Pages

Monday, August 15, 2016

Forensics Quickie: PowerShell Versions and the Registry

FORENSICS QUICKIES! These posts will consist of small tidbits of useful information that can be explained very succinctly.

I was chatting with Jared Atkinson and James Habben about PowerShell today and a question emerged from the discussion: is there way to determine the version of PowerShell installed on a given machine without using the $PSVersionTable PowerShell command? We all agreed that it would be nice to have an offline source for finding this information.

Scenario

You want to determine the version of PowerShell installed on a machine, but don't have a means by which to run the $PSVersionTable PowerShell command (e.g. you are working off of a forensic image -- not a live machine).

The Solution

Right off the bat, Jared suggested that there had to be something in the registry related to this information and subsequently pointed us to the following registry key: HKLM\SOFTWARE\Microsoft\PowerShell. James noted that he found a subkey named "1" inside. Within the "1" subkey is yet another subkey named PowerShellEngine. As we can see in the screenshot below, there is a value named PowerShellVersion that will tell us the version of PowerShell installed on the machine.

 Note that PowerShell version 2.0 is shown in this registry key

There was a nuance, however. While James was only seeing one subkey (with the name "1"), I was seeing another subkey in addition to "1." I also saw a subkey named "3" on my machine. I took a look to find the following:

 A second subkey named "3" shows a different, more recent version of PowerShell

We wondered what this could mean. It wasn't until Jared noted that having the "1" subkey would indicate the existence of PowerShell v1 or v2 and that having the "3" subkey would indicate PowerShell v3-5 that this all started to make more sense.

James's machine was a Windows XP workstation. My machines were Windows 10 workstations. Therefore, James's SOFTWARE hive only had a single "1" subkey. It only had PowerShell v2 on it. But why did the Windows 10 workstations have both a "1" subkey and a "3" subkey? Jared, once again, suggested that a previous version of Windows being upgraded to Windows 10 may have been the reason. Sure enough, I had upgraded my Windows 7 machines to Windows 10 and had NOT done a fresh Windows 10 install. Note that this may not be the reason for seeing both subkeys; I reviewed a machine with a fresh Windows 10 install and observed that it also had both subkeys.

The bottom line is that, yes, the version of PowerShell can be found in the registry and not just by running the $PSVersionTable PowerShell command. But keep in mind that you might find more than one registry key containing PowerShell version information.
Note: Beware the PowerShell.exe Location

Do not be fooled by the default location of PowerShell.exe. The executable's path will show %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe. Unless manually changed, this path will show "v1.0" regardless of the PowerShell versions installed on the machine.


Extras

Great! We solved our problem. But what about some of this other stuff we see in the PowerShellEngine subkey? What's that RuntimeVersion value and why doesn't it match the PowerShellVersion value? If two PowerShell engines exist on the Windows 10 machines, how do I use the older, v2 engine instead of the v5 engine?

To answer these questions, let's first use the easiest way possible to determine the version of PowerShell installed on a machine: the $PSVersionTable PowerShell command. (I ran everything below on the Windows 10 machine).

PS C:\Users\4n6k> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.0.10240.16384
WSManStackVersion              3.0
SerializationVersion           1.1.0.1
CLRVersion                     4.0.30319.42000
BuildVersion                   10.0.10240.16384
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion      2.3

First, I looked to see if there was an easier way to figure out what all of this output meant. And, what do you know, a quick Google search and ServerFault answer were able to point me in the right direction. Instead of looking at the help files in a PowerShell session, I just looked up what I needed online here. We come back with this:
  • CLRVersion: 
    • The version of the common language runtime (CLR).
  • BuildVersion: 
    • The build number of the current version.
  • PSVersion: 
    • The Windows PowerShell version number.
  • WSManStackVersion: 
    • The version number of the WS-Management stack.
  • PSCompatibleVersions: 
    • Versions of Windows PowerShell that are compatible with the current version.
  • SerializationVersion:  
    • The version of the serialization method.
  • PSRemotingProtocolVersion: 
    • The version of the Windows PowerShell remote management protocol.
And there you have it. Full explanations of what we're looking at here.
Note: CLRVersion & RuntimeVersion

Notice that when we run the $PSVersionTable command, we see a line named CLRVersion. The value associated with this name is the same as the value that we see when we look in the registry at the RuntimeVersion value. This is because both of these entries are related to the "Common Language Runtime (CLR)" used in the .NET Framework. You can read more about that here. Since I'm using Windows 10, I have .NET 4.6, which uses CLR version 4.0.30319.42000.


So, what about the two PowerShell engines that exist on my Windows 10 machines? What if I want to use a different engine than v5? Well, it's as easy as running a PowerShell command. To quote this MSDN article:

"When you start Windows PowerShell, the newest version starts by default. To start Windows PowerShell with the Windows PowerShell 2.0 Engine, use the Version parameter of PowerShell.exe. You can run the command at any command prompt, including Windows PowerShell and Cmd.exe.

PowerShell.exe -Version 2

Let's give it a shot.

PS C:\Users\4n6k> $psversiontable
Name                           Value
----                           -----
PSVersion                      5.0.10240.16384
WSManStackVersion              3.0
SerializationVersion           1.1.0.1
CLRVersion                     4.0.30319.42000
BuildVersion                   10.0.10240.16384
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion      2.3

PS C:\Users\4n6k> PowerShell.exe -Version 2
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Users\4n6k> $psversiontable
Name                           Value
----                           -----
CLRVersion                     2.0.50727.8669
BuildVersion                   6.1.7600.16385
PSVersion                      2.0
WSManStackVersion              2.0
PSCompatibleVersions           {1.0, 2.0}
SerializationVersion           1.1.0.1
PSRemotingProtocolVersion      2.1

As you can see, our PowerShell session is now using the v2 engine instead of v5. Note that when I tried PowerShell.exe -Version 3, the output I received was the same output I received for v5. This may be due to jumping from PowerShell v2 on Windows 7 to PowerShell v5 on Windows 10. This could also be because of the split between v1/v2 and v3/v4/v5 (thanks to James and Jared for this possible explanation).

A big thanks goes out to Jared Atkinson and James Habben. This post wouldn't exist without their involvement and discussion.

-4n6k


References
1. What do the contents of PowerShell's $PSVersionTable represent? (ServerFault)
2. Common Language Runtime (CLR)
3. MSDN: about_Automatic_Variables - PowerShell
4. Environment.Version Property (.NET)
5. Starting the Windows PowerShell 2.0 Engine

Posted by Anonymous at 11:19 PM 5 comments
Labels: , , , , , , , , , , ,

Wednesday, March 16, 2016

Jump List Forensics: AppID Master List (400+ AppIDs)


TL;DR: The list of 400+ manually generated Jump List application IDs can be found at the bottom of this post.

About 5 years ago, I wrote two blog posts related to Windows Jump Lists [1] [2]. These two posts covered jump list basics and focused mainly on how each application that is run on a Windows machine has the potential to generate a %uniqueAppID%.automaticDestinations-ms file in the C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\ directory. The AppID lists I created in 2011 have been useful to me in the past, so I decided to expand them. Many tools use these lists, as well. With that, I've recently added over 100 more unique application AppIDs and combined them into one list.

As a refresher, each application (depending on the executable's path and filename) will have a unique Application ID (i.e. AppID) that will be included in the name of the .automaticDestinations-ms jump list file. Jump lists provide additional avenues in determining which applications were run on the system, the paths from which they were run, and the files recently used by them.

The catch is that you need to know which AppIDs will be generated for certain applications. And, at this point in the game, the only way to know that is to either (a) manually generate the .automaticDestinations-ms files or (b) know the executable's absolute path and use Hexacorn's AppID Calculator. Either way, you need to have some kind of starting information to come back with an answer.

As we already know, two ways in which the .automaticDestinations-ms files are generated are:


...and...

Both of these methods will show you the application's jump list, thereby generating/modifying the application's .automaticDestinations-ms file. In this case, that file is named:

 C:\Users\4n6k\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9b9cdc69c1c24e2b.automaticDestinations-ms

...with 9b9cdc69c1c24e2b being the AppID for 64-bit Notepad.

