-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathsignatures.py
494 lines (494 loc) · 28.9 KB
/
signatures.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
signatures = [
["JPEG2000 image files", "00 00 00 0C 6A 50 20 20", "JP2"],
["3GPP multimedia files", "00 00 00 14 66 74 79 70", "3GP"],
["MPEG-4 v1", "00 00 00 14 66 74 79 70 69 73 6F 6D", "MP4"],
["3rd Generation Partnership Project 3GPP", "00 00 00 14 66 74 79 70", "3GG|3GP|3G2"],
["Windows Disk Image", "00 00 00 00 14 00 00 00", "TBI"],
["MPEG-4 video_1", "00 00 00 18 66 74 79 70", "3GP5|M4V|MP4"],
["MPEG-4 video_2", "00 00 00 1C 66 74 79 70", "MP4"],
["3GPP2 multimedia files", "00 00 00 20 66 74 79 70", "3GP"],
["Apple audio and video", "00 00 00 20 66 74 79 70 4D 34 41", "M4A"],
["3rd Generation Partnership Project 3GPP2", "00 00 00 20 66 74 79 70", "3GG|3GP|3G2"],
["Windows icon|printer spool file", "00 00 01 00", "ICO|SPL"],
["MPEG video file", "00 00 01 B3", "MPG"],
["DVD video file", "00 00 01 BA", "MPG|VOB"],
["Windows cursor", "00 00 02 00", "CUR"],
["Compucon-Singer embroidery design file", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "XXX"],
["QuattroPro spreadsheet", "00 00 02 00", "WB2"],
["Lotus 1-2-3 (v1)", "00 00 02 00 06 04 06 00", "WK1"],
["Lotus 1-2-3 (v3)", "00 00 1A 00 00 10 04 00", "WK3"],
["Lotus 1-2-3 (v4|v5)", "00 00 1A 00 02 10 04 00", "WK4|WK5"],
["Lotus 1-2-3 (v9)", "00 00 1A 00 05 10 04", "123"],
["Quark Express (Intel)", "00 00 49 49 58 50 52", "QXD"],
["Quark Express (Motorola)", "00 00 4D 4D 58 50 52", "QXD"],
["TrueType font file", "00 01 00 00 00", "TTF"],
["Microsoft Money file", "00 01 00 00 4D 53 49 53 41 4D 20 44 61 74 61 62 61 73 65", "MNY"],
["Microsoft Access 2007", "00 01 00 00 53 74 61 6E 64 61 72 64 20 41 43 45 20 44 42", "ACCDB"],
["Microsoft Access", "00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42", "MDB"],
["Palm Address Book Archive", "00 01 42 41", "ABA"],
["Palm DateBook Archive", "00 01 42 44", "DBA"],
["Netscape Navigator (v4) database", "00 06 15 61 00 00 00 02 00 00 04 D2 00 00 10 00", "DB"],
["Mbox table of contents file", "00 0D BB A0", "(none)"],
["FLIC animation", "00 11", "FLI"],
["BIOS details in RAM", "00 14 00 00 01 02", "(none)"],
["Netscape Communicator (v4) mail folder", "00 1E 84 90 00 00 00 00", "SNM"],
["Firebird and Interbase database files", "01 00 39 30", "FDB|GDB"],
["The Bat! Message Base Index", "01 01 47 19 A4 00 00 00 00 00 00 00", "TBI"],
["SQL Data Base", "01 0F 00 00", "MDF"],
["Novell LANalyzer capture file", "01 10", "TR1"],
["Silicon Graphics RGB Bitmap", "01 DA 01 01 00 03", "RGB"],
["Micrografx vector graphic file", "01 FF 02 04 03 02", "DRW"],
["Digital Speech Standard file", "02 64 73 73", "DSS"],
["MapInfo Native Data Format", "03", "DAT"],
["dBASE III file", "03", "DB3"],
["Quicken price history", "03 00 00 00", "QPH"],
["Approach index file", "03 00 00 00 41 50 50 52", "ADX"],
["dBASE IV file", "04", "DB4"],
["INFO2 Windows recycle bin_1", "04 00 00 00", "(none)"],
["INFO2 Windows recycle bin_2", "05 00 00 00", "(none)"],
["Generic drawing programs", "07", "DRW"],
["SkinCrafter skin", "07 53 4B 46", "SKF"],
["DesignTools 2D Design file", "07 64 74 32 64 64 74 64", "DTD"],
["dBASE IV or dBFast configuration file", "08", "DB"],
["ZSOFT Paintbrush file_1", "0A 02 01 01", "PCX"],
["ZSOFT Paintbrush file_2", "0A 03 01 01", "PCX"],
["ZSOFT Paintbrush file_3", "0A 05 01 01", "PCX"],
["MultiBit Bitcoin wallet file", "0A 16 6F 72 67 2E 62 69 74 63 6F 69 6E 2E 70 72", "WALLET"],
["Monochrome Picture TIFF bitmap", "0C ED", "MP"],
["DeskMate Document", "0D 44 4F 43", "DOC"],
