process hierarchy can be built in user session (using carbon APIs)
restored manual script extraction to supplment ES limitations
improved pasteboard heuristics
1. for BTM events, we now use the instigator in the alert (otherwise its just always the BTM daemon)
2. VirusTotal popover now shows links for both instigator and persisted item
3. Signing alert shows signer now, and platform binary correctly too
Patrick Wardle