In the AppID list, you will notice a few entries containing multiple versions of applications. Many of these applications retain their default installation location as they are updated to new versions. This essentially means that the AppID will stay the same. As an example, if we take a look at iTunes, we'll see that iTunes 9.0.0.70 has an AppID of 83b03b46dcd30a0e; I tested and verified that in 2011. If we take a look at a more recent version (12.3.2.35), we can see that the AppID has remained the same. This is because when the newer version is installed (and then run), it is doing so from the same location as the old version was, which causes the AppID to remain the same among different versions. If you want to learn more about how the AppID is actually generated, I highly recommend that you read through Hexacorn's blog post here.

With that, you can find the AppID master list at the bottom of this post:

Note that with the release of Eric Zimmerman's JLECmd (Jump List Explorer Command Line), an investigator can gain better insight into the applications for which the jump list files were generated.

As Eric explains in his Jump Lists In-Depth post, jump lists are (more or less) collections of LNK files. So, for example, if you have a jump list .automaticDestinations-ms file that has an unknown AppID and you see that the LNK files contained within it all point to a specific file type (say, AutoCAD .dwg drawing files), you might be able to conclude that the jumplist belongs to an AutoCAD-related program. Obviously, this is a very simple example, but you get the idea. You have more information to work with now.

The AppID master list is a work in progress and will likely be updated occasionally throughout its life cycle.

-4n6k


References
1. Jump Lists In Depth (by Eric Zimmerman)
2. Introducing JLECmd! (by Eric Zimmerman)
3. JumpLists file names and AppID calculator (by Hexacorn)
4. Jump List Forensics: AppIDs Part 1 (by 4n6k)
5. Jump List Forensics: AppIDs Part 2 (by 4n6k)

 


4n6k Jump List AppID Master List

  • The following is a list of Jump List AppIDs manually generated by 4n6k.
  • I am making this available for free. Many forensic tools have used this and previous lists already. Please give credit where credit is due.
  • Testing was done using 64-bit versions of Windows 7 and Windows 10.
  • Page last modified: 2016/03/16.


