093f4|Lphant 3.51
9839aec31243a928|Microsoft Office Excel 2010 x86
989d7545c2b2e7b2|IMVU 465.8.0.0
98b0ef1c84088|fulDC 6.78
99c15cf3e6d52b61|mldonkey 3.1.0
9a3bdae86d5576ee|WinSCP 3.2.1 (Build 174) / 3.8.0 (Build 312)
9a464053cd82de6d|LINE Messenger
9ad1ec169bf2da7f|FlylinkDC++ r405 (Build 7358)
9ad84c52efeae190|1Password 4.6.0.604
9b9cdc69c1c24e2b|Notepad (64-bit)
9b9cdc69c1c24e2b|Notepad 64-bit
9c08ad74ad8708df|Microsoft Publisher 2016 64-bit
9c32e2313792e6e8|Microsoft Built-in Disk Cleanup (Win10)
9c7cc110ff56d1bd|Microsoft Office PowerPoint 2010 x86
9ce6555426f54b46|HxD 1.7.7.0
9d1f905ce5044aee|Edge Browser
9d78513a8998829c|Microsoft Built-in Run Dialog (Win7 + Win10)
9d91276b0be3e46b|Windows Help and Support (Built-in) Win7
9dacebaa9ac8ca4e|TLNews Newsreader 2.2.0 (Build 2430)
9e0b3f677a26bbc4|BitKinex 3.2.3
9edafe4ba4b22ce7|Eclipse IDE Oxygen (4.7.3a)
9f03ae476ad461fa|GroupsAloud 1.0
9f5c7755804b850a|Windows Script Host - wscript.exe (64-bit)
9fda41b86ddcf1db|VLC 0.5.3 / 0.8.6i / 0.9.7 / 1.1.11
9fda41b86ddcf1db|VLC Media Player 0.5.3 / 0.8.6i / 0.9.7 / 1.1.11 / 2.2.1
9fdb10e18cdd0101|Cisco AnyConnect Secure Mobility Client 3.1.02040
a028c9db28aa15a3|Piriform Defraggler 2.20.989 64-bit
a0d6b1b874c6e9d2|TOR Browser 6.0.2
a10b45adb36c1d27|PST Walker 5.54
a18df73203b0340e|Microsoft Word 2016
a1d19afe5a80f80|FileZilla 2.2.32
a2c73c383525f1bb|RealVNC Viewer 5.3.0 64-bit
a31ec95fdd5f350f|BitComet 0.49 / 0.59 / 0.69 / 0.79 / 0.89 / 0.99 / 1.07 / 1.28
a3e0d98f5653b539|Instantbird 1.0 (20110623121653) (JL support)
a4a5324453625195|Microsoft Office Word 2013 x86
a4a5324453625195|Microsoft Word 2013 32-bit
a4def57ee99d77e9|Nomad News 1.43
a52b0784bd667468|Photos Microsoft 16.526.11220.0 (Windows 10)
a581b8002a6eb671|WiseFTP 5.5.9
a5db18f617e28a51|ICQ 6.5 (Build 2024)
a6d4dfec09c69409|Microsoft Word Viewer 11.8169.8172
a746f9625f7695e8|HeXHub 5.07
a75b276f6e72cf2a|Kazaa Lite Tools K++ 2.7.0
a75b276f6e72cf2a|Kazaa Lite Tools K++ 2.7.0 / WinMX 3.53
a75b276f6e72cf2a|WinMX 3.53
a777ad264b54abab|JetVideo 8.0.2.200 Basic
a79a7ce3c45d781|CuteFTP 7.1 (Build 06.06.2005.1)
a7bd71699cd38d1c|Microsoft Office Word 2010 x86
a8c43ef36da523b1|Microsoft Office Word 2003 Pinned and Recent.
a8df13a46d66f6b5|Kommute (Calypso) 0.24
aa11f575087b3bdc|Unzbin 2.6.8
ac3a63b839ac9d3a|Azureus Vuze Bittorrent Client 4.6.0.4 / 5.7.1.0
ac3a63b839ac9d3a|Vuze 4.6.0.4
ac8920ed05001800|@DMDirc 0.6.5 (Profile store: C:\Users\$user\AppData\Roaming\DMDirc\)
ac8920ed05001800|DMDirc 0.6.5 (Profile store: C:\Users\$user\AppData\Roaming\DMDirc\)
accca100973ef8dc|Azureus 2.0.8.4
ace8715529916d31|40tude Dialog 2.0.15.1 (Beta 38)
adecfb853d77462a|Microsoft Office Word 2007 Pinned and Recent.
