diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml similarity index 92% rename from detections/endpoint/detection_of_tools_built_by_nirsoft.yml rename to detections/deprecated/detection_of_tools_built_by_nirsoft.yml index c41a4a0605d..2fe7690cc05 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Bhavin Patel, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system. data_source: @@ -53,3 +53,8 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml similarity index 92% rename from detections/endpoint/possible_browser_pass_view_parameter.yml rename to detections/deprecated/possible_browser_pass_view_parameter.yml index 70b5aa3b1a2..b21bcb9a319 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -1,10 +1,10 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 8 +version: 9 creation_date: '2021-11-22' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches. data_source: @@ -35,3 +35,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml similarity index 95% rename from detections/endpoint/windows_nirsoft_advancedrun.yml rename to detections/deprecated/windows_nirsoft_advancedrun.yml index b91a5c4c4c5..8e8fc5ffdff 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -1,10 +1,10 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 12 +version: 13 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment. data_source: @@ -85,3 +85,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 3d410e82b46..7e4a09118f1 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -1,14 +1,13 @@ name: Windows NirSoft Tool Bundle File Created id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41 -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-01' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects the creation of files associated with the NirSoft - tool bundles on Windows endpoints. + The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools. @@ -20,23 +19,17 @@ search: | min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem where + FROM datamodel=Endpoint.Filesystem WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name = "*.zip" + | table original_file_name + | rename original_file_name as Filesystem.file_name + ] - Filesystem.file_name IN ( - "brtools.zip", - "mailpv.zip", - "networktools.zip", - "passreccommandline.zip", - "passrecenc.zip", - "progtools.zip", - "rdpv.zip", - "systools.zip", - "webbrowserpassview.zip" - ) - - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product @@ -71,7 +64,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool bundle file $file_name$ created on host $dest$ + message: NirSoft tool bundle file [$file_name$] created on host [$dest$]. +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path analytic_story: - Unusual Processes - Data Destruction @@ -88,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index eb146d19cc4..5d5dd6628d8 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,47 +1,78 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: Hunting +type: Anomaly description: | The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` + + | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile - | search nirsoftFile=true | `windows_nirsoft_utilities_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). + Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model. known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - Data Destruction - WhisperGate + - Unusual Processes asset_type: Endpoint atomic_guid: - 81ce22fd-9612-4154-918e-8a1f285d214d diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv new file mode 100644 index 00000000000..ba62fd11e72 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -0,0 +1,592 @@ +original_file_name,description +acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." +acm.zip,"ZIP Bundle for acm.exe" +AddrView.exe,"Extract URL addresses from HTML pages." +addrview.zip,"ZIP Bundle for AddrView.exe" +AdvancedRun.exe,"Run a program with different settings that you choose." +advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +AllThreadsView.exe,"Displays a list of all running threads in Windows" +allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." +alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" +altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +AppAudioConfig.exe,"View/change audio settings of applications" +appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" +appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " +appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" +appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." +appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " +appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.exe,"displays useful information about your network adapters." +awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.exe,"view essential information about ActiveX components installed on your computer." +axhelper.zip,"ZIP Bundle for axhelper.exe" +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." +batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." +batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." +bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +BluetoothCL.exe,"Show bluetooth devices list" +bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." +bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." +bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." +bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" +bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." +browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" +browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" +browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " +browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" +brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +BulkFileChanger.exe,"Change date/time/attributes of multiple files." +bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." +bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" +chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" +chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" +chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " +chromepass.zip,"ZIP Bundle for ChromePass.exe" +CleanAfterMe.exe,"Clean files and Registry values in your system." +cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +Clipboardic.exe,"Small and simple clipboard manager." +clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +ControlMyMonitor.exe,"View and modify the settings of your monitor." +controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." +countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" +cports.zip,"ZIP Bundle for cports.exe" +CProcess.exe,"Displays the list of all processes currently running on your system." +cprocess.zip,"ZIP Bundle for CProcess.exe" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." +credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +CredHistView.exe,"Decrypt the CREDHIST file of Windows" +credhistview.zip,"ZIP Bundle for CredHistView.exe" +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" +csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." +ctie.zip,"ZIP Bundle for ctie.exe" +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." +customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." +dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." +deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +DevManView.exe,"Alternative