AppID Application + Version Date Added Executable Path Added By
???????????????? [i2p] i2phex 3.2.0.103.0 9/15/2011 [Default Install Location] 4n6k
f1a4c04eebef2906 [i2p] Robert 0.0.29 Preferences 9/15/2011 [Default Install Location] 4n6k
???????????????? [i2p] Rufus 0.0.4 9/15/2011 [Default Install Location] 4n6k
9ad84c52efeae190 1Password 4.6.0.604 3/8/2016 [Default Install Location] C:\Program Files (x86)\1Password 4\1Password.exe 4n6k
d28ee773b2cea9b2 3D-FTP 9.0 build 7 9/15/2011 [Default Install Location] 4n6k
ace8715529916d31 40tude Dialog 2.0.15.1 (Beta 38) 9/15/2011 [Default Install Location] 4n6k
3dc02b55e44d6697 7-Zip 3.13 / 4.20 9/7/2011 [Default Install Location] 4n6k
4975d6798a8bdf66 7-Zip 4.65 / 9.20 9/7/2011 [Default Install Location] 4n6k
cd2acd4089508507 AbsoluteTelnet 9.18 Lite 9/15/2011 [Default Install Location] 4n6k
59f56184c796cfd4 ACDSee Photo Manager 10 (Build 219) 9/7/2011 [Default Install Location] 4n6k
d838aac097abece7 ACDSee Photo Manager 12 (Build 344) 9/7/2011 [Default Install Location] 4n6k
8bd5c6433ca967e9 ACDSee Photo Manager 2009 (v11.0 Build 113) 9/7/2011 [Default Install Location] 4n6k
b39c5f226977725d ACDSee Pro 8.1.99 9/7/2011 [Default Install Location] 4n6k
23646679aaccfae0 Adobe Acrobat 9.4.0 9/7/2011 [Default Install Location] 4n6k
1a89d1befe8e90e3 Adobe Acrobat Distiller Pro XI 32-bit 11.0.0779 2/29/2016 [Default Install Location] C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrodist.exe 4n6k
de48a32edcbe79e4 Adobe Acrobat Reader DC 2015.010.20056 3/14/2016 [Default Install Location] C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 4n6k
7010c278903c2b0f Adobe Acrobat XI Pro 32-bit 2/28/2016 [Default Install Location] C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrobat.exe 4n6k
177aeb41deb606ae Adobe Photoshop CS6 (64 Bit) 3/1/2016 [Default Install Location] C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\Photoshop.exe 4n6k
f0468ce1ae57883d Adobe Reader 7.1.0 9/7/2011 [Default Install Location] 4n6k
c2d349a0e756411b Adobe Reader 8.1.2 9/7/2011 [Default Install Location] 4n6k
ee462c3b81abb6f6 Adobe Reader X 10.1.0 9/7/2011 [Default Install Location] 4n6k
installs to .exe loc AirDC++ 2.10 9/15/2011 4n6k
e6ef42224b845020 ALFTP 5.20.0.4 9/15/2011 [Default Install Location] 4n6k
cc76755e0f925ce6 AllPicturez 1.2 9/15/2011 [Default Install Location] 4n6k
d22ad6d9d20e6857 ALLPlayer 4.7 9/7/2011 [Default Install Location] 4n6k
36f6bc3efe1d99e0 Alt.Binz 0.25.0 (Build 27.09.2007) 9/15/2011 [Default Install Location] 4n6k
76f6f1bd18c19698 aMule 2.2.6 9/15/2011 [Default Install Location] 4n6k
d53b52fb65bde78c Android Newsgroup Downloader 6.2 9/15/2011 [Default Install Location] 4n6k
c845f3a6022d647c Another File 2.03 (Build 2/7/2004) 9/15/2011 [Default Install Location] 4n6k
cb5250eaef7e3213 ApexDC++ 1.4.3.957 9/15/2011 [Default Install Location] 4n6k
bfc1d76f16fa778f Ares (Galaxy) 1.8.4 / 1.9.8 / 2.1.0 / 2.1.7.3041 / 3.1.9.4045 3/8/2016 [Default Install Location] C:\Program Files (x86)\Ares\Ares.exe 4n6k
bba8a4896f0d26f Ares Chat Client (3.1.9.4045) 3/9/2016 [Default Install Location] C:\Program Files (x86)\Ares\chatclient.exe 4n6k
efbb2bf3c1d06466 Auslogics Disk Defrag 6.2.1.0 3/10/2016 [Default Install Location] C:\Program Files (x86)\Auslogics\DiskDefrag\DiskDefrag.exe 4n6k
780732558f827a42 AutoPix 5.3.3 9/15/2011 [Default Install Location] 4n6k
(portable) Azureus 0.9.0 (portable) 9/15/2011 4n6k
accca100973ef8dc Azureus 2.0.8.4 9/15/2011 [Default Install Location] 4n6k
ccb36ff8a8c03b4b Azureus 2.5.0.4 / Vuze 3.0.5.0 9/15/2011 [Default Install Location] 4n6k
ac3a63b839ac9d3a Azureus Vuze Bittorrent Client 4.6.0.4 / 5.7.1.0 3/14/2016 [Default Install Location] C:\Program Files\Vuze\Azureus.exe 4n6k
c997d2e1a0f0929 BCWipe 6.08.6 3/9/2016 [Default Install Location] C:\Program Files (x86)\Jetico\BCWipe\BCWipe.exe 4n6k
4b6925efc53a3c08 BCWipe Task Manager 3.02.3 / 3.06.5.5 3/9/2016 [Default Install Location] C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe 4n6k
e1d47cb031dafb9f BearShare 6.0.0.22717 / 8.1.0.70928 / 10.0.0.112380 9/15/2011 [Default Install Location] 4n6k
558c5bd9f906860a BearShare Lite 5.2.5.1 9/15/2011 [Default Install Location] 4n6k
b223c3ffbc0a7a42 Bersirc 2.2.14 9/15/2011 [Default Install Location] 4n6k
eab25958dbddbaa4 Binary News Reaper 2 (Beta 0.14.7.448) 9/15/2011 [Default Install Location] 4n6k
bf483b423ebbd327 Binary Vortex 5.0 9/15/2011 [Default Install Location] 4n6k
baea31eacd87186b BinaryBoy 1.97 (Build 55) 9/15/2011 [Default Install Location] 4n6k
36801066f71b73c5 Binbot 2.0 9/15/2011 [Default Install Location] 4n6k
13eb0e5d9a49eaef Binjet 3.0.2 9/15/2011 [Default Install Location] 4n6k
8172865a9d5185cb Binreader 1.0 (Beta 1) 9/15/2011 [Default Install Location] 4n6k
6224453d9701a612 BinTube 3.7.1.0 (requires VLC 10.5!) 9/15/2011 [Default Install Location] 4n6k
(portable) BitComet 0.39 (portable) 9/15/2011 4n6k
a31ec95fdd5f350f BitComet 0.49 / 0.59 / 0.69 / 0.79 / 0.89 / 0.99 / 1.07 / 1.28 9/15/2011 [Default Install Location] 4n6k
9e0b3f677a26bbc4 BitKinex 3.2.3 9/15/2011 [Default Install Location] 4n6k
bcd7ba75303acbcf BitLord 1.1 9/15/2011 [Default Install Location] 4n6k
1434d6d62d64857d BitLord 1.2.0-66 9/15/2011 [Default Install Location] 4n6k
e73d9f534ed5618a BitSpirit 1.2.0.228 / 2.0 / 2.6.3.168 / 2.7.2.239 / 2.8.0.072 / 3.1.0.077 / 3.6.0.550 9/15/2011 [Default Install Location] 4n6k
c9374251edb4c1a8 BitTornado T-0.3.17 9/15/2011 [Default Install Location] 4n6k
2d61cccb4338dfc8 BitTorrent 5.0.0 / 6.0.0 / 7.2.1 (Build 25548) 9/15/2011 [Default Install Location] 4n6k
ba3a45f7fd2583e1 Blubster 3.1.1 9/15/2011 [Default Install Location] 4n6k
4a7e4f6a181d3d08 broolzShare 9/15/2011 [Default Install Location] 4n6k
4cdf7858c6673f4b Bullet Proof FTP 1.26 9/15/2011 [Default Install Location] 4n6k
714b179e552596df Bullet Proof FTP 2.4.0 (Build 31) 9/15/2011 [Default Install Location] 4n6k
20ef367747c22564 Bullet Proof FTP 2010.75.0.75 9/15/2011 [Default Install Location] 4n6k
f001ea668c0aa916 Cabos 0.8.2 9/15/2011 [Default Install Location] 4n6k
6bb98fb8cdc26d69 Calculator (Windows built-in) 2/26/2016 [Default Install Location] C:\Windows\System32\calc.exe 4n6k
8fd1364019dc2115 Calibre E-Book Manager 2.33 3/7/2016 [Default Install Location] C:\Program Files (x86)\Calibre2\calibre.exe 4n6k
ed7a5cc3cca8d52a CCleaner 1.32.345 / 1.41.544 / 2.36.1233 / 3.10.1525 9/15/2011 [Default Install Location] 4n6k
ccc0fa1b9f86f7b3 CCleaner 5.15.5513 64-bit 3/9/2016 [Default Install Location] C:\Program Files\CCleaner\CCleaner64.exe 4n6k