ae069d21df1c57df|mIRC 6.35 / 7.19
ae3f2acd395b622e|QuickTime Player 6.5.1 / 7.0.3 / 7.5.5 (Build 249.13)
aedd2de3901a77f4|Pidgin 2.0.0 / 2.10.0 / 2.7.3
aedd2de3901a77f4|Pidgin 2.10.11
b0236d03c0627ac4|ICQ 5.1 / ICQLite Build 1068
b0459de4674aab56|(.vmcx)
b0459de4674aab56|Windows Virtual PC - vmwindow.exe (32- and 64-bit)
b06a975b62567622|Windows Live Messenger 8.5.1235.0517 BETA
b08971c77377bde3|Microsoft Visual Studio Community 2015
b17d3d0c9ca7e29|"Picasa 3.8.0 (build 117.43, 0) / 3.9.141 (build 259)"
b17d3d0c9ca7e29|"Picasa 3.8.0 (Build 117.43, 0)"
b223c3ffbc0a7a42|Bersirc 2.2.14
b3016b8da2077262|eMule 0.50a
b3965c840bf28ef4|AIM 4.8.2616
b39bc6b590f53961|HexChat 2.10.2 32-bit
b39c5f226977725d|ACDSee Pro 8.1.99
b3f13480c2785ae|Paint 6.1 (build 7601: SP1)
b48ce76eda60b97|Shareaza 8.0.0.112300
b50ee40805bd280f|QuickTime Alternative 1.9.5 (Media Player Classic 6.4.9.1)
b6267f3fcb700b60|WiseFTP 4.1.0
b74736c2bd8cc8a5|WinZip
b74736c2bd8cc8a5|WinZip 15.5 (9468)
b77ef7f3fc946302|Pale Moon Browser 26.1.1 (32-bit)
b7cb1d1c1991accf|FlashFXP 4.0.0 (Build 1548)
b868d9201b866d96|Microsoft Lync 4.0.7577.0
b8ab77100df80ab2|Microsoft Excel 2016 64-bit
b8ab77100df80ab2|Microsoft Office Excel x64
b8c13a5dd8c455a2|Titan FTP Server 8.40 (Build 1338)
b8c29862d9f95832|Microsoft Office InfoPath 2010 x86
b91050d8b077a4e8|Windows Media Center (Win7)
b91050d8b077a4e8|Windows Media Center x64
ba132e702c0147ef|KCeasy 0.19-rc1
ba3a45f7fd2583e1|Blubster 3.1.1
bac8a6b507360131|Remote Desktop Connection Manager 2.2
baea31eacd87186b|BinaryBoy 1.97 (Build 55)
bba8a4896f0d26f|Ares Chat Client (3.1.9.4045)
bc03160ee1a59fc1|Foxit PDF Reader 5.4.5
bc0c37e84e063727|Windows Command Processor - cmd.exe (32-bit)
bc2f88eccd3461b4|Microsoft Built-in Event Viewer 1.0 (Win10)
bcc705f705d8132b|Instan-t 5.2 (Build 2824)
bcd7ba75303acbcf|BitLord 1.1
bd249197a6faeff2|Windows Live Messenger 2011
be4875bb3e0c158f|CrossFTP 1.75a
be71009ff8bb02a2|Microsoft Office Outlook x86
bec10d3aaf939ffa|Pale Moon Browser 26.1.1 (64-bit)
bf483b423ebbd327|Binary Vortex 5.0
bf9ae1f46bd9c491|Nimbuzz 2.0.0 (rev 6266)
bfc1d76f16fa778f|Ares (Galaxy) 1.8.4 / 1.9.8 / 2.1.0 / 2.1.7.3041
bfc1d76f16fa778f|Ares (Galaxy) 1.8.4 / 1.9.8 / 2.1.0 / 2.1.7.3041 / 3.1.9.4045
bfe841f4d35c92b1|QuadSucker/News 5.0
c01d68e40226892b|ClicksAndWhistles 2.7.146
c02baf50d02056fc|FotoVac 1.0
c04f69101c131440|CuteFTP 5.0 (Build 50.6.10.2)
c1eece5026414c64|Recuva 1.52.1086 (64-bit)
c2d349a0e756411b|Adobe Reader 8.1.2
c312e260e424ae76|Mail.Ru Agent 5.8 (JL support)
c5236fd5824c9545|PLAYXPERT 1.0.140.2822
c54b96f328bdc28d|WiseFTP 7.3.0
c5c24a503b1727df|XnView 1.98.2 Small / 1.98.2 Standard
c5c24a503b1727df|XnView 1.98.2 Small / 1.98.2 Standard / 2.35
c5ef839d8d1c76f4|LimeWire 5.2.13
c634153e7f5fce9c|IrfanView 3.10 / 4.30
c634153e7f5fce9c|IrfanView 3.10 / 4.30 / 4.41 32-bit
c6f7b5bf1b9675e4|BitWise IM 1.7.3a
c71ef2c372d322d7|PGP Desktop 10
c765823d986857ba|Adobe Illustrator CS5 (32-bit)
c7a4093872176c74|Paint Shop Pro Pinned and Recent.