["Nero CD compilation", "0E 4E 65 72 6F 49 53 4F", "NRI"],
["DeskMate Worksheet", "0E 57 4B 53", "WKS"],
["Easy CD Creator 5 Layout file", "10 00 00 00", "CL5"],
["Windows prefetch file", "11 00 00 00 53 43 43 41", "PF"],
["Lotus Notes database template", "1A 00 00", "NTF"],
["Lotus Notes database", "1A 00 00 04 00 00", "NSF"],
["LH archive (old vers.|type 1)", "1A 02", "ARC"],
["LH archive (old vers.|type 2)", "1A 03", "ARC"],
["LH archive (old vers.|type 3)", "1A 04", "ARC"],
["LH archive (old vers.|type 4)", "1A 08", "ARC"],
["LH archive (old vers.|type 5)", "1A 09", "ARC"],
["Compressed archive file", "1A 0B", "PAK"],
["WinPharoah capture file", "1A 35 01 00", "ETH"],
["WebM video file", "1A 45 DF A3", "WEBM"],
["Matroska stream file", "1A 45 DF A3 93 42 82 88", "MKV"],
["Runtime Software disk image", "1A 52 54 53 20 43 4F 4D", "DAT"],
["WordStar Version 5.0|6.0 document", "1D 7D", "WS"],
["GZIP archive file", "1F 8B 08", "GZ"],
["VLC Player Skin file", "1F 8B 08", "VLT"],
["Compressed tape archive_1", "1F 9D 90", "TAR.Z"],
["Compressed tape archive_2", "1F A0", "TAR.Z"],
["MapInfo Sea Chart", "21", "BSB"],
["AIN Compressed Archive", "21 12", "AIN"],
["Unix archiver (ar)|MS Program Library Common Object File Format (COFF)", "21 3C 61 72 63 68 3E 0A", "LIB"],
["Microsoft Outlook Exchange Offline Storage Folder", "21 42 44 4E", "OST"],
["Cerius2 file", "23 20", "MSI"],
["ASCII STereoLithography FIle", "73 6F 6C 69 64", "stl|STL"],
["VMware 4 Virtual Disk description", "23 20 44 69 73 6B 20 44", "VMDK"],
["MS Developer Studio project file", "23 20 4D 69 63 72 6F 73", "DSP"],
["Adaptive Multi-Rate ACELP Codec (GSM)", "23 21 41 4D 52", "AMR"],
["Skype audio compression", "23 21 53 49 4C 4B 0A", "SIL"],
["Radiance High Dynamic Range image file", "23 3F 52 41 44 49 41 4E", "HDR"],
["Brother-Babylock-Bernina Home Embroidery", "23 50 45 43 30 30 30 31", "PEC"],
["Brother-Babylock-Bernina Home Embroidery", "23 50 45 53 30", "PES"],
["SPSS Data file", "24 46 4C 32 40 28 23 29", "SAV"],
["Encapsulated PostScript file", "25 21 50 53 2D 41 64 6F", "EPS"],
["PDF file", "25 50 44 46", "PDF|FDF"],
["Fuzzy bitmap (FBM) file", " 25 62 69 74 6D 61 70", "FBM"],
["BinHex 4 Compressed Archive", "28 54 68 69 73 20 66 69", "HQX"],
["Symantec Wise Installer log", " 2A 2A 2A 20 20 49 6E 73", "LOG"],
["RealPlayer video file (V11+)", "2E 52 45 43", "IVR"],
["RealMedia streaming media", "2E 52 4D 46", "RM|RMVB"],
["RealAudio file", "2E 52 4D 46 00 00 00 12", "RA"],
["RealAudio streaming media", "2E 72 61 FD 00", "RA"],
["NeXT|Sun Microsystems audio file", "2E 73 6E 64", "AU"],
["Thunderbird|Mozilla Mail Summary File", "2F 2F 20 3C 21 2D 2D 20 3C 6D 64 62 3A 6D 6F 72 6B 3A 7A", "MSF"],
["MS security catalog file", "30", "CAT"],
["Windows Event Viewer file", "30 00 00 00 4C 66 4C 65", "EVT"],
["Windows Media Audio|Video File", "30 26 B2 75 8E 66 CF 11", "ASF|WMA|WMV"],
["National Transfer Format Map", "30 31 4F 52 44 4E 41 4E", "NTF"],
["cpio archive", "30 37 30 37 30", "(none)"],
["MS Write file_1", "31 BE", "WRI"],
["MS Write file_2", "32 BE", "WRI"],
["Pfaff Home Embroidery", "32 03 10 00 00 00 00 00 00 00 80 00 00 00 FF 00", "PCS"],
["Tcpdump capture file", "34 CD B2 A1", "(none)"],
["7-Zip compressed file", "37 7A BC AF 27 1C", "7Z"],
["zisofs compressed file", "37 E4 53 96 C9 DB D6 07", "(none)"],
["Photoshop image", "38 42 50 53", "PSD"],
["Surfplan kite project file", "3A 56 45 52 53 49 4F 4E", "SLE"],
["Advanced Stream Redirector", "3C", "ASX"],
["BizTalk XML-Data Reduced Schema", "3C", "XDR"],
["AOL HTML mail", "3C 21 64 6F 63 74 79 70", "DCI"],