4fd44f9938892caa CDBurnerXP 3/10/2016 [Default Install Location] C:\Program Files (x86)\CDBurnerXP\cdbxpp.exe 4n6k
7cb0735d45243070 CDisplay 1.8.1.0 9/7/2011 [Default Install Location] 4n6k
5d696d521de238c3 Chrome 9.0.597.84 / 12.0.742.100 / 13.0.785.215 9/7/2011 [Default Install Location] 4n6k
9fdb10e18cdd0101 Cisco AnyConnect Secure Mobility Client 3.1.02040 2/28/2016 [Default Install Location] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe 4n6k
44a50e6c87bc012 Classic FTP Plus 2.15 9/15/2011 [Default Install Location] 4n6k
c01d68e40226892b ClicksAndWhistles 2.7.146 9/15/2011 [Default Install Location] 4n6k
4fceec8e021ac978 CoffeeCup Free FTP 3.5.0.0 9/15/2011 [Default Install Location] 4n6k
8deb27dfa31c5c2a CoffeeCup Free FTP 4.4 (Build 1904) 9/15/2011 [Default Install Location] 4n6k
6728dd69a3088f97 Command Prompt 2/29/2016 [Default Install Location] %windir%\system32\cmd.exe 4n6k
7e4dca80246863e3 Control Panel - Settings 3/4/2016 [Default Install Location] %windir%\System32\Control.exe 4n6k
6a316aa67a46820b Core FTP LE 1.3c (Build 1437) / 2.2 (Build 1689) 9/15/2011 [Default Install Location] 4n6k
be4875bb3e0c158f CrossFTP 1.75a 9/15/2011 [Default Install Location] 4n6k
7494a606a9eef18e Crystal Player 1.98 9/7/2011 [Default Install Location] 4n6k
c04f69101c131440 CuteFTP 5.0 (Build 50.6.10.2) 9/15/2011 [Default Install Location] 4n6k
a79a7ce3c45d781 CuteFTP 7.1 (Build 06.06.2005.1) 9/15/2011 [Default Install Location] 4n6k
59e86071b87ac1c3 CuteFTP 8.3 (Build 8.3.4.0007) 9/15/2011 [Default Install Location] 4n6k
d8081f151f4bd8a5 CuteFTP 8.3 Lite (Build 8.3.4.0007) 9/15/2011 [Default Install Location] 4n6k
3198e37206f28dc7 CuteFTP 8.3 Professional (Build 8.3.4.0007) 9/15/2011 [Default Install Location] 4n6k
f82607a219af2999 Cyberduck 4.1.2 (Build 8999) 9/15/2011 [Default Install Location] 4n6k
(portable) CzDC 0.699 (portable) 9/15/2011 4n6k
(portable) Datawire 1.3 (portable) 9/15/2011 4n6k
(portable) DC++ 0.181 (portable) 9/15/2011 4n6k
560d789a6a42ad5a DC++ 0.261 / 0.698 / 0.782 (r2402.1) 9/15/2011 [Default Install Location] 4n6k
4aa2a5710da3efe0 DCSharpHub 2.0.0 9/15/2011 [Default Install Location] 4n6k
2db8e25112ab4453 Deluge 1.3.12 / 1.3.3 3/10/2016 [Default Install Location] C:\Program Files (x86)\Deluge\deluge.exe 4n6k
cf6379a9a987366e Digibin 1.31 9/15/2011 [Default Install Location] 4n6k
3edf100b207e2199 digiKam 1.7.0 (KDE 4.4.4) 9/7/2011 [Default Install Location] 4n6k
fa7144034d7d083d Directory Opus 10.0.2.0.4269 (JL tasks supported) 9/15/2011 [Default Install Location] 4n6k
ac8920ed05001800 DMDirc 0.6.5 (Profile store: C:\Users\$user\AppData\Roaming\DMDirc\) 9/15/2011 [Default Install Location] 4n6k
1cffbe973a437c74 DSPlayer 0.889 Lite 9/7/2011 [Default Install Location] 4n6k
5b186fc4a0b40504 Dtella 1.2.5 (Purdue network only) 9/15/2011 [Default Install Location] 4n6k
43886ba3395acdcc Easy Post 3.0 9/15/2011 [Default Install Location] 4n6k
2437d4d14b056114 EiskaltDC++ 2.2.3 9/15/2011 [Default Install Location] 4n6k
b3016b8da2077262 eMule 0.50a 9/15/2011 [Default Install Location] 4n6k
966fa7c312d9b10 Eraser 6.2.0.2970 3/10/2016 [Default Install Location] C:\Program Files\Eraser\Eraser.exe 4n6k
d78150e0484a4e1d Evernote 5.9.6.9494 3/11/2016 [Default Install Location] C:\Program Files (x86)\Evernote\Evernote\Evernote.exe 4n6k
cbbe886eca4bfc2d ExoSee 1.0.0 9/15/2011 [Default Install Location] 4n6k
f91fd0c57c4fe449 ExpanDrive 2.1.0 9/15/2011 [Default Install Location] 4n6k
cfab0ec14b6f953 Express NewsPictures 2.41 (Build 08.05.07.0) 9/15/2011 [Default Install Location] 4n6k
386a2f6aa7967f36 EyeBrowse 2.7 9/7/2011 [Default Install Location] 4n6k
8f852307189803b8 Far Manager 2.0.1807 9/15/2011 [Default Install Location] 4n6k
22c4d315e96389e0 FastCopy 3.12 3/11/2016 [Default Install Location] C:\Program Files (x86)\FastCopy\FastCopy.exe 4n6k
169b3be0bc43d592 FastPictureViewer Professional 1.6 (Build 211) 9/7/2011 [Default Install Location] 4n6k
e9a39dfba105ea23 Faststone Image Viewer 4.6 / 5.5 3/12/2016 [Default Install Location] C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe 4n6k
a1d19afe5a80f80 FileZilla 2.2.32 9/15/2011 [Default Install Location] 4n6k
e107946bb682ce47 Filezilla 3.5.1 / 3.16 3/11/2016 [Default Install Location] C:\Program Files\FileZilla FTP Client\filezilla.exe 4n6k
226400522157fe8b FileZilla Server 0.9.39 beta 9/15/2011 [Default Install Location] 4n6k
5c450709f7ae4396 Firefox 1.0 / 2.0 / 3.0 9/7/2011 [Default Install Location] 4n6k
5df4765359170e26 Firefox 4.0.1 9/7/2011 [Default Install Location] 4n6k
1eb796d87c32eff9 Firefox 5.0 9/7/2011 [Default Install Location] 4n6k
1461132e553e2e6c Firefox 6.0 9/7/2011 [Default Install Location] 4n6k
b7cb1d1c1991accf FlashFXP 4.0.0 (Build 1548) 9/15/2011 [Default Install Location] 4n6k
8628e76fd9020e81 Fling File Transfer Plus 2.24 9/15/2011 [Default Install Location] 4n6k
9ad1ec169bf2da7f FlylinkDC++ r405 (Build 7358) 9/15/2011 [Default Install Location] 4n6k
7526de4a8b5914d9 Forte Agent 6.00 (Build 32.1186) 9/15/2011 [Default Install Location] 4n6k
c02baf50d02056fc FotoVac 1.0 9/15/2011 [Default Install Location] 4n6k
3e9850346f375d41 Foxit Phantom PDF 7.2.2.929 3/1/2016 [Default Install Location] C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitPhantomPDF.exe 4n6k
8a461f82e9eb4102 Foxit Reader 7.2.0.722 3/1/2016 [Default Install Location] C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReader.exe 4n6k
4dd48f858b1a6ba7 Free Download Manager 3.0 (Build 852) 9/15/2011 [Default Install Location] 4n6k
7a4ba998575ff2a4 FreeCommander XE 2016 Build 715 32-bit 3/12/2016 [Default Install Location] C:\Program Files (x86)\FreeCommander XE\FreeCommander.exe 4n6k
(portable) Freenet (default install dir is C:\Users\$user\...) 9/15/2011 4n6k
(portable) Frost 2011-03-05 (portable) 9/15/2011 4n6k
f214ca2dd40c59c1 FrostWire 4.20.9 9/15/2011 [Default Install Location] 4n6k
73ce3745a843c0a4 FrostWire 5.1.4 9/15/2011 [Default Install Location] 4n6k
49b5edbd92d8cd58 FTP Commander 8.02 9/15/2011 [Default Install Location] 4n6k
7937df3c65790919 FTP Explorer 10.5.19 (Build 001) 9/15/2011 [Default Install Location] 4n6k
10f5a20c21466e85 FTP Voyager 15.2.0.17 9/15/2011 [Default Install Location] 4n6k
f64de962764b9b0f FTPRush 1.1.3 / 2.15 9/15/2011 [Default Install Location] 4n6k
98b0ef1c84088 fulDC 6.78 9/15/2011 [Default Install Location] 4n6k
3c309c17f7e8ffe1 GIMP 2.8.16 3/12/2016 [Default Install Location] C:\Program Files\GIMP 2\bin\gimp-2.8.exe 4n6k
e6ea77a1d4553872 Gnucleus 1.8.6.0 9/15/2011 [Default Install Location] 4n6k
ed49e1e6ccdba2f5 GNUnet 0.8.1a 9/15/2011 [Default Install Location] 4n6k