to the standard Device Manager of Windows." +devmanview.zip,"ZIP Bundle for DevManView.exe" +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." +dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +Dialupass.exe,"NirSoft Dialupass utility." +dialupass.zip,"ZIP Bundle for Dialupass.exe" +DiskCountersView.exe,"Show disk drive read/write counters." +diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." +disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." +dllexp.zip,"ZIP Bundle for dllexp.exe" +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " +dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" +dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " +dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" +domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" +domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." +dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +DownTester.exe,"Test your Internet download speed." +downtester.zip,"ZIP Bundle for DownTester.exe" +DriveLetterView.exe,"View and change drive letter assignments " +driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." +driverview.zip,"ZIP Bundle for DriverView.exe" +DumpEDID.exe,"Dump EDID information into the console window." +dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" +edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." +encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" +esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." +eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " +eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." +executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" +exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +ExtPassword.exe,"External Drive Password Recovery" +extpassword.zip,"ZIP Bundle for ExtPassword.exe" +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " +fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." +faview.zip,"ZIP Bundle for faview.exe" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." +fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +FileAccessErrorView.exe,"Displays file access error information" +fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." +fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +FileTypesMan.exe,"Alternative to the File Types manager of Windows." +filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" +firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." +firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +FlashCookiesView.exe,"View Flash cookies stored in your computer." +flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +FolderChangesView.exe,"Monitor folder/drive changes." +folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +FolderTimeUpdate.exe,"Updates the Modified Time of folders." +foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.exe,"Scans your disk, and displays a report about each folder." +folrep.zip,"ZIP Bundle for folrep.exe" +FreeSpaceLogView.exe,"View log of free disk space on Windows" +freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." +fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " +fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." +gacview.zip,"ZIP Bundle for gacview.exe" +GDIView.exe,"Displays the list of GDI handles opened by every process" +gdiview.zip,"ZIP Bundle for GDIView.exe" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" +getnir.zip,"ZIP Bundle for GetNir.exe" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" +guipropview.zip,"ZIP Bundle for GUIPropView.exe" +HandleCountersView.exe,"Shows handle counter for every process" +handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" +hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." +heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" +hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." +hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +HtmlAsText.exe,"Converts HTML documents to simple text files." +htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +HtmlDocEdit.exe,"Simple HTML designer/editor" +htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." +httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" +iconsext.zip,"ZIP Bundle for iconsext.exe" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." +iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" +iecv.zip,"ZIP Bundle for iecv.exe" +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " +iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." +iehv.zip,"ZIP Bundle for iehv.exe" +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" +iepv.zip,"ZIP Bundle for iepv.exe" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." +imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +InjectedDLL.exe,"Display the list of injected DLLs." +injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." +insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +InstalledAppView.exe,"View installed Windows 10 apps" +installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." +installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." +installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +InstalledPackagesView.exe,"Displays installed MSI packages on your system." +installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +IPInfoOffline.exe,"view country information about IP addresses." +ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" +ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +IPNetInfo.exe,"NirSoft IPNetInfo utility." +ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +IPPathTableView.exe,"IP Path Table Viewer" +ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.exe,"Displays the installed Java Runtime Environments." +jrview.zip,"ZIP Bundle for jrview.exe" +jsae.exe,"Creates Javascript animation from image files on your local drive." +jsae.zip,"ZIP Bundle for jsae.exe" +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." +jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." +keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +LANIPScanner.exe,"Local network scanner for Windows" +lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +LastActivityView.exe,"View the latest computer activity." +lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." +livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." +livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +LoadedDllsView.exe,"Displays all DLL files loaded on your system." +loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +LostMyPassword.exe,"Password recovery tool for Windows" +lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." +lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " +lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +MACAddressView.exe,"MAC address lookup tool" +macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" +madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.exe,"Recovers email passwords" +mailpv.zip,"ZIP Bundle for mailpv.exe" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " +managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." +mdnsview.zip,"ZIP Bundle for mDNSView.exe" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." +mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." +mmview.zip,"ZIP