["Windows Visual Stylesheet", "3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D", "MANIFEST"],
["User Interface Language", "3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 3F 3E", "XML"],
["MMC Snap-in Control file", "3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 3F 3E 0D 0A 3C 4D 4D 43 5F 43 6F 6E 73 6F 6C 65 46 69 6C 65 20 43 6F 6E 73 6F 6C 65 56 65 72 73 69 6F 6E 3D 22", "MSC"],
["Csound music", "3C 43 73 6F 75 6E 64 53 79 6E 74 68 65 73 69 7A", "CSD"],
["Adobe FrameMaker", "3C 4D 61 6B 65 72 46 69", "FM|MIF"],
["GPS Exchange (v1.1)", "3C 67 70 78 20 76 65 72 73 69 6F 6E 3D 22 31 2E", "GPX"],
["BASE85 file", "3C 7E 36 3C 5C 25 5F 30 67 53 71 68 3B", "B85"],
["Windows Help file_2", "3F 5F 03 00", "GID|HLP"],
["Generic AutoCAD drawing", "41 43 31 30", "DWG"],
["Steganos virtual secure drive", "41 43 76", "SLE"],
["AOL parameter|info files", "41 43 53 44", "(none)"],
["Harvard Graphics symbol graphic", "41 4D 59 4F", "SYW"],
["AOL config files", "41 4F 4C", "ABI|ABY|BAG|IDX|IND|PFC"],
["AOL and AIM buddy list", "41 4F 4C 20 46 65 65 64", "BAG"],
["AOL address book", "41 4F 4C 44 42", "ABY"],
["AOL user configuration", "41 4F 4C 44 42", "IDX"],
["AOL client preferences|settings file", "41 4F 4C 49 44 58", "IND"],
["AOL address book index", "41 4F 4C 49 4E 44 45 58", "ABI"],
["AOL personal file cabinet", "41 4F 4C 56 4D 31 30 30", "ORG|PFC"],
["AVG6 Integrity database", "41 56 47 36 5F 49 6E 74", "DAT"],
["FreeArc compressed file", "41 72 43 01", "ARC"],
["NTFS MFT (BAAD)", "42 41 41 44", "(none)"],
["vCard", "42 45 47 49 4E 3A 56 43", "VCF"],
["Speedtouch router firmware", "42 4C 49 32 32 33", "BIN|BLI|RBI"],
["Bitmap image", "42 4D", "BMP|DIB"],
["Palmpilot resource file", "42 4F 4F 4B 4D 4F 42 49", "PRC"],
["Better Portable Graphics", "42 50 47 FB", "BPG"],
["bzip2 compressed archive", "42 5A 68", "BZ2|TAR.BZ2|TBZ2|TB2"],
["Puffer ASCII encrypted archive", "42 65 67 69 6E 20 50 75 66 66 65 72", "APUF"],
["Blink compressed archive", "42 6C 69 6E 6B", "BLI"],
["RagTime document", "43 23 2B 44 A4 43 4D A5", "RTD"],
["WordPerfect dictionary", "43 42 46 49 4C 45", "CBD"],
["ISO-9660 CD Disc Image", "43 44 30 30 31", "ISO"],
["Compressed ISO CD image", "43 49 53 4F", "CSO"],
["Windows 7 thumbnail", "43 4D 4D 4D 15 00 00 00", "DB"],
["Corel Binary metafile", "43 4D 58 31", "CLB"],
["COM+ Catalog", "43 4F 4D 2B", "CLB"],
["VMware 3 Virtual Disk", "43 4F 57 44", "VMDK"],
["Corel Photopaint file_1", "43 50 54 37 46 49 4C 45", "CPT"],
["Corel Photopaint file_2", "43 50 54 46 49 4C 45", "CPT"],
["Win9x registry hive", "43 52 45 47", "DAT"],
["Crush compressed archive", "43 52 55 53 48 20 76", "CRU"],
["Shockwave Flash file", "43 57 53", "SWF"],
["Calculux Indoor lighting project file", "43 61 6C 63 75 6C 75 78 20 49 6E 64 6F 6F 72 20", "CIN"],
["WhereIsIt Catalog", "43 61 74 61 6C 6F 67 20", "CTF"],
["IE History file", "43 6C 69 65 6E 74 20 55", "DAT"],
["Creative Voice", "43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46", "VOC"],
["DAX Compressed CD image", "44 41 58 00", "DAX"],
["Palm Zire photo database", "44 42 46 48", "DB"],
["Amiga DiskMasher compressed archive", "44 4D 53 21", "DMS"],
["Amiga disk file", "44 4F 53", "ADF"],
["DVR-Studio stream file", "44 56 44", "DVR"],
["DVD info file", "44 56 44", "IFO"],
["Elite Plus Commander game file", "45 4C 49 54 45 20 43 6F", "CDR"],
["VideoVCD|VCDImager file", "45 4E 54 52 59 56 43 44", "VCD"],
["EasyRecovery Saved State file", "45 52 46 53 53 41 56 45", "DAT"],
["DST Compression", "44 53 54 62", "DST"],
["MS Document Imaging file", "45 50", "MDI"],