817bb211c92fd254 GOM Player 2.0.12.3375 / 2.1.28.5039 9/7/2011 [Default Install Location] 4n6k
5d696d521de238c3 Google Chrome 48.0.2564.116 2/27/2016 [Default Install Location] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 4n6k
5fb817cd5a8cad21 Google Drive 3/12/2016 [Default Install Location] C:\Program Files (x86)\Google\Drive\googledrivesync.exe 4n6k
f920768fe275f7f4 Grabit 1.5.3 Beta (Build 909) / 1.6.2 (Build 940) / 1.7.2 Beta 4 (Build 997) 9/15/2011 [Default Install Location] 4n6k
3ed70ef3495535f7 Gravity 3.0.4 9/15/2011 [Default Install Location] 4n6k
9f03ae476ad461fa GroupsAloud 1.0 9/15/2011 [Default Install Location] 4n6k
cc4b36fbfb69a757 gtk-gnutella 0.97 9/15/2011 [Default Install Location] 4n6k
b39bc6b590f53961 HexChat 2.10.2 32-bit 3/12/2016 [Default Install Location] C:\Program Files (x86)\HexChat\hexchat.exe 4n6k
9749cea96d411f37 HexChat 2.10.2 64-bit 3/14/2016 [Default Install Location] C:\Program Files\HexChat\hexchat.exe 4n6k
a746f9625f7695e8 HeXHub 5.07 9/15/2011 [Default Install Location] 4n6k
edc786643819316c HoneyView3 #5834 9/7/2011 [Default Install Location] 4n6k
d3530c5294441522 HydraIRC 0.3.165 9/15/2011 [Default Install Location] 4n6k
2ff9dc8fb7e11f39 I2P 0.8.8 (no window) 9/15/2011 [Default Install Location] 4n6k
223bf0f360c6fea5 I2P 0.8.8 (restartable) 9/15/2011 [Default Install Location] 4n6k
8904a5fd2d98b546 IceChat 7.70 20101031 9/15/2011 [Default Install Location] 4n6k
6b3a5ce7ad4af9e4 IceChat 9 RC2 9/15/2011 [Default Install Location] 4n6k
e31a6a8a7506f733 Image AXS Pro 4.1 9/7/2011 [Default Install Location] 4n6k
76689ff502a1fd9e Imagine Image and Animation Viewer 1.0.7 9/7/2011 [Default Install Location] 4n6k
2519133d6d830f7e IMatch 3.6.0.113 9/7/2011 [Default Install Location] 4n6k
f61b65550a84027e iMesh 11.0.0.112351 9/15/2011 [Default Install Location] 4n6k
c8e4c10e5460b00c iMesh 6.5.0.16898 9/15/2011 [Default Install Location] 4n6k
8f3d7202aa5d4c01 ImgBurn 2.5.8.0 3/1/2016 [Default Install Location] C:\Program Files (x86)\ImgBurn\ImgBurn.exe 4n6k
1110d9896dceddb3 imgSeek 0.8.5 9/7/2011 [Default Install Location] 4n6k
e0f7a40340179171 imule 1.4.5 (rev. 749) 9/15/2011 [Default Install Location] 4n6k
f0c7bd3e0584a65a InfraRecorder 0.53.0.0 32-bit 3/14/2016 [Default Install Location] C:\Program Files (x86)\InfraRecorder\infrarecorder.exe 4n6k
174c2c811c286c58 InfraRecorder 0.53.0.0 64-bit 3/14/2016 [Default Install Location] C:\Program Files\InfraRecorder\infrarecorder.exe 4n6k
28c8b86deab549a1 Internet Explorer 8.0.7600.16385 / 9 3/5/2016 [Default Install Location] C:\Program Files (x86)\Internet Explorer\iexplore.exe 4n6k
c634153e7f5fce9c IrfanView 3.10 / 4.30 / 4.41 32-bit 3/14/2016 [Default Install Location] C:\Program Files (x86)\IrfanView\i_view32.exe 4n6k
ea83017cdd24374d IrfanView Thumbnails 9/7/2011 [Default Install Location] 4n6k
6bc3383cb68a3e37 iTunes 7.6.0.29 / 8.0.0.35 9/7/2011 [Default Install Location] 4n6k
83b03b46dcd30a0e iTunes 9.0.0.70 / 9.2.1.5 / 10.4.1.10 (begin custom 'Tasks' JL capability) / 12.3.2.35 64-bit 3/14/2016 [Default Install Location] C:\Program Files\iTunes\iTunes.exe 4n6k
3c93a049a30e25e6 J. River Media Center 16.0.149 9/7/2011 [Default Install Location] 4n6k
d460280b17628695 Java Binary 9/15/2011 [Default Install Location] 4n6k
fe5e840511621941 JetAudio 5.1.9.3018 Basic / 6.2.5.8220 Basic / 7.0.0 Basic / 8.0.16.2000 Basic 9/7/2011 [Default Install Location] 4n6k
c8112ac53c5ed250 Jetico Log Viewer 1.1 3/9/2016 [Default Install Location] C:\Program Files (x86)\Jetico\BCWipe\logview.exe 4n6k
a777ad264b54abab JetVideo 8.0.2.200 Basic 9/7/2011 [Default Install Location] 4n6k
(portable) Jucy DC 0.85.0.201008281346 (portable) 9/15/2011 4n6k
784182360de0c5b6 Kazaa Lite 1.7.1 9/15/2011 [Default Install Location] 4n6k
??? Kazaa Lite Tools K++ 2.7.0 9/15/2011 [Default Install Location] 4n6k
ba132e702c0147ef KCeasy 0.19-rc1 9/15/2011 [Default Install Location] 4n6k
d97efdf3888fe7eb KeePass 2.31 3/14/2016 [Default Install Location] C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe 4n6k
a8df13a46d66f6b5 Kommute (Calypso) 0.24 9/15/2011 [Default Install Location] 4n6k
3917dd550d7df9a8 Konvertor 4.06 (Build 10) 9/7/2011 [Default Install Location] 4n6k
fa496fe13dd62edf KVIrc 3.4.2.1 / 4.0.4 9/15/2011 [Default Install Location] 4n6k
(portable) LamaHub 0.0.5.5 (portable) 9/15/2011 4n6k
9560577fd87cf573 LeechFTP 1.3 (Build 207) 9/15/2011 [Default Install Location] 4n6k
7dca40fd2a5a971f LibreOffice 5.1.0.3 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\soffice.exe 4n6k
7c2916afd6f116a6 LibreOffice 5.1.0.3 Base 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\sbase.exe 4n6k
83dd64e7fa560bd5 LibreOffice 5.1.0.3 Calc 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\scalc.exe 4n6k
f6fd5d99e2b6e178 LibreOffice 5.1.0.3 Draw 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\sdraw.exe 4n6k
26753c97ea000ecd LibreOffice 5.1.0.3 Math 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\smath.exe 4n6k
ecd1a5e2c3af9c46 LibreOffice 5.1.0.3 Press 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\simpress.exe 4n6k
d38a3ea7ec79fbed LibreOffice 5.1.0.3 Writer 3/14/2016 [Default Install Location] C:\Program Files (x86)\LibreOffice 5\program\swriter.exe 4n6k
65f7dd884b016ab2 LimeChat 2.39 9/15/2011 [Default Install Location] 4n6k
c5ef839d8d1c76f4 LimeWire 5.2.13 9/15/2011 [Default Install Location] 4n6k
9a464053cd82de6d LINE Messenger 3/14/2016 [Default Install Location] C:\Program Files (x86)\LINE\LINE.exe 4n6k
49db7ed4f2703c22 LogMeIn Client 1.3.1835 3/14/2016 [Default Install Location] C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe 4n6k
977a5d147aa093f4 Lphant 3.51 9/15/2011 [Default Install Location] 4n6k
96252daff039437a Lphant 7.0.0.112351 9/15/2011 [Default Install Location] 4n6k
e76a4ef13fbf2bb1 Manolito 3.1.1 9/15/2011 [Default Install Location] 4n6k
4a49906d074a3ad3 Media Go 1.8 (Build 121) 9/7/2011 [Default Install Location] 4n6k
Depends on location Media Player Classic - Home Cinema 1.5.2.3456 (default install is \Users\user\ dir, so dynamic) 9/7/2011 4n6k
Depends on location Media Player Classic 6.4.8.9 (is portable) 9/7/2011 4n6k
1cf97c38a5881255 MediaPortal 1.1.3 9/7/2011 [Default Install Location] 4n6k
86781fe8437db23e Messenger Pro 2.66.6.3353 9/15/2011 [Default Install Location] 4n6k
f0275e8685d95486 Microsoft Excel 2013 32-bit 2/26/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE 4n6k
319f01bf9fe00f2d Microsoft Access 2013 64-bit 3/14/2016 [Default Install Location] C:\Program Files\Microsoft Office 15\root\office15\MSACCESS.EXE 4n6k