c8112ac53c5ed250|Jetico Log Viewer 1.1
c845f3a6022d647c|Another File 2.Build 2/7/2004)
c8aa3eaee3d4343d|Trillian 0.74 / 3.1 / 4.2.0.25 / 5.0.0.35 (JL support)
c8e4c10e5460b00c|iMesh 6.5.0.16898
c91d08dcfc39a506|SM Player 0.6.9 r3447
c9374251edb4c1a8|BitTornado T-0.3.17
c98ab5ccf25dda79|NewsShark 2.0
c9950c443027c765|WinZip 9.0 SR-1 (6224) / 10.0 (6667)
c997d2e1a0f0929|BCWipe 6.08.6
c99ddde925d26df3|Robo-FTP 3.7.9 CronMaker
ca1eb46544793057|RetroShare 0.5.2a (Build 4550)
ca942805559495e9|aMSN 0.98.4
caea34d2e74f5c8|uTorrent 3.4.7
cb1d97aca3fb7e6b|Newz Crawler 1.9.0 (Build 4100)
cb5250eaef7e3213|ApexDC++ 1.4.3.957
cb984e3bc7faf234|NewsRover 17.0 (Rev.0)
cb996a858d7f15c|PDF Architect 4.0.09.25450 64-bit
cbbe886eca4bfc2d|ExoSee 1.0.0
cbeb786f0132005d|VLC 0.7.2
cc4b36fbfb69a757|gtk-gnutella 0.97
cc76755e0f925ce6|AllPicturez 1.2
cca6383a507bac64|Gadu-Gadu 10.5.2.13164
ccb36ff8a8c03b4b|Azureus 2.5.0.4 / Vuze 3.0.5.0
ccc0fa1b9f86f7b3|CCleaner 5.15.5513 64-bit
cd2acd4089508507|AbsoluteTelnet 9.18 Lite
cd40ead0b1eb15ab|NNTPGrab 0.6.2
cd8cafb0fb6afdab|uTorrent 1.7.7 (Build 8179) / 1.8.5 / 2.0 / 2.21 (Build 25113) / 3.0 (Build 25583)
cdb6f0c373f2da0f|stunnel 5.31
cdf30b95c55fd785|Microsoft Office Excel 2007
cf6379a9a987366e|Digibin 1.31
cfab0ec14b6f953|Express NewsPictures 2.41 (Build 08.05.07.0)
cfb56c56fa0f0a54|Mozilla 0.9.9
d00655d2aa12ff6d|Microsoft Office PowerPoint x64
d00655d2aa12ff6d|Microsoft PowerPoint 2016 64-bit
d0261ed6e16b200b|News File Grabber 4.6.0.4
d1fc019238236806|Newsgroup Commander Pro 9.05
d22ad6d9d20e6857|ALLPlayer 4.7
d28ee773b2cea9b2|3D-FTP 9.0 build 7
d2d0fc95675fb2c8|Microsoft Built-in Print Management (Win10)
d33ecf70f0b74a77|"Picasa 2.2.0 (Build 28.08, 0)"
d33ecf70f0b74a77|Picasa 2.2.0 (Build 28.08, 0)
d3530c5294441522|HydraIRC 0.3.165
d38a3ea7ec79fbed|LibreOffice 5.1.0.3 Writer
d38adec6953449ba|Microsoft Office OneNote 2010 x64
d3c5cf21e86b28af|SeaMonkey 2.3.3
d41746b133d17456|Tkabber 0.11.1
d460280b17628695|Java Binary
d4a589cab4f573f7|Microsoft Project 2010 x86
d53b52fb65bde78c|Android Newsgroup Downloader 6.2
d5c02fc7afbb3fd4|NNTPGrab 0.6.2 Server
d5c3931caad5f793|Adobe Soundbooth CS5 (32-bit)
d64d36b238c843a3|Microsoft Office InfoPath 2010 x86
d7528034b5bd6f28|Windows Live Mail Pinned and Recent.