["Expert Witness Compression Format", "45 56 46 09 0D 0A FF 00", "E01"],
["EnCase Evidence File Format V2", "45 56 46 32 0D 0A 81", "Ex01"],
["Windows Vista event log", "45 6C 66 46 69 6C 65 00", "EVTX"],
["QuickBooks backup", "45 86 00 00 06 00", "QBB"],
["MS Fax Cover Sheet", "46 41 58 43 4F 56 45 52", "CPE"],
["Fiasco database definition file", "46 44 42 48 00", "FDB"],
["NTFS MFT (FILE)", "46 49 4C 45", "(none)"],
["Flash video file", "46 4C 56", "FLV"],
["Audio Interchange File", "46 4F 52 4D 00", "AIFF"],
["DAKX Compressed Audio", "46 4F 52 4D 00", "DAX"],
["Shockwave Flash player", "46 57 53", "SWF"],
["Generic e-mail_2", "46 72 6F 6D", "EML"],
["GIF file", "47 49 46 38", "GIF"],
["GIMP pattern file", "47 50 41 54", "PAT"],
["Show Partner graphics file", "47 58 32", "GX2"],
["Genetec video archive", "47 65 6E 65 74 65 63 20 4F 6D 6E 69 63 61 73 74", "G64"],
["SAS Transport dataset", "48 45 41 44 45 52 20 52 45 43 4F 52 44 2A 2A 2A", "XPT"],
["Harvard Graphics presentation file", "48 48 47 42 31", "SH3"],
["TIFF file_1", "49 20 49", "TIF|TIFF"],
["MP3 audio file", "49 44 33", "MP3"],
["Sprint Music Store audio", "49 44 33 03 00 00 00", "KOZ"],
["Canon RAW file", "49 49 1A 00 00 00 48 45", "CRW"],
["TIFF file_2", "49 49 2A 00", "TIF|TIFF"],
["Windows 7 thumbnail_2", "49 4D 4D 4D 15 00 00 00", "DB"],
["Install Shield compressed file", "49 53 63 28", "CAB|HDR"],
["MS Reader eBook", "49 54 4F 4C 49 54 4C 53", "LIT"],
["MS Compiled HTML Help File", "49 54 53 46", "CHI|CHM"],
["Inno Setup Uninstall Log", "49 6E 6E 6F 20 53 65 74", "DAT"],
["Inter@ctive Pager Backup (BlackBerry file", " 49 6E 74 65 72 40 63 74 69 76 65 20 50 61 67 65", "IPD"],
["JARCS compressed archive", "4A 41 52 43 53 00", "JAR"],
["AOL ART file_1", "4A 47 03 0E", "JG"],
["AOL ART file_2", "4A 47 04 0E", "JG"],
["VMware 4 Virtual Disk", "4B 44 4D", "VMDK"],
["KGB archive", "4B 47 42 5F 61 72 63 68", "KGB"],
["Win9x printer spool file", "4B 49 00 00", "SHD"],
["KWAJ (compressed) file", "4B 57 41 4A 88 F0 27 D1", "(none)"],
["Windows shortcut file", "4C 00 00 00 01 14 02 00", "LNK"],
["MS COFF relocatable object code", "4C 01", "OBJ"],
["Tajima emboridery", "4C 41 3A", "DST"],
["Windows help file_3", "4C 4E 02 00", "GID|HLP"],
["Logical File Evidence Format", "4C 56 46 09 0D 0A FF 00", "E01"],
["Merriam-Webster Pocket Dictionary", "4D 2D 57 20 50 6F 63 6B", "PDB"],
["Mozilla archive", "4D 41 52 31 00", "MAR"],
["Microsoft|MSN MARC archive", "4D 41 52 43", "MAR"],
["MAr compressed archive", "4D 41 72 30 00", "MAR"],
["TargetExpress target file", "4D 43 57 20 54 65 63 68 6E 6F 67 6F 6C 69 65 73", "MTE"],
["Windows dump file", "4D 44 4D 50 93 A7", "DMP|HDMP"],
["Milestones project management file", "4D 49 4C 45 53", "MLS"],
["Skype localization data file", "4D 4C 53 57", "MLS"],
["TIFF file_3", "4D 4D 00 2A", "TIF|TIFF"],
["TIFF file_4", "4D 4D 00 2B", "TIF|TIFF"],
["Yamaha Synthetic music Mobile Application Format", "4D 4D 4D 44 00 00", "MMF"],
["VMware BIOS state file", "4D 52 56 4E", "NVRAM"],
["Microsoft cabinet file", "4D 53 43 46", "CAB"],
["Powerpoint Packaged Presentation", "4D 53 43 46", "PPZ"],
["MS Access Snapshot Viewer file", "4D 53 43 46", "SNP"],
["OLE|SPSS|Visual C++ library file", "4D 53 46 54 02 00 01 00", "TLB"],
["Microsoft Windows Imaging Format", "4D 53 57 49 4D", "WIM"],
["Sony Compressed Voice File", "4D 53 5F 56 4F 49 43 45", "CDR|DVF|MSV"],
["MIDI sound file", "4D 54 68 64", "MID|MIDI"],
["Yamaha Piano", "4D 54 68 64", "PCS"],
["CD Stomper Pro label file", "4D 56", "DSN"],
["Milestones project management file_1", "4D 56 32 31 34", "MLS"],
["Milestones project management file_2", "4D 56 32 43", "MLS"],