606a33f5a27b57d4 Microsoft Built-in Computer Management 10.0.10011.16384 (Win10) 3/4/2016 [Default Install Location] %windir%\system32\compmgmt.msc /s 4n6k
f784591ff7f60f76 Microsoft Built-in Defragment and Optimize Drives (Win10) 3/4/2016 [Default Install Location] %windir%\system32\dfrgui.exe 4n6k
9c32e2313792e6e8 Microsoft Built-in Disk Cleanup (Win10) 3/4/2016 [Default Install Location] %windir%\system32\cleanmgr.exe 4n6k
bc2f88eccd3461b4 Microsoft Built-in Event Viewer 1.0 (Win10) 3/4/2016 [Default Install Location] %windir%\system32\eventvwr.msc /s 4n6k
d2d0fc95675fb2c8 Microsoft Built-in Print Management (Win10) 3/4/2016 [Default Install Location] %systemroot%\system32\printmanagement.msc 4n6k
9d78513a8998829c Microsoft Built-in Run Dialog (Win7 + Win10) 3/6/2016 [Default Install Location] ??? 4n6k
817e5ad5be351574 Microsoft Built-in Services 10.0.10011.16384 (Win10) 3/4/2016 [Default Install Location] %windir%\system32\services.msc 4n6k
3353b940c074fd0c Microsoft Built-in Snipping Tool 3/6/2016 [Default Install Location] %windir%\system32\SnippingTool.exe 4n6k
fac3aa4105c6c466 Microsoft Built-in System Restore (Win7) 3/7/2016 [Default Install Location] %systemroot%\system32\rstrui.exe 4n6k
fa02aa2c575837a6 Microsoft Built-in Task Scheduler 1.0 (Win10) 3/4/2016 [Default Install Location] %windir%\system32\taskschd.msc /s 4n6k
50c5e019818564e3 Microsoft Excel Viewer 12.0.6219.1000 3/11/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\Office12\XLVIEW.EXE 4n6k
905c98e216107aa1 Microsoft Lync 2013 15.0.4753.1000 2/27/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\Office15\lync.exe 4n6k
6d2bac8f1edf6668 Microsoft Outlook 2013 32-bit 2/27/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE 4n6k
12dc1ea8e34b5a6 Microsoft Paint (built-in Win7) 3/6/2016 [Default Install Location] C:\Windows\System32\mspaint.exe 4n6k
8fdb062f1e486cac Microsoft Powerpoint 2013 32-bit 2/27/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\Office15\POWERPNT.EXE 4n6k
b08971c77377bde3 Microsoft Visual Studio Community 2015 3/2/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe 4n6k
a4a5324453625195 Microsoft Word 2013 32-bit 2/26/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE 4n6k
a6d4dfec09c69409 Microsoft Word Viewer 11.8169.8172 3/11/2016 [Default Install Location] C:\Program Files (x86)\Microsoft Office\OFFICE11\WORDVIEW.EXE 4n6k
19ccee0274976da8 mIRC 4.72 / 5.61 9/15/2011 [Default Install Location] 4n6k
ae069d21df1c57df mIRC 6.35 / 7.19 9/15/2011 [Default Install Location] 4n6k
99c15cf3e6d52b61 mldonkey 3.1.0 9/15/2011 [Default Install Location] 4n6k
ff224628f0e8103c Morpheus 3.0.3.6 9/15/2011 [Default Install Location] 4n6k
fdbaca0a1fce6055 MozBackup 1.5.1 3/14/2016 [Default Install Location] C:\Program Files (x86)\MozBackup\MozBackup.exe 4n6k
cfb56c56fa0f0a54 Mozilla 0.9.9 9/7/2011 [Default Install Location] 4n6k
969252ce11249fdd Mozilla Firefox 40.0 / 44.0.2 2/28/2016 [Default Install Location] C:\Program Files (x86)\Mozilla Firefox\firefox.exe 4n6k
(portable) MUTE File Sharing 0.5.1 (portable) 9/15/2011 4n6k
e30bbea3e1642660 Neebly 1.0.4 9/15/2011 [Default Install Location] 4n6k
54c803dfc87b52ba Nettalk 6.7.12 9/15/2011 [Default Install Location] 4n6k
d0261ed6e16b200b News File Grabber 4.6.0.4 9/15/2011 [Default Install Location] 4n6k
7b2b4f995b54387d News Reactor 20100224.16 9/15/2011 [Default Install Location] 4n6k
8211531a7918b389 Newsbin Pro 6.00 (Build 1019) (JL support) 9/15/2011 [Default Install Location] 4n6k
186b5ccada1d986b NewsGrabber 3.0.36 9/15/2011 [Default Install Location] 4n6k
d1fc019238236806 Newsgroup Commander Pro 9.05 9/15/2011 [Default Install Location] 4n6k
4d72cfa1d0a67418 Newsgroup Image Collector 9/15/2011 [Default Install Location] 4n6k
92f1d5db021cd876 NewsLeecher 4.0 / 5.0 Beta 6 9/15/2011 [Default Install Location] 4n6k
d7666c416cba240c NewsMan Pro 3.0.5.2 9/15/2011 [Default Install Location] 4n6k
cb984e3bc7faf234 NewsRover 17.0 (Rev.0) 9/15/2011 [Default Install Location] 4n6k
c98ab5ccf25dda79 NewsShark 2.0 9/15/2011 [Default Install Location] 4n6k
dba909a61476ccec NewsWolf 1.41 9/15/2011 [Default Install Location] 4n6k
2b164f512891ae37 NewsWolf NSListGen 9/15/2011 [Default Install Location] 4n6k
cb1d97aca3fb7e6b Newz Crawler 1.9.0 (Build 4100) 9/15/2011 [Default Install Location] 4n6k
3be7b307dfccb58f NiouzeFire 0.8.7.0 9/15/2011 [Default Install Location] 4n6k
cd40ead0b1eb15ab NNTPGrab 0.6.2 9/15/2011 [Default Install Location] 4n6k
d5c02fc7afbb3fd4 NNTPGrab 0.6.2 Server 9/15/2011 [Default Install Location] 4n6k
See Java Binary Nodezilla Agent 0.5.15 - built in Java 9/15/2011 [Default Install Location] 4n6k
a4def57ee99d77e9 Nomad News 1.43 9/15/2011 [Default Install Location] 4n6k
e70d383b15687e37 Notepad++ 6.6.7 2/27/2016 [Default Install Location] C:\Program Files (x86)\Notepad++\notepad++.exe 4n6k
de76415e0060ce13 Noworyta News Reader 2.9 9/15/2011 [Default Install Location] 4n6k
16ec093b8f51508f Opera 8.54 build 7730 / 9.64 build 10487 / 11.50 build 1074 9/7/2011 [Default Install Location] 4n6k
23ef200ca6364eff Oracle VM VirtualBox 5.0.16 3/14/2016 [Default Install Location] C:\Program Files\Oracle\VirtualBox\VirtualBox.exe 4n6k
3f97341a65bac63a Ozum 6.07 (Build 6070) 9/15/2011 [Default Install Location] 4n6k
b3f13480c2785ae Paint 6.1 (build 7601: SP1) 9/7/2011 [Default Install Location] 4n6k
2fa14c7753239e4c Paint.NET 2.72 / 3.5.8.4081.24580 9/7/2011 [Default Install Location] 4n6k
3866ff352d7719e1 Paint.NET 4.0.9 3/14/2016 [Default Install Location] C:\Program Files\paint.net\PaintDotNet.exe 4n6k
b77ef7f3fc946302 Pale Moon Browser 26.1.1 (32-bit) 3/14/2016 [Default Install Location] C:\Program Files (x86)\Pale Moon\palemoon.exe 4n6k
bec10d3aaf939ffa Pale Moon Browser 26.1.1 (64-bit) 3/14/2016 [Default Install Location] C:\Program Files\Pale Moon\palemoon.exe 4n6k
27da120d7e75cf1f pbFTPClient 6.1 9/15/2011 [Default Install Location] 4n6k
cb996a858d7f15c PDF Architect 4.0.09.25450 64-bit 3/2/2016 [Default Install Location] C:\Program Files\PDF Architect 4\architect.exe 4n6k
4700ff5ae80a6713 PDFCreator 2.2 3/1/2016 [Default Install Location] C:\Program Files\PDFCreator\PDFCreator.exe 4n6k
4d7bdaea55ad352 PeaZip 6.0.0 3/14/2016 [Default Install Location] C:\Program Files (x86)\PeaZip\peazip.exe 4n6k
(portable) Perfect Dark 0.883 / 0.940 / 1.06 / 1.07 (all portable) 9/15/2011 4n6k
See Java Binary Phex 3.4.2 (Build 116) - built in Java 9/15/2011 [Default Install Location] 4n6k
d33ecf70f0b74a77 Picasa 2.2.0 (Build 28.08, 0) 9/7/2011 [Default Install Location] 4n6k