Bundle for mmview.exe" +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" +mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +MonitorInfoView.exe,"displays essential information about your monitor." +monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaCacheView.exe,"Displays the list of files stored in the cache of Mozilla-based Web browsers." +mozillacacheview.zip,"ZIP Bundle for MozillaCacheView.exe" +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" +mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" +mspass.zip,"ZIP Bundle for mspass.exe" +MUICacheView.exe,"Edit/delete MUICache items in your system" +muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." +multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." +mweather.zip,"ZIP Bundle for mweather.exe" +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." +myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" +mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." +myuninst.zip,"ZIP Bundle for myuninst.exe" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." +mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." +mzcv.zip,"ZIP Bundle for mzcv.exe" +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" +netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." +netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." +netpass.zip,"ZIP Bundle for netpass.exe" +NetResView.exe,"displays the list of all network resources on your LAN." +netresview.zip,"ZIP Bundle for NetResView.exe" +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." +netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." +networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." +networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." +networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." +networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." +networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" +networktools.zip,"ZIP Bundle for cports.exe" +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" +networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" +networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.exe,"Do many useful tasks from command-line." +nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." +nirext.zip,"ZIP Bundle for nirext.exe" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" +nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." +nk2view.zip,"ZIP Bundle for nk2view.exe" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." +ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." +officeins.zip,"ZIP Bundle for OfficeIns.exe" +OfflineRegistryFinder.exe,"Find data in external Registry files" +offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +OfflineRegistryView.exe,"View offline Registry files" +offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" +ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OpenSaveFilesView.exe,"Displays list of files that you previously opened." +opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." +openwithview.zip,"ZIP Bundle for OpenWithView.exe" +OperaCacheView.exe,"Cache viewer for Opera Web browser." +operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +OperaPassView.exe,"Password recovery tool for Opera Web browser." +operapassview.zip,"ZIP Bundle for OperaPassView.exe" +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" +outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" +outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." +outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +OutlookStatView.exe,"Display a general statistics of your Outlook emails." +outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" +outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" +passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" +passrecpk.zip,"ZIP Bundle for mspass.exe" +passrecview.zip,"ZIP Bundle for PassRecView.exe" +PasswordFox.exe,"View passwords stored in Firefox Web browser." +passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordHashesView.exe,"Displays the SHA1 and NTLM hashes of login passwords for currently logged-in users." +passwordhashesview.zip,"ZIP Bundle for PasswordHashesView.exe" +PasswordScan.exe,"Displays security information about passwords stored in your system." +passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +PingInfoView.exe,"ping multiple host names and IP addresses." +pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" +pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" +previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +ProcessActivityView.exe,"Show the file activity for selected process." +processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +ProcessTCPSummary.exe,"Displays TCP connections summary" +processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." +processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" +productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" +produkey.zip,"ZIP Bundle for ProduKey.exe" +progtools.zip,"ZIP Bundle for dllexp.exe" +PropertySystemView.exe,"View/edit file properties" +propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." +pspv.zip,"ZIP Bundle for pspv.exe" +PstPassword.exe,"Recover lost password of Outlook PST file." +pstpassword.zip,"ZIP Bundle for PstPassword.exe" +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." +quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." +rdpv.zip,"ZIP Bundle for rdpv.exe" +RecentFilesView.exe,"Display the list of recently opened files" +recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." +regdllview.zip,"ZIP Bundle for RegDllView.exe" +RegFileExport.exe,"Export offline Registry file to .reg file" +regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." +regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegHiveBackup.exe,"Backs up Registry files and user Registry hives to a specified folder." +reghivebackup.zip,"ZIP Bundle for RegHiveBackup.exe" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." +registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" +regscanner.zip,"ZIP Bundle for RegScanner.exe" +regtools.zip,"ZIP Bundle for RegScanner.exe" +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." +resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +RouterPassView.exe,"Recover passwords from router config file." +routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." +rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +RunAsDate.exe,"Run a program with the specified date." +runasdate.zip,"ZIP Bundle for RunAsDate.exe" +RunFromProcess.exe,"Run a program from another process that you choose." +runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" +runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" +safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +SafariHistoryView.exe,"History viewer for Safari Web browser" +safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +SearchFilterView.exe,"view the search filters installed on your system." +searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." +searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +SecurityQuestionsView.exe,"View Windows 10 security questions" +securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." +securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." +seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.exe,"displays