["Windows|DOS executable file", "4D 5A", "COM|DLL|DRV|EXE|PIF|QTS|QTX|SYS"],
["MS audio compression manager driver", "4D 5A", "ACM"],
["Library cache file", "4D 5A", "AX"],
["Control panel application", "4D 5A", "CPL"],
["Font file", "4D 5A", "FON"],
["ActiveX|OLE Custom Control", "4D 5A", "OCX"],
["OLE object library", "4D 5A", "OLB"],
["Screen saver", "4D 5A", "SCR"],
["VisualBASIC application", "4D 5A", "VBX"],
["Windows virtual device drivers", "4D 5A", "VXD|386"],
["Acrobat plug-in", "4D 5A 90 00 03 00 00 00", "API"],
["DirectShow filter", "4D 5A 90 00 03 00 00 00", "AX"],
["Audition graphic filter", "4D 5A 90 00 03 00 00 00", "FLT"],
["ZoneAlam data file", "4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF", "ZAP"],
["MS C++ debugging symbols file", "4D 69 63 72 6F 73 6F 66 74 20 43 2F 43 2B 2B 20", "PDB"],
["Visual Studio .NET file", "4D 69 63 72 6F 73 6F 66 74 20 56 69 73 75 61 6C", "SLN"],
["VMapSource GPS Waypoint Database", "4D 73 52 63 66", "GDB"],
["TomTom traffic data", "4E 41 56 54 52 41 46 46", "DAT"],
["MS Windows journal", "4E 42 2A 00", "JNT|JTP"],
["NES Sound file", "4E 45 53 4D 1A 01", "NSF"],
["National Imagery Transmission Format file", "4E 49 54 46 30", "NTF"],
["Agent newsreader character map", "4E 61 6D 65 3A 20", "COD"],
["1Password 4 Cloud Keychain", "4F 50 43 4C 44 41 54", "attachment"],
["Psion Series 3 Database", "4F 50 4C 44 61 74 61 62", "DBF"],
["Ogg Vorbis Codec compressed file", "4F 67 67 53 00 02 00 00", "OGA|OGG|OGV|OGX"],
["Visio|DisplayWrite 4 text file", "4F 7B", "DW4"],
["Quicken QuickFinder Information File", "50 00 00 00 20 00 00 00", "IDX"],
["Portable Graymap Graphic", "50 35 0A", "PGM"],
["Quake archive file", "50 41 43 4B", "PAK"],
["Windows memory dump", "50 41 47 45 44 55", "DMP"],
["PAX password protected bitmap", "50 41 58", "PAX"],
["PestPatrol data|scan strings", "50 45 53 54", "DAT"],
["PGP disk image", "50 47 50 64 4D 41 49 4E", "PGD"],
["ChromaGraph Graphics Card Bitmap", "50 49 43 54 00 08", "IMG"],
["PKZIP archive_1", "50 4B 03 04", "ZIP"],
["MacOS X Dashboard Widget", "50 4B 03 04", "ZIP"],
["MS Office Open XML Format Document", "50 4B 03 04", "DOCX|PPTX|XLSX"],
["Java archive_1", "50 4B 03 04", "JAR"],
["Google Earth session file", "50 4B 03 04", "KMZ"],
["KWord document", "50 4B 03 04", "KWD"],
["OpenDocument template", "50 4B 03 04", "ODT|ODP|OTT"],
["OpenOffice documents", "50 4B 03 04", "SXC|SXD|SXI|SXW"],
["StarOffice spreadsheet", "50 4B 03 04", "SXC"],
["Windows Media compressed skin file", "50 4B 03 04", "WMZ"],
["Mozilla Browser Archive", "50 4B 03 04", "XPI"],
["XML paper specification file", "50 4B 03 04", "XPS"],
["eXact Packager Models", "50 4B 03 04", "XPT"],
["Open Publication Structure eBook", "50 4B 03 04 0A 00 02 00", "EPUB"],
["ZLock Pro encrypted ZIP", "50 4B 03 04 14 00 01 00", "ZIP"],
["MS Office 2007 documents", "50 4B 03 04 14 00 06 00", "DOCX|PPTX|XLSX"],
["Java archive_2", "50 4B 03 04 14 00 08 00", "JAR"],
["PKZIP archive_2", "50 4B 05 06", "ZIP"],
["PKZIP archive_3", "50 4B 07 08", "ZIP"],
["Windows Program Manager group file", "50 4D 43 43", "GRP"],
["Norton Disk Doctor undo file", "50 4E 43 49 55 4E 44 4F", "DAT"],
["Microsoft Windows User State Migration Tool", "50 4D 4F 43 43 4D 4F 43", "PMOCCMOC"],
["Puffer encrypted archive", "50 55 46 58", "PUF"],
["Qcow Disk Image", "51 46 49", "QEMU"],
["Quicken data file", "51 57 20 56 65 72 2E 20", "ABD|QSD"],
["Shareaza (P2P) thumbnail", "52 41 5A 41 54 44 42 31", "DAT"],
["WinNT Registry|Registry Undo files", "52 45 47 45 44 49 54", "REG|SUD"],