d7666c416cba240c|NewsMan Pro 3.0.5.2
d78150e0484a4e1d|Evernote 5.9.6.9494
d7d647c92cd5d1e6|uTalk 2.6.4 r47692
d7db75db9cdd7c5d|Xnews 5.04.25
d8081f151f4bd8a5|CuteFTP 8.3 Lite (Build 8.3.4.0007)
d838aac097abece7|ACDSee Photo Manager 12 (Build 344)
d8671c1ed93c75c8|Tor Browser 5.5.2
d93f411851d7c929|Windows Powershell 5.0 32-bit
d97efdf3888fe7eb|KeePass 2.31
da7e8de5b8273a0f|Yahoo Messenger 5.0.0.1226 / 6.0.0.1922
db3b8d985f0668e|FreeFileSync 10.7
dba909a61476ccec|NewsWolf 1.41
dc64de6c91c18300|Brosix Communicator 3.1.3 (Build 110719 nid 1)
dd658a07478b46c2|PIRCH98 1.0.1.1190
de48a32edcbe79e4|Acrobat Reader 15.x
de48a32edcbe79e4|Adobe Acrobat Reader DC 2015.010.20056
de76415e0060ce13|Noworyta News Reader 2.9
dee18f19c7e3a2ec|PopNote 5.21
e0246018261a9ccc|qutIM 0.2.80.0
e0532b20aa26a0c9|QQ International 1.1 (2042)
e0f7a40340179171|imule 1.4.5 (rev. 749)
e107946bb682ce47|FileZilla 3.5.1
e107946bb682ce47|Filezilla 3.5.1 / 3.16
e1d47cb031dafb9f|BearShare 6.0.0.22717 / 8.1.0.70928 / 10.0.0.112380
e2a593822e01aed3|Adobe Flash CS5 (32-bit)
e30bbea3e1642660|Neebly 1.0.4
e31a6a8a7506f733|Image AXS Pro 4.1
e36bfc8972e5ab1d|XPS Viewer
e40cb5a291ad1a5b|Songbird 1.9.3 (Build 1959)
e42a8e0f4d9b8dcf|Sysax FTP Automation 5.15
e4bd2558bfab368d|UltraDefrag 7.0.0
e57cfc995bdc1d98|Snagit 11
e6ea77a1d4553872|Gnucleus 1.8.6.0
e6ee34ac9913c0a9|VLC 0.6.2
e6ef42224b845020|ALFTP 5.20.0.4
e70d383b15687e37|Notepad++ 5.6.8 (32-bit)
e70d383b15687e37|Notepad++ 6.6.7
e73d9f534ed5618a|BitSpirit 1.2.0.228 / 2.0 / 2.6.3.168 / 2.7.2.239 / 2.8.0.072 / 3.1.0.077 / 3.6.0.550
e76a4ef13fbf2bb1|Manolito 3.1.1
e93dbdcede8623f2|Pandion 2.6.106
e9a39dfba105ea23|FastStone Image Viewer 4.6
e9a39dfba105ea23|Faststone Image Viewer 4.6 / 5.5
ea83017cdd24374d|IrfanView Thumbnails
eab25958dbddbaa4|Binary News Reaper 2 (Beta 0.14.7.448)
eb3300e672136bc7|Stream Reactor 1.0 Beta 9 (uses VLC!)