b17d3d0c9ca7e29 Picasa 3.8.0 (build 117.43, 0) / 3.9.141 (build 259) 3/14/2016 [Default Install Location] C:\Program Files (x86)\Google\Picasa3\Picasa3.exe 4n6k
aedd2de3901a77f4 Pidgin 2.10.11 3/4/2016 [Default Install Location] C:\Program Files (x86)\Pidgin\pidgin.exe 4n6k
792699a1373f1386 Piolet 3.1.1 9/15/2011 [Default Install Location] 4n6k
dd658a07478b46c2 PIRCH98 1.0.1.1190 9/15/2011 [Default Install Location] 4n6k
a028c9db28aa15a3 Piriform Defraggler 2.20.989 64-bit 3/10/2016 [Default Install Location] C:\Program Files\Defraggler\Defraggler64.exe 4n6k
Embedded in IE Prizm Viewer 9/7/2011 [Default Install Location] 4n6k
(portable) PtokaX DC Hub 0.4.1.2 (portable) 9/15/2011 4n6k
bfe841f4d35c92b1 QuadSucker/News 5.0 9/15/2011 [Default Install Location] 4n6k
(portable) Quassel IRC 0.7.1 (portable) 9/15/2011 4n6k
b50ee40805bd280f QuickTime Alternative 1.9.5 (Media Player Classic 6.4.9.1) 9/7/2011 [Default Install Location] 4n6k
ae3f2acd395b622e QuickTime Player 6.5.1 / 7.0.3 / 7.5.5 (Build 249.13) 9/7/2011 [Default Install Location] 4n6k
62bff50b969c2575 Quintessential Media Player 5.0 (Build 121) - also usage stats (times used, tracks played, total time used) 9/7/2011 [Default Install Location] 4n6k
6e9d40a4c63bb562 Real Player Alternative 1.25 (Media Player Classic 6.4.8.2 / 6.4.9.0) 9/7/2011 [Default Install Location] 4n6k
f92e607f9de02413 RealPlayer 14.0.6.666 9/7/2011 [Default Install Location] 4n6k
7593af37134fd767 RealPlayer 6.0.6.99 / 7 / 8 / 10.5 9/7/2011 [Default Install Location] 4n6k
37392221756de927 RealPlayer SP 12 9/7/2011 [Default Install Location] 4n6k
2b5841989b3857da RealVNC Server 5.3.0 64-bit (Chat) 3/14/2016 [Default Install Location] ??? 4n6k
fe9e0f7260000a12 RealVNC Server 5.3.0 64-bit (Connect+File Transfer) 3/14/2016 [Default Install Location] C:\Program Files\RealVNC\VNC Server\vncserverui.exe 4n6k
a2c73c383525f1bb RealVNC Viewer 5.3.0 64-bit 3/14/2016 [Default Install Location] C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe 4n6k
c1eece5026414c64 Recuva 1.52.1086 (64-bit) 3/14/2016 [Default Install Location] C:\Program Files\Recuva\recuva64.exe 4n6k
1bc392b8e104a00e Remote Desktop Connection 6.1.7600 (Win7) 3/5/2016 [Default Install Location] %windir%\system32\mstsc.exe 4n6k
bac8a6b507360131 Remote Desktop Connection Manager 2.2 2/26/2016 [Default Install Location] C:\Program Files (x86)\Remote Desktop Connection Manager\RDCMan.exe 4n6k
14354e216395983a Remote Desktop Manager 2.1.0.0 FREE 3/14/2016 [Default Install Location] C:\Program Files (x86)\Devolutions\Remote Desktop Manager Free\RemoteDesktopManagerF 4n6k
ca1eb46544793057 RetroShare 0.5.2a (Build 4550) 9/15/2011 [Default Install Location] 4n6k
3cf13d83b0bd3867 RevConnect 0.674p (based on DC++) 9/15/2011 [Default Install Location] 4n6k
409b67100697bcc0 Revo Uninstaller Pro 3.1.5 3/14/2016 [Default Install Location] C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe 4n6k
fc999f29bc5c3560 Robo-FTP 3.7.9 9/15/2011 [Default Install Location] 4n6k
c99ddde925d26df3 Robo-FTP 3.7.9 CronMaker 9/15/2011 [Default Install Location] 4n6k
4b632cf2ceceac35 Robo-FTP Server 3.2.5 9/15/2011 [Default Install Location] 4n6k
(portable) RSX++ 1.21 (portable) 9/15/2011 4n6k
web-based sabnzbd 0.6.8 9/15/2011 4n6k
8a1c1c7c389a5320 Safari 3.2.3 (525.29) 9/7/2011 [Default Install Location] 4n6k
1da3c90a72bf5527 Safari 4.0.5 (531.22.7) / 5.1 (7534.50) 9/7/2011 [Default Install Location] 4n6k
Depends on location Scientific and Technical Document Viewer 1.6.2 Portable (STDU) 9/7/2011 4n6k
5e01ecaf82f7d8e Scour Exchange 0.0.0.228 9/15/2011 [Default Install Location] 4n6k
d3c5cf21e86b28af SeaMonkey 2.3.3 9/15/2011 [Default Install Location] 4n6k
3a5148bf2288a434 Secure FTP 2.6.1 (Build 20101209.1254) 9/15/2011 [Default Install Location] 4n6k
5d7b4175afdcc260 Shareaza 2.0.0.0 9/15/2011 [Default Install Location] 4n6k
b48ce76eda60b97 Shareaza 8.0.0.112300 9/15/2011 [Default Install Location] 4n6k
74ea779831912e30 Skype 7.18.0.112 3/14/2016 [Default Install Location] C:\Program Files (x86)\Skype\Phone\Skype.exe 4n6k
3168cc975b354a01 Slypheed 3.1.2 (Build 1120) 9/15/2011 [Default Install Location] 4n6k
c91d08dcfc39a506 SM Player 0.6.9 r3447 9/7/2011 [Default Install Location] 4n6k
fe8bb4692de7b989 Smart Defrag 4.3.0.847 3/14/2016 [Default Install Location] C:\Program Files (x86)\IObit\Smart Defrag 4\SmartDefrag.exe 4n6k
435a2f986b404eb7 SmartFTP 4.0.1214.0 / 7.0.2200.0 3/14/2016 [Default Install Location] C:\Program Files\SmartFTP Client\ 4n6k
6fee01bd55a634fe Smuxi 0.8.0.0 9/15/2011 [Default Install Location] 4n6k
16d71406474462b5 Snagit Editor 12.4.1 3/14/2016 [Default Install Location] C:\Program Files (x86)\TechSmith\Snagit 12\SnagitEditor.exe 4n6k
23f08dab0f6aaf30 SoMud 1.3.3 9/15/2011 [Default Install Location] 4n6k
e40cb5a291ad1a5b Songbird 1.9.3 (Build 1959) 9/7/2011 [Default Install Location] 4n6k
135df2a440abe9bb SoulSeek 156c 9/15/2011 [Default Install Location] 4n6k
7a7c60efd66817a2 Spotnet 1.7.4 9/15/2011 [Default Install Location] 4n6k
ecd21b58c2f65a2f StealthNet 0.8.7.9 9/15/2011 [Default Install Location] 4n6k
ec3e36af0cdcb3e1 Steam build 2/4/2016 3/2/2016 [Default Install Location] C:\Program Files (x86)\Steam\Steam.exe 4n6k
337ed59af273c758 Sticky Notes 9/7/2011 [Default Install Location] 4n6k
eb3300e672136bc7 Stream Reactor 1.0 Beta 9 (uses VLC!) 9/15/2011 [Default Install Location] 4n6k
(portable) StrongDC++ 2.42 (portable) 9/15/2011 4n6k
cdb6f0c373f2da0f stunnel 5.31 3/14/2016 [Default Install Location] C:\Program Files (x86)\stunnel\bin\stunnel.exe 4n6k
explorer integrated Swish 9/15/2011 4n6k
e42a8e0f4d9b8dcf Sysax FTP Automation 5.15 9/15/2011 [Default Install Location] 4n6k
3df22b7648cec4c1 TeamViewer 11.0.55321 3/4/2016 [Default Install Location] C:\Program Files (x86)\TeamViewer\TeamViewer.exe 4n6k
134620458666ccb0 TeraCopy 2.3 64-bit 2/28/2016 [Default Install Location] C:\Program Files\TeraCopy\TeraCopy.exe 4n6k
4d8bdacf5265a04f The KMPlayer 2.9.4.1434 9/7/2011 [Default Install Location] 4n6k
776beb1fcfc6dfa5 Thunderbird 1.0.6 (20050716) / 3.0.2 9/15/2011 [Default Install Location] 4n6k
9027fe24326910d2 Thunderbird 38.6.0 3/14/2016 [Default Install Location] C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe 4n6k
3d877ec11607fe4 Thunderbird 6.0.2 9/15/2011 [Default Install Location] 4n6k
7192f2de78fd9e96 TIFNY 5.0.3 9/15/2011 [Default Install Location] 4n6k
b8c13a5dd8c455a2 Titan FTP Server 8.40 (Build 1338) 9/15/2011 [Default Install Location] 4n6k
(portable) TkDC++ 1.3 (portable) 9/15/2011 4n6k
9dacebaa9ac8ca4e TLNews Newsreader 2.2.0 (Build 2430) 9/15/2011 [Default Install Location] 4n6k