["Antenna data file", "52 45 56 4E 55 4D 3A 2C", "AD"],
["Windows animated cursor", "52 49 46 46", "ANI"],
["Corel Presentation Exchange metadata", "52 49 46 46", "CMX"],
["CorelDraw document", "52 49 46 46", "CDR"],
["Video CD MPEG movie", "52 49 46 46", "DAT"],
["Micrografx Designer graphic", "52 49 46 46", "DS4"],
["4X Movie video", "52 49 46 46", "4XM"],
["Resource Interchange File Format", "52 49 46 46", "AVI|CDA|QCP|RMI|WAV|WEBP"],
["WinNT Netmon capture file", "52 54 53 53", "CAP"],
["WinRAR compressed archive", "52 61 72 21 1A 07 00", "RAR"],
["Generic e-mail_1", "52 65 74 75 72 6E 2D 50", "EML"],
["Underground Audio", "53 43 48 6C", "AST"],
["Img Software Bitmap", "53 43 4D 49", "IMG"],
["SMPTE DPX (big endian)", "53 44 50 58", "SDPX"],
["Harvard Graphics presentation", "53 48 4F 57", "SHW"],
["Sietronics CPI XRD document", "53 49 45 54 52 4F 4E 49", "CPI"],
["Flexible Image Transport System (FITS) file", "53 49 4D 50 4C 45 20 20 3D 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54", "FITS"],
["StuffIt archive", "53 49 54 21 00", "SIT"],
["SmartDraw Drawing file", "53 4D 41 52 54 44 52 57", "SDR"],
["StorageCraft ShadownProtect backup file", "53 50 46 49 00", "SPF"],
["MultiBit Bitcoin blockchain file", "53 50 56 42", "SPVB"],
["SQLite database file", "53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00", "DB"],
["DB2 conversion file", "53 51 4C 4F 43 4F 4E 56", "CNV"],
["QBASIC SZDD file", "53 5A 20 88 F0 27 33 D1", "(none)"],
["SZDD file format", "53 5A 44 44 88 F0 27 33", "(none)"],
["StuffIt compressed archive", "53 74 75 66 66 49 74 20", "SIT"],
["SuperCalc worksheet", "53 75 70 65 72 43 61 6C", "CAL"],
["Wii-GameCube", "54 48 50 00", "THP"],
["GNU Info Reader file", "54 68 69 73 20 69 73 20", "INFO"],
["Unicode extensions", "55 43 45 58", "UCE"],
["UFA compressed archive", "55 46 41 C6 D2 C1", "UFA"],
["UFO Capture map file", "55 46 4F 4F 72 62 69 74", "DAT"],
["Visual C PreCompiled header", "56 43 50 43 48 30", "PCH"],
["Visual Basic User-defined Control file", "56 45 52 53 49 4F 4E 20", "CTL"],
["MapInfo Interchange Format file", "56 65 72 73 69 6F 6E 20", "MIF"],
["Walkman MP3 file", "57 4D 4D 50", "DAT"],
["WordStar for Windows file", "57 53 32 30 30 30", "WS2"],
["Lotus WordPro file", "57 6F 72 64 50 72 6F", "LWP"],
["Exchange e-mail", "58 2D", "EML"],
["Packet sniffer files", "58 43 50 00", "CAP"],
["XPCOM libraries", "58 50 43 4F 4D 0A 54 79", "XPT"],
["SMPTE DPX file (little endian)", "58 50 44 53", "DPX"],
["MS Publisher", "58 54", "BDR"],
["ZOO compressed archive", "5A 4F 4F 20", "ZOO"],
["Macromedia Shockwave Flash", "5A 57 53", "SWF"],
["MS Exchange configuration file", "5B 47 65 6E 65 72 61 6C", "ECF"],
["Visual C++ Workbench Info File", "5B 4D 53 56 43", "VCW"],
["Dial-up networking file", "5B 50 68 6F 6E 65 5D", "DUN"],
["Lotus AMI Pro document_1", "5B 56 45 52 5D", "SAM"],
["VocalTec VoIP media file", "5B 56 4D 44 5D", "VMD"],
["Microsoft Code Page Translation file", "5B 57 69 6E 64 6F 77 73", "CPX"],
["Flight Simulator Aircraft Configuration", "5B 66 6C 74 73 69 6D 2E", "CFG"],
["WinAmp Playlist", "5B 70 6C 61 79 6C 69 73 74 5D", "PLS"],
["Lotus AMI Pro document_2", "5B 76 65 72 5D", "SAM"],
["Husqvarna Designer", "5D FC C8 00", "HUS"],
["Jar archive", "5F 27 A8 89", "JAR"],
["EnCase case file", "5F 43 41 53 45 5F", "CAS|CBK"],
["Compressed archive file", "60 EA", "ARJ"],
["UUencoded file", "62 65 67 69 6E", "(none)"],
["UUencoded BASE64 file", "62 65 67 69 6E 2D 62 61 73 65 36 34", "b64"],
["Binary property list (plist)", "62 70 6C 69 73 74", "(none)"],
["Apple Core Audio File", "63 61 66 66", "CAF"],