eb7e629258d326a1|WindowWasher 6.6.1.18
ebd8c95d87f25154|Carrier 2.5.5
ec3e36af0cdcb3e1|Steam build 2/4/2016
ecd1a5e2c3af9c46|LibreOffice 5.1.0.3 Press
ecd21b58c2f65a2f|StealthNet 0.8.7.9
ecdd9154e84d5544|Wickr Top Secret Messenger Desktop 2.3.5
ed49e1e6ccdba2f5|GNUnet 0.8.1a
ed7a5cc3cca8d52a|CCleaner 1.32.345 / 1.41.544 / 2.36.1233 / 3.10.1525
edc786643819316c|HoneyView3 #5834
ee0c103672a7a2b9|ManyCam 6.7.0
ee462c3b81abb6f6|Adobe Reader X 10.1.0
ef473fab8120b354|uTorrent 3.5.5
ef606b196796ebb|HP MediaSmart Photo
efb08d4e11e21ece|Paltalk Messenger 10.0 (Build 409)
efbb2bf3c1d06466|Auslogics Disk Defrag 6.2.1.0
f001ea668c0aa916|Cabos 0.8.2
f01b4d95cf55d32a|Windows Explorer (Win10) ??? TEST THIS
f01b4d95cf55d32a|Windows Explorer Windows 8.1
f0275e8685d95486|Microsoft Excel 2013 32-bit
f0275e8685d95486|Microsoft Office Excel 2013 x86
f0468ce1ae57883d|Adobe Reader 7.1.0
f09b920bfb781142|Camfrog 4.0.47 / 5.5.0 / 6.1 (build 146) (JL support)
f0c7bd3e0584a65a|InfraRecorder 0.53.0.0 32-bit
f1a4c04eebef2906|[i2p] Robert 0.0.29 Preferences
f214ca2dd40c59c1|FrostWire 4.20.9
f2cb1c38ab948f58|X-Chat 1.8.10 / 2.6.9 / 2.8.9
f5ac5390b9115fdb|Microsoft Office PowerPoint 2007
f5e4e50707bcd215|Microsoft Message Analyzer 1.4
f61b65550a84027e|iMesh 11.0.0.112351
f64de962764b9b0f|FTPRush 1.1.3 / 2.15
f674c3a77cfe39d0|Winamp 2.95 / 5.1 / 5.621
f674c3a77cfe39d0|Winamp 2.95 / 5.1 / 5.621 / 5.666
f6fd5d99e2b6e178|LibreOffice 5.1.0.3 Draw
f784591ff7f60f76|Microsoft Built-in Defragment and Optimize Drives (Win10)
f82607a219af2999|Cyberduck 4.1.2 (Build 8999)
f91fd0c57c4fe449|ExpanDrive 2.1.0
f920768fe275f7f4|Grabit 1.5.3 Beta (Build 909) / 1.6.2 (Build 940) / 1.7.2 Beta 4 (Build 997)
f92e607f9de02413|RealPlayer 14.0.6.666
fa02aa2c575837a6|Microsoft Built-in Task Scheduler 1.0 (Win10)
fa496fe13dd62edf|KVIrc 3.4.2.1 / 4.0.4
fa7144034d7d083d|Directory Opus 10.0.2.0.4269 (JL tasks supported)
fac3aa4105c6c466|Microsoft Built-in System Restore (Win7)
faef7def55a1d4b|VLC 2.2.6
fb1f39d1f230480a|Bopup Messenger 5.6.2.9178 (all languages: en,du,fr,ger,rus,es)
fb1f39d1f230480a|Bopup Messenger 5.6.2.9178 (all languages: en;du;fr;ger;rus;es)
fb230a9fe81e71a8|Yahoo Messenger 11.0.0.2014-us
fb3b0dbfee58fac8|Microsoft Office Word 365 x86
fb3b0dbfee58fac8|Microsoft Word 2016 64-bit
fb7ca8059b8f2123|ooVoo 3.0.7.21
fc999f29bc5c3560|Robo-FTP 3.7.9
fd1ad55e472f20e0|Google Earth Pro 7.3.2.5491
fdbaca0a1fce6055|MozBackup 1.5.1
fe57f5df17b45fe|Wireshark 2.6.3
fe5e840511621941|JetAudio 5.1.9.3018 Basic / 6.2.5.8220 Basic / 7.0.0 Basic / 8.0.16.2000 Basic
fe8bb4692de7b989|Smart Defrag 4.3.0.847
fe9e0f7260000a12|RealVNC Server 5.3.0 64-bit (Connect+File Transfer)
ff103e2cc310d0d|Adobe Reader XI
ff224628f0e8103c|Morpheus 3.0.3.6
4cb9c5750d51c07f|Microsoft Movies & TV (Build 10.19031.11411.0)
ae6df75df512bd06|Microsoft Groove Music (Build 10.19031.1141.0)
959668a81d4f220e|Sublime Text 3.2.1 (Build 3207)
9eff0b23d51fe003|XMind 201807140020