d8671c1ed93c75c8 Tor Browser 5.5.2 3/14/2016 [Default Install Location] C:\Users\4n6k\Desktop\Tor Browser\Browser\firefox.exe 4n6k
7904145af324576e Total Commander 7.56a (Build 16.12.2010) / 8.52a 32-bit 3/14/2016 [Default Install Location] C:\totalcmd\TOTALCMD.EXE 4n6k
5b7f3287093c1623 Total Commander 8.52a 64-bit 3/14/2016 [Default Install Location] C:\totalcmd\TOTALCMD64.EXE 4n6k
17d3eb086439f0d7 TrueCrypt 7.1a 64-bit 2/29/2016 [Default Install Location] C:\Program Files\TrueCrypt\TrueCrypt.exe 4n6k
5ea2a50c7979fbdc TrustyFiles 3.1.0.22 9/15/2011 [Default Install Location] 4n6k
e4bd2558bfab368d UltraDefrag 7.0.0 3/14/2016 [Default Install Location] C:\Program Files\UltraDefrag\ultradefrag.exe 4n6k
7fd04185af357bd5 UltraLeeacher 1.7.0.2969 / 1.8 Beta (Build 3490) 9/15/2011 [Default Install Location] 4n6k
387d72eb9c9aa960 UltraVNC 1.2.1.0 Launcher 3/14/2016 [Default Install Location] C:\Program Files\uvnc bvba\UltraVNC\UVNC_Launch.exe 4n6k
2ca2a1a69dc5465f UltraVNC 1.2.1.0 Server Property Page 3/14/2016 [Default Install Location] C:\Program Files\uvnc bvba\UltraVNC\winvnc.exe 4n6k
5b72f67adcce9045 UltraVNC 1.2.1.0 Settings 3/14/2016 [Default Install Location] C:\Program Files\uvnc bvba\UltraVNC\uvnc_settings.exe 4n6k
28493d9d08e13aa6 UltraVNC Viewer 1.2.1.0 3/14/2016 [Default Install Location] C:\Program Files\uvnc bvba\UltraVNC\vncviewer.exe 4n6k
aa11f575087b3bdc Unzbin 2.6.8 9/15/2011 [Default Install Location] 4n6k
79370f660ab51725 UploadFTP 2.0.1.0 9/15/2011 [Default Install Location] 4n6k
pay only Usenet Explorer 3.3 (pay) 9/15/2011 [Default Install Location] 4n6k
(portable) uTorrent 1.1.1-dev (Build 110) / 1.3.0 / 1.5.0 (all portable) 9/15/2011 4n6k
cd8cafb0fb6afdab uTorrent 1.7.7 (Build 8179) / 1.8.5 / 2.0 / 2.21 (Build 25113) / 3.0 (Build 25583) 9/15/2011 [Default Install Location] 4n6k
550abc1cb58eb92c VeraCrypt 1.16 64-bit 2/29/2016 [Default Install Location] C:\Program Files\VeraCrypt\VeraCrypt.exe 4n6k
4acae695c73a28c7 VLC 0.3.0 / 0.4.6 9/7/2011 [Default Install Location] 4n6k
e6ee34ac9913c0a9 VLC 0.6.2 9/7/2011 [Default Install Location] 4n6k
cbeb786f0132005d VLC 0.7.2 9/7/2011 [Default Install Location] 4n6k
9fda41b86ddcf1db VLC Media Player 0.5.3 / 0.8.6i / 0.9.7 / 1.1.11 / 2.2.1 3/2/2016 [Default Install Location] C:\Program Files (x86)\VideoLAN\VLC\vlc.exe 4n6k
50620fe75ee0093 VMware Player 12 build-3272444 3/8/2016 [Default Install Location] C:\Program Files (x86)\VMware\VMware Workstation\vmplayer.exe 4n6k
8eafbd04ec8631ce VMware Workstation 11.0.0 build-2305329 2/26/2016 [Default Install Location] C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe 4n6k
ecdd9154e84d5544 Wickr Top Secret Messenger Desktop 2.3.5 2/29/2016 [Default Install Location] C:\Program Files (x86)\Wickr Inc\Wickr\Wickr.exe 4n6k
f674c3a77cfe39d0 Winamp 2.95 / 5.1 / 5.621 / 5.666 3/14/2016 [Default Install Location] C:\Program Files (x86)\Winamp\winamp.exe 4n6k
90e5e8b21d7e7924 Winamp 3.0d (Build 488) 9/7/2011 [Default Install Location] 4n6k
bc0c37e84e063727 Windows Command Processor - cmd.exe (32-bit) 9/7/2011 [Default Install Location] 4n6k
8fb5ce5e2b049ce Windows Defender (Win10 built-in) 3/8/2016 [Default Install Location] %ProgramFiles%\Windows Defender\MSASCui.exe 4n6k
411447f7de177c68 Windows DVD Maker 64-bit (Win7) 3/6/2016 [Default Install Location] %ProgramFiles%\DVD Maker\DVDMaker.exe 4n6k
f01b4d95cf55d32a Windows Explorer (Win10) ??? TEST THIS 3/8/2016 [Default Install Location] ??? 4n6k
1b4dd67f29cb1962 Windows Explorer (Win7) 3/5/2016 [Default Install Location] %windir%\explorer.exe 4n6k
9d91276b0be3e46b Windows Help and Support (Built-in) Win7 3/6/2016 [Default Install Location] ??? 4n6k
b91050d8b077a4e8 Windows Media Center (Win7) 3/5/2016 [Default Install Location] %windir%\ehome\ehshell.exe 4n6k
74d7f43c1561fc1e Windows Media Player 12.0.7600.16415 / 12.0.7601.17514 3/5/2016 [Default Install Location] %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe /prefetch:1 4n6k
7a8db574299c8568 Windows Movie Maker 2012 (build 16.4.3528.0331) 2/28/2016 [Default Install Location] C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe 4n6k
3594aab44bca414b Windows Photo Viewer 9/7/2011 [Default Install Location] 4n6k
d93f411851d7c929 Windows Powershell 5.0 32-bit 3/7/2016 [Default Install Location] %SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe 4n6k
590aee7bdd69b59b Windows Powershell 5.0 64-bit 3/7/2016 [Default Install Location] %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe 4n6k
eb7e629258d326a1 WindowWasher 6.6.1.18 9/15/2011 [Default Install Location] 4n6k
??? WinMX 3.53 9/15/2011 [Default Install Location] 4n6k
490c000889535727 WinMX 4.9.3.0 9/15/2011 [Default Install Location] 4n6k
(portable) Winny 2.0b7.1 - all languages (portable) 9/15/2011 [Default Install Location] 4n6k
290532160612e071 WinRAR 2.90 / 3.60 / 4.01 9/7/2011 [Default Install Location] 4n6k
46f433176bc0b3d2 WinRAR 5.30 beta 64-bit 3/2/2016 [Default Install Location] C:\Program Files\WinRAR\WinRAR.exe 4n6k
6a8b377d0f5cb666 WinSCP 2.3.0 (Build 146) 9/15/2011 [Default Install Location] 4n6k
9a3bdae86d5576ee WinSCP 3.2.1 (Build 174) / 3.8.0 (Build 312) 9/15/2011 [Default Install Location] 4n6k
6bb54d82fa42128d WinSCP 4.3.4 (Build 1428) 9/15/2011 [Default Install Location] 4n6k
b74736c2bd8cc8a5 WinZip 15.5 (9468) 9/7/2011 [Default Install Location] 4n6k
c9950c443027c765 WinZip 9.0 SR-1 (6224) / 10.0 (6667) 9/7/2011 [Default Install Location] 4n6k
b6267f3fcb700b60 WiseFTP 4.1.0 9/15/2011 [Default Install Location] 4n6k
a581b8002a6eb671 WiseFTP 5.5.9 9/15/2011 [Default Install Location] 4n6k
2544ff74641b639d WiseFTP 6.1.5 9/15/2011 [Default Install Location] 4n6k
c54b96f328bdc28d WiseFTP 7.3.0 9/15/2011 [Default Install Location] 4n6k
Web-based WS_FTP 9/15/2011 4n6k
2a5a615382a84729 X-Chat 2 2.8.6-2 9/15/2011 [Default Install Location] 4n6k
(portable) xHub 0.2.6.7 (portable) 9/15/2011 4n6k
d7db75db9cdd7c5d Xnews 5.04.25 9/15/2011 [Default Install Location] 4n6k
c5c24a503b1727df XnView 1.98.2 Small / 1.98.2 Standard / 2.35 3/14/2016 [Default Install Location] C:\Program Files (x86)\XnView\xnview.exe 4n6k
(portable) YnHub 1.036.152 (portable) 9/15/2011 4n6k
1c30573bdfce4155 Zenmap GUI 6.49BETA4 3/7/2016 [Default Install Location] C:\Program Files (x86)\Nmap\zenmap.exe 4n6k
497b42680f564128 Zoner PhotoStudio 13 (Build 7) 9/7/2011 [Default Install Location] 4n6k
9b9cdc69c1c24e2b Notepad 64-bit 3/14/2016 %windir%\system32\notepad.exe 4n6k
Posted by Anonymous at 5:21 PM 0 comments
Labels: , , , , , , , , , ,