["Virtual PC HD image", "63 6F 6E 65 63 74 69 78", "VHD"],
["Photoshop Custom Shape", "63 75 73 68 00 00 00 02", "CSH"],
["Intel PROset|Wireless Profile", "64 00 00 00", "P10"],
["Dalvik (Android) executable file", "64 65 78 0A", "dex"],
["Audacity audio file", "64 6E 73 2E", "AU"],
["MS Visual Studio workspace file", "64 73 77 66 69 6C 65", "DSW"],
["WinNT printer spool file", "66 49 00 00", "SHD"],
["Free Lossless Audio Codec file", "66 4C 61 43 00 00 00 22", "FLAC"],
["Win2000|XP printer spool file", "67 49 00 00", "SHD"],
["GIMP file", "67 69 6d 70 20 78 63 66", "XCF"],
["Win Server 2003 printer spool file", "68 49 00 00", "SHD"],
["Skype user data file", "6C 33 33 6C", "DBB"],
["MultiBit Bitcoin wallet information", "6D 75 6C 74 69 42 69 74 2E 69 6E 66 6F", "INFO"],
["SMS text (SIM)", "6F 3C", "(none)"],
["1Password 4 Cloud Keychain encrypted data", "6F 70 64 61 74 61 30 31", "(none)"],
["WinNT registry file", "72 65 67 66", "DAT"],
["Sonic Foundry Acid Music File", "72 69 66 66", "AC"],
["RealMedia metafile", "72 74 73 70 3A 2F 2F", "RAM"],
["Allegro Generic Packfile (compressed)", "73 6C 68 21", "DAT"],
["Allegro Generic Packfile (uncompressed)", "73 6C 68 2E", "DAT"],
["PalmOS SuperMemo", "73 6D 5F", "PDB"],
["CALS raster bitmap", "73 72 63 64 6F 63 69 64", "CAL"],
["PowerBASIC Debugger Symbols", "73 7A 65 7A", "PDB"],
["OpenEXR bitmap image", "76 2F 31 01", "EXR"],
["Qimage filter", "76 32 30 30 33 2E 31 30", "FLT"],
["MacOS X image file", "78 01 73 0D 62 62 60", "DMG"],
["eXtensible ARchive file", "78 61 72 21", "XAR"],
["ZoomBrowser Image Index", "7A 62 65 78", "INFO"],
["Windows application log", "7B 0D 0A 6F 20", "LGC|LGD"],
["MS WinMobile personal note", "7B 5C 70 77 69", "PWI"],
["Rich Text Format", "7B 5C 72 74 66 31", "RTF"],
["Huskygram Poem or Singer embroidery", "7C 4B C3 74 E1 C8 53 A4 79 B9 01 1D FC 4F DD 13", "CSD"],
["Corel Paint Shop Pro image", "7E 42 4B 00", "PSP"],
["Digital Watchdog DW-TP-500G audio", "7E 74 2C 01 50 70 02 4D 52", "IMG"],
["ELF executable", "7F 45 4C 46", "(none)"],
["Relocatable object code", "80", "OBJ"],
["Dreamcast audio", "80 00 00 20 03 12 04", "ADX"],
["Kodak Cineon image", "80 2A 5F D7", "CIN"],
["Outlook Express address book (Win95)", "81 32 84 C1 85 05 D0 11", "WAB"],
["WordPerfect text", "81 CD AB", "WPF"],
["PNG image", "89 50 4E 47 0D 0A 1A 0A", "PNG"],
["MS Answer Wizard", "8A 01 09 00 00 00 E1 08", "AW"],
["Hamarsoft compressed archive", "91 33 48 46", "HAP"],
["PGP secret keyring_1", "95 00", "SKR"],
["PGP secret keyring_2", "95 01", "SKR"],
["JBOG2 image file", "97 4A 42 32 0D 0A 1A 0A", "JB2"],
["GPG public keyring", "99", "GPG"],
["PGP public keyring", "99 01", "PKR"],
["Outlook address file", "9C CB CB 8D 13 75 D2 11", "WAB"],
["tcpdump (libpcap) capture file", "A1 B2 C3 D4", "(none)"],
["Extended tcpdump (libpcap) capture file", "A1 B2 CD 34", "(none)"],
["Access Data FTK evidence", "A9 0D 00 00 00 00 00 00", "DAT"],
["Quicken data", "AC 9E BD 8F 00 00", "QDF"],
["Java serialization data", "AC ED", "(none)"],
["BGBlitz position database file", "AC ED 00 05 73 72 00 12", "PDB"],
["Win95 password file", "B0 4D 46 43", "PWL"],
["PCX bitmap", "B1 68 DE 3A", "DCX"],
["Acronis True Image", "B4 6E 68 44", "TIB"],
["Windows calendar", "B5 A2 B0 B3 B3 B0 A5 B5", "CAL"],
["MS Write file_3", "BE 00 00 00 AB", "WRI"],
["Palm Desktop DateBook", "BE BA FE CA 0F 50 61 6C 6D 53 47 20 44 61 74 61", "DAT"],
["MS Agent Character file", "C3 AB CD AB", "ACS"],
["Adobe encapsulated PostScript", "C5 D0 D3 C6", "EPS"],
["Jeppesen FliteLog file", "C8 00 79 00", "LBK"],
["Java bytecode", "CA FE BA BE", "CLASS"],