70ffd305907c983b|7zip 18.05
1c7a9be1b15a03ba|Microsoft ScreenSketch
1ced32d74a95c7bc|Microsoft Visual Studio Code
3c3871276e149215|PowerShell 7
573770283dc3d854|Microsoft Window SecHealthUI
9390ee5b658e96e|PuTTY 0.72 / 0.73
a55ed4fbb973aefb|Microsoft Teams
baacb5294867b833|Notepad++ 7.8.6
d249d9ddd424b688|Google Chrome 81.0.4044.138
ff99ba2fb2e34b73|Microsoft Windows Calculator
4ac866364817f10c|Microsoft Edge (Chromium)
ccba5a5986c77e43|Microsoft Edge (Chromium)
188f5ec9d11ded56|Microsoft Edge (Chromium)
69639df789022856|Google Chrome 86.0.4240.111
352fd027c0e8f0e5|Zoom
8bce06a9e923e1f9|Slack 4.10.3
a55ed4fbb973aefb|Microsoft Teams
1c7a9be1b15a03ba|Microsoft Snip & Sketch
466d339d8f21cfbf|Microsoft Snip & Sketch
9a165f62edbfa161|Microsoft Store
573770283dc3d854|Windows Defender
f18460fded109990|Windows Connected Devices
dd7c3b1adb1c168b|Microsoft Game Bar
447e6aa2bbdfbc8a|Slack 4.11.3
3b94415067dd2c5d|GOG Galaxy
58170c92fa4b91a1|MediaMonkey
5f218922e0901ebf|MusicBee
75fdacd8330bac18|AnyDesk
8b87640a40ec9fc|Snagit 2020
af0fdd562e3f275b|Snagit 2020
b7173093b23b9a6a|Beyond Compare 4
d356105fac5527ef|Steam 1/22/2021
28efb5b6d2e28389|EA Origin
20513cdf29d09c0e|Hex Editor Neo
1d12f965b876dc87|Snagit 2021
16f2f0042ddbe0e8|Windows Terminal
352fd027c0e8f0e5|Zoom
7111c0ce965b7246|Battle.net
a7ba40025dac9a67|Microsoft Office Hub
8e4e81d9adc545b8|Microsoft Your Phone
c01827d56ff89056|Microsoft Sticky Notes
bd050ac447f6cd65|Microsoft Xbox App
ff99ba2fb2e34b73|Windows Calculator
fc98c00f85d4ce77|EditPad Pro 8
46e77b87767b92|Opera Browser 75
ad57bd0f4825cce|WinRAR 6.01 Russian 64 bit
'''
LET AppIdLookup <= memoize(key="AppId", query={
SELECT *
FROM parse_csv(accessor='data', separator="|",
filename=AppIdTable)
})
LET X = SELECT * FROM foreach(row={
SELECT OSPath AS AutomaticDestinationsPath
FROM glob(globs=Globs)
}, query={
SELECT AutomaticDestinationsPath, OSPath, Name,
parse_binary(filename=OSPath, accessor="mscfb",
profile=Profile, struct="ShellLinkHeader") AS Parsed
FROM glob(globs='*', accessor="mscfb",
root=pathspec(DelegatePath=AutomaticDestinationsPath))
WHERE Size > 0 AND NOT IsDir AND Name =~ "^\\d+$"
})
LET Y = SELECT AutomaticDestinationsPath, Name AS Stream,
split(sep_string=".", string=AutomaticDestinationsPath.Basename)[0] AS ApplicationId,
ShowHeader(Parsed=Parsed) as _ShellLinkHeader,
Parsed.LinkInfo as _LinkInfo,
ShowLinkTarget(ShellBag=Parsed.LinkTargetIDList.IDList.ShellBag) as _LinkTarget,
Parsed.StringData as _StringData,
ShowExtraData(Parsed=Parsed, OSPath=OSPath) as _ExtraData,
property_store(Parsed=Parsed) as _PropertyStore
FROM X
SELECT *, ApplicationId,
get(item=AppIdLookup, field=ApplicationId).Description AS Application,
_LinkTarget.LinkTarget || _LinkInfo.Target.Path AS LinkTarget,
_ShellLinkHeader.FileSize AS FileSize,
_ShellLinkHeader.CreationTime AS CreationTime,
_ShellLinkHeader.AccessTime AS AccessTime,
_ShellLinkHeader.WriteTime AS WriteTime
FROM Y