the list of installed drivers and services on your system." +serviwin.zip,"ZIP Bundle for serviwin.exe" +ShadowCopyView.exe,"View shadow copies on your system" +shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " +shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." +shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.exe,"Displays the details of shell extensions installed on your computer." +shexview.zip,"ZIP Bundle for shexview.exe" +shman.exe,"Lists all shortcuts on your desktop/start menu." +shman.zip,"ZIP Bundle for shman.exe" +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." +shmnview.zip,"ZIP Bundle for shmnview.exe" +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" +shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" +simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." +simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" +simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +SiteShoter.exe,"Save a screenshot of any Web page into a file." +siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." +skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +SkypeLogView.exe,"View log files created by Skype" +skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." +smsniff.zip,"ZIP Bundle for smsniff.exe" +SniffPass.exe,"capture the passwords that pass through your network adapter." +sniffpass.zip,"ZIP Bundle for SniffPass.exe" +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." +socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" +soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +SpecialFoldersView.exe,"Easily jump to special folders in your system." +specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.exe,"Displays the list of all applications that are loaded on startup." +strun.zip,"ZIP Bundle for strun.exe" +svcl.exe,"Sound volume command-line tool for Windows" +svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." +sysexp.zip,"ZIP Bundle for sysexp.exe" +systools.zip,"ZIP Bundle for ProduKey.exe" +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." +tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." +taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +TCPConnectProblemView.exe,"Monitor TCP connection problems." +tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +TcpLogView.exe,"Monitors the opened TCP connections on your system." +tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +TimeZonesView.exe,"Displays all world time zones." +timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." +turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." +uninstallview.zip,"ZIP Bundle for UninstallView.exe" +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" +urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" +urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +USBDeview.exe,"Lists all installed USB devices that you previously used." +usbdeview.zip,"ZIP Bundle for USBDeview.exe" +USBDriveLog.exe,"USB Drive Log For Windows 10" +usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" +usblogview.zip,"ZIP Bundle for USBLogView.exe" +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" +userassistview.zip,"ZIP Bundle for UserAssistView.exe" +UserProfilesView.exe,"View user profiles information on your system." +userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" +vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" +videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" +videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +VNCPassView.exe,"Recover the passwords stored by the VNC tool." +vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." +volumouse.zip,"ZIP Bundle for volumouse.exe" +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" +wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." +webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." +webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." +webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +WebCamImageSave.exe,"Capture still images from your WebCam." +webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" +webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." +websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." +webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." +whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +WhatIsHang.exe,"Get information about Windows software that hangs." +whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." +whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." +whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.exe,"NirSoft WhoisTD utility." +whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.exe,"find all available information about an IP address from command-line." +whosip.zip,"ZIP Bundle for whosip.exe" +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." +wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" +wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " +wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." +wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +WinCrashReport.exe,"Displays a report about crashed Windows application." +wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +WinDefLogView.exe,"Windows Defender Log Viewer" +windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" +windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +WinFontsView.exe,"Display sample of all fonts installed on your system." +winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.exe,"This utility displays the list of opened windows on your system. " +winlister.zip,"ZIP Bundle for winlister.exe" +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" +winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" +winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." +winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." +winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +WinUpdatesView.exe,"Displays the history of Windows updates for your system." +winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." +wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" +wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." +wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" +WirelessNetConsole.exe,"View wireless networks information (console application)" +wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." +wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +WNetWatcher.exe,"Shows who is connected to your wireless network." +wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." +wul.zip,"ZIP Bundle for wul.exe" +zipinst.exe,"Install applications that do not provide an installation module." +zipinst.zip,"ZIP Bundle for zipinst.exe" diff --git a/lookups/csv/nirsoft_utilities_lookup.yml b/lookups/csv/nirsoft_utilities_lookup.yml new file mode 100644 index 00000000000..ebd1525ea4c --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.yml @@ -0,0 +1,12 @@ +name: nirsoft_utilities_lookup +id: 9ebf4dba-02a9-4f64-9f06-f02d4023c52a +version: 1 +creation_date: '2026-10-01' +modification_date: '2026-10-01' +author: Splunk Threat Research Team +lookup_type: csv +description: A subset of utilities provided by NirSoft that may be used by adversaries. +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +case_sensitive_match: false