["NAV quarantined virus file", "CD 20 AA AA 02 00 00 00", "(none)"],
["Java Cryptography Extension keystore", "CE CE CE CE", "JCEKS"],
["OS X ABI Mach-O binary (32-bit reverse)", "CE FA ED FE", "(none)"],
["Perfect Office document", "CF 11 E0 A1 B1 1A E1 00", "DOC"],
["Outlook Express e-mail folder", "CF AD 12 FE", "DBX"],
["OS X ABI Mach-O binary (64-bit reverse)", "CF FA ED FE", "(none)"],
["Microsoft Office document", "D0 CF 11 E0 A1 B1 1A E1", "DOC|DOT|PPS|PPT|XLA|XLS|WIZ"],
["CaseWare Working Papers", "D0 CF 11 E0 A1 B1 1A E1", "AC_"],
["Access project file", "D0 CF 11 E0 A1 B1 1A E1", "ADP"],
["Lotus|IBM Approach 97 file", "D0 CF 11 E0 A1 B1 1A E1", "APR"],
["MSWorks database file", "D0 CF 11 E0 A1 B1 1A E1", "DB"],
["Microsoft Common Console Document", "D0 CF 11 E0 A1 B1 1A E1", "MSC"],
["Microsoft Installer package", "D0 CF 11 E0 A1 B1 1A E1", "MSI"],
["Minitab data file", "D0 CF 11 E0 A1 B1 1A E1", "MTW"],
["Developer Studio File Options file", "D0 CF 11 E0 A1 B1 1A E1", "OPT"],
["MS Publisher file", "D0 CF 11 E0 A1 B1 1A E1", "PUB"],
["Revit Project file", "D0 CF 11 E0 A1 B1 1A E1", "RVT"],
["Visual Studio Solution User Options file", "D0 CF 11 E0 A1 B1 1A E1", "SOU"],
["SPSS output file", "D0 CF 11 E0 A1 B1 1A E1", "SPO"],
["Visio file", "D0 CF 11 E0 A1 B1 1A E1", "VSD"],
["MSWorks text document", "D0 CF 11 E0 A1 B1 1A E1", "WPS"],
["WinPharoah filter file", "D2 0A 00 00", "FTR"],
["AOL history|typed URL files", "D4 2A", "ARL|AUT"],
["WinDump (winpcap) capture file", "D4 C3 B2 A1", "(none)"],
["Windows graphics metafile", "D7 CD C6 9A", "WMF"],
["Word 2.0 file", "DB A5 2D 00", "DOC"],
["Corel color palette", "DC DC", "CPL"],
["eFax file", "DC FE", "EFX"],
["Amiga icon", "E3 10 00 01 00 00 00 00", "INFO"],
["Win98 password file", "E3 82 85 96", "PWL"],
["MS OneNote note", "E4 52 5C 7B 8C D8 A7 4D", "ONE"],
["Windows executable file_1", "E8", "COM|SYS"],
["Windows executable file_2", "E9", "COM|SYS"],
["Windows executable file_3", "EB", "COM|SYS"],
["GEM Raster file", "EB 3C 90 2A", "IMG"],
["BitLocker boot sector (Vista)", "EB 52 90 2D 46 56 45 2D", "(none)"],
["BitLocker boot sector (Win7)", "EB 58 90 2D 46 56 45 2D", "(none)"],
["RedHat Package Manager", "ED AB EE DB", "RPM"],
["UTF8 file", "EF BB BF", "(none)"],
["FAT12 File Allocation Table", "F0 FF FF", "(none)"],
["FAT16 File Allocation Table", "F8 FF FF FF", "(none)"],
["FAT32 File Allocation Table_1", "F8 FF FF 0F FF FF FF 0F", "(none)"],
["FAT32 File Allocation Table_2", "F8 FF FF 0F FF FF FF FF", "(none)"],
["Bitcoin-Qt blockchain block file", "F9 BE B4 D9", "DAT"],
["XZ archive", "FD 37 7A 58 5A 00", "XZ"],
["OS X ABI Mach-O binary (32-bit)", "FE ED FA CE", "(none)"],
["OS X ABI Mach-O binary (64-bit)", "FE ED FA CF", "(none)"],
["JavaKeyStore", "FE ED FE ED", "(none)"],
["Symantex Ghost image file", "FE EF", "GHO|GHS"],
["UTF-16|UCS-2 file", "FE FF", "(NONE)"],
["Windows executable", "FF", "SYS"],
["Works for Windows spreadsheet", "FF 00 02 00 04 04 05 54", "WKS"],
["QuickReport Report", "FF 0A 00", "QRP"],
["Windows international code page", "FF 46 4F 4E 54", "CPI"],
["Keyboard driver file", "FF 4B 45 59 42 20 20 20", "SYS"],
["WordPerfect text and graphics", "FF 57 50 43", "WP|WPD|WPG|WPP|WP5|WP6"],
["JPEG|EXIF|SPIFF images", "FF D8 FF", "JFIF|JPE|JPEG|JPG"],
["MPEG-4 AAC audio", "FF F1", "AAC"],
["MPEG-2 AAC audio", "FF F9", "AAC"],
["Windows Registry file", "FF FE", "REG"],
["UTF-32|UCS-2 file", "FF FE", "(NONE)"],
["UTF-32|UCS-4 file", "FF FE 00 00", "(NONE)"],
["MSinfo file", "FF FE 23 00 6C 00 69 00", "MOF"],
["DOS system driver", "FF FF FF FF", "SYS"]]